source: server/major/bind.xml@ 8af4fba

12.2 lazarus trunk
Last change on this file since 8af4fba was 58fee5a0, checked in by Douglas R. Reno <renodr@…>, 2 months ago

Update to BIND-9.20.0.

There's a lot of changes that went in here. The tests require the
hypothesis python module, so I've added in a set of commands to setup a
virtual environment and then run the tests from there.

Two libraries were removed, which required changes over in BIND
Utilities to instructions and to the installed files in BIND

The DLZ support has been removed sine BIND-9.18.0 (20 releases ago), so
I've removed the option for that from Command Explanations and dropped
the dependencies.
  • Property mode set to 100644
File size: 32.4 KB
Line 
1<?xml version="1.0" encoding="UTF-8"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY bind-download-http "https://ftp.isc.org/isc/bind9/&bind-version;/bind-&bind-version;.tar.xz">
8 <!ENTITY bind-download-ftp " ">
9 <!ENTITY bind-md5sum "&bind-md5;">
10 <!ENTITY bind-size "5.5 MB">
11 <!ENTITY bind-buildsize "138 MB (22 MB installed)">
12 <!ENTITY bind-time "0.5 SBU (with parallelism=4; about 40 minutes somewhat processor independent, to run the complete test suite)">
13]>
14
15<sect1 id="bind" xreflabel="BIND-&bind-version;">
16 <?dbhtml filename="bind.html"?>
17
18
19 <title>BIND-&bind-version;</title>
20
21 <indexterm zone="bind">
22 <primary sortas="a-BIND">BIND</primary>
23 </indexterm>
24
25 <sect2 role="package">
26 <title>Introduction to BIND</title>
27
28 <para>
29 The <application>BIND</application> package provides a DNS server
30 and client utilities. If you are only interested in the utilities, refer
31 to the <xref linkend="bind-utils"/>.
32 </para>
33
34 &lfs121_checked;
35
36 <bridgehead renderas="sect3">Package Information</bridgehead>
37 <itemizedlist spacing="compact">
38 <listitem>
39 <para>
40 Download (HTTP): <ulink url="&bind-download-http;"/>
41 </para>
42 </listitem>
43 <listitem>
44 <para>
45 Download (FTP): <ulink url="&bind-download-ftp;"/>
46 </para>
47 </listitem>
48 <listitem>
49 <para>
50 Download MD5 sum: &bind-md5sum;
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download size: &bind-size;
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Estimated disk space required: &bind-buildsize;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Estimated build time: &bind-time;
66 </para>
67 </listitem>
68 </itemizedlist>
69<!--
70 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
71 <itemizedlist spacing="compact">
72 <listitem>
73 <para>
74 Required patch:
75 <ulink url="&patch-root;/bind-&bind-version;-upstream_fixes-1.patch"/>
76 </para>
77 </listitem>
78 </itemizedlist>
79-->
80 <bridgehead renderas="sect3">BIND Dependencies</bridgehead>
81
82 <bridgehead renderas="sect4">Required</bridgehead>
83 <para role="required">
84 <xref linkend="liburcu"/> and
85 <xref linkend="libuv"/>
86 </para>
87
88 <bridgehead renderas="sect4">Recommended</bridgehead>
89 <para role="recommended">
90 <xref linkend="json-c"/>,
91 <xref linkend="libcap-pam"/>, and
92 <xref linkend="nghttp2"/>
93 </para>
94
95 <bridgehead renderas="sect4">Optional</bridgehead>
96 <para role="optional">
97 <xref linkend="curl"/>,
98 <xref linkend="libidn2"/>,
99 <xref linkend="libxml2"/>,
100 <xref linkend="lmdb"/>,
101 <xref linkend="mitkrb"/>,
102 <xref linkend="pytest"/>,
103 <xref linkend="sphinx"/> (required to build documentation),
104 <ulink url="https://cmocka.org/">cmocka</ulink>,
105 <ulink url="https://github.com/cjheath/geoip">geoip</ulink>,
106 <ulink url="https://github.com/jemalloc/jemalloc">jemalloc</ulink>,
107 <ulink url="&w3m-url;">w3m</ulink>
108 </para>
109
110 <bridgehead renderas="sect4">Optional (to run the test suite)</bridgehead>
111 <para role="optional">
112 <xref linkend="perl-net-dns"/>
113 </para>
114
115 <para condition="html" role="usernotes">
116 Editor Notes: <ulink url="&blfs-wiki;/bind"/>
117 </para>
118
119 </sect2>
120
121 <sect2 role="installation">
122 <title>Installation of BIND</title>
123
124 <note>
125 <para>
126 Starting with bind-9.18.20, the IP addresses for B.ROOT-SERVERS.NET
127 have changed.
128 </para>
129 </note>
130
131 <para>
132 Install <application>BIND</application> by running the
133 following commands:
134 </para>
135
136<screen><userinput>./configure --prefix=/usr \
137 --sysconfdir=/etc \
138 --localstatedir=/var \
139 --mandir=/usr/share/man \
140 --disable-static &amp;&amp;
141make</userinput></screen>
142
143 <para>
144 Issue the following commands to run the complete suite of tests.
145 First, as the <systemitem class="username">root</systemitem> user, set up
146 some test interfaces:
147 </para>
148
149 <note>
150 <para>
151 If IPv6 is not enabled in the kernel, there will be several
152 error messages: "RTNETLINK answers: Operation not permitted". These
153 messages do not affect the tests.
154 </para>
155 </note>
156
157<screen role="root"
158 remap="test"><userinput>bin/tests/system/ifconfig.sh up</userinput></screen>
159
160 <para>
161 The test suite may indicate some skipped tests depending on
162 what configuration options are used. Some tests are marked
163 <quote>UNTESTED</quote> or do even fail if <xref linkend="perl-net-dns"/>
164 is not installed. One test, <filename>dnssec</filename>, is known to fail.
165 The tests require the
166 <ulink url="https://hypothesis.readthedocs.org/">hypothesis</ulink>
167 python module, which is not in BLFS. To work around this, the instructions
168 below create a Python virtual environment and then install the module
169 in there before running the tests.
170 To run the tests, as an unprivileged user, execute:
171 </para>
172
173<screen remap="test"><userinput>python3 -m venv --system-site-packages testenv &amp;&amp;
174source testenv/bin/activate &amp;&amp;
175pip3 install hypothesis &amp;&amp;
176make -k check &amp;&amp;
177deactivate</userinput></screen>
178
179 <para>
180 Again as <systemitem class="username">root</systemitem>, clean up the
181 test interfaces:
182 </para>
183
184<screen role="root"
185 remap="test"><userinput>bin/tests/system/ifconfig.sh down</userinput></screen>
186
187 <para>
188 Finally, install the package as the <systemitem
189 class="username">root</systemitem> user:
190 </para>
191
192<!-- Documentation is an issue - The docs are now all in .rst format and appear
193to be sphinx based. install source .rst files for now...
194
195leave docs untouched as they does only use disk space when not
196used to recreate the docs via Sphinx. I've added a note regarding
197the documentation. (thomas)
198
199<screen role="root"><userinput>make install &amp;&amp;
200
201install -vdm 755 /usr/share/doc/bind-&bind-version;/{arm,dnssec-guide} &amp;&amp;
202install doc/arm/* /usr/share/doc/bind-&bind-version;/arm &amp;&amp;
203install doc/dnssec-guide/* /usr/share/doc/bind-&bind-version;/dnssec-guide</userinput></screen>
204-->
205<screen role="root"><userinput>make install</userinput></screen>
206
207 </sect2>
208
209 <sect2 role="commands">
210 <title>Command Explanations</title>
211
212 <para>
213 <parameter>--sysconfdir=/etc</parameter>: This parameter forces
214 <application>BIND</application> to look for configuration
215 files in <filename class='directory'>/etc</filename> instead of
216 <filename class='directory'>/usr/etc</filename>.
217 </para>
218
219 <para>
220 <option>--with-libidn2</option>: This parameter enables
221 the IDNA2008 (Internationalized Domain Names in Applications)
222 support.
223 </para>
224
225 <para>
226 <option>--enable-fetchlimit</option>: Use this option if you want
227 to be able to limit the rate of recursive client queries. This may be
228 useful on servers which receive a large number of queries.
229 </para>
230
231<!-- Removed in 9.20.0 (and support has been in LFS for years)
232 <para>
233 <option>- -disable-linux-caps</option>: BIND can also be built without
234 capability support by using this option, at the cost of some loss of
235 security.
236 </para>
237-->
238
239 <para>
240 <option>--disable-doh</option>: Use this option if you do not have
241 <xref linkend="nghttp2" role="nodep"/> installed and do not need support
242 for DNS over HTTPS.
243 </para>
244
245 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
246 href="../../xincludes/static-libraries.xml"/>
247
248 </sect2>
249
250 <sect2 role="configuration">
251 <title>Configuring BIND</title>
252
253 <sect3 id="bind-config">
254 <title>Config files</title>
255
256 <para>
257 <filename>named.conf</filename>,
258 <filename>root.hints</filename>,
259 <filename>127.0.0</filename>,
260 <filename>rndc.conf</filename>, and
261 <filename>resolv.conf</filename>
262 </para>
263
264 <indexterm zone="bind bind-config">
265 <primary sortas="e-etc-named.conf">/etc/named.conf</primary>
266 </indexterm>
267
268 <indexterm zone="bind bind-config">
269 <primary sortas="e-etc-rndc.conf">/etc/rndc.conf</primary>
270 </indexterm>
271
272 <indexterm zone="bind bind-config">
273 <primary sortas="e-etc-resolv.conf">/etc/resolv.conf</primary>
274 </indexterm>
275
276 <indexterm zone="bind bind-config">
277 <primary
278 sortas="e-etc-namedb-root.hints">/etc/namedb/root.hints</primary>
279 </indexterm>
280
281 <indexterm zone="bind bind-config">
282 <primary
283 sortas="e-etc-namedb-pz-127.0.0.0">/etc/namedb/pz/127.0.0.0</primary>
284 </indexterm>
285 </sect3>
286
287 <sect3>
288 <title>Configuration Information</title>
289
290 <para>
291 <application>BIND</application> will be configured to run in a
292 <command>chroot</command> jail as an unprivileged user (<systemitem
293 class="username">named</systemitem>). This configuration is more secure
294 in that a DNS compromise can only affect a few files in the <systemitem
295 class="username">named</systemitem> user's <envar>HOME</envar>
296 directory.
297 </para>
298
299 <para>
300 Create the unprivileged user and group <systemitem
301 class="username">named</systemitem>:
302 </para>
303
304<screen role="root"><userinput>groupadd -g 20 named &amp;&amp;
305useradd -c "BIND Owner" -g named -s /bin/false -u 20 named &amp;&amp;
306install -d -m770 -o named -g named /srv/named</userinput></screen>
307
308 <para>
309 Set up some files, directories and devices needed by
310 <application>BIND</application>:
311 </para>
312
313<screen role="root"><userinput>mkdir -p /srv/named &amp;&amp;
314cd /srv/named &amp;&amp;
315mkdir -p dev etc/named/{slave,pz} usr/lib/engines var/run/named &amp;&amp;
316mknod /srv/named/dev/null c 1 3 &amp;&amp;
317mknod /srv/named/dev/urandom c 1 9 &amp;&amp;
318chmod 666 /srv/named/dev/{null,urandom} &amp;&amp;
319cp /etc/localtime etc</userinput></screen>
320
321 <para>
322 The <filename>rndc.conf</filename> file contains information for
323 controlling <command>named</command> operations with the
324 <command>rndc</command> utility. Generate a key for use in the
325 <filename>named.conf</filename> and <filename>rndc.conf</filename>
326 with the <command>rndc-confgen</command> command:
327 </para>
328
329<screen role="root"><userinput>rndc-confgen -a -b 512 -t /srv/named</userinput></screen>
330
331 <para>
332 Create the <filename>named.conf</filename> file from which
333 <command>named</command> will read the location of zone files, root
334 name servers and secure DNS keys:
335 </para>
336
337<screen role="root"><?dbfo keep-together="auto"?><userinput>cat &gt;&gt; /srv/named/etc/named.conf &lt;&lt; "EOF"
338<literal>options {
339 directory "/etc/named";
340 pid-file "/var/run/named.pid";
341 statistics-file "/var/run/named.stats";
342
343};
344zone "." {
345 type hint;
346 file "root.hints";
347};
348zone "0.0.127.in-addr.arpa" {
349 type master;
350 file "pz/127.0.0";
351};
352
353// Bind 9 now logs by default through syslog (except debug).
354// These are the default logging rules.
355
356logging {
357 category default { default_syslog; default_debug; };
358 category unmatched { null; };
359
360 channel default_syslog {
361 syslog daemon; // send to syslog's daemon
362 // facility
363 severity info; // only send priority info
364 // and higher
365 };
366
367 channel default_debug {
368 file "named.run"; // write to named.run in
369 // the working directory
370 // Note: stderr is used instead
371 // of "named.run"
372 // if the server is started
373 // with the '-f' option.
374 severity dynamic; // log at the server's
375 // current debug level
376 };
377
378 channel default_stderr {
379 stderr; // writes to stderr
380 severity info; // only send priority info
381 // and higher
382 };
383
384 channel null {
385 null; // toss anything sent to
386 // this channel
387 };
388};</literal>
389EOF</userinput></screen>
390
391 <para>
392 Create a zone file with the following contents:
393 </para>
394
395<screen role="root"><userinput>cat &gt; /srv/named/etc/named/pz/127.0.0 &lt;&lt; "EOF"
396<literal>$TTL 3D
397@ IN SOA ns.local.domain. hostmaster.local.domain. (
398 1 ; Serial
399 8H ; Refresh
400 2H ; Retry
401 4W ; Expire
402 1D) ; Minimum TTL
403 NS ns.local.domain.
4041 PTR localhost.</literal>
405EOF</userinput></screen>
406
407 <para>
408 Create the <filename>root.hints</filename> file with the following
409 commands:
410 </para>
411
412 <note>
413 <para>
414 Caution must be used to ensure there are no leading spaces in
415 this file.
416 </para>
417 </note>
418
419<screen role="root"><userinput>cat &gt; /srv/named/etc/named/root.hints &lt;&lt; "EOF"
420<literal>. 6D IN NS A.ROOT-SERVERS.NET.
421. 6D IN NS B.ROOT-SERVERS.NET.
422. 6D IN NS C.ROOT-SERVERS.NET.
423. 6D IN NS D.ROOT-SERVERS.NET.
424. 6D IN NS E.ROOT-SERVERS.NET.
425. 6D IN NS F.ROOT-SERVERS.NET.
426. 6D IN NS G.ROOT-SERVERS.NET.
427. 6D IN NS H.ROOT-SERVERS.NET.
428. 6D IN NS I.ROOT-SERVERS.NET.
429. 6D IN NS J.ROOT-SERVERS.NET.
430. 6D IN NS K.ROOT-SERVERS.NET.
431. 6D IN NS L.ROOT-SERVERS.NET.
432. 6D IN NS M.ROOT-SERVERS.NET.
433A.ROOT-SERVERS.NET. 6D IN A 198.41.0.4
434A.ROOT-SERVERS.NET. 6D IN AAAA 2001:503:ba3e::2:30
435B.ROOT-SERVERS.NET. 6D IN A 170.247.170.2
436B.ROOT-SERVERS.NET. 6D IN AAAA 2801:1b8:10::b
437C.ROOT-SERVERS.NET. 6D IN A 192.33.4.12
438C.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:2::c
439D.ROOT-SERVERS.NET. 6D IN A 199.7.91.13
440D.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:2d::d
441E.ROOT-SERVERS.NET. 6D IN A 192.203.230.10
442E.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:a8::e
443F.ROOT-SERVERS.NET. 6D IN A 192.5.5.241
444F.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:2f::f
445G.ROOT-SERVERS.NET. 6D IN A 192.112.36.4
446G.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:12::d0d
447H.ROOT-SERVERS.NET. 6D IN A 198.97.190.53
448H.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:1::53
449I.ROOT-SERVERS.NET. 6D IN A 192.36.148.17
450I.ROOT-SERVERS.NET. 6D IN AAAA 2001:7fe::53
451J.ROOT-SERVERS.NET. 6D IN A 192.58.128.30
452J.ROOT-SERVERS.NET. 6D IN AAAA 2001:503:c27::2:30
453K.ROOT-SERVERS.NET. 6D IN A 193.0.14.129
454K.ROOT-SERVERS.NET. 6D IN AAAA 2001:7fd::1
455L.ROOT-SERVERS.NET. 6D IN A 199.7.83.42
456L.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:9f::42
457M.ROOT-SERVERS.NET. 6D IN A 202.12.27.33
458M.ROOT-SERVERS.NET. 6D IN AAAA 2001:dc3::35</literal>
459EOF</userinput></screen>
460
461 <para>
462 The <filename>root.hints</filename> file is a list of root name
463 servers. This file must be updated periodically with the
464 <command>dig</command> utility. A current copy of root.hints can be
465 obtained from <ulink url="https://www.internic.net/domain/named.root"/>.
466 For details, consult the "BIND 9 Administrator Reference Manual".
467 </para>
468
469 <para>
470 Create or modify <filename>resolv.conf</filename> to use the new
471 name server with the following commands:
472 </para>
473
474 <note>
475 <para>
476 Replace <replaceable>&lt;yourdomain.com&gt;</replaceable> with
477 your own valid domain name.
478 </para>
479 </note>
480
481<screen role="root"><userinput>cp /etc/resolv.conf /etc/resolv.conf.bak &amp;&amp;
482cat &gt; /etc/resolv.conf &lt;&lt; "EOF"
483<literal>search <replaceable>&lt;yourdomain.com&gt;</replaceable>
484nameserver 127.0.0.1</literal>
485EOF</userinput></screen>
486
487 <para>
488 Set permissions on the <command>chroot</command> jail with the
489 following command:
490 </para>
491
492<screen role="root"><userinput>chown -R named:named /srv/named</userinput></screen>
493
494 </sect3>
495
496 <sect3 id="bind-init">
497 <title><phrase revision="sysv">Boot Script</phrase>
498 <phrase revision="systemd">Systemd Unit</phrase></title>
499
500 <para>
501 To start the DNS server at boot, install the
502 <phrase revision="sysv"><filename>/etc/rc.d/init.d/bind</filename> init
503 script</phrase>
504 <phrase revision="systemd"><filename>named.service</filename>
505 unit</phrase> included in the
506 <xref linkend="bootscripts" revision="sysv"/>
507 <xref linkend="systemd-units" revision="systemd"/> package:
508 </para>
509
510 <indexterm zone="bind bind-init">
511 <primary sortas="f-bind">bind</primary>
512 </indexterm>
513
514<screen role="root" revision="sysv"><userinput>make install-bind</userinput></screen>
515<screen role="root" revision="systemd"><userinput>make install-named</userinput></screen>
516
517 <para>
518 Now start <application>BIND</application> with the following command:
519 </para>
520
521<screen role="root" revision="sysv"><userinput>/etc/rc.d/init.d/bind start</userinput></screen>
522<screen role="root" revision="systemd"><userinput>systemctl start named</userinput></screen>
523
524 </sect3>
525
526 <sect3>
527 <title>Testing BIND</title>
528
529 <para>
530 Test out the new <application>BIND</application> 9 installation.
531 First query the local host address with <command>dig</command>:
532 </para>
533
534<screen><userinput>dig -x 127.0.0.1</userinput></screen>
535
536 <para>
537 Now try an external name lookup, taking note of the speed
538 difference in repeated lookups due to the caching. Run the
539 <command>dig</command> command twice on the same address:
540 </para>
541
542<screen><userinput>dig www.&lfs-domainname; &amp;&amp;
543dig www.&lfs-domainname;</userinput></screen>
544
545 <para>
546 You can see almost instantaneous results with the named caching
547 lookups. Consult the <application>BIND</application> Administrator
548 Reference Manual (see below) for further configuration options.
549 </para>
550
551 </sect3>
552
553 </sect2>
554
555 <sect2>
556 <title>Administrator Reference Manual (ARM)</title>
557
558 <para>
559 The ARM documentation (do not confuse with the processor architecture)
560 is included in the source package. The documentation is in .rst
561 format which means that it can be converted in human readable formats
562 if <xref linkend="sphinx"/> is installed.
563 </para>
564
565 <para>
566 When <application>BIND</application> is set up, especially if it is going
567 to be operating in a real live scenario, it is <emphasis>highly</emphasis>
568 recommended to consult the ARM documentation. ISC provides an
569 updated set of excellent documentation along with every release
570 so it can be easily viewed and/or downloaded &ndash; so there is
571 no excuse to not read the docs. The formats ISC provides are PDF,
572 epub and html at <ulink url="https://downloads.isc.org/isc/bind9/&bind-version;/doc/arm/"/>.
573 </para>
574 </sect2>
575
576 <sect2 role="content">
577 <title>Contents</title>
578
579 <segmentedlist>
580 <segtitle>Installed Programs</segtitle>
581 <segtitle>Installed Libraries</segtitle>
582 <segtitle>Installed Directories</segtitle>
583
584 <seglistitem>
585
586 <seg>arpaname, ddns-confgen, delv, dig, dnssec-cds,
587 dnssec-dsfromkey, dnssec-importkey, dnssec-keyfromlabel, dnssec-keygen,
588 dnssec-ksr, dnssec-revoke, dnssec-settime, dnssec-signzone,
589 dnssec-verify, host, mdig, named, named-checkconf,
590 named-checkzone, named-compilezone, named-journalprint,
591 named-nzd2nzf, named-rrchecker, nsec3hash, nslookup, nsupdate, rndc,
592 rndc-confgen, and tsig-keygen (symlink)</seg>
593
594 <seg>libdns.so, libisc.so, libisccc.so, libisccfg.so, and libns.so</seg>
595
596 <seg>/usr/include/{dns,dst,irs,isc,isccc,isccfg,ns},
597 /usr/lib/bind,
598 and /srv/named</seg>
599 </seglistitem>
600 </segmentedlist>
601
602 <variablelist>
603 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
604 <?dbfo list-presentation="list"?>
605 <?dbhtml list-presentation="table"?>
606
607 <varlistentry id="arpaname">
608 <term><command>arpaname</command></term>
609 <listitem>
610 <para>
611 translates IP addresses to the corresponding ARPA names
612 </para>
613 <indexterm zone="bind arpaname">
614 <primary sortas="b-arpaname">arpaname</primary>
615 </indexterm>
616 </listitem>
617 </varlistentry>
618
619 <varlistentry id="ddns-confgen">
620 <term><command>ddns-confgen</command></term>
621 <listitem>
622 <para>
623 generates a key for use by nsupdate and named
624 </para>
625 <indexterm zone="bind ddns-confgen">
626 <primary sortas="b-ddns-confgen">ddns-confgen</primary>
627 </indexterm>
628 </listitem>
629 </varlistentry>
630
631 <varlistentry id="delv">
632 <term><command>delv</command></term>
633 <listitem>
634 <para>
635 is a new debugging tool that is a successor to
636 <command>dig</command>
637 </para>
638 <indexterm zone="bind delv">
639 <primary sortas="b-delv">delv</primary>
640 </indexterm>
641 </listitem>
642 </varlistentry>
643
644 <varlistentry id="dig">
645 <term><command>dig</command></term>
646 <listitem>
647 <para>
648 interrogates DNS servers
649 </para>
650 <indexterm zone="bind dig">
651 <primary sortas="b-dig">dig</primary>
652 </indexterm>
653 </listitem>
654 </varlistentry>
655
656 <varlistentry id="dnssec-cds">
657 <term><command>dnssec-cds</command></term>
658 <listitem>
659 <para>
660 changes DS records for a child zone based on
661 CDS/CDNSKEY
662 </para>
663 <indexterm zone="bind dnssec-cds">
664 <primary sortas="b-dnssec-cds">dnssec-cds</primary>
665 </indexterm>
666 </listitem>
667 </varlistentry>
668
669 <varlistentry id="dnssec-dsfromkey">
670 <term><command>dnssec-dsfromkey</command></term>
671 <listitem>
672 <para>
673 outputs the Delegation Signer (DS) resource record (RR)
674 </para>
675 <indexterm zone="bind dnssec-dsfromkey">
676 <primary sortas="b-dnssec-dsfromkey">dnssec-dsfromkey</primary>
677 </indexterm>
678 </listitem>
679 </varlistentry>
680
681 <varlistentry id="dnssec-importkey">
682 <term><command>dnssec-importkey</command></term>
683 <listitem>
684 <para>
685 reads a public DNSKEY record and generates a pair of
686 .key/.private files
687 </para>
688 <indexterm zone="bind dnssec-importkey">
689 <primary sortas="b-dnssec-importkey">dnssec-importkey</primary>
690 </indexterm>
691 </listitem>
692 </varlistentry>
693
694 <varlistentry id="dnssec-keyfromlabel">
695 <term><command>dnssec-keyfromlabel</command></term>
696 <listitem>
697 <para>
698 gets keys with the given label from a cryptography hardware device
699 and builds key files for DNSSEC
700 </para>
701 <indexterm zone="bind dnssec-keyfromlabel">
702 <primary sortas="b-dnssec-keyfromlabel">dnssec-keyfromlabel</primary>
703 </indexterm>
704 </listitem>
705 </varlistentry>
706
707 <varlistentry id="dnssec-keymgr">
708 <term><command>dnssec-keymgr</command></term>
709 <listitem>
710 <para>
711 ensures correct DNSKEY coverage based on a defined policy
712 </para>
713 <indexterm zone="bind dnssec-keymgr">
714 <primary sortas="b-dnssec-keymgr">dnssec-keymgr</primary>
715 </indexterm>
716 </listitem>
717 </varlistentry>
718
719 <varlistentry id="dnssec-ksr">
720 <term><command>dnssec-ksr</command></term>
721 <listitem>
722 <para>
723 creates signed key response (SKR) files for offline KSK setups
724 </para>
725 <indexterm zone="bind dnssec-ksr">
726 <primary sortas="b-dnssec-ksr">dnssec-ksr</primary>
727 </indexterm>
728 </listitem>
729 </varlistentry>
730
731 <varlistentry id="dnssec-revoke">
732 <term><command>dnssec-revoke</command></term>
733 <listitem>
734 <para>
735 sets the REVOKED bit on a DNSSEC key
736 </para>
737 <indexterm zone="bind dnssec-revoke">
738 <primary sortas="b-dnssec-revoke">dnssec-revoke</primary>
739 </indexterm>
740 </listitem>
741 </varlistentry>
742
743 <varlistentry id="dnssec-settime">
744 <term><command>dnssec-settime</command></term>
745 <listitem>
746 <para>
747 sets the key timing metadata for a DNSSEC key
748 </para>
749 <indexterm zone="bind dnssec-settime">
750 <primary sortas="b-dnssec-settime">dnssec-settime</primary>
751 </indexterm>
752 </listitem>
753 </varlistentry>
754
755 <varlistentry id="dnssec-signzone">
756 <term><command>dnssec-signzone</command></term>
757 <listitem>
758 <para>
759 generates signed versions of zone files
760 </para>
761 <indexterm zone="bind dnssec-signzone">
762 <primary sortas="b-dnssec-signzone">dnssec-signzone</primary>
763 </indexterm>
764 </listitem>
765 </varlistentry>
766
767 <varlistentry id="dnssec-verify">
768 <term><command>dnssec-verify</command></term>
769 <listitem>
770 <para>
771 verifies that a zone is fully signed for each algorithm found
772 in the DNSKEY RRset for the zone, and that the NSEC / NSEC3
773 chains are complete
774 </para>
775 <indexterm zone="bind dnssec-verify">
776 <primary sortas="b-dnssec-verify">dnssec-verify</primary>
777 </indexterm>
778 </listitem>
779 </varlistentry>
780
781 <varlistentry id="host">
782 <term><command>host</command></term>
783 <listitem>
784 <para>
785 is a utility for DNS lookups
786 </para>
787 <indexterm zone="bind host">
788 <primary sortas="b-host">host</primary>
789 </indexterm>
790 </listitem>
791 </varlistentry>
792
793 <varlistentry id="mdig">
794 <term><command>mdig</command></term>
795 <listitem>
796 <para>
797 is a version of dig that allows multiple queries at once
798 </para>
799 <indexterm zone="bind mdig">
800 <primary sortas="b-mdig">mdig</primary>
801 </indexterm>
802 </listitem>
803 </varlistentry>
804
805 <varlistentry id="named">
806 <term><command>named</command></term>
807 <listitem>
808 <para>
809 is the name server daemon
810 </para>
811 <indexterm zone="bind named">
812 <primary sortas="b-named">named</primary>
813 </indexterm>
814 </listitem>
815 </varlistentry>
816
817 <varlistentry id="named-checkconf">
818 <term><command>named-checkconf</command></term>
819 <listitem>
820 <para>
821 checks the syntax of <filename>named.conf</filename>
822 files
823 </para>
824 <indexterm zone="bind named-checkconf">
825 <primary sortas="b-named-checkconf">named-checkconf</primary>
826 </indexterm>
827 </listitem>
828 </varlistentry>
829
830 <varlistentry id="named-checkzone">
831 <term><command>named-checkzone</command></term>
832 <listitem>
833 <para>
834 checks zone file validity
835 </para>
836 <indexterm zone="bind named-checkzone">
837 <primary sortas="b-named-checkzone">named-checkzone</primary>
838 </indexterm>
839 </listitem>
840 </varlistentry>
841
842 <varlistentry id="named-compilezone">
843 <term><command>named-compilezone</command></term>
844 <listitem>
845 <para>
846 is similar to <command>named-checkzone</command>, but it always
847 dumps the zone contents to a specified file in a specified format
848 </para>
849 <indexterm zone="bind named-compilezone">
850 <primary sortas="b-named-compilezone">named-compilezone</primary>
851 </indexterm>
852 </listitem>
853 </varlistentry>
854
855 <varlistentry id="named-journalprint">
856 <term><command>named-journalprint</command></term>
857 <listitem>
858 <para>
859 prints the zone journal in human-readable form
860 </para>
861 <indexterm zone="bind named-journalprint">
862 <primary sortas="b-named-journalprint">named-journalprint</primary>
863 </indexterm>
864 </listitem>
865 </varlistentry>
866
867 <varlistentry id="named-rrchecker">
868 <term><command>named-rrchecker</command></term>
869 <listitem>
870 <para>
871 reads an individual DNS resource record from standard input and
872 checks if it is syntactically correct
873 </para>
874 <indexterm zone="bind named-rrchecker">
875 <primary sortas="b-named-rrchecker">named-rrchecker</primary>
876 </indexterm>
877 </listitem>
878 </varlistentry>
879
880 <varlistentry id="named-nzd2nzf">
881 <term><command>named-nzd2nzf</command></term>
882 <listitem>
883 <para>
884 converts an NZD database to NZF text format
885 </para>
886 <indexterm zone="bind named-nzd2nzf">
887 <primary sortas="b-named-nzd2nzf">named-nzd2nzf</primary>
888 </indexterm>
889 </listitem>
890 </varlistentry>
891
892 <varlistentry id="nsec3hash">
893 <term><command>nsec3hash</command></term>
894 <listitem>
895 <para>
896 generates an NSEC3 hash based on a set of NSEC3 parameters
897 </para>
898 <indexterm zone="bind nsec3hash">
899 <primary sortas="b-nsec3hash">nsec3hash</primary>
900 </indexterm>
901 </listitem>
902 </varlistentry>
903
904 <varlistentry id="nslookup">
905 <term><command>nslookup</command></term>
906 <listitem>
907 <para>
908 is a program used to query Internet domain nameservers
909 </para>
910 <indexterm zone="bind nslookup">
911 <primary sortas="b-nslookup">nslookup</primary>
912 </indexterm>
913 </listitem>
914 </varlistentry>
915
916 <varlistentry id="nsupdate">
917 <term><command>nsupdate</command></term>
918 <listitem>
919 <para>
920 is used to submit DNS update requests
921 </para>
922 <indexterm zone="bind nsupdate">
923 <primary sortas="b-nsupdate">nsupdate</primary>
924 </indexterm>
925 </listitem>
926 </varlistentry>
927
928 <varlistentry id="rndc">
929 <term><command>rndc</command></term>
930 <listitem>
931 <para>
932 controls the operation of <application>BIND</application>
933 </para>
934 <indexterm zone="bind rndc">
935 <primary sortas="b-rndc">rndc</primary>
936 </indexterm>
937 </listitem>
938 </varlistentry>
939
940 <varlistentry id="rndc-confgen">
941 <term><command>rndc-confgen</command></term>
942 <listitem>
943 <para>
944 generates <filename>rndc.conf</filename> files
945 </para>
946 <indexterm zone="bind rndc-confgen">
947 <primary sortas="b-rndc-confgen">rndc-confgen</primary>
948 </indexterm>
949 </listitem>
950 </varlistentry>
951
952 <varlistentry id="tsig-keygen">
953 <term><command>tsig-keygen</command></term>
954 <listitem>
955 <para>
956 is a symlink to <command>ddns-confgen</command>
957 </para>
958 <indexterm zone="bind tsig-keygen">
959 <primary sortas="b-tsig-keygen">tsig-keygen</primary>
960 </indexterm>
961 </listitem>
962 </varlistentry>
963
964 </variablelist>
965
966 </sect2>
967
968</sect1>
Note: See TracBrowser for help on using the repository browser.