source: server/major/bind.xml@ f40d447

12.0 12.1 kea ken/TL2024 ken/tuningfonts lazarus lxqt plabs/newcss python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition trunk xry111/llvm18 xry111/xf86-video-removal
Last change on this file since f40d447 was f40d447, checked in by Bruce Dubbs <bdubbs@…>, 14 months ago

Update to bind9 and bind 9.18.14.
  • Property mode set to 100644
File size: 36.0 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY bind-download-http "https://ftp.isc.org/isc/bind9/&bind-version;/bind-&bind-version;.tar.xz">
8 <!ENTITY bind-download-ftp "ftp://ftp.isc.org/isc/bind9/&bind-version;/bind-&bind-version;.tar.xz">
9 <!ENTITY bind-md5sum "&bind-md5;">
10 <!ENTITY bind-size "5.2 MB">
11 <!ENTITY bind-buildsize "143 MB (26 MB installed)"><!-- differs much from prev maybe because of docs? -->
12 <!ENTITY bind-time "0.4 SBU (with parallelism=4; about 40 minutes somewhat processor independent, to run the complete test suite)">
13]>
14
15<sect1 id="bind" xreflabel="BIND-&bind-version;">
16 <?dbhtml filename="bind.html"?>
17
18
19 <title>BIND-&bind-version;</title>
20
21 <indexterm zone="bind">
22 <primary sortas="a-BIND">BIND</primary>
23 </indexterm>
24
25 <sect2 role="package">
26 <title>Introduction to BIND</title>
27
28 <para>
29 The <application>BIND</application> package provides a DNS server
30 and client utilities. If you are only interested in the utilities, refer
31 to the <xref linkend="bind-utils"/>.
32 </para>
33
34 &lfs113_checked;
35
36 <bridgehead renderas="sect3">Package Information</bridgehead>
37 <itemizedlist spacing="compact">
38 <listitem>
39 <para>
40 Download (HTTP): <ulink url="&bind-download-http;"/>
41 </para>
42 </listitem>
43 <listitem>
44 <para>
45 Download (FTP): <ulink url="&bind-download-ftp;"/>
46 </para>
47 </listitem>
48 <listitem>
49 <para>
50 Download MD5 sum: &bind-md5sum;
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download size: &bind-size;
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Estimated disk space required: &bind-buildsize;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Estimated build time: &bind-time;
66 </para>
67 </listitem>
68 </itemizedlist>
69<!--
70 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
71 <itemizedlist spacing="compact">
72 <listitem>
73 <para>
74 Required patch:
75 <ulink url="&patch-root;/bind-&bind-version;-upstream_fixes-1.patch"/>
76 </para>
77 </listitem>
78 </itemizedlist>
79-->
80 <bridgehead renderas="sect3">BIND Dependencies</bridgehead>
81
82 <bridgehead renderas="sect4">Required</bridgehead>
83 <para role="required">
84 <xref linkend="libuv"/>
85 </para>
86
87 <bridgehead renderas="sect4">Recommended</bridgehead>
88 <para role="recommended">
89 <xref linkend="json-c"/> and
90 <xref linkend="libcap-pam"/>
91 </para>
92
93 <bridgehead renderas="sect4">Optional</bridgehead>
94 <para role="optional">
95 <xref linkend="curl"/>,
96 <xref linkend="libidn2"/>,
97 <xref linkend="libxml2"/>,
98 <xref linkend="lmdb"/>,
99 <xref linkend="mitkrb"/>,
100 <xref linkend="pytest"/>,
101 <xref linkend="sphinx"/> (required to build documentation),
102 <ulink url="https://cmocka.org/">cmocka</ulink>,
103 <ulink url="https://github.com/cjheath/geoip">geoip</ulink>,
104 <ulink url="https://github.com/jemalloc/jemalloc">jemalloc</ulink>,
105 <ulink url="&w3m-url;">w3m</ulink>
106 </para>
107
108 <bridgehead renderas="sect4">Optional database backends</bridgehead>
109 <para role="optional">
110 <xref linkend="db"/>,
111 <xref linkend="mariadb"/> or <ulink url="https://www.mysql.com/">MySQL</ulink>,
112 <xref linkend="openldap"/>,
113 <xref linkend="postgresql"/>, and
114 <xref linkend="unixodbc"/>
115 </para>
116
117 <bridgehead renderas="sect4">Optional (to run the test suite)</bridgehead>
118 <para role="optional">
119 <xref linkend="perl-net-dns"/>
120 </para>
121
122<!-- docs are now all sphinx based
123 <bridgehead renderas="sect4">Optional (to rebuild the documentation)</bridgehead>
124 <para role="optional">
125 <xref linkend="doxygen"/>,
126 <xref linkend="libxslt"/>, and
127 <xref linkend="texlive"/> (or <xref linkend="tl-installer"/>)
128 </para>
129-->
130
131 <para condition="html" role="usernotes">User Notes:
132 <ulink url="&blfs-wiki;/bind"/></para>
133
134 </sect2>
135
136 <sect2 role="installation">
137 <title>Installation of BIND</title>
138
139<!--
140 <para>
141 To ensure <application>BIND</application> will build dnssec-keymgr,
142 install a python module as the <systemitem
143 class="username">root</systemitem> user:
144 </para>
145
146<screen role="root"><userinput>pip3 install ply</userinput></screen>
147-->
148
149 <para>
150 Install <application>BIND</application> by running the
151 following commands:
152 </para>
153
154<screen><userinput>./configure --prefix=/usr \
155 --sysconfdir=/etc \
156 --localstatedir=/var \
157 --mandir=/usr/share/man \
158 --disable-static &amp;&amp;
159make</userinput></screen>
160
161 <para>
162 Issue the following commands to run the complete suite of tests.
163 First, as the <systemitem class="username">root</systemitem> user, set up
164 some test interfaces:
165 </para>
166
167 <note>
168 <para>
169 If IPv6 is not enabled in the kernel, there will be several
170 error messages: "RTNETLINK answers: Operation not permitted". These
171 messages do not affect the tests.
172 </para>
173 </note>
174
175<screen role="root"
176 remap="test"><userinput>bin/tests/system/ifconfig.sh up</userinput></screen>
177
178 <para>
179 The test suite may indicate some skipped tests depending on
180 what configuration options are used. Some tests are marked
181 <quote>UNTESTED</quote> or do even fail if <xref linkend="perl-net-dns"/>
182 is not installed. <!--One test, <quote>CPU</quote>, is known to fail.-->
183 To run the tests, as an unprivileged user, execute:
184 </para>
185
186<screen remap="test"><userinput>make -k check</userinput></screen>
187
188 <para>
189 Again as <systemitem class="username">root</systemitem>, clean up the
190 test interfaces:
191 </para>
192
193<screen role="root"
194 remap="test"><userinput>bin/tests/system/ifconfig.sh down</userinput></screen>
195
196 <para>
197 Finally, install the package as the <systemitem
198 class="username">root</systemitem> user:
199 </para>
200
201<!-- Documentation is an issue - The docs are now all in .rst format and appear
202to be sphinx based. install source .rst files for now...
203
204leave docs untouched as they does only use disk space when not
205used to recreate the docs via Sphinx. I've added a note regarding
206the documentation. (thomas)
207
208<screen role="root"><userinput>make install &amp;&amp;
209
210install -vdm 755 /usr/share/doc/bind-&bind-version;/{arm,dnssec-guide} &amp;&amp;
211install doc/arm/* /usr/share/doc/bind-&bind-version;/arm &amp;&amp;
212install doc/dnssec-guide/* /usr/share/doc/bind-&bind-version;/dnssec-guide</userinput></screen>
213-->
214<screen role="root"><userinput>make install</userinput></screen>
215
216 </sect2>
217
218 <sect2 role="commands">
219 <title>Command Explanations</title>
220
221 <para>
222 <parameter>--sysconfdir=/etc</parameter>: This parameter forces
223 <application>BIND</application> to look for configuration
224 files in <filename class='directory'>/etc</filename> instead of
225 <filename class='directory'>/usr/etc</filename>.
226 </para>
227
228 <!-- Seems to be removed in 9.18.0
229 <para>
230 <parameter>- -with-libtool</parameter>: This parameter forces the
231 building of dynamic libraries and links the installed binaries to these
232 libraries.
233 </para>
234 -->
235
236 <para>
237 <option>--with-libidn2</option>: This parameter enables
238 the IDNA2008 (Internationalized Domain Names in Applications)
239 support.
240 </para>
241
242 <para>
243 <option>--enable-fetchlimit</option>: Use this option if you want
244 to be able to limit the rate of recursive client queries. This may be
245 useful on servers which receive a large number of queries.
246 </para>
247
248 <para>
249 <option>--disable-linux-caps</option>: BIND can also be built without
250 capability support by using this option, at the cost of some loss of
251 security.
252 </para>
253
254 <para>
255 <option>--with-dlz-{mysql,bdb,filesystem,ldap,odbc,stub}</option>: Use
256 one (or more) of those options to add Dynamically Loadable Zones support.
257 For more information refer to <ulink
258 url="https://bind-dlz.sourceforge.net/">bind-dlz.sourceforge.net</ulink>.
259 </para>
260
261 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
262 href="../../xincludes/static-libraries.xml"/>
263
264 </sect2>
265
266 <sect2 role="configuration">
267 <title>Configuring BIND</title>
268
269 <sect3 id="bind-config">
270 <title>Config files</title>
271
272 <para>
273 <filename>named.conf</filename>,
274 <filename>root.hints</filename>,
275 <filename>127.0.0</filename>,
276 <filename>rndc.conf</filename>, and
277 <filename>resolv.conf</filename>
278 </para>
279
280 <indexterm zone="bind bind-config">
281 <primary sortas="e-etc-named.conf">/etc/named.conf</primary>
282 </indexterm>
283
284 <indexterm zone="bind bind-config">
285 <primary sortas="e-etc-rndc.conf">/etc/rndc.conf</primary>
286 </indexterm>
287
288 <indexterm zone="bind bind-config">
289 <primary sortas="e-etc-resolv.conf">/etc/resolv.conf</primary>
290 </indexterm>
291
292 <indexterm zone="bind bind-config">
293 <primary
294 sortas="e-etc-namedb-root.hints">/etc/namedb/root.hints</primary>
295 </indexterm>
296
297 <indexterm zone="bind bind-config">
298 <primary
299 sortas="e-etc-namedb-pz-127.0.0.0">/etc/namedb/pz/127.0.0.0</primary>
300 </indexterm>
301 </sect3>
302
303 <sect3>
304 <title>Configuration Information</title>
305
306 <para>
307 <application>BIND</application> will be configured to run in a
308 <command>chroot</command> jail as an unprivileged user (<systemitem
309 class="username">named</systemitem>). This configuration is more secure
310 in that a DNS compromise can only affect a few files in the <systemitem
311 class="username">named</systemitem> user's <envar>HOME</envar>
312 directory.
313 </para>
314
315 <para>
316 Create the unprivileged user and group <systemitem
317 class="username">named</systemitem>:
318 </para>
319
320<screen role="root"><userinput>groupadd -g 20 named &amp;&amp;
321useradd -c "BIND Owner" -g named -s /bin/false -u 20 named &amp;&amp;
322install -d -m770 -o named -g named /srv/named</userinput></screen>
323
324 <para>
325 Set up some files, directories and devices needed by
326 <application>BIND</application>:
327 </para>
328
329<screen role="root"><userinput>mkdir -p /srv/named &amp;&amp;
330cd /srv/named &amp;&amp;
331mkdir -p dev etc/named/{slave,pz} usr/lib/engines var/run/named &amp;&amp;
332mknod /srv/named/dev/null c 1 3 &amp;&amp;
333mknod /srv/named/dev/urandom c 1 9 &amp;&amp;
334chmod 666 /srv/named/dev/{null,urandom} &amp;&amp;
335cp /etc/localtime etc</userinput></screen>
336
337 <para>
338 The <filename>rndc.conf</filename> file contains information for
339 controlling <command>named</command> operations with the
340 <command>rndc</command> utility. Generate a key for use in the
341 <filename>named.conf</filename> and <filename>rndc.conf</filename>
342 with the <command>rndc-confgen</command> command:
343 </para>
344
345<screen role="root"><userinput>rndc-confgen -a -b 512 -t /srv/named</userinput></screen>
346
347 <para>
348 Complete the <filename>named.conf</filename> file from which
349 <command>named</command> will read the location of zone files, root
350 name servers and secure DNS keys:
351 </para>
352
353<screen role="root"><?dbfo keep-together="auto"?><userinput>cat &gt;&gt; /srv/named/etc/named.conf &lt;&lt; "EOF"
354<literal>options {
355 directory "/etc/named";
356 pid-file "/var/run/named.pid";
357 statistics-file "/var/run/named.stats";
358
359};
360zone "." {
361 type hint;
362 file "root.hints";
363};
364zone "0.0.127.in-addr.arpa" {
365 type master;
366 file "pz/127.0.0";
367};
368
369// Bind 9 now logs by default through syslog (except debug).
370// These are the default logging rules.
371
372logging {
373 category default { default_syslog; default_debug; };
374 category unmatched { null; };
375
376 channel default_syslog {
377 syslog daemon; // send to syslog's daemon
378 // facility
379 severity info; // only send priority info
380 // and higher
381 };
382
383 channel default_debug {
384 file "named.run"; // write to named.run in
385 // the working directory
386 // Note: stderr is used instead
387 // of "named.run"
388 // if the server is started
389 // with the '-f' option.
390 severity dynamic; // log at the server's
391 // current debug level
392 };
393
394 channel default_stderr {
395 stderr; // writes to stderr
396 severity info; // only send priority info
397 // and higher
398 };
399
400 channel null {
401 null; // toss anything sent to
402 // this channel
403 };
404};</literal>
405EOF</userinput></screen>
406
407 <para>
408 Create a zone file with the following contents:
409 </para>
410
411<screen role="root"><userinput>cat &gt; /srv/named/etc/named/pz/127.0.0 &lt;&lt; "EOF"
412<literal>$TTL 3D
413@ IN SOA ns.local.domain. hostmaster.local.domain. (
414 1 ; Serial
415 8H ; Refresh
416 2H ; Retry
417 4W ; Expire
418 1D) ; Minimum TTL
419 NS ns.local.domain.
4201 PTR localhost.</literal>
421EOF</userinput></screen>
422
423 <para>
424 Create the <filename>root.hints</filename> file with the following
425 commands:
426 </para>
427
428 <note>
429 <para>
430 Caution must be used to ensure there are no leading spaces in
431 this file.
432 </para>
433 </note>
434
435<screen role="root"><userinput>cat &gt; /srv/named/etc/named/root.hints &lt;&lt; "EOF"
436<literal>. 6D IN NS A.ROOT-SERVERS.NET.
437. 6D IN NS B.ROOT-SERVERS.NET.
438. 6D IN NS C.ROOT-SERVERS.NET.
439. 6D IN NS D.ROOT-SERVERS.NET.
440. 6D IN NS E.ROOT-SERVERS.NET.
441. 6D IN NS F.ROOT-SERVERS.NET.
442. 6D IN NS G.ROOT-SERVERS.NET.
443. 6D IN NS H.ROOT-SERVERS.NET.
444. 6D IN NS I.ROOT-SERVERS.NET.
445. 6D IN NS J.ROOT-SERVERS.NET.
446. 6D IN NS K.ROOT-SERVERS.NET.
447. 6D IN NS L.ROOT-SERVERS.NET.
448. 6D IN NS M.ROOT-SERVERS.NET.
449A.ROOT-SERVERS.NET. 6D IN A 198.41.0.4
450A.ROOT-SERVERS.NET. 6D IN AAAA 2001:503:ba3e::2:30
451B.ROOT-SERVERS.NET. 6D IN A 199.9.14.201
452B.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:200::b
453C.ROOT-SERVERS.NET. 6D IN A 192.33.4.12
454C.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:2::c
455D.ROOT-SERVERS.NET. 6D IN A 199.7.91.13
456D.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:2d::d
457E.ROOT-SERVERS.NET. 6D IN A 192.203.230.10
458E.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:a8::e
459F.ROOT-SERVERS.NET. 6D IN A 192.5.5.241
460F.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:2f::f
461G.ROOT-SERVERS.NET. 6D IN A 192.112.36.4
462G.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:12::d0d
463H.ROOT-SERVERS.NET. 6D IN A 198.97.190.53
464H.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:1::53
465I.ROOT-SERVERS.NET. 6D IN A 192.36.148.17
466I.ROOT-SERVERS.NET. 6D IN AAAA 2001:7fe::53
467J.ROOT-SERVERS.NET. 6D IN A 192.58.128.30
468J.ROOT-SERVERS.NET. 6D IN AAAA 2001:503:c27::2:30
469K.ROOT-SERVERS.NET. 6D IN A 193.0.14.129
470K.ROOT-SERVERS.NET. 6D IN AAAA 2001:7fd::1
471L.ROOT-SERVERS.NET. 6D IN A 199.7.83.42
472L.ROOT-SERVERS.NET. 6D IN AAAA 2001:500:9f::42
473M.ROOT-SERVERS.NET. 6D IN A 202.12.27.33
474M.ROOT-SERVERS.NET. 6D IN AAAA 2001:dc3::35</literal>
475EOF</userinput></screen>
476
477 <para>
478 The <filename>root.hints</filename> file is a list of root name
479 servers. This file must be updated periodically with the
480 <command>dig</command> utility. A current copy of root.hints can be
481 obtained from <ulink url="https://www.internic.net/domain/named.root"/>.
482 For details, consult the "BIND 9 Administrator Reference Manual".
483 </para>
484
485 <para>
486 Create or modify <filename>resolv.conf</filename> to use the new
487 name server with the following commands:
488 </para>
489
490 <note>
491 <para>
492 Replace <replaceable>&lt;yourdomain.com&gt;</replaceable> with
493 your own valid domain name.
494 </para>
495 </note>
496
497<screen role="root"><userinput>cp /etc/resolv.conf /etc/resolv.conf.bak &amp;&amp;
498cat &gt; /etc/resolv.conf &lt;&lt; "EOF"
499<literal>search <replaceable>&lt;yourdomain.com&gt;</replaceable>
500nameserver 127.0.0.1</literal>
501EOF</userinput></screen>
502
503 <para>
504 Set permissions on the <command>chroot</command> jail with the
505 following command:
506 </para>
507
508<screen role="root"><userinput>chown -R named:named /srv/named</userinput></screen>
509
510 </sect3>
511
512 <sect3 id="bind-init">
513 <title><phrase revision="sysv">Boot Script</phrase>
514 <phrase revision="systemd">Systemd Unit</phrase></title>
515
516 <para>
517 To start the DNS server at boot, install the
518 <phrase revision="sysv"><filename>/etc/rc.d/init.d/bind</filename> init
519 script</phrase>
520 <phrase revision="systemd"><filename>named.service</filename>
521 unit</phrase> included in the
522 <xref linkend="bootscripts" revision="sysv"/>
523 <xref linkend="systemd-units" revision="systemd"/> package:
524 </para>
525
526 <indexterm zone="bind bind-init">
527 <primary sortas="f-bind">bind</primary>
528 </indexterm>
529
530<screen role="root" revision="sysv"><userinput>make install-bind</userinput></screen>
531<screen role="root" revision="systemd"><userinput>make install-named</userinput></screen>
532
533 <para>
534 Now start <application>BIND</application> with the following command:
535 </para>
536
537<screen role="root" revision="sysv"><userinput>/etc/rc.d/init.d/bind start</userinput></screen>
538<screen role="root" revision="systemd"><userinput>systemctl start named</userinput></screen>
539
540 </sect3>
541
542 <sect3>
543 <title>Testing BIND</title>
544
545 <para>
546 Test out the new <application>BIND</application> 9 installation.
547 First query the local host address with <command>dig</command>:
548 </para>
549
550<screen><userinput>dig -x 127.0.0.1</userinput></screen>
551
552 <para>
553 Now try an external name lookup, taking note of the speed
554 difference in repeated lookups due to the caching. Run the
555 <command>dig</command> command twice on the same address:
556 </para>
557
558<screen><userinput>dig www.&lfs-domainname; &amp;&amp;
559dig www.&lfs-domainname;</userinput></screen>
560
561 <para>
562 You can see almost instantaneous results with the named caching
563 lookups. Consult the <application>BIND</application> Administrator
564 Reference Manual (see below) for further configuration options.
565 </para>
566
567 </sect3>
568
569 </sect2>
570
571 <sect2>
572 <title>Administrator Reference Manual (ARM)</title>
573
574 <para>
575 The ARM documentation (do not confuse with the processor architecture)
576 is included in the source package. The documentation is in .rst
577 format which means, it can be converted in human readable formats
578 if <xref linkend="sphinx"/> is installed.
579 </para>
580
581 <para>
582 When <application>BIND</application> is set up, especially when
583 to operate in a real live scenario, it is <emphasis>highly</emphasis>
584 recommended to consult the ARM documentation. ISC provides an
585 updated set of excellent documentation along with every release
586 so it can be easily viewed and/or downloaded &ndash; so there is
587 no excuse to not read the docs. The formats ISC provides are PDF,
588 epub and html at <ulink url="https://downloads.isc.org/isc/bind9/&bind-version;/doc/arm/"/>.
589 </para>
590 </sect2>
591
592 <sect2 role="content">
593 <title>Contents</title>
594
595 <segmentedlist>
596 <segtitle>Installed Programs</segtitle>
597 <segtitle>Installed Libraries</segtitle>
598 <segtitle>Installed Directories</segtitle>
599
600 <seglistitem>
601
602 <seg>arpaname, <!--bind9-config hardlinked to isc-config.sh,-->
603 ddns-confgen, delv, dig, dnssec-cds, dnssec-checkds, dnssec-coverage,
604 dnssec-dsfromkey, dnssec-importkey, dnssec-keyfromlabel, dnssec-keygen,
605 dnssec-keymgr, dnssec-revoke, dnssec-settime, dnssec-signzone,
606 dnssec-verify, host, mdig, named, named-checkconf,
607 named-checkzone, named-compilezone (symlink), named-journalprint,
608 named-nzd2nzf, named-rrchecker, nsec3hash, nslookup, nsupdate, rndc,
609 rndc-confgen, and tsig-keygen (symlink)</seg>
610
611 <seg>libbind9.so, libdns.so, libirs.so, libisc.so, libisccc.so,
612 libisccfg.so, and libns.so</seg>
613
614 <seg>/usr/include/{bind9,dns,dst,irs,isc,isccc,isccfg,ns,pk11,pkcs11},
615 /usr/lib/named, /usr/lib/python&python3-majorver;/site-packages/isc,
616 and /srv/named</seg>
617 </seglistitem>
618 </segmentedlist>
619
620 <variablelist>
621 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
622 <?dbfo list-presentation="list"?>
623 <?dbhtml list-presentation="table"?>
624
625 <varlistentry id="arpaname">
626 <term><command>arpaname</command></term>
627 <listitem>
628 <para>
629 translates IP addresses to the corresponding ARPA names
630 </para>
631 <indexterm zone="bind arpaname">
632 <primary sortas="b-arpaname">arpaname</primary>
633 </indexterm>
634 </listitem>
635 </varlistentry>
636
637<!-- Not present as of 9.16.5
638 <varlistentry id="bind9-config">
639 <term><command>bind9-config</command></term>
640 <listitem>
641 <para>
642 is hardlinked to <command>isc-config.sh</command>.
643 </para>
644 <indexterm zone="bind bind9-config">
645 <primary sortas="b-bind9-config">bind9-config</primary>
646 </indexterm>
647 </listitem>
648 </varlistentry>
649-->
650
651 <varlistentry id="ddns-confgen">
652 <term><command>ddns-confgen</command></term>
653 <listitem>
654 <para>
655 generates a key for use by nsupdate and named
656 </para>
657 <indexterm zone="bind ddns-confgen">
658 <primary sortas="b-ddns-confgen">ddns-confgen</primary>
659 </indexterm>
660 </listitem>
661 </varlistentry>
662
663 <varlistentry id="delv">
664 <term><command>delv</command></term>
665 <listitem>
666 <para>
667 is a new debugging tool that is a successor to
668 <command>dig</command>
669 </para>
670 <indexterm zone="bind delv">
671 <primary sortas="b-delv">delv</primary>
672 </indexterm>
673 </listitem>
674 </varlistentry>
675
676 <varlistentry id="dig">
677 <term><command>dig</command></term>
678 <listitem>
679 <para>
680 interrogates DNS servers
681 </para>
682 <indexterm zone="bind dig">
683 <primary sortas="b-dig">dig</primary>
684 </indexterm>
685 </listitem>
686 </varlistentry>
687
688 <varlistentry id="dnssec-cds">
689 <term><command>dnssec-cds</command></term>
690 <listitem>
691 <para>
692 changes DS records for a child zone based on
693 CDS/CDNSKEY
694 </para>
695 <indexterm zone="bind dnssec-cds">
696 <primary sortas="b-dnssec-cds">dnssec-cds</primary>
697 </indexterm>
698 </listitem>
699 </varlistentry>
700
701 <varlistentry id="dnssec-checkds">
702 <term><command>dnssec-checkds</command></term>
703 <listitem>
704 <para>
705 is a DNSSEC delegation consistency checking tool
706 </para>
707 <indexterm zone="bind dnssec-checkds">
708 <primary sortas="b-dnssec-checkds">dnssec-checkds</primary>
709 </indexterm>
710 </listitem>
711 </varlistentry>
712
713 <varlistentry id="dnssec-coverage">
714 <term><command>dnssec-coverage</command></term>
715 <listitem>
716 <para>
717 verifies that the DNSSEC keys for a given zone or a set of zones
718 have timing metadata set properly to ensure no future lapses
719 in DNSSEC coverage
720 </para>
721 <indexterm zone="bind dnssec-coverage">
722 <primary sortas="b-dnssec-coverage">dnssec-coverage</primary>
723 </indexterm>
724 </listitem>
725 </varlistentry>
726
727 <varlistentry id="dnssec-dsfromkey">
728 <term><command>dnssec-dsfromkey</command></term>
729 <listitem>
730 <para>
731 outputs the Delegation Signer (DS) resource record (RR)
732 </para>
733 <indexterm zone="bind dnssec-dsfromkey">
734 <primary sortas="b-dnssec-dsfromkey">dnssec-dsfromkey</primary>
735 </indexterm>
736 </listitem>
737 </varlistentry>
738
739 <varlistentry id="dnssec-importkey">
740 <term><command>dnssec-importkey</command></term>
741 <listitem>
742 <para>
743 reads a public DNSKEY record and generates a pair of
744 .key/.private files
745 </para>
746 <indexterm zone="bind dnssec-importkey">
747 <primary sortas="b-dnssec-importkey">dnssec-importkey</primary>
748 </indexterm>
749 </listitem>
750 </varlistentry>
751
752 <varlistentry id="dnssec-keyfromlabel">
753 <term><command>dnssec-keyfromlabel</command></term>
754 <listitem>
755 <para>
756 gets keys with the given label from a cryptography hardware device
757 and builds key files for DNSSEC
758 </para>
759 <indexterm zone="bind dnssec-keyfromlabel">
760 <primary sortas="b-dnssec-keyfromlabel">dnssec-keyfromlabel</primary>
761 </indexterm>
762 </listitem>
763 </varlistentry>
764
765 <varlistentry id="dnssec-keygen">
766 <term><command>dnssec-keygen</command></term>
767 <listitem>
768 <para>
769 is a key generator for secure DNS
770 </para>
771 <indexterm zone="bind dnssec-keygen">
772 <primary sortas="b-dnssec-keygen">dnssec-keygen</primary>
773 </indexterm>
774 </listitem>
775 </varlistentry>
776
777 <varlistentry id="dnssec-keymgr">
778 <term><command>dnssec-keymgr</command></term>
779 <listitem>
780 <para>
781 ensures correct DNSKEY coverage based on a defined policy
782 </para>
783 <indexterm zone="bind dnssec-keymgr">
784 <primary sortas="b-dnssec-keymgr">dnssec-keymgr</primary>
785 </indexterm>
786 </listitem>
787 </varlistentry>
788
789 <varlistentry id="dnssec-revoke">
790 <term><command>dnssec-revoke</command></term>
791 <listitem>
792 <para>
793 sets the REVOKED bit on a DNSSEC key
794 </para>
795 <indexterm zone="bind dnssec-revoke">
796 <primary sortas="b-dnssec-revoke">dnssec-revoke</primary>
797 </indexterm>
798 </listitem>
799 </varlistentry>
800
801 <varlistentry id="dnssec-settime">
802 <term><command>dnssec-settime</command></term>
803 <listitem>
804 <para>
805 sets the key timing metadata for a DNSSEC key
806 </para>
807 <indexterm zone="bind dnssec-settime">
808 <primary sortas="b-dnssec-settime">dnssec-settime</primary>
809 </indexterm>
810 </listitem>
811 </varlistentry>
812
813 <varlistentry id="dnssec-signzone">
814 <term><command>dnssec-signzone</command></term>
815 <listitem>
816 <para>
817 generates signed versions of zone files
818 </para>
819 <indexterm zone="bind dnssec-signzone">
820 <primary sortas="b-dnssec-signzone">dnssec-signzone</primary>
821 </indexterm>
822 </listitem>
823 </varlistentry>
824
825 <varlistentry id="dnssec-verify">
826 <term><command>dnssec-verify</command></term>
827 <listitem>
828 <para>
829 verifies that a zone is fully signed for each algorithm found
830 in the DNSKEY RRset for the zone, and that the NSEC / NSEC3
831 chains are complete
832 </para>
833 <indexterm zone="bind dnssec-verify">
834 <primary sortas="b-dnssec-verify">dnssec-verify</primary>
835 </indexterm>
836 </listitem>
837 </varlistentry>
838
839<!-- No longer present with 9.16.5
840 <varlistentry id="genrandom">
841 <term><command>genrandom</command></term>
842 <listitem>
843 <para>
844 generates a file containing random data.
845 </para>
846 <indexterm zone="bind genrandom">
847 <primary sortas="b-genrandom">genrandom</primary>
848 </indexterm>
849 </listitem>
850 </varlistentry>
851-->
852
853 <varlistentry id="host">
854 <term><command>host</command></term>
855 <listitem>
856 <para>
857 is a utility for DNS lookups
858 </para>
859 <indexterm zone="bind host">
860 <primary sortas="b-host">host</primary>
861 </indexterm>
862 </listitem>
863 </varlistentry>
864
865 <!-- No longer present with 9.16.5
866 <varlistentry id="isc-config.sh">
867 <term><command>isc-config.sh</command></term>
868 <listitem>
869 <para>
870 prints information related to the installed version of ISC BIND.
871 </para>
872 <indexterm zone="bind isc-config.sh">
873 <primary sortas="b-isc-config.sh">isc-config.sh</primary>
874 </indexterm>
875 </listitem>
876 </varlistentry>
877
878 <varlistentry id="isc-hmac-fixup">
879 <term><command>isc-hmac-fixup</command></term>
880 <listitem>
881 <para>
882 fixes HMAC keys generated by older versions of BIND.
883 </para>
884 <indexterm zone="bind isc-hmac-fixup">
885 <primary sortas="b-isc-hmac-fixup">isc-hmac-fixup</primary>
886 </indexterm>
887 </listitem>
888 </varlistentry>
889
890 <varlistentry id="lwresd">
891 <term><command>lwresd</command></term>
892 <listitem>
893 <para>
894 is a caching-only name server for local process use.
895 </para>
896 <indexterm zone="bind lwresd">
897 <primary sortas="b-lwresd">lwresd</primary>
898 </indexterm>
899 </listitem>
900 </varlistentry>
901-->
902
903 <varlistentry id="mdig">
904 <term><command>mdig</command></term>
905 <listitem>
906 <para>
907 is a version of dig that allows multiple queries at once
908 </para>
909 <indexterm zone="bind mdig">
910 <primary sortas="b-mdig">mdig</primary>
911 </indexterm>
912 </listitem>
913 </varlistentry>
914
915 <varlistentry id="named">
916 <term><command>named</command></term>
917 <listitem>
918 <para>
919 is the name server daemon
920 </para>
921 <indexterm zone="bind named">
922 <primary sortas="b-named">named</primary>
923 </indexterm>
924 </listitem>
925 </varlistentry>
926
927 <varlistentry id="named-checkconf">
928 <term><command>named-checkconf</command></term>
929 <listitem>
930 <para>
931 checks the syntax of <filename>named.conf</filename>
932 files
933 </para>
934 <indexterm zone="bind named-checkconf">
935 <primary sortas="b-named-checkconf">named-checkconf</primary>
936 </indexterm>
937 </listitem>
938 </varlistentry>
939
940 <varlistentry id="named-checkzone">
941 <term><command>named-checkzone</command></term>
942 <listitem>
943 <para>
944 checks zone file validity
945 </para>
946 <indexterm zone="bind named-checkzone">
947 <primary sortas="b-named-checkzone">named-checkzone</primary>
948 </indexterm>
949 </listitem>
950 </varlistentry>
951
952 <varlistentry id="named-compilezone">
953 <term><command>named-compilezone</command></term>
954 <listitem>
955 <para>
956 is similar to <command>named-checkzone</command>, but it always
957 dumps the zone contents to a specified file in a specified format
958 </para>
959 <indexterm zone="bind named-compilezone">
960 <primary sortas="b-named-compilezone">named-compilezone</primary>
961 </indexterm>
962 </listitem>
963 </varlistentry>
964
965 <varlistentry id="named-journalprint">
966 <term><command>named-journalprint</command></term>
967 <listitem>
968 <para>
969 prints the zone journal in human-readable form
970 </para>
971 <indexterm zone="bind named-journalprint">
972 <primary sortas="b-named-journalprint">named-journalprint</primary>
973 </indexterm>
974 </listitem>
975 </varlistentry>
976
977 <varlistentry id="named-rrchecker">
978 <term><command>named-rrchecker</command></term>
979 <listitem>
980 <para>
981 reads an individual DNS resource record from standard input and
982 checks if it is syntactically correct
983 </para>
984 <indexterm zone="bind named-rrchecker">
985 <primary sortas="b-named-rrchecker">named-rrchecker</primary>
986 </indexterm>
987 </listitem>
988 </varlistentry>
989
990 <varlistentry id="named-nzd2nzf">
991 <term><command>named-nzd2nzf</command></term>
992 <listitem>
993 <para>
994 converts an NZD database to NZF text format
995 </para>
996 <indexterm zone="bind named-nzd2nzf">
997 <primary sortas="b-named-nzd2nzf">named-nzd2nzf</primary>
998 </indexterm>
999 </listitem>
1000 </varlistentry>
1001
1002 <varlistentry id="nsec3hash">
1003 <term><command>nsec3hash</command></term>
1004 <listitem>
1005 <para>
1006 generates an NSEC3 hash based on a set of NSEC3 parameters
1007 </para>
1008 <indexterm zone="bind nsec3hash">
1009 <primary sortas="b-nsec3hash">nsec3hash</primary>
1010 </indexterm>
1011 </listitem>
1012 </varlistentry>
1013
1014 <varlistentry id="nslookup">
1015 <term><command>nslookup</command></term>
1016 <listitem>
1017 <para>
1018 is a program used to query Internet domain nameservers
1019 </para>
1020 <indexterm zone="bind nslookup">
1021 <primary sortas="b-nslookup">nslookup</primary>
1022 </indexterm>
1023 </listitem>
1024 </varlistentry>
1025
1026 <varlistentry id="nsupdate">
1027 <term><command>nsupdate</command></term>
1028 <listitem>
1029 <para>
1030 is used to submit DNS update requests
1031 </para>
1032 <indexterm zone="bind nsupdate">
1033 <primary sortas="b-nsupdate">nsupdate</primary>
1034 </indexterm>
1035 </listitem>
1036 </varlistentry>
1037
1038 <varlistentry id="rndc">
1039 <term><command>rndc</command></term>
1040 <listitem>
1041 <para>
1042 controls the operation of <application>BIND</application>
1043 </para>
1044 <indexterm zone="bind rndc">
1045 <primary sortas="b-rndc">rndc</primary>
1046 </indexterm>
1047 </listitem>
1048 </varlistentry>
1049
1050 <varlistentry id="rndc-confgen">
1051 <term><command>rndc-confgen</command></term>
1052 <listitem>
1053 <para>
1054 generates <filename>rndc.conf</filename> files
1055 </para>
1056 <indexterm zone="bind rndc-confgen">
1057 <primary sortas="b-rndc-confgen">rndc-confgen</primary>
1058 </indexterm>
1059 </listitem>
1060 </varlistentry>
1061
1062 <varlistentry id="tsig-keygen">
1063 <term><command>tsig-keygen</command></term>
1064 <listitem>
1065 <para>
1066 is a symlink to <command>ddns-confgen</command>
1067 </para>
1068 <indexterm zone="bind tsig-keygen">
1069 <primary sortas="b-tsig-keygen">tsig-keygen</primary>
1070 </indexterm>
1071 </listitem>
1072 </varlistentry>
1073
1074 </variablelist>
1075
1076 </sect2>
1077
1078</sect1>
Note: See TracBrowser for help on using the repository browser.