source: server/major/bind.xml@ 5aac6876

10.0 10.1 11.0 ken/refactor-virt lazarus qt5new trunk xry111/git-date xry111/git-date-for-trunk xry111/git-date-test
Last change on this file since 5aac6876 was 5aac6876, checked in by Bruce Dubbs <bdubbs@…>, 14 months ago

A few tags

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@23616 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 34.4 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY bind-download-http " ">
8 <!ENTITY bind-download-ftp "ftp://ftp.isc.org/isc/bind9/&bind-version;/bind-&bind-version;.tar.xz">
9 <!ENTITY bind-md5sum "5ef3e773f671886a40148c4dd01d017a">
10 <!ENTITY bind-size "3.3 MB">
11 <!ENTITY bind-buildsize "123 MB (23 MB installed)">
12 <!ENTITY bind-time "0.9 SBU (with parallelism=4; add 34+ minutes, processor independent, to run the complete test suite)">
13]>
14
15<sect1 id="bind" xreflabel="BIND-&bind-version;">
16 <?dbhtml filename="bind.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>BIND-&bind-version;</title>
24
25 <indexterm zone="bind">
26 <primary sortas="a-BIND">BIND</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to BIND</title>
31
32 <para>
33 The <application>BIND</application> package provides a DNS server
34 and client utilities. If you are only interested in the utilities, refer
35 to the <xref linkend="bind-utils"/>.
36 </para>
37
38 &lfs10_checked;
39
40 <bridgehead renderas="sect3">Package Information</bridgehead>
41 <itemizedlist spacing="compact">
42 <listitem>
43 <para>
44 Download (HTTP): <ulink url="&bind-download-http;"/>
45 </para>
46 </listitem>
47 <listitem>
48 <para>
49 Download (FTP): <ulink url="&bind-download-ftp;"/>
50 </para>
51 </listitem>
52 <listitem>
53 <para>
54 Download MD5 sum: &bind-md5sum;
55 </para>
56 </listitem>
57 <listitem>
58 <para>
59 Download size: &bind-size;
60 </para>
61 </listitem>
62 <listitem>
63 <para>
64 Estimated disk space required: &bind-buildsize;
65 </para>
66 </listitem>
67 <listitem>
68 <para>
69 Estimated build time: &bind-time;
70 </para>
71 </listitem>
72 </itemizedlist>
73
74 <bridgehead renderas="sect3">BIND Dependencies</bridgehead>
75
76 <bridgehead renderas="sect4">Required</bridgehead>
77 <para role="required">
78 <xref linkend="libuv"/>
79 </para>
80
81 <bridgehead renderas="sect4">Recommended</bridgehead>
82 <para role="recommended">
83 <xref linkend="json-c"/> and
84 <xref linkend="libcap-pam"/>
85 </para>
86
87 <bridgehead renderas="sect4">Optional</bridgehead>
88 <para role="optional">
89 <xref linkend="curl"/>,
90 <xref linkend="libidn2"/>,
91 <xref linkend="libxml2"/>,
92 <xref linkend="mitkrb"/>,
93 <ulink url="https://cmocka.org/">cmocka</ulink>,
94 <ulink url='https://github.com/cjheath/geoip'>geoip</ulink>, and
95 <ulink url="https://pypi.python.org/pypi/Sphinx">Sphinx</ulink>
96 </para>
97
98 <bridgehead renderas="sect4">Optional database backends</bridgehead>
99 <para role="optional">
100 <xref linkend="db"/>,
101 <xref linkend="mariadb"/> or <ulink url="http://www.mysql.com/">MySQL</ulink>,
102 <xref linkend="openldap"/>,
103 <xref linkend="postgresql"/>, and
104 <xref linkend="unixodbc"/>
105 </para>
106
107 <bridgehead renderas="sect4">Optional (to run the test suite)</bridgehead>
108 <para role="optional">
109 <xref linkend="perl-net-dns"/>
110 </para>
111
112 <bridgehead renderas="sect4">Optional (to rebuild the documentation)</bridgehead>
113 <para role="optional">
114 <xref linkend="doxygen"/>,
115 <xref linkend="libxslt"/>, and
116 <xref linkend="texlive"/> (or <xref linkend="tl-installer"/>)
117 </para>
118
119 <para condition="html" role="usernotes">User Notes:
120 <ulink url="&blfs-wiki;/bind"/></para>
121
122 </sect2>
123
124 <sect2 role="installation">
125 <title>Installation of BIND</title>
126
127 <para>
128 To ensure <application>BIND</application> will build dnssec-keymgr,
129 install a python module as the <systemitem
130 class="username">root</systemitem> user:
131 </para>
132
133<screen role="root"><userinput>pip3 install ply</userinput></screen>
134
135 <para>
136 Install <application>BIND</application> by running the
137 following commands:
138 </para>
139
140<screen><userinput>./configure --prefix=/usr \
141 --sysconfdir=/etc \
142 --localstatedir=/var \
143 --mandir=/usr/share/man \
144 --with-libtool \
145 --disable-static &amp;&amp;
146make</userinput></screen>
147
148 <para>
149 Issue the following commands to run the complete suite of tests.
150 First, as the <systemitem class="username">root</systemitem> user, set up
151 some test interfaces:
152 </para>
153
154 <note>
155 <para>
156 If IPv6 is not enabled in the kernel, there will be several
157 error messages: "RTNETLINK answers: Operation not permitted". These
158 messages do not affect the tests.
159 </para>
160 </note>
161
162<screen role="root"
163 remap="test"><userinput>bin/tests/system/ifconfig.sh up</userinput></screen>
164
165 <para>
166 The test suite may indicate some skipped tests depending on
167 what configuration options are used. Some tests are marked
168 <quote>UNTESTED</quote> if <xref linkend="perl-net-dns"/> is not
169 installed. To run the tests, as an unprivileged user, execute:
170 </para>
171
172<screen remap="test"><userinput>make -k check</userinput></screen>
173
174 <para>
175 Again as <systemitem class="username">root</systemitem>, clean up the
176 test interfaces:
177 </para>
178
179<screen role="root"
180 remap="test"><userinput>bin/tests/system/ifconfig.sh down</userinput></screen>
181
182 <para>
183 Finally, install the package as the <systemitem
184 class="username">root</systemitem> user:
185 </para>
186
187<screen role="root"><userinput>make install</userinput></screen>
188 </sect2>
189
190<!-- Documentation is an issue - The docs are now all in .rst format and appear
191to be sphinx based.
192-->
193
194 <sect2 role="commands">
195 <title>Command Explanations</title>
196
197 <para>
198 <parameter>--sysconfdir=/etc</parameter>: This parameter forces
199 <application>BIND</application> to look for configuration
200 files in <filename class='directory'>/etc</filename> instead of
201 <filename class='directory'>/usr/etc</filename>.
202 </para>
203
204 <para>
205 <parameter>--with-libtool</parameter>: This parameter forces the
206 building of dynamic libraries and links the installed binaries to these
207 libraries.
208 </para>
209
210 <para>
211 <option>--with-libidn2</option>: This parameter enables
212 the IDNA2008 (Internationalized Domain Names in Applications)
213 support.
214 </para>
215
216 <para>
217 <option>--enable-fetchlimit</option>: Use this option if you want
218 to be able to limit the rate of recursive client queries. This may be
219 useful on servers which receive a large number of queries.
220 </para>
221
222 <para>
223 <option>--disable-linux-caps</option>: BIND can also be built without
224 capability support by using this option, at the cost of some loss of
225 security.
226 </para>
227
228 <para>
229 <option>--with-dlz-{mysql,bdb,filesystem,ldap,odbc,stub}</option>: Use
230 one (or more) of those options to add Dynamically Loadable Zones support.
231 For more information refer to <ulink
232 url="http://bind-dlz.sourceforge.net/">bind-dlz.sourceforge.net</ulink>.
233 </para>
234
235 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
236 href="../../xincludes/static-libraries.xml"/>
237
238 </sect2>
239
240 <sect2 role="configuration">
241 <title>Configuring BIND</title>
242
243 <sect3 id="bind-config">
244 <title>Config files</title>
245
246 <para>
247 <filename>named.conf</filename>,
248 <filename>root.hints</filename>,
249 <filename>127.0.0</filename>,
250 <filename>rndc.conf</filename>, and
251 <filename>resolv.conf</filename>
252 </para>
253
254 <indexterm zone="bind bind-config">
255 <primary sortas="e-etc-named.conf">/etc/named.conf</primary>
256 </indexterm>
257
258 <indexterm zone="bind bind-config">
259 <primary sortas="e-etc-rndc.conf">/etc/rndc.conf</primary>
260 </indexterm>
261
262 <indexterm zone="bind bind-config">
263 <primary sortas="e-etc-resolv.conf">/etc/resolv.conf</primary>
264 </indexterm>
265
266 <indexterm zone="bind bind-config">
267 <primary
268 sortas="e-etc-namedb-root.hints">/etc/namedb/root.hints</primary>
269 </indexterm>
270
271 <indexterm zone="bind bind-config">
272 <primary
273 sortas="e-etc-namedb-pz-127.0.0.0">/etc/namedb/pz/127.0.0.0</primary>
274 </indexterm>
275 </sect3>
276
277 <sect3>
278 <title>Configuration Information</title>
279
280 <para>
281 <application>BIND</application> will be configured to run in a
282 <command>chroot</command> jail as an unprivileged user (<systemitem
283 class="username">named</systemitem>). This configuration is more secure
284 in that a DNS compromise can only affect a few files in the <systemitem
285 class="username">named</systemitem> user's <envar>HOME</envar>
286 directory.
287 </para>
288
289 <para>
290 Create the unprivileged user and group <systemitem
291 class="username">named</systemitem>:
292 </para>
293
294<screen role="root"><userinput>groupadd -g 20 named &amp;&amp;
295useradd -c "BIND Owner" -g named -s /bin/false -u 20 named &amp;&amp;
296install -d -m770 -o named -g named /srv/named</userinput></screen>
297
298 <para>
299 Set up some files, directories and devices needed by
300 <application>BIND</application>:
301 </para>
302
303<screen role="root"><userinput>mkdir -p /srv/named &amp;&amp;
304cd /srv/named &amp;&amp;
305mkdir -p dev etc/named/{slave,pz} usr/lib/engines var/run/named &amp;&amp;
306mknod /srv/named/dev/null c 1 3 &amp;&amp;
307mknod /srv/named/dev/urandom c 1 9 &amp;&amp;
308chmod 666 /srv/named/dev/{null,urandom} &amp;&amp;
309cp /etc/localtime etc</userinput></screen>
310
311 <para>
312 The <filename>rndc.conf</filename> file contains information for
313 controlling <command>named</command> operations with the
314 <command>rndc</command> utility. Generate a key for use in the
315 <filename>named.conf</filename> and <filename>rdnc.conf</filename>
316 with the <command>rndc-confgen</command> command:
317 </para>
318
319<screen role="root"><userinput>rndc-confgen -a -b 512 -t /srv/named</userinput></screen>
320
321 <para>
322 Complete the <filename>named.conf</filename> file from which
323 <command>named</command> will read the location of zone files, root
324 name servers and secure DNS keys:
325 </para>
326
327<screen role="root"><?dbfo keep-together="auto"?><userinput>cat &gt;&gt; /srv/named/etc/named.conf &lt;&lt; "EOF"
328<literal>options {
329 directory "/etc/named";
330 pid-file "/var/run/named.pid";
331 statistics-file "/var/run/named.stats";
332
333};
334zone "." {
335 type hint;
336 file "root.hints";
337};
338zone "0.0.127.in-addr.arpa" {
339 type master;
340 file "pz/127.0.0";
341};
342
343// Bind 9 now logs by default through syslog (except debug).
344// These are the default logging rules.
345
346logging {
347 category default { default_syslog; default_debug; };
348 category unmatched { null; };
349
350 channel default_syslog {
351 syslog daemon; // send to syslog's daemon
352 // facility
353 severity info; // only send priority info
354 // and higher
355 };
356
357 channel default_debug {
358 file "named.run"; // write to named.run in
359 // the working directory
360 // Note: stderr is used instead
361 // of "named.run"
362 // if the server is started
363 // with the '-f' option.
364 severity dynamic; // log at the server's
365 // current debug level
366 };
367
368 channel default_stderr {
369 stderr; // writes to stderr
370 severity info; // only send priority info
371 // and higher
372 };
373
374 channel null {
375 null; // toss anything sent to
376 // this channel
377 };
378};</literal>
379EOF</userinput></screen>
380
381 <para>
382 Create a zone file with the following contents:
383 </para>
384
385<screen role="root"><userinput>cat &gt; /srv/named/etc/named/pz/127.0.0 &lt;&lt; "EOF"
386<literal>$TTL 3D
387@ IN SOA ns.local.domain. hostmaster.local.domain. (
388 1 ; Serial
389 8H ; Refresh
390 2H ; Retry
391 4W ; Expire
392 1D) ; Minimum TTL
393 NS ns.local.domain.
3941 PTR localhost.</literal>
395EOF</userinput></screen>
396
397 <para>
398 Create the <filename>root.hints</filename> file with the following
399 commands:
400 </para>
401
402 <note>
403 <para>
404 Caution must be used to ensure there are no leading spaces in
405 this file.
406 </para>
407 </note>
408
409<screen role="root"><userinput>cat &gt; /srv/named/etc/named/root.hints &lt;&lt; "EOF"
410<literal>. 6D IN NS A.ROOT-SERVERS.NET.
411. 6D IN NS B.ROOT-SERVERS.NET.
412. 6D IN NS C.ROOT-SERVERS.NET.
413. 6D IN NS D.ROOT-SERVERS.NET.
414. 6D IN NS E.ROOT-SERVERS.NET.
415. 6D IN NS F.ROOT-SERVERS.NET.
416. 6D IN NS G.ROOT-SERVERS.NET.
417. 6D IN NS H.ROOT-SERVERS.NET.
418. 6D IN NS I.ROOT-SERVERS.NET.
419. 6D IN NS J.ROOT-SERVERS.NET.
420. 6D IN NS K.ROOT-SERVERS.NET.
421. 6D IN NS L.ROOT-SERVERS.NET.
422. 6D IN NS M.ROOT-SERVERS.NET.
423A.ROOT-SERVERS.NET. 6D IN A 198.41.0.4
424A.ROOT-SERVERS.NET. 6D IN AAAA 2001:503:ba3e::2:30
425B.ROOT-SERVERS.NET. 6D IN A 192.228.79.201
426B.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:200::b
427C.ROOT-SERVERS.NET. 6D IN A 192.33.4.12
428C.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:2::c
429D.ROOT-SERVERS.NET. 6D IN A 199.7.91.13
430D.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:2d::d
431E.ROOT-SERVERS.NET. 6D IN A 192.203.230.10
432E.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:a8::e
433F.ROOT-SERVERS.NET. 6D IN A 192.5.5.241
434F.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:2f::f
435G.ROOT-SERVERS.NET. 6D IN A 192.112.36.4
436G.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:12::d0d
437H.ROOT-SERVERS.NET. 6D IN A 198.97.190.53
438H.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:1::53
439I.ROOT-SERVERS.NET. 6D IN A 192.36.148.17
440I.ROOT-SERVERS.NET. 6D IN AAAA 2001:7fe::53
441J.ROOT-SERVERS.NET. 6D IN A 192.58.128.30
442J.ROOT-SERVERS.NET. 6D IN AAAA 2001:503:c27::2:30
443K.ROOT-SERVERS.NET. 6D IN A 193.0.14.129
444K.ROOT-SERVERS.NET. 6D IN AAAA 2001:7fd::1
445L.ROOT-SERVERS.NET. 6D IN A 199.7.83.42
446L.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:9f::42
447M.ROOT-SERVERS.NET. 6D IN A 202.12.27.33
448M.ROOT-SERVERS.NET. 6D IN AAAA 2001:dc3::35</literal>
449EOF</userinput></screen>
450
451 <para>
452 The <filename>root.hints</filename> file is a list of root name
453 servers. This file must be updated periodically with the
454 <command>dig</command> utility. A current copy of root.hints can be
455 obtained from <ulink url="ftp://rs.internic.net/domain/named.root" />.
456 For details, consult the "BIND 9 Administrator Reference Manual",
457 included in every source archive of BIND 9 distributed by ISC, in HTML
458 and PDF formats, also available at <ulink
459 url="ftp://ftp.isc.org/isc/bind9/cur/&bind-minor-version;/doc/arm/Bv9ARM.html">
460 BIND 9 Administrator Reference Manual</ulink>.
461 </para>
462
463 <para>
464 Create or modify <filename>resolv.conf</filename> to use the new
465 name server with the following commands:
466 </para>
467
468 <note>
469 <para>
470 Replace <replaceable>&lt;yourdomain.com&gt;</replaceable> with
471 your own valid domain name.
472 </para>
473 </note>
474
475<screen role="root"><userinput>cp /etc/resolv.conf /etc/resolv.conf.bak &amp;&amp;
476cat &gt; /etc/resolv.conf &lt;&lt; "EOF"
477<literal>search <replaceable>&lt;yourdomain.com&gt;</replaceable>
478nameserver 127.0.0.1</literal>
479EOF</userinput></screen>
480
481 <para>
482 Set permissions on the <command>chroot</command> jail with the
483 following command:
484 </para>
485
486<screen role="root"><userinput>chown -R named:named /srv/named</userinput></screen>
487
488 </sect3>
489
490 <sect3 id="bind-init">
491 <title><phrase revision="sysv">Boot Script</phrase>
492 <phrase revision="systemd">Systemd Unit</phrase></title>
493
494 <para>
495 To start the DNS server at boot, install the
496 <phrase revision="sysv"><filename>/etc/rc.d/init.d/bind</filename> init
497 script</phrase>
498 <phrase revision="systemd"><filename>named.service</filename>
499 unit</phrase> included in the
500 <xref linkend="bootscripts" revision="sysv"/>
501 <xref linkend="systemd-units" revision="systemd"/> package:
502 </para>
503
504 <indexterm zone="bind bind-init">
505 <primary sortas="f-bind">bind</primary>
506 </indexterm>
507
508<screen role="root" revision="sysv"><userinput>make install-bind</userinput></screen>
509<screen role="root" revision="systemd"><userinput>make install-named</userinput></screen>
510
511 <para>
512 Now start <application>BIND</application> with the following command:
513 </para>
514
515<screen role="root" revision="sysv"><userinput>/etc/rc.d/init.d/bind start</userinput></screen>
516<screen role="root" revision="systemd"><userinput>systemctl start named</userinput></screen>
517
518 </sect3>
519
520 <sect3>
521 <title>Testing BIND</title>
522
523 <para>
524 Test out the new <application>BIND</application> 9 installation.
525 First query the local host address with <command>dig</command>:
526 </para>
527
528<screen><userinput>dig -x 127.0.0.1</userinput></screen>
529
530 <para>
531 Now try an external name lookup, taking note of the speed
532 difference in repeated lookups due to the caching. Run the
533 <command>dig</command> command twice on the same address:
534 </para>
535
536<screen><userinput>dig www.&lfs-domainname; &amp;&amp;
537dig www.&lfs-domainname;</userinput></screen>
538
539 <para>
540 You can see almost instantaneous results with the named caching
541 lookups. Consult the <application>BIND</application> Administrator
542 Reference Manual located at
543 <ulink url="https://kb.isc.org/docs/bind-916-administrative-reference-manual"/>
544 for further configuration options.
545 </para>
546
547 </sect3>
548
549 </sect2>
550
551 <sect2 role="content">
552 <title>Contents</title>
553
554 <segmentedlist>
555 <segtitle>Installed Programs</segtitle>
556 <segtitle>Installed Libraries</segtitle>
557 <segtitle>Installed Directories</segtitle>
558
559 <seglistitem>
560
561 <seg>arpaname, <!--bind9-config hardlinked to isc-config.sh,-->
562 ddns-confgen, delv, dig, dnssec-cds, dnssec-checkds, dnssec-coverage,
563 dnssec-dsfromkey, dnssec-importkey, dnssec-keyfromlabel, dnssec-keygen,
564 dnssec-keymgr, dnssec-revoke, dnssec-settime, dnssec-signzone,
565 dnssec-verify, <!--genrandom,--> host, mdig,
566 <!--isc-hmac-fixup, lwresd hardlinked to named,--> named-checkconf,
567 named-checkzone, named-compilezone (symlink), named-journalprint,
568 named-rrchecker, named-nzd2nzf, nsec3hash, nslookup, nsupdate, rndc,
569 rndc-confgen, and tsig-keygen (symlink)</seg>
570
571 <seg>libbind9.so, libdns.so, libirs.so, libisc.so, libisccc.so, and
572 libisccfg.so</seg>
573
574 <seg>/usr/include/{bind9,dns,dst,irs,isc,isccc,isccfg,ns,pk11,pkcs11}
575 <!--/usr/share/doc/bind-&bind-version;--> and /srv/named</seg>
576 </seglistitem>
577 </segmentedlist>
578
579 <variablelist>
580 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
581 <?dbfo list-presentation="list"?>
582 <?dbhtml list-presentation="table"?>
583
584 <varlistentry id="arpaname">
585 <term><command>arpaname</command></term>
586 <listitem>
587 <para>
588 translates IP addresses to the corresponding ARPA names.
589 </para>
590 <indexterm zone="bind arpaname">
591 <primary sortas="b-arpaname">arpaname</primary>
592 </indexterm>
593 </listitem>
594 </varlistentry>
595
596<!-- Not present as of 9.16.5
597 <varlistentry id="bind9-config">
598 <term><command>bind9-config</command></term>
599 <listitem>
600 <para>
601 is hardlinked to <command>isc-config.sh</command>.
602 </para>
603 <indexterm zone="bind bind9-config">
604 <primary sortas="b-bind9-config">bind9-config</primary>
605 </indexterm>
606 </listitem>
607 </varlistentry>
608-->
609
610 <varlistentry id="ddns-confgen">
611 <term><command>ddns-confgen</command></term>
612 <listitem>
613 <para>
614 generates a key for use by nsupdate and named.
615 </para>
616 <indexterm zone="bind ddns-confgen">
617 <primary sortas="b-ddns-confgen">ddns-confgen</primary>
618 </indexterm>
619 </listitem>
620 </varlistentry>
621
622 <varlistentry id="delv">
623 <term><command>delv</command></term>
624 <listitem>
625 <para>
626 is a new debugging tool that is a successor to
627 <command>dig</command>.
628 </para>
629 <indexterm zone="bind delv">
630 <primary sortas="b-delv">delv</primary>
631 </indexterm>
632 </listitem>
633 </varlistentry>
634
635 <varlistentry id="dig">
636 <term><command>dig</command></term>
637 <listitem>
638 <para>
639 interrogates DNS servers.
640 </para>
641 <indexterm zone="bind dig">
642 <primary sortas="b-dig">dig</primary>
643 </indexterm>
644 </listitem>
645 </varlistentry>
646
647 <varlistentry id="dnssec-cds">
648 <term><command>dnssec-cds</command></term>
649 <listitem>
650 <para>
651 changes DS records for a child zone based on
652 CDS/CDNSKEY.
653 </para>
654 <indexterm zone="bind dnssec-cds">
655 <primary sortas="b-dnssec-cds">dnssec-cds</primary>
656 </indexterm>
657 </listitem>
658 </varlistentry>
659
660 <varlistentry id="dnssec-checkds">
661 <term><command>dnssec-checkds</command></term>
662 <listitem>
663 <para>
664 is a DNSSEC delegation consistency checking tool.
665 </para>
666 <indexterm zone="bind dnssec-checkds">
667 <primary sortas="b-dnssec-checkds">dnssec-checkds</primary>
668 </indexterm>
669 </listitem>
670 </varlistentry>
671
672 <varlistentry id="dnssec-coverage">
673 <term><command>dnssec-coverage</command></term>
674 <listitem>
675 <para>
676 verifies that the DNSSEC keys for a given zone or a set of zones
677 have timing metadata set properly to ensure no future lapses
678 in DNSSEC coverage.
679 </para>
680 <indexterm zone="bind dnssec-coverage">
681 <primary sortas="b-dnssec-coverage">dnssec-coverage</primary>
682 </indexterm>
683 </listitem>
684 </varlistentry>
685
686 <varlistentry id="dnssec-dsfromkey">
687 <term><command>dnssec-dsfromkey</command></term>
688 <listitem>
689 <para>
690 outputs the Delegation Signer (DS) resource record (RR).
691 </para>
692 <indexterm zone="bind dnssec-dsfromkey">
693 <primary sortas="b-dnssec-dsfromkey">dnssec-dsfromkey</primary>
694 </indexterm>
695 </listitem>
696 </varlistentry>
697
698 <varlistentry id="dnssec-importkey">
699 <term><command>dnssec-importkey</command></term>
700 <listitem>
701 <para>
702 reads a public DNSKEY record and generates a pair of
703 .key/.private files.
704 </para>
705 <indexterm zone="bind dnssec-importkey">
706 <primary sortas="b-dnssec-importkey">dnssec-importkey</primary>
707 </indexterm>
708 </listitem>
709 </varlistentry>
710
711 <varlistentry id="dnssec-keyfromlabel">
712 <term><command>dnssec-keyfromlabel</command></term>
713 <listitem>
714 <para>
715 gets keys with the given label from a crypto hardware and builds
716 key files for DNSSEC.
717 </para>
718 <indexterm zone="bind dnssec-keyfromlabel">
719 <primary sortas="b-dnssec-keyfromlabel">dnssec-keyfromlabel</primary>
720 </indexterm>
721 </listitem>
722 </varlistentry>
723
724 <varlistentry id="dnssec-keygen">
725 <term><command>dnssec-keygen</command></term>
726 <listitem>
727 <para>
728 is a key generator for secure DNS.
729 </para>
730 <indexterm zone="bind dnssec-keygen">
731 <primary sortas="b-dnssec-keygen">dnssec-keygen</primary>
732 </indexterm>
733 </listitem>
734 </varlistentry>
735
736 <varlistentry id="dnssec-keymgr">
737 <term><command>dnssec-keymgr</command></term>
738 <listitem>
739 <para>
740 ensures correct DNSKEY coverage based on a defined policy.
741 </para>
742 <indexterm zone="bind dnssec-keymgr">
743 <primary sortas="b-dnssec-keymgr">dnssec-keymgr</primary>
744 </indexterm>
745 </listitem>
746 </varlistentry>
747
748 <varlistentry id="dnssec-revoke">
749 <term><command>dnssec-revoke</command></term>
750 <listitem>
751 <para>
752 sets the REVOKED bit on a DNSSEC key.
753 </para>
754 <indexterm zone="bind dnssec-revoke">
755 <primary sortas="b-dnssec-revoke">dnssec-revoke</primary>
756 </indexterm>
757 </listitem>
758 </varlistentry>
759
760 <varlistentry id="dnssec-settime">
761 <term><command>dnssec-settime</command></term>
762 <listitem>
763 <para>
764 sets the key timing metadata for a DNSSEC key.
765 </para>
766 <indexterm zone="bind dnssec-settime">
767 <primary sortas="b-dnssec-settime">dnssec-settime</primary>
768 </indexterm>
769 </listitem>
770 </varlistentry>
771
772 <varlistentry id="dnssec-signzone">
773 <term><command>dnssec-signzone</command></term>
774 <listitem>
775 <para>
776 generates signed versions of zone files.
777 </para>
778 <indexterm zone="bind dnssec-signzone">
779 <primary sortas="b-dnssec-signzone">dnssec-signzone</primary>
780 </indexterm>
781 </listitem>
782 </varlistentry>
783
784 <varlistentry id="dnssec-verify">
785 <term><command>dnssec-verify</command></term>
786 <listitem>
787 <para>
788 verifies that a zone is fully signed for each algorithm found
789 in the DNSKEY RRset for the zone, and that the NSEC / NSEC3
790 chains are complete.
791 </para>
792 <indexterm zone="bind dnssec-verify">
793 <primary sortas="b-dnssec-verify">dnssec-verify</primary>
794 </indexterm>
795 </listitem>
796 </varlistentry>
797
798<!-- No longer present with 9.16.5
799 <varlistentry id="genrandom">
800 <term><command>genrandom</command></term>
801 <listitem>
802 <para>
803 generates a file containing random data.
804 </para>
805 <indexterm zone="bind genrandom">
806 <primary sortas="b-genrandom">genrandom</primary>
807 </indexterm>
808 </listitem>
809 </varlistentry>
810-->
811
812 <varlistentry id="host">
813 <term><command>host</command></term>
814 <listitem>
815 <para>
816 is a utility for DNS lookups.
817 </para>
818 <indexterm zone="bind host">
819 <primary sortas="b-host">host</primary>
820 </indexterm>
821 </listitem>
822 </varlistentry>
823
824 <!-- No longer present with 9.16.5
825 <varlistentry id="isc-config.sh">
826 <term><command>isc-config.sh</command></term>
827 <listitem>
828 <para>
829 prints information related to the installed version of ISC BIND.
830 </para>
831 <indexterm zone="bind isc-config.sh">
832 <primary sortas="b-isc-config.sh">isc-config.sh</primary>
833 </indexterm>
834 </listitem>
835 </varlistentry>
836
837 <varlistentry id="isc-hmac-fixup">
838 <term><command>isc-hmac-fixup</command></term>
839 <listitem>
840 <para>
841 fixes HMAC keys generated by older versions of BIND.
842 </para>
843 <indexterm zone="bind isc-hmac-fixup">
844 <primary sortas="b-isc-hmac-fixup">isc-hmac-fixup</primary>
845 </indexterm>
846 </listitem>
847 </varlistentry>
848
849 <varlistentry id="lwresd">
850 <term><command>lwresd</command></term>
851 <listitem>
852 <para>
853 is a caching-only name server for local process use.
854 </para>
855 <indexterm zone="bind lwresd">
856 <primary sortas="b-lwresd">lwresd</primary>
857 </indexterm>
858 </listitem>
859 </varlistentry>
860-->
861
862 <varlistentry id="mdig">
863 <term><command>mdig</command></term>
864 <listitem>
865 <para>
866 is a version of dig that allows multiple queries at once.
867 </para>
868 <indexterm zone="bind mdig">
869 <primary sortas="b-mdig">mdig</primary>
870 </indexterm>
871 </listitem>
872 </varlistentry>
873
874 <varlistentry id="named">
875 <term><command>named</command></term>
876 <listitem>
877 <para>
878 is the name server daemon.
879 </para>
880 <indexterm zone="bind named">
881 <primary sortas="b-named">named</primary>
882 </indexterm>
883 </listitem>
884 </varlistentry>
885
886 <varlistentry id="named-checkconf">
887 <term><command>named-checkconf</command></term>
888 <listitem>
889 <para>
890 checks the syntax of <filename>named.conf</filename>
891 files.
892 </para>
893 <indexterm zone="bind named-checkconf">
894 <primary sortas="b-named-checkconf">named-checkconf</primary>
895 </indexterm>
896 </listitem>
897 </varlistentry>
898
899 <varlistentry id="named-checkzone">
900 <term><command>named-checkzone</command></term>
901 <listitem>
902 <para>
903 checks zone file validity.
904 </para>
905 <indexterm zone="bind named-checkzone">
906 <primary sortas="b-named-checkzone">named-checkzone</primary>
907 </indexterm>
908 </listitem>
909 </varlistentry>
910
911 <varlistentry id="named-compilezone">
912 <term><command>named-compilezone</command></term>
913 <listitem>
914 <para>
915 is similar to <command>named-checkzone</command>, but it always
916 dumps the zone contents to a specified file in a specified format.
917 </para>
918 <indexterm zone="bind named-compilezone">
919 <primary sortas="b-named-compilezone">named-compilezone</primary>
920 </indexterm>
921 </listitem>
922 </varlistentry>
923
924 <varlistentry id="named-journalprint">
925 <term><command>named-journalprint</command></term>
926 <listitem>
927 <para>
928 prints the zone journal in human-readable form.
929 </para>
930 <indexterm zone="bind named-journalprint">
931 <primary sortas="b-named-journalprint">named-journalprint</primary>
932 </indexterm>
933 </listitem>
934 </varlistentry>
935
936 <varlistentry id="named-rrchecker">
937 <term><command>named-rrchecker</command></term>
938 <listitem>
939 <para>
940 reads an individual DNS resource record from standard input and
941 checks if it is syntactically correct.
942 </para>
943 <indexterm zone="bind named-rrchecker">
944 <primary sortas="b-named-rrchecker">named-rrchecker</primary>
945 </indexterm>
946 </listitem>
947 </varlistentry>
948
949 <varlistentry id="named-nzd2nzf">
950 <term><command>named-nzd2nzf</command></term>
951 <listitem>
952 <para>
953 converts an NZD database to NZF text format.
954 </para>
955 <indexterm zone="bind named-nzd2nzf">
956 <primary sortas="b-named-nzd2nzf">named-nzd2nzf</primary>
957 </indexterm>
958 </listitem>
959 </varlistentry>
960
961 <varlistentry id="nsec3hash">
962 <term><command>nsec3hash</command></term>
963 <listitem>
964 <para>
965 generates an NSEC3 hash based on a set of NSEC3 parameters.
966 </para>
967 <indexterm zone="bind nsec3hash">
968 <primary sortas="b-nsec3hash">nsec3hash</primary>
969 </indexterm>
970 </listitem>
971 </varlistentry>
972
973 <varlistentry id="nslookup">
974 <term><command>nslookup</command></term>
975 <listitem>
976 <para>
977 is a program used to query Internet domain nameservers.
978 </para>
979 <indexterm zone="bind nslookup">
980 <primary sortas="b-nslookup">nslookup</primary>
981 </indexterm>
982 </listitem>
983 </varlistentry>
984
985 <varlistentry id="nsupdate">
986 <term><command>nsupdate</command></term>
987 <listitem>
988 <para>
989 is used to submit DNS update requests.
990 </para>
991 <indexterm zone="bind nsupdate">
992 <primary sortas="b-nsupdate">nsupdate</primary>
993 </indexterm>
994 </listitem>
995 </varlistentry>
996
997 <varlistentry id="rndc">
998 <term><command>rndc</command></term>
999 <listitem>
1000 <para>
1001 controls the operation of <application>BIND</application>.
1002 </para>
1003 <indexterm zone="bind rndc">
1004 <primary sortas="b-rndc">rndc</primary>
1005 </indexterm>
1006 </listitem>
1007 </varlistentry>
1008
1009 <varlistentry id="rndc-confgen">
1010 <term><command>rndc-confgen</command></term>
1011 <listitem>
1012 <para>
1013 generates <filename>rndc.conf</filename> files.
1014 </para>
1015 <indexterm zone="bind rndc-confgen">
1016 <primary sortas="b-rndc-confgen">rndc-confgen</primary>
1017 </indexterm>
1018 </listitem>
1019 </varlistentry>
1020
1021 <varlistentry id="tsig-keygen">
1022 <term><command>tsig-keygen</command></term>
1023 <listitem>
1024 <para>
1025 is a symlink to <command>ddns-confgen</command>.
1026 </para>
1027 <indexterm zone="bind tsig-keygen">
1028 <primary sortas="b-tsig-keygen">tsig-keygen</primary>
1029 </indexterm>
1030 </listitem>
1031 </varlistentry>
1032
1033 </variablelist>
1034
1035 </sect2>
1036
1037</sect1>
Note: See TracBrowser for help on using the repository browser.