| blob | 738418c85994396387f97fcc2f182046c7768a74 |
1 .\" $NetBSD: nslint.8,v 1.1.1.3 2014/12/10 03:34:34 christos Exp $
2 .\"
3 .\" @(#) Id: nslint.8 238 2009-03-14 05:43:37Z leres (LBL)
4 .\"
5 .\" Copyright (c) 1994, 1996, 1997, 1999, 2001, 2002, 2009
6 .\" The Regents of the University of California. All rights reserved.
7 .\" All rights reserved.
8 .\"
9 .\" Redistribution and use in source and binary forms, with or without
10 .\" modification, are permitted provided that: (1) source code distributions
11 .\" retain the above copyright notice and this paragraph in its entirety, (2)
12 .\" distributions including binary code include the above copyright notice and
13 .\" this paragraph in its entirety in the documentation or other materials
14 .\" provided with the distribution, and (3) all advertising materials mentioning
15 .\" features or use of this software display the following acknowledgement:
16 .\" ``This product includes software developed by the University of California,
17 .\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
18 .\" the University nor the names of its contributors may be used to endorse
19 .\" or promote products derived from this software without specific prior
20 .\" written permission.
21 .\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
22 .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
23 .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
24 .\"
25 .TH nslint 8 "2 May 2002"
26 .UC 4
27 .SH NAME
28 nslint - perform consistency checks on dns files
29 .SH SYNOPSIS
30 .B nslint
31 [
32 .B -d
33 ] [
34 .B -c
35 .I named.conf
36 ] [
37 .B -C
38 .I nslint.conf
39 ]
40 .br
41 .B nslint
42 [
43 .B -d
44 ] [
45 .B -b
46 .I named.boot
47 ] [
48 .B -B
49 .I nslint.boot
50 ]
51 .SH DESCRIPTION
52 .B Nslint
53 reads the nameserver configuration files and performs a number of
54 consistency checks on the dns records. If any problems are discovered,
55 error messages are displayed on
56 .I stderr
57 and
58 .B nslint
59 exits with a non-zero status.
60 .LP
61 Here is a partial list of errors
62 .B nslint
63 detects:
64 .IP
65 Records that are malformed.
66 .IP
67 Names that contain dots but are missing a trailing dot.
68 .IP
69 .B PTR
70 records with names that are missing a trailing dot.
71 .IP
72 Names that contain illegal characters (rfc1034).
73 .IP
74 .B A
75 records
76 without matching
77 .B PTR
78 records
79 .IP
80 .B PTR
81 records
82 without matching
83 .B A
84 records
85 .IP
86 Names with more than one address on the same subnet.
87 .IP
88 Addresses in use by more than one name.
89 .IP
90 Names with
91 .B CNAME
92 and other records (rfc1033).
93 .IP
94 Unknown service and/or protocol keywords in
95 .B WKS
96 records.
97 .IP
98 Missing semicolons and quotes.
99 .LP
100 .SH OPTIONS
101 .TP
102 .B -b
103 Specify an alternate
104 .I named.boot
105 file. The default is
106 .IR /etc/named.boot .
107 .TP
108 .TP
109 .B -c
110 Specify an alternate
111 .I named.conf
112 file. The default is
113 .IR /etc/named.conf .
114 .TP
115 .B -B
116 Specify an alternate
117 .I nslint.boot
118 file. The default is
119 .I nslint.boot
120 in the last
121 .B directory
122 line processed in
123 .I named.boot
124 (or the current working directory).
125 This file is processed like a second
126 .IR named.boot .
127 The most common use is to tell
128 .B nslint
129 about
130 .B A
131 records that match
132 .B PTR
133 records that point outside the domains listed in
134 .IR named.boot .
135 .TP
136 .B -C
137 Specify an alternate
138 .I nslint.conf
139 file. The default is
140 .I nslint.conf
141 in the last
142 .B directory
143 line processed in
144 .I named.conf
145 (or the current working directory).
146 This file is processed like a second
147 .IR named.conf .
148 .TP
149 .B -d
150 Raise the debugging level. Debugging information is
151 displayed on
152 .IR stdout .
153 .LP
154 .B Nslint
155 knows how to read
156 BIND 8 and 9's
157 .I named.conf
158 configuration file and also
159 older BIND's
160 .I named.boot
161 file. If both files exist,
162 .B nslint
163 will prefer
164 .I named.conf
165 (on the theory that you forgot to delete
166 .I named.boot
167 when you upgraded BIND).
168 .LP
169 .SH "ADVANCED CONFIGURATION"
170 There are some cases where it is necessary to use the
171 advanced configuration features of
172 .BR nslint .
173 Advanced configuration is done with the
174 .I nslint.conf
175 file. (You can also use
176 .I nslint.boot
177 which has a syntax similar to
178 .I named.boot
179 but is not described here.)
180 .LP
181 The most common is when a site has a demilitarized zone (DMZ).
182 The problem here is that the DMZ network will have
183 .B PTR
184 records for hosts outside its domain. For example lets say
185 we have
186 .I 128.0.rev
187 with:
188 .LP
189 .RS
190 .nf
191 .sp .5
192 1.1 604800 in ptr gateway.lbl.gov.
193 2.1 604800 in ptr gateway.es.net.
194 .sp .5
195 .fi
196 .RE
197 .LP
198 Obviously we will define an
199 .B A
200 record for
201 .I gateway.lbl.gov
202 pointing to
203 .I 128.0.1.1
204 but we will get errors because there is no
205 .B A
206 record defined for
207 .IR gateway.es.net .
208 The solution is to create a
209 .I nslint.conf
210 file (in the same directory as the other dns files)
211 with:
212 .LP
213 .RS
214 .nf
215 .sp .5
216 zone "es.net" {
217 .RS
218 type master;
219 file "nslint.es.net";
220 .RE
221 };
222 .sp .5
223 .fi
224 .RE
225 .LP
226 And then create the file
227 .I nslint.es.net
228 with:
229 .LP
230 .RS
231 .nf
232 .sp .5
233 gateway 1 in a 128.0.1.2
234 .sp .5
235 .fi
236 .RE
237 .LP
238 Another problem occurs when there is a
239 .B CNAME
240 that points to a host outside the local domains. Let's say we have
241 .I info.lbl.gov
242 pointing to
243 .IR larry.es.net :
244 .LP
245 .RS
246 .nf
247 .sp .5
248 info 604800 in cname larry.es.net.
249 .sp .5
250 .fi
251 .RE
252 .LP
253 In this case we would need:
254 .LP
255 .RS
256 .nf
257 .sp .5
258 zone "es.net" {
259 .RS
260 type master;
261 file "nslint.es.net";
262 .RE
263 };
264 .sp .5
265 .fi
266 .RE
267 .LP
268 in
269 .I nslint.boot
270 and:
271 .LP
272 .RS
273 .nf
274 .sp .5
275 larry 1 in txt "place holder"
276 .sp .5
277 .fi
278 .RE
279 .LP
280 .IR nslint.es.net .
281 .LP
282 One last problem
283 when a pseudo host is setup to allow two more
284 more actual hosts provide a service. For, let's say that
285 .I lbl.gov
286 contains:
287 .LP
288 .RS
289 .nf
290 .sp .5
291 server 604800 in a 128.0.6.6
292 server 604800 in a 128.0.6.94
293 ;
294 tom 604800 in a 128.0.6.6
295 tom 604800 in mx 0 lbl.gov.
296 ;
297 jerry 604800 in a 128.0.6.94
298 jerry 604800 in mx 0 lbl.gov.
299 .sp .5
300 .fi
301 .RE
302 .LP
303 In this case
304 .B nslint
305 would complain about missing
306 .B PTR
307 records and ip addresses in use by more than one host.
308 To suppress these warnings, add you would the lines:
309 .LP
310 .RS
311 .nf
312 .sp .5
313 zone "lbl.gov" {
314 .RS
315 type master;
316 file "nslint.lbl.gov";
317 .RE
318 };
319 .LP
320 zone "0.128.in-addr.arpa" {
321 .RS
322 type master;
323 file "nslint.128.0.rev";
324 .RE
325 };
326 .sp .5
327 .fi
328 .RE
329 .LP
330 to
331 .I nslint.conf
332 and create
333 .I nslint.lbl.gov
334 with:
335 .LP
336 .RS
337 .nf
338 .sp .5
339 server 1 in allowdupa 128.0.6.6
340 server 1 in allowdupa 128.0.6.94
341 .sp .5
342 .fi
343 .RE
344 .LP
345 and create
346 .I nslint.128.0.rev
347 with:
348 .LP
349 .RS
350 .nf
351 .sp .5
352 6.6 604800 in ptr server.lbl.gov.
353 94.6 604800 in ptr server.lbl.gov.
354 .sp .5
355 .fi
356 .RE
357 .LP
358 In this example, the
359 .B allowdupa
360 keyword tells
361 .B nslint
362 that it's ok for
363 .I 128.0.6.6
364 and
365 .I 128.0.6.94
366 to be shared by
367 .IR server.lbl.gov ,
368 .IR tom.lbl.gov ,
369 and
370 .IR jerry.lbl.gov .
371 .LP
372 Another
373 .B nslint
374 feature helps detect hosts that have mistakenly had two ip addresses
375 assigned on the same subnet. This can happen when two different
376 people request an ip address for the same hostname or when someone
377 forgets an address has been assigned and requests a new number.
378 .LP
379 To detect such
380 .B A
381 records, add a
382 .B nslint
383 section to your
384 .I nslint.conf
385 containing something similar to:
386 .LP
387 .RS
388 .nf
389 .sp .5
390 nslint {
391 .RS
392 network "128.0.6/22";
393 .RE
394 };
395 .sp .5
396 .fi
397 .RE
398 .LP
399 or:
400 .LP
401 .RS
402 .nf
403 .sp .5
404 nslint {
405 .RS
406 network "128.0.6 255.255.252.0";
407 .RE
408 };
409 .sp .5
410 .fi
411 .RE
412 .LP
413 These two examples are are equivalent ways of saying the same thing;
414 that subnet
415 .I 128.0.6
416 has a 22 bit wide subnet mask.
417 .LP
418 Using information from the above
419 .B network
420 statement,
421 .B nslint
422 would would flag the following
423 .B A
424 records as being in error:
425 .LP
426 .RS
427 .nf
428 .sp .5
429 server 1 in a 128.0.6.48
430 server 1 in a 128.0.7.16
431 .sp .5
432 .fi
433 .RE
434 .LP
435 Note that if you specify any
436 .B network
437 lines in your
438 .I nslint.conf
439 file,
440 .B nslint
441 requires you to include lines for all networks;
442 otherwise you might forget to add
443 .B network
444 lines for new networks.
445 .LP
446 Sometimes you have a zone that
447 .B nslint
448 just can't deal with. A good example is
449 a dynamic dns zone. To handle this, you can
450 add the following to
451 .IB nslint.com :
452 .LP
453 .RS
454 .nf
455 .sp .5
456 nslint {
457 .RS
458 ignorezone "dhcp.lbl.gov";
459 .RE
460 };
461 .sp .5
462 .fi
463 .RE
464 .LP
465 This will suppress "name referenced without other records" warnings.
466 .LP
467 .SH FILES
468 .na
469 .nh
470 .nf
471 /etc/named.conf - default named configuration file
472 /etc/named.boot - old style named configuration file
473 nslint.conf - default nslint configuration file
474 nslint.boot - old style nslint configuration file
475 .ad
476 .hy
477 .fi
478 .LP
479 .SH "SEE ALSO"
480 .na
481 .nh
482 .IR named (8),
483 rfc1033,
484 rfc1034
485 .ad
486 .hy
487 .SH AUTHOR
488 Craig Leres of the
489 Lawrence Berkeley National Laboratory, University of California, Berkeley, CA.
490 .LP
491 The current version is available via anonymous ftp:
492 .LP
493 .RS
494 .I ftp://ftp.ee.lbl.gov/nslint.tar.gz
495 .RE
496 .SH BUGS
497 Please send bug reports to nslint@ee.lbl.gov.
498 .LP
499 Not everyone is guaranteed to agree with all the checks done.