rndc.conf(4)

1rndc.conf(4)                     File Formats                     rndc.conf(4)
2
3
4

NAME

6       rndc.conf - rndc configuration file
7

SYNOPSIS

9       rndc.conf
10
11

DESCRIPTION

13       rndc.conf  is  the  configuration file for rndc, the BIND 9 name server
14       control utility. This file  has  a  similar  structure  and  syntax  to
15       named.conf.  Statements  are  enclosed  in braces and terminated with a
16       semi-colon. Clauses in the statements are also  semi-colon  terminated.
17       The usual comment styles are supported:
18
19       C style       /* */
20
21
22       C++ style     // to end of line
23
24
25       Unix style    # to end of line
26
27
28
29       rndc.conf  is  much simpler than named.conf. The file uses three state‐
30       ments: an options statement, a server statement and a key statement.
31
32
33       The options statement contains three clauses. The default-server clause
34       is  followed by the name or address of a name server. This host is used
35       when no name server is provided as an argument to rndc. The default-key
36       clause  is  followed  by the name of a key which is identified by a key
37       statement. If no keyid is provided on the rndc command line, and no key
38       clause  is  found in a matching server statement, this default key will
39       be used to  authenticate  the  server's  commands  and  responses.  The
40       default-port clause is followed by the port to connect to on the remote
41       name server. If no port option is provided on the  rndc  command  line,
42       and  no  port  clause  is  found  in  a matching server statement, this
43       default port will be used to connect.
44
45
46       After the server keyword, the server statement includes a string  which
47       is  the  hostname  or  address for a name server. The statement has two
48       possible clauses: key and port. The key name must match the name  of  a
49       key  statement  in the file. The port number specifies the port to con‐
50       nect to.
51
52
53       The key statement begins with an identifying string, the  name  of  the
54       key. The statement has two clauses. algorithm identifies the encryption
55       algorithm for rndc to use; currently only HMAC-MD5 is  supported.  This
56       is  followed  by a secret clause which contains the base-64 encoding of
57       the algorithm's encryption key. The base-64 string is enclosed in  dou‐
58       ble quotes.
59
60
61       There  are  two  common  ways  to  generate  the base-64 string for the
62       secret. The BIND 9 program rndc-confgen(1M) can be used to  generate  a
63       random  key,  or  the mmencode program, also known as mimencode, can be
64       used to generate a base-64 string from known input. mmencode  does  not
65       ship  with  BIND  9  but is available on many systems. See the EXAMPLES
66       section for sample command lines for each.
67

EXAMPLES

69         options {
70              default-server  localhost;
71              default-key     samplekey;
72         };
73
74         server localhost {
75              key             samplekey;
76         };
77
78         key samplekey {
79              algorithm hmac-md5;
80              secret
81              "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
82         };
83
84
85
86
87
88       In the above example, rndc by default  uses  the  server  at  localhost
89       (127.0.0.1)  and  the  key  called samplekey. Commands to the localhost
90       server use the samplekey  key,  which  must  also  be  defined  in  the
91       server's  configuration  file  with  the  same name and secret. The key
92       statement indicates that samplekey uses  the  HMAC-MD5  algorithm.  Its
93       secret  clause  contains  the  base-64  encoding of the HMAC-MD5 secret
94       enclosed in double quotes.
95
96
97       To generate a random secret with rndc-confgen:
98
99         rndc-confgen
100
101
102
103
104       A complete rndc.conf file, including the randomly generated  key,  will
105       be  written  to  the  standard  output.  Commented out key and controls
106       statements for named.conf are also printed.
107
108
109       To generate a base-64 secret with mmencode:
110
111         echo "known plaintext for a secret" | mmencode
112
113
114

NAME SERVER CONFIGURATION

116       The name server must be configured to accept rndc  connections  and  to
117       recognize  the  key specified in the rndc.conf file, using the controls
118       statement in named.conf. See the sections on the controls statement  in
119       the BIND 9 Administrator Reference Manual for details.
120

ATTRIBUTES

122       See attributes(5) for descriptions of the following attributes:
123
124
125
126
127       ┌─────────────────────────────┬─────────────────────────────┐
128       │      ATTRIBUTE TYPE         │      ATTRIBUTE VALUE        │
129       ├─────────────────────────────┼─────────────────────────────┤
130       │Availability                 │SUNWbind                     │
131       ├─────────────────────────────┼─────────────────────────────┤
132       │Interface Stability          │External                     │
133       └─────────────────────────────┴─────────────────────────────┘
134

NAME

SYNOPSIS

DESCRIPTION

EXAMPLES

NAME SERVER CONFIGURATION

ATTRIBUTES

SEE ALSO