source: server/major/bind.xml@ 850ac6f

12.1 ken/TL2024 ken/tuningfonts lazarus plabs/newcss python3.11 rahul/power-profiles-daemon renodr/vulkan-addition trunk xry111/llvm18
Last change on this file since 850ac6f was 850ac6f, checked in by Douglas R. Reno <renodr@…>, 9 months ago

Update to bind-9.18.19 (Security Update)
  • Property mode set to 100644
File size: 32.4 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY bind-download-http "https://ftp.isc.org/isc/bind9/&bind-version;/bind-&bind-version;.tar.xz">
8 <!ENTITY bind-download-ftp "ftp://ftp.isc.org/isc/bind9/&bind-version;/bind-&bind-version;.tar.xz">
9 <!ENTITY bind-md5sum "&bind-md5;">
10 <!ENTITY bind-size "5.2 MB">
11 <!ENTITY bind-buildsize "135 MB (21 MB installed)">
12 <!ENTITY bind-time "0.4 SBU (with parallelism=4; about 40 minutes somewhat processor independent, to run the complete test suite)">
13]>
14
15<sect1 id="bind" xreflabel="BIND-&bind-version;">
16 <?dbhtml filename="bind.html"?>
17
18
19 <title>BIND-&bind-version;</title>
20
21 <indexterm zone="bind">
22 <primary sortas="a-BIND">BIND</primary>
23 </indexterm>
24
25 <sect2 role="package">
26 <title>Introduction to BIND</title>
27
28 <para>
29 The <application>BIND</application> package provides a DNS server
30 and client utilities. If you are only interested in the utilities, refer
31 to the <xref linkend="bind-utils"/>.
32 </para>
33
34 &lfs120_checked;
35
36 <bridgehead renderas="sect3">Package Information</bridgehead>
37 <itemizedlist spacing="compact">
38 <listitem>
39 <para>
40 Download (HTTP): <ulink url="&bind-download-http;"/>
41 </para>
42 </listitem>
43 <listitem>
44 <para>
45 Download (FTP): <ulink url="&bind-download-ftp;"/>
46 </para>
47 </listitem>
48 <listitem>
49 <para>
50 Download MD5 sum: &bind-md5sum;
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download size: &bind-size;
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Estimated disk space required: &bind-buildsize;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Estimated build time: &bind-time;
66 </para>
67 </listitem>
68 </itemizedlist>
69<!--
70 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
71 <itemizedlist spacing="compact">
72 <listitem>
73 <para>
74 Required patch:
75 <ulink url="&patch-root;/bind-&bind-version;-upstream_fixes-1.patch"/>
76 </para>
77 </listitem>
78 </itemizedlist>
79-->
80 <bridgehead renderas="sect3">BIND Dependencies</bridgehead>
81
82 <bridgehead renderas="sect4">Required</bridgehead>
83 <para role="required">
84 <xref linkend="libuv"/>
85 </para>
86
87 <bridgehead renderas="sect4">Recommended</bridgehead>
88 <para role="recommended">
89 <xref linkend="json-c"/>,
90 <xref linkend="libcap-pam"/>, and
91 <xref linkend="nghttp2"/>
92 </para>
93
94 <bridgehead renderas="sect4">Optional</bridgehead>
95 <para role="optional">
96 <xref linkend="curl"/>,
97 <xref linkend="libidn2"/>,
98 <xref linkend="libxml2"/>,
99 <xref linkend="lmdb"/>,
100 <xref linkend="mitkrb"/>,
101 <xref linkend="pytest"/>,
102 <xref linkend="sphinx"/> (required to build documentation),
103 <ulink url="https://cmocka.org/">cmocka</ulink>,
104 <ulink url="https://github.com/cjheath/geoip">geoip</ulink>,
105 <ulink url="https://github.com/jemalloc/jemalloc">jemalloc</ulink>,
106 <ulink url="&w3m-url;">w3m</ulink>
107 </para>
108
109 <bridgehead renderas="sect4">Optional database backends</bridgehead>
110 <para role="optional">
111 <xref linkend="db"/>,
112 <xref linkend="mariadb"/> or <ulink url="https://www.mysql.com/">MySQL</ulink>,
113 <xref linkend="openldap"/>,
114 <xref linkend="postgresql"/>, and
115 <xref linkend="unixodbc"/>
116 </para>
117
118 <bridgehead renderas="sect4">Optional (to run the test suite)</bridgehead>
119 <para role="optional">
120 <xref linkend="perl-net-dns"/>
121 </para>
122
123 </sect2>
124
125 <sect2 role="installation">
126 <title>Installation of BIND</title>
127
128<!--
129 <para>
130 To ensure <application>BIND</application> will build dnssec-keymgr,
131 install a python module as the <systemitem
132 class="username">root</systemitem> user:
133 </para>
134
135<screen role="root"><userinput>pip3 install ply</userinput></screen>
136-->
137
138 <para>
139 Install <application>BIND</application> by running the
140 following commands:
141 </para>
142
143<screen><userinput>./configure --prefix=/usr \
144 --sysconfdir=/etc \
145 --localstatedir=/var \
146 --mandir=/usr/share/man \
147 --disable-static &amp;&amp;
148make</userinput></screen>
149
150 <para>
151 Issue the following commands to run the complete suite of tests.
152 First, as the <systemitem class="username">root</systemitem> user, set up
153 some test interfaces:
154 </para>
155
156 <note>
157 <para>
158 If IPv6 is not enabled in the kernel, there will be several
159 error messages: "RTNETLINK answers: Operation not permitted". These
160 messages do not affect the tests.
161 </para>
162 </note>
163
164<screen role="root"
165 remap="test"><userinput>bin/tests/system/ifconfig.sh up</userinput></screen>
166
167 <para>
168 The test suite may indicate some skipped tests depending on
169 what configuration options are used. Some tests are marked
170 <quote>UNTESTED</quote> or do even fail if <xref linkend="perl-net-dns"/>
171 is not installed. Two tests, <filename>resolver</filename> and
172 <filename>dispatch</filename>, are known to fail.
173 To run the tests, as an unprivileged user, execute:
174 </para>
175
176<screen remap="test"><userinput>make -k check</userinput></screen>
177
178 <para>
179 Again as <systemitem class="username">root</systemitem>, clean up the
180 test interfaces:
181 </para>
182
183<screen role="root"
184 remap="test"><userinput>bin/tests/system/ifconfig.sh down</userinput></screen>
185
186 <para>
187 Finally, install the package as the <systemitem
188 class="username">root</systemitem> user:
189 </para>
190
191<!-- Documentation is an issue - The docs are now all in .rst format and appear
192to be sphinx based. install source .rst files for now...
193
194leave docs untouched as they does only use disk space when not
195used to recreate the docs via Sphinx. I've added a note regarding
196the documentation. (thomas)
197
198<screen role="root"><userinput>make install &amp;&amp;
199
200install -vdm 755 /usr/share/doc/bind-&bind-version;/{arm,dnssec-guide} &amp;&amp;
201install doc/arm/* /usr/share/doc/bind-&bind-version;/arm &amp;&amp;
202install doc/dnssec-guide/* /usr/share/doc/bind-&bind-version;/dnssec-guide</userinput></screen>
203-->
204<screen role="root"><userinput>make install</userinput></screen>
205
206 </sect2>
207
208 <sect2 role="commands">
209 <title>Command Explanations</title>
210
211 <para>
212 <parameter>--sysconfdir=/etc</parameter>: This parameter forces
213 <application>BIND</application> to look for configuration
214 files in <filename class='directory'>/etc</filename> instead of
215 <filename class='directory'>/usr/etc</filename>.
216 </para>
217
218 <!-- Seems to be removed in 9.18.0
219 <para>
220 <parameter>- -with-libtool</parameter>: This parameter forces the
221 building of dynamic libraries and links the installed binaries to these
222 libraries.
223 </para>
224 -->
225
226 <para>
227 <option>--with-libidn2</option>: This parameter enables
228 the IDNA2008 (Internationalized Domain Names in Applications)
229 support.
230 </para>
231
232 <para>
233 <option>--enable-fetchlimit</option>: Use this option if you want
234 to be able to limit the rate of recursive client queries. This may be
235 useful on servers which receive a large number of queries.
236 </para>
237
238 <para>
239 <option>--disable-linux-caps</option>: BIND can also be built without
240 capability support by using this option, at the cost of some loss of
241 security.
242 </para>
243
244 <para>
245 <option>--with-dlz-{mysql,bdb,filesystem,ldap,odbc,stub}</option>: Use
246 one (or more) of those options to add Dynamically Loadable Zones support.
247 For more information refer to <ulink
248 url="https://bind-dlz.sourceforge.net/">bind-dlz.sourceforge.net</ulink>.
249 </para>
250
251 <para>
252 <option>--disable-doh</option>: Use this option if you do not have
253 <xref linkend="nghttp2" role="nodep"/> installed and do not need support
254 for DNS over HTTPS.
255 </para>
256
257 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
258 href="../../xincludes/static-libraries.xml"/>
259
260 </sect2>
261
262 <sect2 role="configuration">
263 <title>Configuring BIND</title>
264
265 <sect3 id="bind-config">
266 <title>Config files</title>
267
268 <para>
269 <filename>named.conf</filename>,
270 <filename>root.hints</filename>,
271 <filename>127.0.0</filename>,
272 <filename>rndc.conf</filename>, and
273 <filename>resolv.conf</filename>
274 </para>
275
276 <indexterm zone="bind bind-config">
277 <primary sortas="e-etc-named.conf">/etc/named.conf</primary>
278 </indexterm>
279
280 <indexterm zone="bind bind-config">
281 <primary sortas="e-etc-rndc.conf">/etc/rndc.conf</primary>
282 </indexterm>
283
284 <indexterm zone="bind bind-config">
285 <primary sortas="e-etc-resolv.conf">/etc/resolv.conf</primary>
286 </indexterm>
287
288 <indexterm zone="bind bind-config">
289 <primary
290 sortas="e-etc-namedb-root.hints">/etc/namedb/root.hints</primary>
291 </indexterm>
292
293 <indexterm zone="bind bind-config">
294 <primary
295 sortas="e-etc-namedb-pz-127.0.0.0">/etc/namedb/pz/127.0.0.0</primary>
296 </indexterm>
297 </sect3>
298
299 <sect3>
300 <title>Configuration Information</title>
301
302 <para>
303 <application>BIND</application> will be configured to run in a
304 <command>chroot</command> jail as an unprivileged user (<systemitem
305 class="username">named</systemitem>). This configuration is more secure
306 in that a DNS compromise can only affect a few files in the <systemitem
307 class="username">named</systemitem> user's <envar>HOME</envar>
308 directory.
309 </para>
310
311 <para>
312 Create the unprivileged user and group <systemitem
313 class="username">named</systemitem>:
314 </para>
315
316<screen role="root"><userinput>groupadd -g 20 named &amp;&amp;
317useradd -c "BIND Owner" -g named -s /bin/false -u 20 named &amp;&amp;
318install -d -m770 -o named -g named /srv/named</userinput></screen>
319
320 <para>
321 Set up some files, directories and devices needed by
322 <application>BIND</application>:
323 </para>
324
325<screen role="root"><userinput>mkdir -p /srv/named &amp;&amp;
326cd /srv/named &amp;&amp;
327mkdir -p dev etc/named/{slave,pz} usr/lib/engines var/run/named &amp;&amp;
328mknod /srv/named/dev/null c 1 3 &amp;&amp;
329mknod /srv/named/dev/urandom c 1 9 &amp;&amp;
330chmod 666 /srv/named/dev/{null,urandom} &amp;&amp;
331cp /etc/localtime etc</userinput></screen>
332
333 <para>
334 The <filename>rndc.conf</filename> file contains information for
335 controlling <command>named</command> operations with the
336 <command>rndc</command> utility. Generate a key for use in the
337 <filename>named.conf</filename> and <filename>rndc.conf</filename>
338 with the <command>rndc-confgen</command> command:
339 </para>
340
341<screen role="root"><userinput>rndc-confgen -a -b 512 -t /srv/named</userinput></screen>
342
343 <para>
344 Create the <filename>named.conf</filename> file from which
345 <command>named</command> will read the location of zone files, root
346 name servers and secure DNS keys:
347 </para>
348
349<screen role="root"><?dbfo keep-together="auto"?><userinput>cat &gt;&gt; /srv/named/etc/named.conf &lt;&lt; "EOF"
350<literal>options {
351 directory "/etc/named";
352 pid-file "/var/run/named.pid";
353 statistics-file "/var/run/named.stats";
354
355};
356zone "." {
357 type hint;
358 file "root.hints";
359};
360zone "0.0.127.in-addr.arpa" {
361 type master;
362 file "pz/127.0.0";
363};
364
365// Bind 9 now logs by default through syslog (except debug).
366// These are the default logging rules.
367
368logging {
369 category default { default_syslog; default_debug; };
370 category unmatched { null; };
371
372 channel default_syslog {
373 syslog daemon; // send to syslog's daemon
374 // facility
375 severity info; // only send priority info
376 // and higher
377 };
378
379 channel default_debug {
380 file "named.run"; // write to named.run in
381 // the working directory
382 // Note: stderr is used instead
383 // of "named.run"
384 // if the server is started
385 // with the '-f' option.
386 severity dynamic; // log at the server's
387 // current debug level
388 };
389
390 channel default_stderr {
391 stderr; // writes to stderr
392 severity info; // only send priority info
393 // and higher
394 };
395
396 channel null {
397 null; // toss anything sent to
398 // this channel
399 };
400};</literal>
401EOF</userinput></screen>
402
403 <para>
404 Create a zone file with the following contents:
405 </para>
406
407<screen role="root"><userinput>cat &gt; /srv/named/etc/named/pz/127.0.0 &lt;&lt; "EOF"
408<literal>$TTL 3D
409@ IN SOA ns.local.domain. hostmaster.local.domain. (
410 1 ; Serial
411 8H ; Refresh
412 2H ; Retry
413 4W ; Expire
414 1D) ; Minimum TTL
415 NS ns.local.domain.
4161 PTR localhost.</literal>
417EOF</userinput></screen>
418
419 <para>
420 Create the <filename>root.hints</filename> file with the following
421 commands:
422 </para>
423
424 <note>
425 <para>
426 Caution must be used to ensure there are no leading spaces in
427 this file.
428 </para>
429 </note>
430
431<screen role="root"><userinput>cat &gt; /srv/named/etc/named/root.hints &lt;&lt; "EOF"
432<literal>. 6D IN NS A.ROOT-SERVERS.NET.
433. 6D IN NS B.ROOT-SERVERS.NET.
434. 6D IN NS C.ROOT-SERVERS.NET.
435. 6D IN NS D.ROOT-SERVERS.NET.
436. 6D IN NS E.ROOT-SERVERS.NET.
437. 6D IN NS F.ROOT-SERVERS.NET.
438. 6D IN NS G.ROOT-SERVERS.NET.
439. 6D IN NS H.ROOT-SERVERS.NET.
440. 6D IN NS I.ROOT-SERVERS.NET.
441. 6D IN NS J.ROOT-SERVERS.NET.
442. 6D IN NS K.ROOT-SERVERS.NET.
443. 6D IN NS L.ROOT-SERVERS.NET.
444. 6D IN NS M.ROOT-SERVERS.NET.
445A.ROOT-SERVERS.NET. 6D IN A 198.41.0.4
446A.ROOT-SERVERS.NET. 6D IN AAAA 2001:503:ba3e::2:30
447B.ROOT-SERVERS.NET. 6D IN A 199.9.14.201
448B.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:200::b
449C.ROOT-SERVERS.NET. 6D IN A 192.33.4.12
450C.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:2::c
451D.ROOT-SERVERS.NET. 6D IN A 199.7.91.13
452D.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:2d::d
453E.ROOT-SERVERS.NET. 6D IN A 192.203.230.10
454E.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:a8::e
455F.ROOT-SERVERS.NET. 6D IN A 192.5.5.241
456F.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:2f::f
457G.ROOT-SERVERS.NET. 6D IN A 192.112.36.4
458G.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:12::d0d
459H.ROOT-SERVERS.NET. 6D IN A 198.97.190.53
460H.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:1::53
461I.ROOT-SERVERS.NET. 6D IN A 192.36.148.17
462I.ROOT-SERVERS.NET. 6D IN AAAA 2001:7fe::53
463J.ROOT-SERVERS.NET. 6D IN A 192.58.128.30
464J.ROOT-SERVERS.NET. 6D IN AAAA 2001:503:c27::2:30
465K.ROOT-SERVERS.NET. 6D IN A 193.0.14.129
466K.ROOT-SERVERS.NET. 6D IN AAAA 2001:7fd::1
467L.ROOT-SERVERS.NET. 6D IN A 199.7.83.42
468L.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:9f::42
469M.ROOT-SERVERS.NET. 6D IN A 202.12.27.33
470M.ROOT-SERVERS.NET. 6D IN AAAA 2001:dc3::35</literal>
471EOF</userinput></screen>
472
473 <para>
474 The <filename>root.hints</filename> file is a list of root name
475 servers. This file must be updated periodically with the
476 <command>dig</command> utility. A current copy of root.hints can be
477 obtained from <ulink url="https://www.internic.net/domain/named.root"/>.
478 For details, consult the "BIND 9 Administrator Reference Manual".
479 </para>
480
481 <para>
482 Create or modify <filename>resolv.conf</filename> to use the new
483 name server with the following commands:
484 </para>
485
486 <note>
487 <para>
488 Replace <replaceable>&lt;yourdomain.com&gt;</replaceable> with
489 your own valid domain name.
490 </para>
491 </note>
492
493<screen role="root"><userinput>cp /etc/resolv.conf /etc/resolv.conf.bak &amp;&amp;
494cat &gt; /etc/resolv.conf &lt;&lt; "EOF"
495<literal>search <replaceable>&lt;yourdomain.com&gt;</replaceable>
496nameserver 127.0.0.1</literal>
497EOF</userinput></screen>
498
499 <para>
500 Set permissions on the <command>chroot</command> jail with the
501 following command:
502 </para>
503
504<screen role="root"><userinput>chown -R named:named /srv/named</userinput></screen>
505
506 </sect3>
507
508 <sect3 id="bind-init">
509 <title><phrase revision="sysv">Boot Script</phrase>
510 <phrase revision="systemd">Systemd Unit</phrase></title>
511
512 <para>
513 To start the DNS server at boot, install the
514 <phrase revision="sysv"><filename>/etc/rc.d/init.d/bind</filename> init
515 script</phrase>
516 <phrase revision="systemd"><filename>named.service</filename>
517 unit</phrase> included in the
518 <xref linkend="bootscripts" revision="sysv"/>
519 <xref linkend="systemd-units" revision="systemd"/> package:
520 </para>
521
522 <indexterm zone="bind bind-init">
523 <primary sortas="f-bind">bind</primary>
524 </indexterm>
525
526<screen role="root" revision="sysv"><userinput>make install-bind</userinput></screen>
527<screen role="root" revision="systemd"><userinput>make install-named</userinput></screen>
528
529 <para>
530 Now start <application>BIND</application> with the following command:
531 </para>
532
533<screen role="root" revision="sysv"><userinput>/etc/rc.d/init.d/bind start</userinput></screen>
534<screen role="root" revision="systemd"><userinput>systemctl start named</userinput></screen>
535
536 </sect3>
537
538 <sect3>
539 <title>Testing BIND</title>
540
541 <para>
542 Test out the new <application>BIND</application> 9 installation.
543 First query the local host address with <command>dig</command>:
544 </para>
545
546<screen><userinput>dig -x 127.0.0.1</userinput></screen>
547
548 <para>
549 Now try an external name lookup, taking note of the speed
550 difference in repeated lookups due to the caching. Run the
551 <command>dig</command> command twice on the same address:
552 </para>
553
554<screen><userinput>dig www.&lfs-domainname; &amp;&amp;
555dig www.&lfs-domainname;</userinput></screen>
556
557 <para>
558 You can see almost instantaneous results with the named caching
559 lookups. Consult the <application>BIND</application> Administrator
560 Reference Manual (see below) for further configuration options.
561 </para>
562
563 </sect3>
564
565 </sect2>
566
567 <sect2>
568 <title>Administrator Reference Manual (ARM)</title>
569
570 <para>
571 The ARM documentation (do not confuse with the processor architecture)
572 is included in the source package. The documentation is in .rst
573 format which means that it can be converted in human readable formats
574 if <xref linkend="sphinx"/> is installed.
575 </para>
576
577 <para>
578 When <application>BIND</application> is set up, especially if it is going
579 to be operating in a real live scenario, it is <emphasis>highly</emphasis>
580 recommended to consult the ARM documentation. ISC provides an
581 updated set of excellent documentation along with every release
582 so it can be easily viewed and/or downloaded &ndash; so there is
583 no excuse to not read the docs. The formats ISC provides are PDF,
584 epub and html at <ulink url="https://downloads.isc.org/isc/bind9/&bind-version;/doc/arm/"/>.
585 </para>
586 </sect2>
587
588 <sect2 role="content">
589 <title>Contents</title>
590
591 <segmentedlist>
592 <segtitle>Installed Programs</segtitle>
593 <segtitle>Installed Libraries</segtitle>
594 <segtitle>Installed Directories</segtitle>
595
596 <seglistitem>
597
598 <seg>arpaname, ddns-confgen, delv, dig, dnssec-cds,
599 dnssec-dsfromkey, dnssec-importkey, dnssec-keyfromlabel, dnssec-keygen,
600 dnssec-revoke, dnssec-settime, dnssec-signzone,
601 dnssec-verify, host, mdig, named, named-checkconf,
602 named-checkzone, named-compilezone, named-journalprint,
603 named-nzd2nzf, named-rrchecker, nsec3hash, nslookup, nsupdate, rndc,
604 rndc-confgen, and tsig-keygen (symlink)</seg>
605
606 <seg>libbind9.so, libdns.so, libirs.so, libisc.so, libisccc.so,
607 libisccfg.so, and libns.so</seg>
608
609 <seg>/usr/include/{bind9,dns,dst,irs,isc,isccc,isccfg,ns},
610 /usr/lib/bind,
611 and /srv/named</seg>
612 </seglistitem>
613 </segmentedlist>
614
615 <variablelist>
616 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
617 <?dbfo list-presentation="list"?>
618 <?dbhtml list-presentation="table"?>
619
620 <varlistentry id="arpaname">
621 <term><command>arpaname</command></term>
622 <listitem>
623 <para>
624 translates IP addresses to the corresponding ARPA names
625 </para>
626 <indexterm zone="bind arpaname">
627 <primary sortas="b-arpaname">arpaname</primary>
628 </indexterm>
629 </listitem>
630 </varlistentry>
631
632 <varlistentry id="ddns-confgen">
633 <term><command>ddns-confgen</command></term>
634 <listitem>
635 <para>
636 generates a key for use by nsupdate and named
637 </para>
638 <indexterm zone="bind ddns-confgen">
639 <primary sortas="b-ddns-confgen">ddns-confgen</primary>
640 </indexterm>
641 </listitem>
642 </varlistentry>
643
644 <varlistentry id="delv">
645 <term><command>delv</command></term>
646 <listitem>
647 <para>
648 is a new debugging tool that is a successor to
649 <command>dig</command>
650 </para>
651 <indexterm zone="bind delv">
652 <primary sortas="b-delv">delv</primary>
653 </indexterm>
654 </listitem>
655 </varlistentry>
656
657 <varlistentry id="dig">
658 <term><command>dig</command></term>
659 <listitem>
660 <para>
661 interrogates DNS servers
662 </para>
663 <indexterm zone="bind dig">
664 <primary sortas="b-dig">dig</primary>
665 </indexterm>
666 </listitem>
667 </varlistentry>
668
669 <varlistentry id="dnssec-cds">
670 <term><command>dnssec-cds</command></term>
671 <listitem>
672 <para>
673 changes DS records for a child zone based on
674 CDS/CDNSKEY
675 </para>
676 <indexterm zone="bind dnssec-cds">
677 <primary sortas="b-dnssec-cds">dnssec-cds</primary>
678 </indexterm>
679 </listitem>
680 </varlistentry>
681
682 <varlistentry id="dnssec-dsfromkey">
683 <term><command>dnssec-dsfromkey</command></term>
684 <listitem>
685 <para>
686 outputs the Delegation Signer (DS) resource record (RR)
687 </para>
688 <indexterm zone="bind dnssec-dsfromkey">
689 <primary sortas="b-dnssec-dsfromkey">dnssec-dsfromkey</primary>
690 </indexterm>
691 </listitem>
692 </varlistentry>
693
694 <varlistentry id="dnssec-importkey">
695 <term><command>dnssec-importkey</command></term>
696 <listitem>
697 <para>
698 reads a public DNSKEY record and generates a pair of
699 .key/.private files
700 </para>
701 <indexterm zone="bind dnssec-importkey">
702 <primary sortas="b-dnssec-importkey">dnssec-importkey</primary>
703 </indexterm>
704 </listitem>
705 </varlistentry>
706
707 <varlistentry id="dnssec-keyfromlabel">
708 <term><command>dnssec-keyfromlabel</command></term>
709 <listitem>
710 <para>
711 gets keys with the given label from a cryptography hardware device
712 and builds key files for DNSSEC
713 </para>
714 <indexterm zone="bind dnssec-keyfromlabel">
715 <primary sortas="b-dnssec-keyfromlabel">dnssec-keyfromlabel</primary>
716 </indexterm>
717 </listitem>
718 </varlistentry>
719
720 <varlistentry id="dnssec-keymgr">
721 <term><command>dnssec-keymgr</command></term>
722 <listitem>
723 <para>
724 ensures correct DNSKEY coverage based on a defined policy
725 </para>
726 <indexterm zone="bind dnssec-keymgr">
727 <primary sortas="b-dnssec-keymgr">dnssec-keymgr</primary>
728 </indexterm>
729 </listitem>
730 </varlistentry>
731
732 <varlistentry id="dnssec-revoke">
733 <term><command>dnssec-revoke</command></term>
734 <listitem>
735 <para>
736 sets the REVOKED bit on a DNSSEC key
737 </para>
738 <indexterm zone="bind dnssec-revoke">
739 <primary sortas="b-dnssec-revoke">dnssec-revoke</primary>
740 </indexterm>
741 </listitem>
742 </varlistentry>
743
744 <varlistentry id="dnssec-settime">
745 <term><command>dnssec-settime</command></term>
746 <listitem>
747 <para>
748 sets the key timing metadata for a DNSSEC key
749 </para>
750 <indexterm zone="bind dnssec-settime">
751 <primary sortas="b-dnssec-settime">dnssec-settime</primary>
752 </indexterm>
753 </listitem>
754 </varlistentry>
755
756 <varlistentry id="dnssec-signzone">
757 <term><command>dnssec-signzone</command></term>
758 <listitem>
759 <para>
760 generates signed versions of zone files
761 </para>
762 <indexterm zone="bind dnssec-signzone">
763 <primary sortas="b-dnssec-signzone">dnssec-signzone</primary>
764 </indexterm>
765 </listitem>
766 </varlistentry>
767
768 <varlistentry id="dnssec-verify">
769 <term><command>dnssec-verify</command></term>
770 <listitem>
771 <para>
772 verifies that a zone is fully signed for each algorithm found
773 in the DNSKEY RRset for the zone, and that the NSEC / NSEC3
774 chains are complete
775 </para>
776 <indexterm zone="bind dnssec-verify">
777 <primary sortas="b-dnssec-verify">dnssec-verify</primary>
778 </indexterm>
779 </listitem>
780 </varlistentry>
781
782 <varlistentry id="host">
783 <term><command>host</command></term>
784 <listitem>
785 <para>
786 is a utility for DNS lookups
787 </para>
788 <indexterm zone="bind host">
789 <primary sortas="b-host">host</primary>
790 </indexterm>
791 </listitem>
792 </varlistentry>
793
794 <varlistentry id="mdig">
795 <term><command>mdig</command></term>
796 <listitem>
797 <para>
798 is a version of dig that allows multiple queries at once
799 </para>
800 <indexterm zone="bind mdig">
801 <primary sortas="b-mdig">mdig</primary>
802 </indexterm>
803 </listitem>
804 </varlistentry>
805
806 <varlistentry id="named">
807 <term><command>named</command></term>
808 <listitem>
809 <para>
810 is the name server daemon
811 </para>
812 <indexterm zone="bind named">
813 <primary sortas="b-named">named</primary>
814 </indexterm>
815 </listitem>
816 </varlistentry>
817
818 <varlistentry id="named-checkconf">
819 <term><command>named-checkconf</command></term>
820 <listitem>
821 <para>
822 checks the syntax of <filename>named.conf</filename>
823 files
824 </para>
825 <indexterm zone="bind named-checkconf">
826 <primary sortas="b-named-checkconf">named-checkconf</primary>
827 </indexterm>
828 </listitem>
829 </varlistentry>
830
831 <varlistentry id="named-checkzone">
832 <term><command>named-checkzone</command></term>
833 <listitem>
834 <para>
835 checks zone file validity
836 </para>
837 <indexterm zone="bind named-checkzone">
838 <primary sortas="b-named-checkzone">named-checkzone</primary>
839 </indexterm>
840 </listitem>
841 </varlistentry>
842
843 <varlistentry id="named-compilezone">
844 <term><command>named-compilezone</command></term>
845 <listitem>
846 <para>
847 is similar to <command>named-checkzone</command>, but it always
848 dumps the zone contents to a specified file in a specified format
849 </para>
850 <indexterm zone="bind named-compilezone">
851 <primary sortas="b-named-compilezone">named-compilezone</primary>
852 </indexterm>
853 </listitem>
854 </varlistentry>
855
856 <varlistentry id="named-journalprint">
857 <term><command>named-journalprint</command></term>
858 <listitem>
859 <para>
860 prints the zone journal in human-readable form
861 </para>
862 <indexterm zone="bind named-journalprint">
863 <primary sortas="b-named-journalprint">named-journalprint</primary>
864 </indexterm>
865 </listitem>
866 </varlistentry>
867
868 <varlistentry id="named-rrchecker">
869 <term><command>named-rrchecker</command></term>
870 <listitem>
871 <para>
872 reads an individual DNS resource record from standard input and
873 checks if it is syntactically correct
874 </para>
875 <indexterm zone="bind named-rrchecker">
876 <primary sortas="b-named-rrchecker">named-rrchecker</primary>
877 </indexterm>
878 </listitem>
879 </varlistentry>
880
881 <varlistentry id="named-nzd2nzf">
882 <term><command>named-nzd2nzf</command></term>
883 <listitem>
884 <para>
885 converts an NZD database to NZF text format
886 </para>
887 <indexterm zone="bind named-nzd2nzf">
888 <primary sortas="b-named-nzd2nzf">named-nzd2nzf</primary>
889 </indexterm>
890 </listitem>
891 </varlistentry>
892
893 <varlistentry id="nsec3hash">
894 <term><command>nsec3hash</command></term>
895 <listitem>
896 <para>
897 generates an NSEC3 hash based on a set of NSEC3 parameters
898 </para>
899 <indexterm zone="bind nsec3hash">
900 <primary sortas="b-nsec3hash">nsec3hash</primary>
901 </indexterm>
902 </listitem>
903 </varlistentry>
904
905 <varlistentry id="nslookup">
906 <term><command>nslookup</command></term>
907 <listitem>
908 <para>
909 is a program used to query Internet domain nameservers
910 </para>
911 <indexterm zone="bind nslookup">
912 <primary sortas="b-nslookup">nslookup</primary>
913 </indexterm>
914 </listitem>
915 </varlistentry>
916
917 <varlistentry id="nsupdate">
918 <term><command>nsupdate</command></term>
919 <listitem>
920 <para>
921 is used to submit DNS update requests
922 </para>
923 <indexterm zone="bind nsupdate">
924 <primary sortas="b-nsupdate">nsupdate</primary>
925 </indexterm>
926 </listitem>
927 </varlistentry>
928
929 <varlistentry id="rndc">
930 <term><command>rndc</command></term>
931 <listitem>
932 <para>
933 controls the operation of <application>BIND</application>
934 </para>
935 <indexterm zone="bind rndc">
936 <primary sortas="b-rndc">rndc</primary>
937 </indexterm>
938 </listitem>
939 </varlistentry>
940
941 <varlistentry id="rndc-confgen">
942 <term><command>rndc-confgen</command></term>
943 <listitem>
944 <para>
945 generates <filename>rndc.conf</filename> files
946 </para>
947 <indexterm zone="bind rndc-confgen">
948 <primary sortas="b-rndc-confgen">rndc-confgen</primary>
949 </indexterm>
950 </listitem>
951 </varlistentry>
952
953 <varlistentry id="tsig-keygen">
954 <term><command>tsig-keygen</command></term>
955 <listitem>
956 <para>
957 is a symlink to <command>ddns-confgen</command>
958 </para>
959 <indexterm zone="bind tsig-keygen">
960 <primary sortas="b-tsig-keygen">tsig-keygen</primary>
961 </indexterm>
962 </listitem>
963 </varlistentry>
964
965 </variablelist>
966
967 </sect2>
968
969</sect1>
Note: See TracBrowser for help on using the repository browser.