source: server/major/bind.xml@ db8d44a9

trunk
Last change on this file since db8d44a9 was db8d44a9, checked in by Thomas Trepl <thomas@…>, 4 hours ago

Update bind and bind-utils to 9.20.3
  • Property mode set to 100644
File size: 32.9 KB
Line 
1<?xml version="1.0" encoding="UTF-8"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY bind-download-http "https://ftp.isc.org/isc/bind9/&bind-version;/bind-&bind-version;.tar.xz">
8 <!ENTITY bind-download-ftp " ">
9 <!ENTITY bind-md5sum "&bind-md5;">
10 <!ENTITY bind-size "5.4 MB">
11 <!ENTITY bind-buildsize "138 MB (22 MB installed)">
12 <!ENTITY bind-time "0.5 SBU (with parallelism=4; about 40 minutes somewhat processor independent, to run the complete test suite)">
13]>
14
15<sect1 id="bind" xreflabel="BIND-&bind-version;">
16 <?dbhtml filename="bind.html"?>
17
18
19 <title>BIND-&bind-version;</title>
20
21 <indexterm zone="bind">
22 <primary sortas="a-BIND">BIND</primary>
23 </indexterm>
24
25 <sect2 role="package">
26 <title>Introduction to BIND</title>
27
28 <para>
29 The <application>BIND</application> package provides a DNS server
30 and client utilities. If you are only interested in the utilities, refer
31 to the <xref linkend="bind-utils"/>.
32 </para>
33
34 &lfs122_checked;
35
36 <bridgehead renderas="sect3">Package Information</bridgehead>
37 <itemizedlist spacing="compact">
38 <listitem>
39 <para>
40 Download (HTTP): <ulink url="&bind-download-http;"/>
41 </para>
42 </listitem>
43 <listitem>
44 <para>
45 Download (FTP): <ulink url="&bind-download-ftp;"/>
46 </para>
47 </listitem>
48 <listitem>
49 <para>
50 Download MD5 sum: &bind-md5sum;
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download size: &bind-size;
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Estimated disk space required: &bind-buildsize;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Estimated build time: &bind-time;
66 </para>
67 </listitem>
68 </itemizedlist>
69<!--
70 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
71 <itemizedlist spacing="compact">
72 <listitem>
73 <para>
74 Required patch:
75 <ulink url="&patch-root;/bind-&bind-version;-upstream_fixes-1.patch"/>
76 </para>
77 </listitem>
78 </itemizedlist>
79-->
80 <bridgehead renderas="sect3">BIND Dependencies</bridgehead>
81
82 <bridgehead renderas="sect4">Required</bridgehead>
83 <para role="required">
84 <xref linkend="liburcu"/> and
85 <xref linkend="libuv"/>
86 </para>
87
88 <bridgehead renderas="sect4">Recommended</bridgehead>
89 <para role="recommended">
90 <xref linkend="json-c"/>,
91 <xref linkend="libcap-pam"/>, and
92 <xref linkend="nghttp2"/>
93 </para>
94
95 <bridgehead renderas="sect4">Optional</bridgehead>
96 <para role="optional">
97 <xref linkend="curl"/>,
98 <xref linkend="libidn2"/>,
99 <xref linkend="libxml2"/>,
100 <xref linkend="lmdb"/>,
101 <xref linkend="mitkrb"/>,
102 <xref linkend="pytest"/>,
103 <xref linkend="sphinx"/> (required to build documentation),
104 <ulink url="https://cmocka.org/">cmocka</ulink>,
105 <ulink url="https://github.com/cjheath/geoip">geoip</ulink>,
106 <ulink url="https://github.com/jemalloc/jemalloc">jemalloc</ulink>,
107 <ulink url="&w3m-url;">w3m</ulink>
108 </para>
109
110 <bridgehead renderas="sect4">Optional (to run the test suite)</bridgehead>
111 <para role="optional">
112 <xref linkend="perl-net-dns"/>
113 </para>
114
115 <para condition="html" role="usernotes">
116 Editor Notes: <ulink url="&blfs-wiki;/bind"/>
117 </para>
118
119 </sect2>
120
121 <sect2 role="installation">
122 <title>Installation of BIND</title>
123<!-- Its now (Oct'24) about a year ago
124 Btw, if the root file is a bit out of sync, it doesn't break the
125 installation. named queries one of the servers in that list (and
126 is that doesn't work another) to retrieve the actual list and keep
127 it in cache. We do not even be required to create the root.hint
128 as named has a list builtin. As long as at least one of the servers
129 is valid, named will be able to retrieve the actual list (they call
130 it "re-prime") and thus it will be operational.
131 <note>
132 <para>
133 Starting with bind-9.18.20, the IP addresses for B.ROOT-SERVERS.NET
134 have changed.
135 </para>
136 </note>
137-->
138 <para>
139 Install <application>BIND</application> by running the
140 following commands:
141 </para>
142
143<screen><userinput>./configure --prefix=/usr \
144 --sysconfdir=/etc \
145 --localstatedir=/var \
146 --mandir=/usr/share/man \
147 --disable-static &amp;&amp;
148make</userinput></screen>
149
150 <para>
151 Issue the following commands to run the complete suite of tests.
152 First, as the <systemitem class="username">root</systemitem> user, set up
153 some test interfaces:
154 </para>
155
156 <note>
157 <para>
158 If IPv6 is not enabled in the kernel, there will be several
159 error messages: "RTNETLINK answers: Operation not permitted". These
160 messages do not affect the tests.
161 </para>
162 </note>
163
164<screen role="root"
165 remap="test"><userinput>bin/tests/system/ifconfig.sh up</userinput></screen>
166
167 <para>
168 The test suite may indicate some skipped tests depending on
169 what configuration options are used. Some tests are marked
170 <quote>UNTESTED</quote> or do even fail if <xref linkend="perl-net-dns"/>
171 is not installed. One test, <filename>dnssec</filename>, is known to fail.
172 The tests require the
173 <ulink url="https://hypothesis.readthedocs.org/">hypothesis</ulink>
174 python module, which is not in BLFS. To work around this, the instructions
175 below create a Python virtual environment and then install the module
176 in there before running the tests.
177 To run the tests, as an unprivileged user, execute:
178 </para>
179
180<screen remap="test"><userinput>python3 -m venv --system-site-packages testenv &amp;&amp;
181source testenv/bin/activate &amp;&amp;
182pip3 install hypothesis &amp;&amp;
183make -k check &amp;&amp;
184deactivate</userinput></screen>
185
186 <para>
187 Again as <systemitem class="username">root</systemitem>, clean up the
188 test interfaces:
189 </para>
190
191<screen role="root"
192 remap="test"><userinput>bin/tests/system/ifconfig.sh down</userinput></screen>
193
194 <para>
195 Finally, install the package as the <systemitem
196 class="username">root</systemitem> user:
197 </para>
198
199<!-- Documentation is an issue - The docs are now all in .rst format and appear
200to be sphinx based. install source .rst files for now...
201
202leave docs untouched as they does only use disk space when not
203used to recreate the docs via Sphinx. I've added a note regarding
204the documentation. (thomas)
205
206<screen role="root"><userinput>make install &amp;&amp;
207
208install -vdm 755 /usr/share/doc/bind-&bind-version;/{arm,dnssec-guide} &amp;&amp;
209install doc/arm/* /usr/share/doc/bind-&bind-version;/arm &amp;&amp;
210install doc/dnssec-guide/* /usr/share/doc/bind-&bind-version;/dnssec-guide</userinput></screen>
211-->
212<screen role="root"><userinput>make install</userinput></screen>
213
214 </sect2>
215
216 <sect2 role="commands">
217 <title>Command Explanations</title>
218
219 <para>
220 <parameter>--sysconfdir=/etc</parameter>: This parameter forces
221 <application>BIND</application> to look for configuration
222 files in <filename class='directory'>/etc</filename> instead of
223 <filename class='directory'>/usr/etc</filename>.
224 </para>
225
226 <para>
227 <option>--with-libidn2</option>: This parameter enables
228 the IDNA2008 (Internationalized Domain Names in Applications)
229 support.
230 </para>
231
232 <para>
233 <option>--enable-fetchlimit</option>: Use this option if you want
234 to be able to limit the rate of recursive client queries. This may be
235 useful on servers which receive a large number of queries.
236 </para>
237
238<!-- Removed in 9.20.0 (and support has been in LFS for years)
239 <para>
240 <option>- -disable-linux-caps</option>: BIND can also be built without
241 capability support by using this option, at the cost of some loss of
242 security.
243 </para>
244-->
245
246 <para>
247 <option>--disable-doh</option>: Use this option if you do not have
248 <xref linkend="nghttp2" role="nodep"/> installed and do not need support
249 for DNS over HTTPS.
250 </para>
251
252 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
253 href="../../xincludes/static-libraries.xml"/>
254
255 </sect2>
256
257 <sect2 role="configuration">
258 <title>Configuring BIND</title>
259
260 <sect3 id="bind-config">
261 <title>Config files</title>
262
263 <para>
264 <filename>named.conf</filename>,
265 <filename>root.hints</filename>,
266 <filename>127.0.0</filename>,
267 <filename>rndc.conf</filename>, and
268 <filename>resolv.conf</filename>
269 </para>
270
271 <indexterm zone="bind bind-config">
272 <primary sortas="e-etc-named.conf">/etc/named.conf</primary>
273 </indexterm>
274
275 <indexterm zone="bind bind-config">
276 <primary sortas="e-etc-rndc.conf">/etc/rndc.conf</primary>
277 </indexterm>
278
279 <indexterm zone="bind bind-config">
280 <primary sortas="e-etc-resolv.conf">/etc/resolv.conf</primary>
281 </indexterm>
282
283 <indexterm zone="bind bind-config">
284 <primary
285 sortas="e-etc-namedb-root.hints">/etc/namedb/root.hints</primary>
286 </indexterm>
287
288 <indexterm zone="bind bind-config">
289 <primary
290 sortas="e-etc-namedb-pz-127.0.0.0">/etc/namedb/pz/127.0.0.0</primary>
291 </indexterm>
292 </sect3>
293
294 <sect3>
295 <title>Configuration Information</title>
296
297 <para>
298 <application>BIND</application> will be configured to run in a
299 <command>chroot</command> jail as an unprivileged user (<systemitem
300 class="username">named</systemitem>). This configuration is more secure
301 in that a DNS compromise can only affect a few files in the <systemitem
302 class="username">named</systemitem> user's <envar>HOME</envar>
303 directory.
304 </para>
305
306 <para>
307 Create the unprivileged user and group <systemitem
308 class="username">named</systemitem>:
309 </para>
310
311<screen role="root"><userinput>groupadd -g 20 named &amp;&amp;
312useradd -c "BIND Owner" -g named -s /bin/false -u 20 named &amp;&amp;
313install -d -m770 -o named -g named /srv/named</userinput></screen>
314
315 <para>
316 Set up some files, directories and devices needed by
317 <application>BIND</application>:
318 </para>
319
320<screen role="root"><userinput>mkdir -p /srv/named &amp;&amp;
321cd /srv/named &amp;&amp;
322mkdir -p dev etc/named/{slave,pz} usr/lib/engines var/run/named &amp;&amp;
323mknod /srv/named/dev/null c 1 3 &amp;&amp;
324mknod /srv/named/dev/urandom c 1 9 &amp;&amp;
325chmod 666 /srv/named/dev/{null,urandom} &amp;&amp;
326cp /etc/localtime etc</userinput></screen>
327
328 <para>
329 The <filename>rndc.conf</filename> file contains information for
330 controlling <command>named</command> operations with the
331 <command>rndc</command> utility. Generate a key for use in the
332 <filename>named.conf</filename> and <filename>rndc.conf</filename>
333 with the <command>rndc-confgen</command> command:
334 </para>
335
336<screen role="root"><userinput>rndc-confgen -a -b 512 -t /srv/named</userinput></screen>
337
338 <para>
339 Create the <filename>named.conf</filename> file from which
340 <command>named</command> will read the location of zone files, root
341 name servers and secure DNS keys:
342 </para>
343
344<screen role="root"><?dbfo keep-together="auto"?><userinput>cat &gt;&gt; /srv/named/etc/named.conf &lt;&lt; "EOF"
345<literal>options {
346 directory "/etc/named";
347 pid-file "/var/run/named.pid";
348 statistics-file "/var/run/named.stats";
349
350};
351zone "." {
352 type hint;
353 file "root.hints";
354};
355zone "0.0.127.in-addr.arpa" {
356 type master;
357 file "pz/127.0.0";
358};
359
360// Bind 9 now logs by default through syslog (except debug).
361// These are the default logging rules.
362
363logging {
364 category default { default_syslog; default_debug; };
365 category unmatched { null; };
366
367 channel default_syslog {
368 syslog daemon; // send to syslog's daemon
369 // facility
370 severity info; // only send priority info
371 // and higher
372 };
373
374 channel default_debug {
375 file "named.run"; // write to named.run in
376 // the working directory
377 // Note: stderr is used instead
378 // of "named.run"
379 // if the server is started
380 // with the '-f' option.
381 severity dynamic; // log at the server's
382 // current debug level
383 };
384
385 channel default_stderr {
386 stderr; // writes to stderr
387 severity info; // only send priority info
388 // and higher
389 };
390
391 channel null {
392 null; // toss anything sent to
393 // this channel
394 };
395};</literal>
396EOF</userinput></screen>
397
398 <para>
399 Create a zone file with the following contents:
400 </para>
401
402<screen role="root"><userinput>cat &gt; /srv/named/etc/named/pz/127.0.0 &lt;&lt; "EOF"
403<literal>$TTL 3D
404@ IN SOA ns.local.domain. hostmaster.local.domain. (
405 1 ; Serial
406 8H ; Refresh
407 2H ; Retry
408 4W ; Expire
409 1D) ; Minimum TTL
410 NS ns.local.domain.
4111 PTR localhost.</literal>
412EOF</userinput></screen>
413
414 <para>
415 Create the <filename>root.hints</filename> file with the following
416 commands:
417 </para>
418
419 <note>
420 <para>
421 Caution must be used to ensure there are no leading spaces in
422 this file.
423 </para>
424 </note>
425
426<screen role="root"><userinput>cat &gt; /srv/named/etc/named/root.hints &lt;&lt; "EOF"
427<literal>. 6D IN NS A.ROOT-SERVERS.NET.
428. 6D IN NS B.ROOT-SERVERS.NET.
429. 6D IN NS C.ROOT-SERVERS.NET.
430. 6D IN NS D.ROOT-SERVERS.NET.
431. 6D IN NS E.ROOT-SERVERS.NET.
432. 6D IN NS F.ROOT-SERVERS.NET.
433. 6D IN NS G.ROOT-SERVERS.NET.
434. 6D IN NS H.ROOT-SERVERS.NET.
435. 6D IN NS I.ROOT-SERVERS.NET.
436. 6D IN NS J.ROOT-SERVERS.NET.
437. 6D IN NS K.ROOT-SERVERS.NET.
438. 6D IN NS L.ROOT-SERVERS.NET.
439. 6D IN NS M.ROOT-SERVERS.NET.
440A.ROOT-SERVERS.NET. 6D IN A 198.41.0.4
441A.ROOT-SERVERS.NET. 6D IN AAAA 2001:503:ba3e::2:30
442B.ROOT-SERVERS.NET. 6D IN A 170.247.170.2
443B.ROOT-SERVERS.NET. 6D IN AAAA 2801:1b8:10::b
444C.ROOT-SERVERS.NET. 6D IN A 192.33.4.12
445C.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:2::c
446D.ROOT-SERVERS.NET. 6D IN A 199.7.91.13
447D.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:2d::d
448E.ROOT-SERVERS.NET. 6D IN A 192.203.230.10
449E.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:a8::e
450F.ROOT-SERVERS.NET. 6D IN A 192.5.5.241
451F.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:2f::f
452G.ROOT-SERVERS.NET. 6D IN A 192.112.36.4
453G.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:12::d0d
454H.ROOT-SERVERS.NET. 6D IN A 198.97.190.53
455H.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:1::53
456I.ROOT-SERVERS.NET. 6D IN A 192.36.148.17
457I.ROOT-SERVERS.NET. 6D IN AAAA 2001:7fe::53
458J.ROOT-SERVERS.NET. 6D IN A 192.58.128.30
459J.ROOT-SERVERS.NET. 6D IN AAAA 2001:503:c27::2:30
460K.ROOT-SERVERS.NET. 6D IN A 193.0.14.129
461K.ROOT-SERVERS.NET. 6D IN AAAA 2001:7fd::1
462L.ROOT-SERVERS.NET. 6D IN A 199.7.83.42
463L.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:9f::42
464M.ROOT-SERVERS.NET. 6D IN A 202.12.27.33
465M.ROOT-SERVERS.NET. 6D IN AAAA 2001:dc3::35</literal>
466EOF</userinput></screen>
467
468 <para>
469 The <filename>root.hints</filename> file is a list of root name
470 servers. This file must be updated periodically with the
471 <command>dig</command> utility. A current copy of root.hints can be
472 obtained from <ulink url="https://www.internic.net/domain/named.root"/>.
473 For details, consult the "BIND 9 Administrator Reference Manual".
474 </para>
475
476 <para>
477 Create or modify <filename>resolv.conf</filename> to use the new
478 name server with the following commands:
479 </para>
480
481 <note>
482 <para>
483 Replace <replaceable>&lt;yourdomain.com&gt;</replaceable> with
484 your own valid domain name.
485 </para>
486 </note>
487
488<screen role="root"><userinput>cp /etc/resolv.conf /etc/resolv.conf.bak &amp;&amp;
489cat &gt; /etc/resolv.conf &lt;&lt; "EOF"
490<literal>search <replaceable>&lt;yourdomain.com&gt;</replaceable>
491nameserver 127.0.0.1</literal>
492EOF</userinput></screen>
493
494 <para>
495 Set permissions on the <command>chroot</command> jail with the
496 following command:
497 </para>
498
499<screen role="root"><userinput>chown -R named:named /srv/named</userinput></screen>
500
501 </sect3>
502
503 <sect3 id="bind-init">
504 <title><phrase revision="sysv">Boot Script</phrase>
505 <phrase revision="systemd">Systemd Unit</phrase></title>
506
507 <para>
508 To start the DNS server at boot, install the
509 <phrase revision="sysv"><filename>/etc/rc.d/init.d/bind</filename> init
510 script</phrase>
511 <phrase revision="systemd"><filename>named.service</filename>
512 unit</phrase> included in the
513 <xref linkend="bootscripts" revision="sysv"/>
514 <xref linkend="systemd-units" revision="systemd"/> package:
515 </para>
516
517 <indexterm zone="bind bind-init">
518 <primary sortas="f-bind">bind</primary>
519 </indexterm>
520
521<screen role="root" revision="sysv"><userinput>make install-bind</userinput></screen>
522<screen role="root" revision="systemd"><userinput>make install-named</userinput></screen>
523
524 <para>
525 Now start <application>BIND</application> with the following command:
526 </para>
527
528<screen role="root" revision="sysv"><userinput>/etc/rc.d/init.d/bind start</userinput></screen>
529<screen role="root" revision="systemd"><userinput>systemctl start named</userinput></screen>
530
531 </sect3>
532
533 <sect3>
534 <title>Testing BIND</title>
535
536 <para>
537 Test out the new <application>BIND</application> 9 installation.
538 First query the local host address with <command>dig</command>:
539 </para>
540
541<screen><userinput>dig -x 127.0.0.1</userinput></screen>
542
543 <para>
544 Now try an external name lookup, taking note of the speed
545 difference in repeated lookups due to the caching. Run the
546 <command>dig</command> command twice on the same address:
547 </para>
548
549<screen><userinput>dig www.&lfs-domainname; &amp;&amp;
550dig www.&lfs-domainname;</userinput></screen>
551
552 <para>
553 You can see almost instantaneous results with the named caching
554 lookups. Consult the <application>BIND</application> Administrator
555 Reference Manual (see below) for further configuration options.
556 </para>
557
558 </sect3>
559
560 </sect2>
561
562 <sect2>
563 <title>Administrator Reference Manual (ARM)</title>
564
565 <para>
566 The ARM documentation (do not confuse with the processor architecture)
567 is included in the source package. The documentation is in .rst
568 format which means that it can be converted in human readable formats
569 if <xref linkend="sphinx"/> is installed.
570 </para>
571
572 <para>
573 When <application>BIND</application> is set up, especially if it is going
574 to be operating in a real live scenario, it is <emphasis>highly</emphasis>
575 recommended to consult the ARM documentation. ISC provides an
576 updated set of excellent documentation along with every release
577 so it can be easily viewed and/or downloaded &ndash; so there is
578 no excuse to not read the docs. The formats ISC provides are epub
579 and html at <ulink url="https://downloads.isc.org/isc/bind9/&bind-version;/doc/arm/"/>.
580 </para>
581 </sect2>
582
583 <sect2 role="content">
584 <title>Contents</title>
585
586 <segmentedlist>
587 <segtitle>Installed Programs</segtitle>
588 <segtitle>Installed Libraries</segtitle>
589 <segtitle>Installed Directories</segtitle>
590
591 <seglistitem>
592
593 <seg>arpaname, ddns-confgen, delv, dig, dnssec-cds,
594 dnssec-dsfromkey, dnssec-importkey, dnssec-keyfromlabel, dnssec-keygen,
595 dnssec-ksr, dnssec-revoke, dnssec-settime, dnssec-signzone,
596 dnssec-verify, host, mdig, named, named-checkconf,
597 named-checkzone, named-compilezone, named-journalprint,
598 named-nzd2nzf, named-rrchecker, nsec3hash, nslookup, nsupdate, rndc,
599 rndc-confgen, and tsig-keygen (symlink)</seg>
600
601 <seg>libdns.so, libisc.so, libisccc.so, libisccfg.so, and libns.so</seg>
602
603 <seg>/usr/include/{dns,dst,irs,isc,isccc,isccfg,ns},
604 /usr/lib/bind,
605 and /srv/named</seg>
606 </seglistitem>
607 </segmentedlist>
608
609 <variablelist>
610 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
611 <?dbfo list-presentation="list"?>
612 <?dbhtml list-presentation="table"?>
613
614 <varlistentry id="arpaname">
615 <term><command>arpaname</command></term>
616 <listitem>
617 <para>
618 translates IP addresses to the corresponding ARPA names
619 </para>
620 <indexterm zone="bind arpaname">
621 <primary sortas="b-arpaname">arpaname</primary>
622 </indexterm>
623 </listitem>
624 </varlistentry>
625
626 <varlistentry id="ddns-confgen">
627 <term><command>ddns-confgen</command></term>
628 <listitem>
629 <para>
630 generates a key for use by nsupdate and named
631 </para>
632 <indexterm zone="bind ddns-confgen">
633 <primary sortas="b-ddns-confgen">ddns-confgen</primary>
634 </indexterm>
635 </listitem>
636 </varlistentry>
637
638 <varlistentry id="delv">
639 <term><command>delv</command></term>
640 <listitem>
641 <para>
642 is a new debugging tool that is a successor to
643 <command>dig</command>
644 </para>
645 <indexterm zone="bind delv">
646 <primary sortas="b-delv">delv</primary>
647 </indexterm>
648 </listitem>
649 </varlistentry>
650
651 <varlistentry id="dig">
652 <term><command>dig</command></term>
653 <listitem>
654 <para>
655 interrogates DNS servers
656 </para>
657 <indexterm zone="bind dig">
658 <primary sortas="b-dig">dig</primary>
659 </indexterm>
660 </listitem>
661 </varlistentry>
662
663 <varlistentry id="dnssec-cds">
664 <term><command>dnssec-cds</command></term>
665 <listitem>
666 <para>
667 changes DS records for a child zone based on
668 CDS/CDNSKEY
669 </para>
670 <indexterm zone="bind dnssec-cds">
671 <primary sortas="b-dnssec-cds">dnssec-cds</primary>
672 </indexterm>
673 </listitem>
674 </varlistentry>
675
676 <varlistentry id="dnssec-dsfromkey">
677 <term><command>dnssec-dsfromkey</command></term>
678 <listitem>
679 <para>
680 outputs the Delegation Signer (DS) resource record (RR)
681 </para>
682 <indexterm zone="bind dnssec-dsfromkey">
683 <primary sortas="b-dnssec-dsfromkey">dnssec-dsfromkey</primary>
684 </indexterm>
685 </listitem>
686 </varlistentry>
687
688 <varlistentry id="dnssec-importkey">
689 <term><command>dnssec-importkey</command></term>
690 <listitem>
691 <para>
692 reads a public DNSKEY record and generates a pair of
693 .key/.private files
694 </para>
695 <indexterm zone="bind dnssec-importkey">
696 <primary sortas="b-dnssec-importkey">dnssec-importkey</primary>
697 </indexterm>
698 </listitem>
699 </varlistentry>
700
701 <varlistentry id="dnssec-keyfromlabel">
702 <term><command>dnssec-keyfromlabel</command></term>
703 <listitem>
704 <para>
705 gets keys with the given label from a cryptography hardware device
706 and builds key files for DNSSEC
707 </para>
708 <indexterm zone="bind dnssec-keyfromlabel">
709 <primary sortas="b-dnssec-keyfromlabel">dnssec-keyfromlabel</primary>
710 </indexterm>
711 </listitem>
712 </varlistentry>
713
714 <varlistentry id="dnssec-keymgr">
715 <term><command>dnssec-keymgr</command></term>
716 <listitem>
717 <para>
718 ensures correct DNSKEY coverage based on a defined policy
719 </para>
720 <indexterm zone="bind dnssec-keymgr">
721 <primary sortas="b-dnssec-keymgr">dnssec-keymgr</primary>
722 </indexterm>
723 </listitem>
724 </varlistentry>
725
726 <varlistentry id="dnssec-ksr">
727 <term><command>dnssec-ksr</command></term>
728 <listitem>
729 <para>
730 creates signed key response (SKR) files for offline KSK setups
731 </para>
732 <indexterm zone="bind dnssec-ksr">
733 <primary sortas="b-dnssec-ksr">dnssec-ksr</primary>
734 </indexterm>
735 </listitem>
736 </varlistentry>
737
738 <varlistentry id="dnssec-revoke">
739 <term><command>dnssec-revoke</command></term>
740 <listitem>
741 <para>
742 sets the REVOKED bit on a DNSSEC key
743 </para>
744 <indexterm zone="bind dnssec-revoke">
745 <primary sortas="b-dnssec-revoke">dnssec-revoke</primary>
746 </indexterm>
747 </listitem>
748 </varlistentry>
749
750 <varlistentry id="dnssec-settime">
751 <term><command>dnssec-settime</command></term>
752 <listitem>
753 <para>
754 sets the key timing metadata for a DNSSEC key
755 </para>
756 <indexterm zone="bind dnssec-settime">
757 <primary sortas="b-dnssec-settime">dnssec-settime</primary>
758 </indexterm>
759 </listitem>
760 </varlistentry>
761
762 <varlistentry id="dnssec-signzone">
763 <term><command>dnssec-signzone</command></term>
764 <listitem>
765 <para>
766 generates signed versions of zone files
767 </para>
768 <indexterm zone="bind dnssec-signzone">
769 <primary sortas="b-dnssec-signzone">dnssec-signzone</primary>
770 </indexterm>
771 </listitem>
772 </varlistentry>
773
774 <varlistentry id="dnssec-verify">
775 <term><command>dnssec-verify</command></term>
776 <listitem>
777 <para>
778 verifies that a zone is fully signed for each algorithm found
779 in the DNSKEY RRset for the zone, and that the NSEC / NSEC3
780 chains are complete
781 </para>
782 <indexterm zone="bind dnssec-verify">
783 <primary sortas="b-dnssec-verify">dnssec-verify</primary>
784 </indexterm>
785 </listitem>
786 </varlistentry>
787
788 <varlistentry id="host">
789 <term><command>host</command></term>
790 <listitem>
791 <para>
792 is a utility for DNS lookups
793 </para>
794 <indexterm zone="bind host">
795 <primary sortas="b-host">host</primary>
796 </indexterm>
797 </listitem>
798 </varlistentry>
799
800 <varlistentry id="mdig">
801 <term><command>mdig</command></term>
802 <listitem>
803 <para>
804 is a version of dig that allows multiple queries at once
805 </para>
806 <indexterm zone="bind mdig">
807 <primary sortas="b-mdig">mdig</primary>
808 </indexterm>
809 </listitem>
810 </varlistentry>
811
812 <varlistentry id="named">
813 <term><command>named</command></term>
814 <listitem>
815 <para>
816 is the name server daemon
817 </para>
818 <indexterm zone="bind named">
819 <primary sortas="b-named">named</primary>
820 </indexterm>
821 </listitem>
822 </varlistentry>
823
824 <varlistentry id="named-checkconf">
825 <term><command>named-checkconf</command></term>
826 <listitem>
827 <para>
828 checks the syntax of <filename>named.conf</filename>
829 files
830 </para>
831 <indexterm zone="bind named-checkconf">
832 <primary sortas="b-named-checkconf">named-checkconf</primary>
833 </indexterm>
834 </listitem>
835 </varlistentry>
836
837 <varlistentry id="named-checkzone">
838 <term><command>named-checkzone</command></term>
839 <listitem>
840 <para>
841 checks zone file validity
842 </para>
843 <indexterm zone="bind named-checkzone">
844 <primary sortas="b-named-checkzone">named-checkzone</primary>
845 </indexterm>
846 </listitem>
847 </varlistentry>
848
849 <varlistentry id="named-compilezone">
850 <term><command>named-compilezone</command></term>
851 <listitem>
852 <para>
853 is similar to <command>named-checkzone</command>, but it always
854 dumps the zone contents to a specified file in a specified format
855 </para>
856 <indexterm zone="bind named-compilezone">
857 <primary sortas="b-named-compilezone">named-compilezone</primary>
858 </indexterm>
859 </listitem>
860 </varlistentry>
861
862 <varlistentry id="named-journalprint">
863 <term><command>named-journalprint</command></term>
864 <listitem>
865 <para>
866 prints the zone journal in human-readable form
867 </para>
868 <indexterm zone="bind named-journalprint">
869 <primary sortas="b-named-journalprint">named-journalprint</primary>
870 </indexterm>
871 </listitem>
872 </varlistentry>
873
874 <varlistentry id="named-rrchecker">
875 <term><command>named-rrchecker</command></term>
876 <listitem>
877 <para>
878 reads an individual DNS resource record from standard input and
879 checks if it is syntactically correct
880 </para>
881 <indexterm zone="bind named-rrchecker">
882 <primary sortas="b-named-rrchecker">named-rrchecker</primary>
883 </indexterm>
884 </listitem>
885 </varlistentry>
886
887 <varlistentry id="named-nzd2nzf">
888 <term><command>named-nzd2nzf</command></term>
889 <listitem>
890 <para>
891 converts an NZD database to NZF text format
892 </para>
893 <indexterm zone="bind named-nzd2nzf">
894 <primary sortas="b-named-nzd2nzf">named-nzd2nzf</primary>
895 </indexterm>
896 </listitem>
897 </varlistentry>
898
899 <varlistentry id="nsec3hash">
900 <term><command>nsec3hash</command></term>
901 <listitem>
902 <para>
903 generates an NSEC3 hash based on a set of NSEC3 parameters
904 </para>
905 <indexterm zone="bind nsec3hash">
906 <primary sortas="b-nsec3hash">nsec3hash</primary>
907 </indexterm>
908 </listitem>
909 </varlistentry>
910
911 <varlistentry id="nslookup">
912 <term><command>nslookup</command></term>
913 <listitem>
914 <para>
915 is a program used to query Internet domain nameservers
916 </para>
917 <indexterm zone="bind nslookup">
918 <primary sortas="b-nslookup">nslookup</primary>
919 </indexterm>
920 </listitem>
921 </varlistentry>
922
923 <varlistentry id="nsupdate">
924 <term><command>nsupdate</command></term>
925 <listitem>
926 <para>
927 is used to submit DNS update requests
928 </para>
929 <indexterm zone="bind nsupdate">
930 <primary sortas="b-nsupdate">nsupdate</primary>
931 </indexterm>
932 </listitem>
933 </varlistentry>
934
935 <varlistentry id="rndc">
936 <term><command>rndc</command></term>
937 <listitem>
938 <para>
939 controls the operation of <application>BIND</application>
940 </para>
941 <indexterm zone="bind rndc">
942 <primary sortas="b-rndc">rndc</primary>
943 </indexterm>
944 </listitem>
945 </varlistentry>
946
947 <varlistentry id="rndc-confgen">
948 <term><command>rndc-confgen</command></term>
949 <listitem>
950 <para>
951 generates <filename>rndc.conf</filename> files
952 </para>
953 <indexterm zone="bind rndc-confgen">
954 <primary sortas="b-rndc-confgen">rndc-confgen</primary>
955 </indexterm>
956 </listitem>
957 </varlistentry>
958
959 <varlistentry id="tsig-keygen">
960 <term><command>tsig-keygen</command></term>
961 <listitem>
962 <para>
963 is a symlink to <command>ddns-confgen</command>
964 </para>
965 <indexterm zone="bind tsig-keygen">
966 <primary sortas="b-tsig-keygen">tsig-keygen</primary>
967 </indexterm>
968 </listitem>
969 </varlistentry>
970
971 </variablelist>
972
973 </sect2>
974
975</sect1>
Note: See TracBrowser for help on using the repository browser.