SEARCH
NEW RPMS
DIRECTORIES
ABOUT
FAQ
VARIOUS
BLOG
DONATE


YUM REPOSITORY

 
 

MAN page from Trustix bind-utils-9.2.2-9tr.i586.rpm

RNDC.CONF

Section: (5)
Updated: June 30, 2000
Index 

NAME

rndc.conf - rndc configuration file 

SYNOPSIS

rndc.conf 

DESCRIPTION

rndc.conf is the configuration filefor rndc, the BIND 9 name server controlutility. This file has a similar structure and syntax tonamed.conf. Statements are enclosedin braces and terminated with a semi-colon. Clauses inthe statements are also semi-colon terminated. The usualcomment styles are supported:

C style: /* */

C++ style: // to end of line

Unix style: # to end of line

rndc.conf is much simpler thannamed.conf. The file uses threestatements: an options statement, a server statementand a key statement.

The options statement contains three clauses.The default-server clause is followed by thename or address of a name server. This host will be used whenno name server is given as an argument torndc. The default-keyclause is followed by the name of a key which is identified bya key statement. If nokeyid is provided on the rndc command line,and no key clause is found in a matchingserver statement, this default key will beused to authenticate the server's commands and responses. Thedefault-port clause is followed by the portto connect to on the remote name server. If noport option is provided on the rndc commandline, and no port clause is found in amatching server statement, this default portwill be used to connect.

After the server keyword, the server statementincludes a string which is the hostname or address for a nameserver. The statement has two possible clauses:key and port. The key name mustmatch the name of a key statement in the file. The port numberspecifies the port to connect to.

The key statement begins with an identifyingstring, the name of the key. The statement has two clauses.algorithm identifies the encryption algorithmfor rndc to use; currently only HMAC-MD5 issupported. This is followed by a secret clause which containsthe base-64 encoding of the algorithm's encryption key. Thebase-64 string is enclosed in double quotes.

There are two common ways to generate the base-64 string for thesecret. The BIND 9 program rndc-confgen canbe used to generate a random key, or themmencode program, also known asmimencode, can be used to generate a base-64string from known input. mmencode does notship with BIND 9 but is available on many systems. See theEXAMPLE section for sample command lines for each. 

EXAMPLE

    options {        default-server  localhost;        default-key     samplekey;      };      server localhost {        key             samplekey;      };      key samplekey {        algorithm       hmac-md5;        secret          "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";      };    

In the above example, rndc will by default usethe server at localhost (127.0.0.1) and the key called samplekey.Commands to the localhost server will use the samplekey key, whichmust also be defined in the server's configuration file with thesame name and secret. The key statement indicates that samplekeyuses the HMAC-MD5 algorithm and its secret clause contains thebase-64 encoding of the HMAC-MD5 secret enclosed in double quotes.

To generate a random secret with rndc-confgen:

rndc-confgen

A complete rndc.conf file, including therandomly generated key, will be written to the standardoutput. Commented out key andcontrols statements fornamed.conf are also printed.

To generate a base-64 secret with mmencode:

echo "known plaintext for a secret" | mmencode 

NAME SERVER CONFIGURATION

The name server must be configured to accept rndc connections andto recognize the key specified in the rndc.conffile, using the controls statement in named.conf.See the sections on the controls statement in theBIND 9 Administrator Reference Manual for details. 

SEE ALSO

rndc(8),rndc-confgen(8),mmencode(1),BIND 9 Administrator Reference Manual. 

AUTHOR

Internet Software Consortium


 

Index

NAME
SYNOPSIS
DESCRIPTION
EXAMPLE
NAME SERVER CONFIGURATION
SEE ALSO
AUTHOR

This document was created byman2html,using the manual pages.