1*00b67f09SDavid van Moolenbroek<!-- 2*00b67f09SDavid van Moolenbroek - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") 3*00b67f09SDavid van Moolenbroek - Copyright (C) 2000-2003 Internet Software Consortium. 4*00b67f09SDavid van Moolenbroek - 5*00b67f09SDavid van Moolenbroek - Permission to use, copy, modify, and/or distribute this software for any 6*00b67f09SDavid van Moolenbroek - purpose with or without fee is hereby granted, provided that the above 7*00b67f09SDavid van Moolenbroek - copyright notice and this permission notice appear in all copies. 8*00b67f09SDavid van Moolenbroek - 9*00b67f09SDavid van Moolenbroek - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 10*00b67f09SDavid van Moolenbroek - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 11*00b67f09SDavid van Moolenbroek - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 12*00b67f09SDavid van Moolenbroek - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 13*00b67f09SDavid van Moolenbroek - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 14*00b67f09SDavid van Moolenbroek - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 15*00b67f09SDavid van Moolenbroek - PERFORMANCE OF THIS SOFTWARE. 16*00b67f09SDavid van Moolenbroek--> 17*00b67f09SDavid van Moolenbroek<!-- $Id: man.nsupdate.html,v 1.5 2015/09/03 07:33:34 christos Exp $ --> 18*00b67f09SDavid van Moolenbroek<html> 19*00b67f09SDavid van Moolenbroek<head> 20*00b67f09SDavid van Moolenbroek<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> 21*00b67f09SDavid van Moolenbroek<title>nsupdate</title> 22*00b67f09SDavid van Moolenbroek<meta name="generator" content="DocBook XSL Stylesheets V1.71.1"> 23*00b67f09SDavid van Moolenbroek<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual"> 24*00b67f09SDavid van Moolenbroek<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages"> 25*00b67f09SDavid van Moolenbroek<link rel="prev" href="man.named-rrchecker.html" title="named-rrchecker"> 26*00b67f09SDavid van Moolenbroek<link rel="next" href="man.rndc.html" title="rndc"> 27*00b67f09SDavid van Moolenbroek</head> 28*00b67f09SDavid van Moolenbroek<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"> 29*00b67f09SDavid van Moolenbroek<div class="navheader"> 30*00b67f09SDavid van Moolenbroek<table width="100%" summary="Navigation header"> 31*00b67f09SDavid van Moolenbroek<tr><th colspan="3" align="center"><span class="application">nsupdate</span></th></tr> 32*00b67f09SDavid van Moolenbroek<tr> 33*00b67f09SDavid van Moolenbroek<td width="20%" align="left"> 34*00b67f09SDavid van Moolenbroek<a accesskey="p" href="man.named-rrchecker.html">Prev</a>�</td> 35*00b67f09SDavid van Moolenbroek<th width="60%" align="center">Manual pages</th> 36*00b67f09SDavid van Moolenbroek<td width="20%" align="right">�<a accesskey="n" href="man.rndc.html">Next</a> 37*00b67f09SDavid van Moolenbroek</td> 38*00b67f09SDavid van Moolenbroek</tr> 39*00b67f09SDavid van Moolenbroek</table> 40*00b67f09SDavid van Moolenbroek<hr> 41*00b67f09SDavid van Moolenbroek</div> 42*00b67f09SDavid van Moolenbroek<div class="refentry" lang="en"> 43*00b67f09SDavid van Moolenbroek<a name="man.nsupdate"></a><div class="titlepage"></div> 44*00b67f09SDavid van Moolenbroek<div class="refnamediv"> 45*00b67f09SDavid van Moolenbroek<h2>Name</h2> 46*00b67f09SDavid van Moolenbroek<p><span class="application">nsupdate</span> — Dynamic DNS update utility</p> 47*00b67f09SDavid van Moolenbroek</div> 48*00b67f09SDavid van Moolenbroek<div class="refsynopsisdiv"> 49*00b67f09SDavid van Moolenbroek<h2>Synopsis</h2> 50*00b67f09SDavid van Moolenbroek<div class="cmdsynopsis"><p><code class="command">nsupdate</code> [<code class="option">-d</code>] [<code class="option">-D</code>] [[<code class="option">-g</code>] | [<code class="option">-o</code>] | [<code class="option">-l</code>] | [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>] | [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-R <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-v</code>] [<code class="option">-T</code>] [<code class="option">-P</code>] [<code class="option">-V</code>] [filename]</p></div> 51*00b67f09SDavid van Moolenbroek</div> 52*00b67f09SDavid van Moolenbroek<div class="refsect1" lang="en"> 53*00b67f09SDavid van Moolenbroek<a name="id2653616"></a><h2>DESCRIPTION</h2> 54*00b67f09SDavid van Moolenbroek<p><span><strong class="command">nsupdate</strong></span> 55*00b67f09SDavid van Moolenbroek is used to submit Dynamic DNS Update requests as defined in RFC 2136 56*00b67f09SDavid van Moolenbroek to a name server. 57*00b67f09SDavid van Moolenbroek This allows resource records to be added or removed from a zone 58*00b67f09SDavid van Moolenbroek without manually editing the zone file. 59*00b67f09SDavid van Moolenbroek A single update request can contain requests to add or remove more than 60*00b67f09SDavid van Moolenbroek one 61*00b67f09SDavid van Moolenbroek resource record. 62*00b67f09SDavid van Moolenbroek </p> 63*00b67f09SDavid van Moolenbroek<p> 64*00b67f09SDavid van Moolenbroek Zones that are under dynamic control via 65*00b67f09SDavid van Moolenbroek <span><strong class="command">nsupdate</strong></span> 66*00b67f09SDavid van Moolenbroek or a DHCP server should not be edited by hand. 67*00b67f09SDavid van Moolenbroek Manual edits could 68*00b67f09SDavid van Moolenbroek conflict with dynamic updates and cause data to be lost. 69*00b67f09SDavid van Moolenbroek </p> 70*00b67f09SDavid van Moolenbroek<p> 71*00b67f09SDavid van Moolenbroek The resource records that are dynamically added or removed with 72*00b67f09SDavid van Moolenbroek <span><strong class="command">nsupdate</strong></span> 73*00b67f09SDavid van Moolenbroek have to be in the same zone. 74*00b67f09SDavid van Moolenbroek Requests are sent to the zone's master server. 75*00b67f09SDavid van Moolenbroek This is identified by the MNAME field of the zone's SOA record. 76*00b67f09SDavid van Moolenbroek </p> 77*00b67f09SDavid van Moolenbroek<p> 78*00b67f09SDavid van Moolenbroek The 79*00b67f09SDavid van Moolenbroek <code class="option">-d</code> 80*00b67f09SDavid van Moolenbroek option makes 81*00b67f09SDavid van Moolenbroek <span><strong class="command">nsupdate</strong></span> 82*00b67f09SDavid van Moolenbroek operate in debug mode. 83*00b67f09SDavid van Moolenbroek This provides tracing information about the update requests that are 84*00b67f09SDavid van Moolenbroek made and the replies received from the name server. 85*00b67f09SDavid van Moolenbroek </p> 86*00b67f09SDavid van Moolenbroek<p> 87*00b67f09SDavid van Moolenbroek The <code class="option">-D</code> option makes <span><strong class="command">nsupdate</strong></span> 88*00b67f09SDavid van Moolenbroek report additional debugging information to <code class="option">-d</code>. 89*00b67f09SDavid van Moolenbroek </p> 90*00b67f09SDavid van Moolenbroek<p> 91*00b67f09SDavid van Moolenbroek The <code class="option">-L</code> option with an integer argument of zero or 92*00b67f09SDavid van Moolenbroek higher sets the logging debug level. If zero, logging is disabled. 93*00b67f09SDavid van Moolenbroek </p> 94*00b67f09SDavid van Moolenbroek<p> 95*00b67f09SDavid van Moolenbroek Transaction signatures can be used to authenticate the Dynamic 96*00b67f09SDavid van Moolenbroek DNS updates. These use the TSIG resource record type described 97*00b67f09SDavid van Moolenbroek in RFC 2845 or the SIG(0) record described in RFC 2535 and 98*00b67f09SDavid van Moolenbroek RFC 2931 or GSS-TSIG as described in RFC 3645. TSIG relies on 99*00b67f09SDavid van Moolenbroek a shared secret that should only be known to 100*00b67f09SDavid van Moolenbroek <span><strong class="command">nsupdate</strong></span> and the name server. Currently, 101*00b67f09SDavid van Moolenbroek the only supported encryption algorithm for TSIG is HMAC-MD5, 102*00b67f09SDavid van Moolenbroek which is defined in RFC 2104. Once other algorithms are 103*00b67f09SDavid van Moolenbroek defined for TSIG, applications will need to ensure they select 104*00b67f09SDavid van Moolenbroek the appropriate algorithm as well as the key when authenticating 105*00b67f09SDavid van Moolenbroek each other. For instance, suitable <span class="type">key</span> and 106*00b67f09SDavid van Moolenbroek <span class="type">server</span> statements would be added to 107*00b67f09SDavid van Moolenbroek <code class="filename">/etc/named.conf</code> so that the name server 108*00b67f09SDavid van Moolenbroek can associate the appropriate secret key and algorithm with 109*00b67f09SDavid van Moolenbroek the IP address of the client application that will be using 110*00b67f09SDavid van Moolenbroek TSIG authentication. SIG(0) uses public key cryptography. 111*00b67f09SDavid van Moolenbroek To use a SIG(0) key, the public key must be stored in a KEY 112*00b67f09SDavid van Moolenbroek record in a zone served by the name server. 113*00b67f09SDavid van Moolenbroek <span><strong class="command">nsupdate</strong></span> does not read 114*00b67f09SDavid van Moolenbroek <code class="filename">/etc/named.conf</code>. 115*00b67f09SDavid van Moolenbroek </p> 116*00b67f09SDavid van Moolenbroek<p> 117*00b67f09SDavid van Moolenbroek GSS-TSIG uses Kerberos credentials. Standard GSS-TSIG mode 118*00b67f09SDavid van Moolenbroek is switched on with the <code class="option">-g</code> flag. A 119*00b67f09SDavid van Moolenbroek non-standards-compliant variant of GSS-TSIG used by Windows 120*00b67f09SDavid van Moolenbroek 2000 can be switched on with the <code class="option">-o</code> flag. 121*00b67f09SDavid van Moolenbroek </p> 122*00b67f09SDavid van Moolenbroek<p><span><strong class="command">nsupdate</strong></span> 123*00b67f09SDavid van Moolenbroek uses the <code class="option">-y</code> or <code class="option">-k</code> option 124*00b67f09SDavid van Moolenbroek to provide the shared secret needed to generate a TSIG record 125*00b67f09SDavid van Moolenbroek for authenticating Dynamic DNS update requests, default type 126*00b67f09SDavid van Moolenbroek HMAC-MD5. These options are mutually exclusive. 127*00b67f09SDavid van Moolenbroek </p> 128*00b67f09SDavid van Moolenbroek<p> 129*00b67f09SDavid van Moolenbroek When the <code class="option">-y</code> option is used, a signature is 130*00b67f09SDavid van Moolenbroek generated from 131*00b67f09SDavid van Moolenbroek [<span class="optional"><em class="parameter"><code>hmac:</code></em></span>]<em class="parameter"><code>keyname:secret.</code></em> 132*00b67f09SDavid van Moolenbroek <em class="parameter"><code>keyname</code></em> is the name of the key, and 133*00b67f09SDavid van Moolenbroek <em class="parameter"><code>secret</code></em> is the base64 encoded shared secret. 134*00b67f09SDavid van Moolenbroek <em class="parameter"><code>hmac</code></em> is the name of the key algorithm; 135*00b67f09SDavid van Moolenbroek valid choices are <code class="literal">hmac-md5</code>, 136*00b67f09SDavid van Moolenbroek <code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>, 137*00b67f09SDavid van Moolenbroek <code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>, or 138*00b67f09SDavid van Moolenbroek <code class="literal">hmac-sha512</code>. If <em class="parameter"><code>hmac</code></em> 139*00b67f09SDavid van Moolenbroek is not specified, the default is <code class="literal">hmac-md5</code>. 140*00b67f09SDavid van Moolenbroek NOTE: Use of the <code class="option">-y</code> option is discouraged because the 141*00b67f09SDavid van Moolenbroek shared secret is supplied as a command line argument in clear text. 142*00b67f09SDavid van Moolenbroek This may be visible in the output from 143*00b67f09SDavid van Moolenbroek <span class="citerefentry"><span class="refentrytitle">ps</span>(1)</span> 144*00b67f09SDavid van Moolenbroek or in a history file maintained by the user's shell. 145*00b67f09SDavid van Moolenbroek </p> 146*00b67f09SDavid van Moolenbroek<p> 147*00b67f09SDavid van Moolenbroek With the 148*00b67f09SDavid van Moolenbroek <code class="option">-k</code> option, <span><strong class="command">nsupdate</strong></span> reads 149*00b67f09SDavid van Moolenbroek the shared secret from the file <em class="parameter"><code>keyfile</code></em>. 150*00b67f09SDavid van Moolenbroek Keyfiles may be in two formats: a single file containing 151*00b67f09SDavid van Moolenbroek a <code class="filename">named.conf</code>-format <span><strong class="command">key</strong></span> 152*00b67f09SDavid van Moolenbroek statement, which may be generated automatically by 153*00b67f09SDavid van Moolenbroek <span><strong class="command">ddns-confgen</strong></span>, or a pair of files whose names are 154*00b67f09SDavid van Moolenbroek of the format <code class="filename">K{name}.+157.+{random}.key</code> and 155*00b67f09SDavid van Moolenbroek <code class="filename">K{name}.+157.+{random}.private</code>, which can be 156*00b67f09SDavid van Moolenbroek generated by <span><strong class="command">dnssec-keygen</strong></span>. 157*00b67f09SDavid van Moolenbroek The <code class="option">-k</code> may also be used to specify a SIG(0) key used 158*00b67f09SDavid van Moolenbroek to authenticate Dynamic DNS update requests. In this case, the key 159*00b67f09SDavid van Moolenbroek specified is not an HMAC-MD5 key. 160*00b67f09SDavid van Moolenbroek </p> 161*00b67f09SDavid van Moolenbroek<p> 162*00b67f09SDavid van Moolenbroek <span><strong class="command">nsupdate</strong></span> can be run in a local-host only mode 163*00b67f09SDavid van Moolenbroek using the <code class="option">-l</code> flag. This sets the server address to 164*00b67f09SDavid van Moolenbroek localhost (disabling the <span><strong class="command">server</strong></span> so that the server 165*00b67f09SDavid van Moolenbroek address cannot be overridden). Connections to the local server will 166*00b67f09SDavid van Moolenbroek use a TSIG key found in <code class="filename">/var/run/named/session.key</code>, 167*00b67f09SDavid van Moolenbroek which is automatically generated by <span><strong class="command">named</strong></span> if any 168*00b67f09SDavid van Moolenbroek local master zone has set <span><strong class="command">update-policy</strong></span> to 169*00b67f09SDavid van Moolenbroek <span><strong class="command">local</strong></span>. The location of this key file can be 170*00b67f09SDavid van Moolenbroek overridden with the <code class="option">-k</code> option. 171*00b67f09SDavid van Moolenbroek </p> 172*00b67f09SDavid van Moolenbroek<p> 173*00b67f09SDavid van Moolenbroek By default, <span><strong class="command">nsupdate</strong></span> 174*00b67f09SDavid van Moolenbroek uses UDP to send update requests to the name server unless they are too 175*00b67f09SDavid van Moolenbroek large to fit in a UDP request in which case TCP will be used. 176*00b67f09SDavid van Moolenbroek The 177*00b67f09SDavid van Moolenbroek <code class="option">-v</code> 178*00b67f09SDavid van Moolenbroek option makes 179*00b67f09SDavid van Moolenbroek <span><strong class="command">nsupdate</strong></span> 180*00b67f09SDavid van Moolenbroek use a TCP connection. 181*00b67f09SDavid van Moolenbroek This may be preferable when a batch of update requests is made. 182*00b67f09SDavid van Moolenbroek </p> 183*00b67f09SDavid van Moolenbroek<p> 184*00b67f09SDavid van Moolenbroek The <code class="option">-p</code> sets the default port number to use for 185*00b67f09SDavid van Moolenbroek connections to a name server. The default is 53. 186*00b67f09SDavid van Moolenbroek </p> 187*00b67f09SDavid van Moolenbroek<p> 188*00b67f09SDavid van Moolenbroek The <code class="option">-t</code> option sets the maximum time an update request 189*00b67f09SDavid van Moolenbroek can 190*00b67f09SDavid van Moolenbroek take before it is aborted. The default is 300 seconds. Zero can be 191*00b67f09SDavid van Moolenbroek used 192*00b67f09SDavid van Moolenbroek to disable the timeout. 193*00b67f09SDavid van Moolenbroek </p> 194*00b67f09SDavid van Moolenbroek<p> 195*00b67f09SDavid van Moolenbroek The <code class="option">-u</code> option sets the UDP retry interval. The default 196*00b67f09SDavid van Moolenbroek is 197*00b67f09SDavid van Moolenbroek 3 seconds. If zero, the interval will be computed from the timeout 198*00b67f09SDavid van Moolenbroek interval 199*00b67f09SDavid van Moolenbroek and number of UDP retries. 200*00b67f09SDavid van Moolenbroek </p> 201*00b67f09SDavid van Moolenbroek<p> 202*00b67f09SDavid van Moolenbroek The <code class="option">-r</code> option sets the number of UDP retries. The 203*00b67f09SDavid van Moolenbroek default is 204*00b67f09SDavid van Moolenbroek 3. If zero, only one update request will be made. 205*00b67f09SDavid van Moolenbroek </p> 206*00b67f09SDavid van Moolenbroek<p> 207*00b67f09SDavid van Moolenbroek The <code class="option">-R <em class="replaceable"><code>randomdev</code></em></code> option 208*00b67f09SDavid van Moolenbroek specifies a source of randomness. If the operating system 209*00b67f09SDavid van Moolenbroek does not provide a <code class="filename">/dev/random</code> or 210*00b67f09SDavid van Moolenbroek equivalent device, the default source of randomness is keyboard 211*00b67f09SDavid van Moolenbroek input. <code class="filename">randomdev</code> specifies the name of 212*00b67f09SDavid van Moolenbroek a character device or file containing random data to be used 213*00b67f09SDavid van Moolenbroek instead of the default. The special value 214*00b67f09SDavid van Moolenbroek <code class="filename">keyboard</code> indicates that keyboard input 215*00b67f09SDavid van Moolenbroek should be used. This option may be specified multiple times. 216*00b67f09SDavid van Moolenbroek </p> 217*00b67f09SDavid van Moolenbroek<p> 218*00b67f09SDavid van Moolenbroek Other types can be entered using "TYPEXXXXX" where "XXXXX" is the 219*00b67f09SDavid van Moolenbroek decimal value of the type with no leading zeros. The rdata, 220*00b67f09SDavid van Moolenbroek if present, will be parsed using the UNKNOWN rdata format, 221*00b67f09SDavid van Moolenbroek (<backslash> <hash> <space> <length> 222*00b67f09SDavid van Moolenbroek <space> <hexstring>). 223*00b67f09SDavid van Moolenbroek </p> 224*00b67f09SDavid van Moolenbroek<p> 225*00b67f09SDavid van Moolenbroek The <code class="option">-T</code> and <code class="option">-P</code> options print out 226*00b67f09SDavid van Moolenbroek lists of non-meta types for which the type-specific presentation 227*00b67f09SDavid van Moolenbroek formats are known. <code class="option">-T</code> prints out the list of 228*00b67f09SDavid van Moolenbroek IANA-assigned types. <code class="option">-P</code> prints out the list of 229*00b67f09SDavid van Moolenbroek private types specific to <span><strong class="command">named</strong></span>. These options 230*00b67f09SDavid van Moolenbroek may be combined. <span><strong class="command">nsupdate</strong></span> will exit after the 231*00b67f09SDavid van Moolenbroek lists are printed. 232*00b67f09SDavid van Moolenbroek </p> 233*00b67f09SDavid van Moolenbroek<p> 234*00b67f09SDavid van Moolenbroek The -V option causes <span><strong class="command">nsupdate</strong></span> to print the 235*00b67f09SDavid van Moolenbroek version number and exit. 236*00b67f09SDavid van Moolenbroek </p> 237*00b67f09SDavid van Moolenbroek</div> 238*00b67f09SDavid van Moolenbroek<div class="refsect1" lang="en"> 239*00b67f09SDavid van Moolenbroek<a name="id2657457"></a><h2>INPUT FORMAT</h2> 240*00b67f09SDavid van Moolenbroek<p><span><strong class="command">nsupdate</strong></span> 241*00b67f09SDavid van Moolenbroek reads input from 242*00b67f09SDavid van Moolenbroek <em class="parameter"><code>filename</code></em> 243*00b67f09SDavid van Moolenbroek or standard input. 244*00b67f09SDavid van Moolenbroek Each command is supplied on exactly one line of input. 245*00b67f09SDavid van Moolenbroek Some commands are for administrative purposes. 246*00b67f09SDavid van Moolenbroek The others are either update instructions or prerequisite checks on the 247*00b67f09SDavid van Moolenbroek contents of the zone. 248*00b67f09SDavid van Moolenbroek These checks set conditions that some name or set of 249*00b67f09SDavid van Moolenbroek resource records (RRset) either exists or is absent from the zone. 250*00b67f09SDavid van Moolenbroek These conditions must be met if the entire update request is to succeed. 251*00b67f09SDavid van Moolenbroek Updates will be rejected if the tests for the prerequisite conditions 252*00b67f09SDavid van Moolenbroek fail. 253*00b67f09SDavid van Moolenbroek </p> 254*00b67f09SDavid van Moolenbroek<p> 255*00b67f09SDavid van Moolenbroek Every update request consists of zero or more prerequisites 256*00b67f09SDavid van Moolenbroek and zero or more updates. 257*00b67f09SDavid van Moolenbroek This allows a suitably authenticated update request to proceed if some 258*00b67f09SDavid van Moolenbroek specified resource records are present or missing from the zone. 259*00b67f09SDavid van Moolenbroek A blank input line (or the <span><strong class="command">send</strong></span> command) 260*00b67f09SDavid van Moolenbroek causes the 261*00b67f09SDavid van Moolenbroek accumulated commands to be sent as one Dynamic DNS update request to the 262*00b67f09SDavid van Moolenbroek name server. 263*00b67f09SDavid van Moolenbroek </p> 264*00b67f09SDavid van Moolenbroek<p> 265*00b67f09SDavid van Moolenbroek The command formats and their meaning are as follows: 266*00b67f09SDavid van Moolenbroek </p> 267*00b67f09SDavid van Moolenbroek<div class="variablelist"><dl> 268*00b67f09SDavid van Moolenbroek<dt><span class="term"> 269*00b67f09SDavid van Moolenbroek <span><strong class="command">server</strong></span> 270*00b67f09SDavid van Moolenbroek {servername} 271*00b67f09SDavid van Moolenbroek [port] 272*00b67f09SDavid van Moolenbroek </span></dt> 273*00b67f09SDavid van Moolenbroek<dd><p> 274*00b67f09SDavid van Moolenbroek Sends all dynamic update requests to the name server 275*00b67f09SDavid van Moolenbroek <em class="parameter"><code>servername</code></em>. 276*00b67f09SDavid van Moolenbroek When no server statement is provided, 277*00b67f09SDavid van Moolenbroek <span><strong class="command">nsupdate</strong></span> 278*00b67f09SDavid van Moolenbroek will send updates to the master server of the correct zone. 279*00b67f09SDavid van Moolenbroek The MNAME field of that zone's SOA record will identify the 280*00b67f09SDavid van Moolenbroek master 281*00b67f09SDavid van Moolenbroek server for that zone. 282*00b67f09SDavid van Moolenbroek <em class="parameter"><code>port</code></em> 283*00b67f09SDavid van Moolenbroek is the port number on 284*00b67f09SDavid van Moolenbroek <em class="parameter"><code>servername</code></em> 285*00b67f09SDavid van Moolenbroek where the dynamic update requests get sent. 286*00b67f09SDavid van Moolenbroek If no port number is specified, the default DNS port number of 287*00b67f09SDavid van Moolenbroek 53 is 288*00b67f09SDavid van Moolenbroek used. 289*00b67f09SDavid van Moolenbroek </p></dd> 290*00b67f09SDavid van Moolenbroek<dt><span class="term"> 291*00b67f09SDavid van Moolenbroek <span><strong class="command">local</strong></span> 292*00b67f09SDavid van Moolenbroek {address} 293*00b67f09SDavid van Moolenbroek [port] 294*00b67f09SDavid van Moolenbroek </span></dt> 295*00b67f09SDavid van Moolenbroek<dd><p> 296*00b67f09SDavid van Moolenbroek Sends all dynamic update requests using the local 297*00b67f09SDavid van Moolenbroek <em class="parameter"><code>address</code></em>. 298*00b67f09SDavid van Moolenbroek 299*00b67f09SDavid van Moolenbroek When no local statement is provided, 300*00b67f09SDavid van Moolenbroek <span><strong class="command">nsupdate</strong></span> 301*00b67f09SDavid van Moolenbroek will send updates using an address and port chosen by the 302*00b67f09SDavid van Moolenbroek system. 303*00b67f09SDavid van Moolenbroek <em class="parameter"><code>port</code></em> 304*00b67f09SDavid van Moolenbroek can additionally be used to make requests come from a specific 305*00b67f09SDavid van Moolenbroek port. 306*00b67f09SDavid van Moolenbroek If no port number is specified, the system will assign one. 307*00b67f09SDavid van Moolenbroek </p></dd> 308*00b67f09SDavid van Moolenbroek<dt><span class="term"> 309*00b67f09SDavid van Moolenbroek <span><strong class="command">zone</strong></span> 310*00b67f09SDavid van Moolenbroek {zonename} 311*00b67f09SDavid van Moolenbroek </span></dt> 312*00b67f09SDavid van Moolenbroek<dd><p> 313*00b67f09SDavid van Moolenbroek Specifies that all updates are to be made to the zone 314*00b67f09SDavid van Moolenbroek <em class="parameter"><code>zonename</code></em>. 315*00b67f09SDavid van Moolenbroek If no 316*00b67f09SDavid van Moolenbroek <em class="parameter"><code>zone</code></em> 317*00b67f09SDavid van Moolenbroek statement is provided, 318*00b67f09SDavid van Moolenbroek <span><strong class="command">nsupdate</strong></span> 319*00b67f09SDavid van Moolenbroek will attempt determine the correct zone to update based on the 320*00b67f09SDavid van Moolenbroek rest of the input. 321*00b67f09SDavid van Moolenbroek </p></dd> 322*00b67f09SDavid van Moolenbroek<dt><span class="term"> 323*00b67f09SDavid van Moolenbroek <span><strong class="command">class</strong></span> 324*00b67f09SDavid van Moolenbroek {classname} 325*00b67f09SDavid van Moolenbroek </span></dt> 326*00b67f09SDavid van Moolenbroek<dd><p> 327*00b67f09SDavid van Moolenbroek Specify the default class. 328*00b67f09SDavid van Moolenbroek If no <em class="parameter"><code>class</code></em> is specified, the 329*00b67f09SDavid van Moolenbroek default class is 330*00b67f09SDavid van Moolenbroek <em class="parameter"><code>IN</code></em>. 331*00b67f09SDavid van Moolenbroek </p></dd> 332*00b67f09SDavid van Moolenbroek<dt><span class="term"> 333*00b67f09SDavid van Moolenbroek <span><strong class="command">ttl</strong></span> 334*00b67f09SDavid van Moolenbroek {seconds} 335*00b67f09SDavid van Moolenbroek </span></dt> 336*00b67f09SDavid van Moolenbroek<dd><p> 337*00b67f09SDavid van Moolenbroek Specify the default time to live for records to be added. 338*00b67f09SDavid van Moolenbroek The value <em class="parameter"><code>none</code></em> will clear the default 339*00b67f09SDavid van Moolenbroek ttl. 340*00b67f09SDavid van Moolenbroek </p></dd> 341*00b67f09SDavid van Moolenbroek<dt><span class="term"> 342*00b67f09SDavid van Moolenbroek <span><strong class="command">key</strong></span> 343*00b67f09SDavid van Moolenbroek [hmac:] {keyname} 344*00b67f09SDavid van Moolenbroek {secret} 345*00b67f09SDavid van Moolenbroek </span></dt> 346*00b67f09SDavid van Moolenbroek<dd><p> 347*00b67f09SDavid van Moolenbroek Specifies that all updates are to be TSIG-signed using the 348*00b67f09SDavid van Moolenbroek <em class="parameter"><code>keyname</code></em> <em class="parameter"><code>secret</code></em> pair. 349*00b67f09SDavid van Moolenbroek If <em class="parameter"><code>hmac</code></em> is specified, then it sets the 350*00b67f09SDavid van Moolenbroek signing algorithm in use; the default is 351*00b67f09SDavid van Moolenbroek <code class="literal">hmac-md5</code>. The <span><strong class="command">key</strong></span> 352*00b67f09SDavid van Moolenbroek command overrides any key specified on the command line via 353*00b67f09SDavid van Moolenbroek <code class="option">-y</code> or <code class="option">-k</code>. 354*00b67f09SDavid van Moolenbroek </p></dd> 355*00b67f09SDavid van Moolenbroek<dt><span class="term"> 356*00b67f09SDavid van Moolenbroek <span><strong class="command">gsstsig</strong></span> 357*00b67f09SDavid van Moolenbroek </span></dt> 358*00b67f09SDavid van Moolenbroek<dd><p> 359*00b67f09SDavid van Moolenbroek Use GSS-TSIG to sign the updated. This is equivalent to 360*00b67f09SDavid van Moolenbroek specifying <code class="option">-g</code> on the commandline. 361*00b67f09SDavid van Moolenbroek </p></dd> 362*00b67f09SDavid van Moolenbroek<dt><span class="term"> 363*00b67f09SDavid van Moolenbroek <span><strong class="command">oldgsstsig</strong></span> 364*00b67f09SDavid van Moolenbroek </span></dt> 365*00b67f09SDavid van Moolenbroek<dd><p> 366*00b67f09SDavid van Moolenbroek Use the Windows 2000 version of GSS-TSIG to sign the updated. 367*00b67f09SDavid van Moolenbroek This is equivalent to specifying <code class="option">-o</code> on the 368*00b67f09SDavid van Moolenbroek commandline. 369*00b67f09SDavid van Moolenbroek </p></dd> 370*00b67f09SDavid van Moolenbroek<dt><span class="term"> 371*00b67f09SDavid van Moolenbroek <span><strong class="command">realm</strong></span> 372*00b67f09SDavid van Moolenbroek {[<span class="optional">realm_name</span>]} 373*00b67f09SDavid van Moolenbroek </span></dt> 374*00b67f09SDavid van Moolenbroek<dd><p> 375*00b67f09SDavid van Moolenbroek When using GSS-TSIG use <em class="parameter"><code>realm_name</code></em> rather 376*00b67f09SDavid van Moolenbroek than the default realm in <code class="filename">krb5.conf</code>. If no 377*00b67f09SDavid van Moolenbroek realm is specified the saved realm is cleared. 378*00b67f09SDavid van Moolenbroek </p></dd> 379*00b67f09SDavid van Moolenbroek<dt><span class="term"> 380*00b67f09SDavid van Moolenbroek <span><strong class="command">[<span class="optional">prereq</span>] nxdomain</strong></span> 381*00b67f09SDavid van Moolenbroek {domain-name} 382*00b67f09SDavid van Moolenbroek </span></dt> 383*00b67f09SDavid van Moolenbroek<dd><p> 384*00b67f09SDavid van Moolenbroek Requires that no resource record of any type exists with name 385*00b67f09SDavid van Moolenbroek <em class="parameter"><code>domain-name</code></em>. 386*00b67f09SDavid van Moolenbroek </p></dd> 387*00b67f09SDavid van Moolenbroek<dt><span class="term"> 388*00b67f09SDavid van Moolenbroek <span><strong class="command">[<span class="optional">prereq</span>] yxdomain</strong></span> 389*00b67f09SDavid van Moolenbroek {domain-name} 390*00b67f09SDavid van Moolenbroek </span></dt> 391*00b67f09SDavid van Moolenbroek<dd><p> 392*00b67f09SDavid van Moolenbroek Requires that 393*00b67f09SDavid van Moolenbroek <em class="parameter"><code>domain-name</code></em> 394*00b67f09SDavid van Moolenbroek exists (has as at least one resource record, of any type). 395*00b67f09SDavid van Moolenbroek </p></dd> 396*00b67f09SDavid van Moolenbroek<dt><span class="term"> 397*00b67f09SDavid van Moolenbroek <span><strong class="command">[<span class="optional">prereq</span>] nxrrset</strong></span> 398*00b67f09SDavid van Moolenbroek {domain-name} 399*00b67f09SDavid van Moolenbroek [class] 400*00b67f09SDavid van Moolenbroek {type} 401*00b67f09SDavid van Moolenbroek </span></dt> 402*00b67f09SDavid van Moolenbroek<dd><p> 403*00b67f09SDavid van Moolenbroek Requires that no resource record exists of the specified 404*00b67f09SDavid van Moolenbroek <em class="parameter"><code>type</code></em>, 405*00b67f09SDavid van Moolenbroek <em class="parameter"><code>class</code></em> 406*00b67f09SDavid van Moolenbroek and 407*00b67f09SDavid van Moolenbroek <em class="parameter"><code>domain-name</code></em>. 408*00b67f09SDavid van Moolenbroek If 409*00b67f09SDavid van Moolenbroek <em class="parameter"><code>class</code></em> 410*00b67f09SDavid van Moolenbroek is omitted, IN (internet) is assumed. 411*00b67f09SDavid van Moolenbroek </p></dd> 412*00b67f09SDavid van Moolenbroek<dt><span class="term"> 413*00b67f09SDavid van Moolenbroek <span><strong class="command">[<span class="optional">prereq</span>] yxrrset</strong></span> 414*00b67f09SDavid van Moolenbroek {domain-name} 415*00b67f09SDavid van Moolenbroek [class] 416*00b67f09SDavid van Moolenbroek {type} 417*00b67f09SDavid van Moolenbroek </span></dt> 418*00b67f09SDavid van Moolenbroek<dd><p> 419*00b67f09SDavid van Moolenbroek This requires that a resource record of the specified 420*00b67f09SDavid van Moolenbroek <em class="parameter"><code>type</code></em>, 421*00b67f09SDavid van Moolenbroek <em class="parameter"><code>class</code></em> 422*00b67f09SDavid van Moolenbroek and 423*00b67f09SDavid van Moolenbroek <em class="parameter"><code>domain-name</code></em> 424*00b67f09SDavid van Moolenbroek must exist. 425*00b67f09SDavid van Moolenbroek If 426*00b67f09SDavid van Moolenbroek <em class="parameter"><code>class</code></em> 427*00b67f09SDavid van Moolenbroek is omitted, IN (internet) is assumed. 428*00b67f09SDavid van Moolenbroek </p></dd> 429*00b67f09SDavid van Moolenbroek<dt><span class="term"> 430*00b67f09SDavid van Moolenbroek <span><strong class="command">[<span class="optional">prereq</span>] yxrrset</strong></span> 431*00b67f09SDavid van Moolenbroek {domain-name} 432*00b67f09SDavid van Moolenbroek [class] 433*00b67f09SDavid van Moolenbroek {type} 434*00b67f09SDavid van Moolenbroek {data...} 435*00b67f09SDavid van Moolenbroek </span></dt> 436*00b67f09SDavid van Moolenbroek<dd><p> 437*00b67f09SDavid van Moolenbroek The 438*00b67f09SDavid van Moolenbroek <em class="parameter"><code>data</code></em> 439*00b67f09SDavid van Moolenbroek from each set of prerequisites of this form 440*00b67f09SDavid van Moolenbroek sharing a common 441*00b67f09SDavid van Moolenbroek <em class="parameter"><code>type</code></em>, 442*00b67f09SDavid van Moolenbroek <em class="parameter"><code>class</code></em>, 443*00b67f09SDavid van Moolenbroek and 444*00b67f09SDavid van Moolenbroek <em class="parameter"><code>domain-name</code></em> 445*00b67f09SDavid van Moolenbroek are combined to form a set of RRs. This set of RRs must 446*00b67f09SDavid van Moolenbroek exactly match the set of RRs existing in the zone at the 447*00b67f09SDavid van Moolenbroek given 448*00b67f09SDavid van Moolenbroek <em class="parameter"><code>type</code></em>, 449*00b67f09SDavid van Moolenbroek <em class="parameter"><code>class</code></em>, 450*00b67f09SDavid van Moolenbroek and 451*00b67f09SDavid van Moolenbroek <em class="parameter"><code>domain-name</code></em>. 452*00b67f09SDavid van Moolenbroek The 453*00b67f09SDavid van Moolenbroek <em class="parameter"><code>data</code></em> 454*00b67f09SDavid van Moolenbroek are written in the standard text representation of the resource 455*00b67f09SDavid van Moolenbroek record's 456*00b67f09SDavid van Moolenbroek RDATA. 457*00b67f09SDavid van Moolenbroek </p></dd> 458*00b67f09SDavid van Moolenbroek<dt><span class="term"> 459*00b67f09SDavid van Moolenbroek <span><strong class="command">[<span class="optional">update</span>] del[<span class="optional">ete</span>]</strong></span> 460*00b67f09SDavid van Moolenbroek {domain-name} 461*00b67f09SDavid van Moolenbroek [ttl] 462*00b67f09SDavid van Moolenbroek [class] 463*00b67f09SDavid van Moolenbroek [type [data...]] 464*00b67f09SDavid van Moolenbroek </span></dt> 465*00b67f09SDavid van Moolenbroek<dd><p> 466*00b67f09SDavid van Moolenbroek Deletes any resource records named 467*00b67f09SDavid van Moolenbroek <em class="parameter"><code>domain-name</code></em>. 468*00b67f09SDavid van Moolenbroek If 469*00b67f09SDavid van Moolenbroek <em class="parameter"><code>type</code></em> 470*00b67f09SDavid van Moolenbroek and 471*00b67f09SDavid van Moolenbroek <em class="parameter"><code>data</code></em> 472*00b67f09SDavid van Moolenbroek is provided, only matching resource records will be removed. 473*00b67f09SDavid van Moolenbroek The internet class is assumed if 474*00b67f09SDavid van Moolenbroek <em class="parameter"><code>class</code></em> 475*00b67f09SDavid van Moolenbroek is not supplied. The 476*00b67f09SDavid van Moolenbroek <em class="parameter"><code>ttl</code></em> 477*00b67f09SDavid van Moolenbroek is ignored, and is only allowed for compatibility. 478*00b67f09SDavid van Moolenbroek </p></dd> 479*00b67f09SDavid van Moolenbroek<dt><span class="term"> 480*00b67f09SDavid van Moolenbroek <span><strong class="command">[<span class="optional">update</span>] add</strong></span> 481*00b67f09SDavid van Moolenbroek {domain-name} 482*00b67f09SDavid van Moolenbroek {ttl} 483*00b67f09SDavid van Moolenbroek [class] 484*00b67f09SDavid van Moolenbroek {type} 485*00b67f09SDavid van Moolenbroek {data...} 486*00b67f09SDavid van Moolenbroek </span></dt> 487*00b67f09SDavid van Moolenbroek<dd><p> 488*00b67f09SDavid van Moolenbroek Adds a new resource record with the specified 489*00b67f09SDavid van Moolenbroek <em class="parameter"><code>ttl</code></em>, 490*00b67f09SDavid van Moolenbroek <em class="parameter"><code>class</code></em> 491*00b67f09SDavid van Moolenbroek and 492*00b67f09SDavid van Moolenbroek <em class="parameter"><code>data</code></em>. 493*00b67f09SDavid van Moolenbroek </p></dd> 494*00b67f09SDavid van Moolenbroek<dt><span class="term"> 495*00b67f09SDavid van Moolenbroek <span><strong class="command">show</strong></span> 496*00b67f09SDavid van Moolenbroek </span></dt> 497*00b67f09SDavid van Moolenbroek<dd><p> 498*00b67f09SDavid van Moolenbroek Displays the current message, containing all of the 499*00b67f09SDavid van Moolenbroek prerequisites and 500*00b67f09SDavid van Moolenbroek updates specified since the last send. 501*00b67f09SDavid van Moolenbroek </p></dd> 502*00b67f09SDavid van Moolenbroek<dt><span class="term"> 503*00b67f09SDavid van Moolenbroek <span><strong class="command">send</strong></span> 504*00b67f09SDavid van Moolenbroek </span></dt> 505*00b67f09SDavid van Moolenbroek<dd><p> 506*00b67f09SDavid van Moolenbroek Sends the current message. This is equivalent to entering a 507*00b67f09SDavid van Moolenbroek blank line. 508*00b67f09SDavid van Moolenbroek </p></dd> 509*00b67f09SDavid van Moolenbroek<dt><span class="term"> 510*00b67f09SDavid van Moolenbroek <span><strong class="command">answer</strong></span> 511*00b67f09SDavid van Moolenbroek </span></dt> 512*00b67f09SDavid van Moolenbroek<dd><p> 513*00b67f09SDavid van Moolenbroek Displays the answer. 514*00b67f09SDavid van Moolenbroek </p></dd> 515*00b67f09SDavid van Moolenbroek<dt><span class="term"> 516*00b67f09SDavid van Moolenbroek <span><strong class="command">debug</strong></span> 517*00b67f09SDavid van Moolenbroek </span></dt> 518*00b67f09SDavid van Moolenbroek<dd><p> 519*00b67f09SDavid van Moolenbroek Turn on debugging. 520*00b67f09SDavid van Moolenbroek </p></dd> 521*00b67f09SDavid van Moolenbroek<dt><span class="term"> 522*00b67f09SDavid van Moolenbroek <span><strong class="command">version</strong></span> 523*00b67f09SDavid van Moolenbroek </span></dt> 524*00b67f09SDavid van Moolenbroek<dd><p> 525*00b67f09SDavid van Moolenbroek Print version number. 526*00b67f09SDavid van Moolenbroek </p></dd> 527*00b67f09SDavid van Moolenbroek<dt><span class="term"> 528*00b67f09SDavid van Moolenbroek <span><strong class="command">help</strong></span> 529*00b67f09SDavid van Moolenbroek </span></dt> 530*00b67f09SDavid van Moolenbroek<dd><p> 531*00b67f09SDavid van Moolenbroek Print a list of commands. 532*00b67f09SDavid van Moolenbroek </p></dd> 533*00b67f09SDavid van Moolenbroek</dl></div> 534*00b67f09SDavid van Moolenbroek<p> 535*00b67f09SDavid van Moolenbroek </p> 536*00b67f09SDavid van Moolenbroek<p> 537*00b67f09SDavid van Moolenbroek Lines beginning with a semicolon are comments and are ignored. 538*00b67f09SDavid van Moolenbroek </p> 539*00b67f09SDavid van Moolenbroek</div> 540*00b67f09SDavid van Moolenbroek<div class="refsect1" lang="en"> 541*00b67f09SDavid van Moolenbroek<a name="id2689776"></a><h2>EXAMPLES</h2> 542*00b67f09SDavid van Moolenbroek<p> 543*00b67f09SDavid van Moolenbroek The examples below show how 544*00b67f09SDavid van Moolenbroek <span><strong class="command">nsupdate</strong></span> 545*00b67f09SDavid van Moolenbroek could be used to insert and delete resource records from the 546*00b67f09SDavid van Moolenbroek <span class="type">example.com</span> 547*00b67f09SDavid van Moolenbroek zone. 548*00b67f09SDavid van Moolenbroek Notice that the input in each example contains a trailing blank line so 549*00b67f09SDavid van Moolenbroek that 550*00b67f09SDavid van Moolenbroek a group of commands are sent as one dynamic update request to the 551*00b67f09SDavid van Moolenbroek master name server for 552*00b67f09SDavid van Moolenbroek <span class="type">example.com</span>. 553*00b67f09SDavid van Moolenbroek 554*00b67f09SDavid van Moolenbroek </p> 555*00b67f09SDavid van Moolenbroek<pre class="programlisting"> 556*00b67f09SDavid van Moolenbroek# nsupdate 557*00b67f09SDavid van Moolenbroek> update delete oldhost.example.com A 558*00b67f09SDavid van Moolenbroek> update add newhost.example.com 86400 A 172.16.1.1 559*00b67f09SDavid van Moolenbroek> send 560*00b67f09SDavid van Moolenbroek</pre> 561*00b67f09SDavid van Moolenbroek<p> 562*00b67f09SDavid van Moolenbroek </p> 563*00b67f09SDavid van Moolenbroek<p> 564*00b67f09SDavid van Moolenbroek Any A records for 565*00b67f09SDavid van Moolenbroek <span class="type">oldhost.example.com</span> 566*00b67f09SDavid van Moolenbroek are deleted. 567*00b67f09SDavid van Moolenbroek And an A record for 568*00b67f09SDavid van Moolenbroek <span class="type">newhost.example.com</span> 569*00b67f09SDavid van Moolenbroek with IP address 172.16.1.1 is added. 570*00b67f09SDavid van Moolenbroek The newly-added record has a 1 day TTL (86400 seconds). 571*00b67f09SDavid van Moolenbroek </p> 572*00b67f09SDavid van Moolenbroek<pre class="programlisting"> 573*00b67f09SDavid van Moolenbroek# nsupdate 574*00b67f09SDavid van Moolenbroek> prereq nxdomain nickname.example.com 575*00b67f09SDavid van Moolenbroek> update add nickname.example.com 86400 CNAME somehost.example.com 576*00b67f09SDavid van Moolenbroek> send 577*00b67f09SDavid van Moolenbroek</pre> 578*00b67f09SDavid van Moolenbroek<p> 579*00b67f09SDavid van Moolenbroek </p> 580*00b67f09SDavid van Moolenbroek<p> 581*00b67f09SDavid van Moolenbroek The prerequisite condition gets the name server to check that there 582*00b67f09SDavid van Moolenbroek are no resource records of any type for 583*00b67f09SDavid van Moolenbroek <span class="type">nickname.example.com</span>. 584*00b67f09SDavid van Moolenbroek 585*00b67f09SDavid van Moolenbroek If there are, the update request fails. 586*00b67f09SDavid van Moolenbroek If this name does not exist, a CNAME for it is added. 587*00b67f09SDavid van Moolenbroek This ensures that when the CNAME is added, it cannot conflict with the 588*00b67f09SDavid van Moolenbroek long-standing rule in RFC 1034 that a name must not exist as any other 589*00b67f09SDavid van Moolenbroek record type if it exists as a CNAME. 590*00b67f09SDavid van Moolenbroek (The rule has been updated for DNSSEC in RFC 2535 to allow CNAMEs to have 591*00b67f09SDavid van Moolenbroek RRSIG, DNSKEY and NSEC records.) 592*00b67f09SDavid van Moolenbroek </p> 593*00b67f09SDavid van Moolenbroek</div> 594*00b67f09SDavid van Moolenbroek<div class="refsect1" lang="en"> 595*00b67f09SDavid van Moolenbroek<a name="id2689826"></a><h2>FILES</h2> 596*00b67f09SDavid van Moolenbroek<div class="variablelist"><dl> 597*00b67f09SDavid van Moolenbroek<dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt> 598*00b67f09SDavid van Moolenbroek<dd><p> 599*00b67f09SDavid van Moolenbroek used to identify default name server 600*00b67f09SDavid van Moolenbroek </p></dd> 601*00b67f09SDavid van Moolenbroek<dt><span class="term"><code class="constant">/var/run/named/session.key</code></span></dt> 602*00b67f09SDavid van Moolenbroek<dd><p> 603*00b67f09SDavid van Moolenbroek sets the default TSIG key for use in local-only mode 604*00b67f09SDavid van Moolenbroek </p></dd> 605*00b67f09SDavid van Moolenbroek<dt><span class="term"><code class="constant">K{name}.+157.+{random}.key</code></span></dt> 606*00b67f09SDavid van Moolenbroek<dd><p> 607*00b67f09SDavid van Moolenbroek base-64 encoding of HMAC-MD5 key created by 608*00b67f09SDavid van Moolenbroek <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>. 609*00b67f09SDavid van Moolenbroek </p></dd> 610*00b67f09SDavid van Moolenbroek<dt><span class="term"><code class="constant">K{name}.+157.+{random}.private</code></span></dt> 611*00b67f09SDavid van Moolenbroek<dd><p> 612*00b67f09SDavid van Moolenbroek base-64 encoding of HMAC-MD5 key created by 613*00b67f09SDavid van Moolenbroek <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>. 614*00b67f09SDavid van Moolenbroek </p></dd> 615*00b67f09SDavid van Moolenbroek</dl></div> 616*00b67f09SDavid van Moolenbroek</div> 617*00b67f09SDavid van Moolenbroek<div class="refsect1" lang="en"> 618*00b67f09SDavid van Moolenbroek<a name="id2689909"></a><h2>SEE ALSO</h2> 619*00b67f09SDavid van Moolenbroek<p> 620*00b67f09SDavid van Moolenbroek <em class="citetitle">RFC 2136</em>, 621*00b67f09SDavid van Moolenbroek <em class="citetitle">RFC 3007</em>, 622*00b67f09SDavid van Moolenbroek <em class="citetitle">RFC 2104</em>, 623*00b67f09SDavid van Moolenbroek <em class="citetitle">RFC 2845</em>, 624*00b67f09SDavid van Moolenbroek <em class="citetitle">RFC 1034</em>, 625*00b67f09SDavid van Moolenbroek <em class="citetitle">RFC 2535</em>, 626*00b67f09SDavid van Moolenbroek <em class="citetitle">RFC 2931</em>, 627*00b67f09SDavid van Moolenbroek <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>, 628*00b67f09SDavid van Moolenbroek <span class="citerefentry"><span class="refentrytitle">ddns-confgen</span>(8)</span>, 629*00b67f09SDavid van Moolenbroek <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>. 630*00b67f09SDavid van Moolenbroek </p> 631*00b67f09SDavid van Moolenbroek</div> 632*00b67f09SDavid van Moolenbroek<div class="refsect1" lang="en"> 633*00b67f09SDavid van Moolenbroek<a name="id2689966"></a><h2>BUGS</h2> 634*00b67f09SDavid van Moolenbroek<p> 635*00b67f09SDavid van Moolenbroek The TSIG key is redundantly stored in two separate files. 636*00b67f09SDavid van Moolenbroek This is a consequence of nsupdate using the DST library 637*00b67f09SDavid van Moolenbroek for its cryptographic operations, and may change in future 638*00b67f09SDavid van Moolenbroek releases. 639*00b67f09SDavid van Moolenbroek </p> 640*00b67f09SDavid van Moolenbroek</div> 641*00b67f09SDavid van Moolenbroek</div> 642*00b67f09SDavid van Moolenbroek<div class="navfooter"> 643*00b67f09SDavid van Moolenbroek<hr> 644*00b67f09SDavid van Moolenbroek<table width="100%" summary="Navigation footer"> 645*00b67f09SDavid van Moolenbroek<tr> 646*00b67f09SDavid van Moolenbroek<td width="40%" align="left"> 647*00b67f09SDavid van Moolenbroek<a accesskey="p" href="man.named-rrchecker.html">Prev</a>�</td> 648*00b67f09SDavid van Moolenbroek<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td> 649*00b67f09SDavid van Moolenbroek<td width="40%" align="right">�<a accesskey="n" href="man.rndc.html">Next</a> 650*00b67f09SDavid van Moolenbroek</td> 651*00b67f09SDavid van Moolenbroek</tr> 652*00b67f09SDavid van Moolenbroek<tr> 653*00b67f09SDavid van Moolenbroek<td width="40%" align="left" valign="top"> 654*00b67f09SDavid van Moolenbroek<span class="application">named-rrchecker</span>�</td> 655*00b67f09SDavid van Moolenbroek<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td> 656*00b67f09SDavid van Moolenbroek<td width="40%" align="right" valign="top">�<span class="application">rndc</span> 657*00b67f09SDavid van Moolenbroek</td> 658*00b67f09SDavid van Moolenbroek</tr> 659*00b67f09SDavid van Moolenbroek</table> 660*00b67f09SDavid van Moolenbroek</div> 661*00b67f09SDavid van Moolenbroek<p style="text-align: center;">BIND 9.10.2-P4</p> 662*00b67f09SDavid van Moolenbroek</body> 663*00b67f09SDavid van Moolenbroek</html> 664