external/bsd/bind/dist/doc/arm/Bv9ARM.ch03.html

   1 <!--
   2  - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
   3  - Copyright (C) 2000-2003 Internet Software Consortium.
   4  -
   5  - Permission to use, copy, modify, and/or distribute this software for any
   6  - purpose with or without fee is hereby granted, provided that the above
   7  - copyright notice and this permission notice appear in all copies.
   8  -
   9  - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  10  - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  11  - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
  12  - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
  13  - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
  14  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  15  - PERFORMANCE OF THIS SOFTWARE.
  16 -->
  17 <!-- Id -->
  18 <html>
  19 <head>
  20 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
  21 <title>Chapter 3. Name Server Configuration</title>
  22 <meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
  23 <link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
  24 <link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
  25 <link rel="prev" href="Bv9ARM.ch02.html" title="Chapter 2. BIND Resource Requirements">
  26 <link rel="next" href="Bv9ARM.ch04.html" title="Chapter 4. Advanced DNS Features">
  27 </head>
  28 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
  29 <div class="navheader">
  30 <table width="100%" summary="Navigation header">
  31 <tr><th colspan="3" align="center">Chapter 3. Name Server Configuration</th></tr>
  32 <tr>
  33 <td width="20%" align="left">
  34 <a accesskey="p" href="Bv9ARM.ch02.html">Prev</a> </td>
  35 <th width="60%" align="center"> </th>
  36 <td width="20%" align="right"> <a accesskey="n" href="Bv9ARM.ch04.html">Next</a>
  37 </td>
  38 </tr>
  39 </table>
  40 <hr>
  41 </div>
  42 <div class="chapter" lang="en">
  43 <div class="titlepage"><div><div><h2 class="title">
  44 <a name="Bv9ARM.ch03"></a>Chapter 3. Name Server Configuration</h2></div></div></div>
  45 <div class="toc">
  46 <p><b>Table of Contents</b></p>
  47 <dl>
  48 <dt><span class="sect1"><a href="Bv9ARM.ch03.html#sample_configuration">Sample Configurations</a></span></dt>
  49 <dd><dl>
  50 <dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2567998">A Caching-only Name Server</a></span></dt>
  51 <dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568014">An Authoritative-only Name Server</a></span></dt>
  52 </dl></dd>
  53 <dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568037">Load Balancing</a></span></dt>
  54 <dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568391">Name Server Operations</a></span></dt>
  55 <dd><dl>
  56 <dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568396">Tools for Use With the Name Server Daemon</a></span></dt>
  57 <dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2569465">Signals</a></span></dt>
  58 </dl></dd>
  59 </dl>
  60 </div>
  61 <p>
  62       In this chapter we provide some suggested configurations along
  63       with guidelines for their use.  We suggest reasonable values for
  64       certain option settings.
  65     </p>
  66 <div class="sect1" lang="en">
  67 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
  68 <a name="sample_configuration"></a>Sample Configurations</h2></div></div></div>
  69 <div class="sect2" lang="en">
  70 <div class="titlepage"><div><div><h3 class="title">
  71 <a name="id2567998"></a>A Caching-only Name Server</h3></div></div></div>
  72 <p>
  73           The following sample configuration is appropriate for a caching-only
  74           name server for use by clients internal to a corporation.  All
  75           queries
  76           from outside clients are refused using the <span><strong class="command">allow-query</strong></span>
  77           option.  Alternatively, the same effect could be achieved using
  78           suitable
  79           firewall rules.
  80         </p>
  81 <pre class="programlisting">
  82 // Two corporate subnets we wish to allow queries from.
  83 acl corpnets { 192.168.4.0/24; 192.168.7.0/24; };
  84 options {
  85      // Working directory
  86      directory "/etc/namedb";
  87
  88      allow-query { corpnets; };
  89 };
  90 // Provide a reverse mapping for the loopback
  91 // address 127.0.0.1
  92 zone "0.0.127.in-addr.arpa" {
  93      type master;
  94      file "localhost.rev";
  95      notify no;
  96 };
  97 </pre>
  98 </div>
  99 <div class="sect2" lang="en">
 100 <div class="titlepage"><div><div><h3 class="title">
 101 <a name="id2568014"></a>An Authoritative-only Name Server</h3></div></div></div>
 102 <p>
 103           This sample configuration is for an authoritative-only server
 104           that is the master server for "<code class="filename">example.com</code>"
 105           and a slave for the subdomain "<code class="filename">eng.example.com</code>".
 106         </p>
 107 <pre class="programlisting">
 108 options {
 109      // Working directory
 110      directory "/etc/namedb";
 111      // Do not allow access to cache
 112      allow-query-cache { none; };
 113      // This is the default
 114      allow-query { any; };
 115      // Do not provide recursive service
 116      recursion no;
 117 };
 118
 119 // Provide a reverse mapping for the loopback
 120 // address 127.0.0.1
 121 zone "0.0.127.in-addr.arpa" {
 122      type master;
 123      file "localhost.rev";
 124      notify no;
 125 };
 126 // We are the master server for example.com
 127 zone "example.com" {
 128      type master;
 129      file "example.com.db";
 130      // IP addresses of slave servers allowed to
 131      // transfer example.com
 132      allow-transfer {
 133           192.168.4.14;
 134           192.168.5.53;
 135      };
 136 };
 137 // We are a slave server for eng.example.com
 138 zone "eng.example.com" {
 139      type slave;
 140      file "eng.example.com.bk";
 141      // IP address of eng.example.com master server
 142      masters { 192.168.4.12; };
 143 };
 144 </pre>
 145 </div>
 146 </div>
 147 <div class="sect1" lang="en">
 148 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 149 <a name="id2568037"></a>Load Balancing</h2></div></div></div>
 150 <p>
 151         A primitive form of load balancing can be achieved in
 152         the <acronym class="acronym">DNS</acronym> by using multiple records
 153         (such as multiple A records) for one name.
 154       </p>
 155 <p>
 156         For example, if you have three WWW servers with network addresses
 157         of 10.0.0.1, 10.0.0.2 and 10.0.0.3, a set of records such as the
 158         following means that clients will connect to each machine one third
 159         of the time:
 160       </p>
 161 <div class="informaltable"><table border="1">
 162 <colgroup>
 163 <col>
 164 <col>
 165 <col>
 166 <col>
 167 <col>
 168 </colgroup>
 169 <tbody>
 170 <tr>
 171 <td>
 172                 <p>
 173                   Name
 174                 </p>
 175               </td>
 176 <td>
 177                 <p>
 178                   TTL
 179                 </p>
 180               </td>
 181 <td>
 182                 <p>
 183                   CLASS
 184                 </p>
 185               </td>
 186 <td>
 187                 <p>
 188                   TYPE
 189                 </p>
 190               </td>
 191 <td>
 192                 <p>
 193                   Resource Record (RR) Data
 194                 </p>
 195               </td>
 196 </tr>
 197 <tr>
 198 <td>
 199                 <p>
 200                   <code class="literal">www</code>
 201                 </p>
 202               </td>
 203 <td>
 204                 <p>
 205                   <code class="literal">600</code>
 206                 </p>
 207               </td>
 208 <td>
 209                 <p>
 210                   <code class="literal">IN</code>
 211                 </p>
 212               </td>
 213 <td>
 214                 <p>
 215                   <code class="literal">A</code>
 216                 </p>
 217               </td>
 218 <td>
 219                 <p>
 220                   <code class="literal">10.0.0.1</code>
 221                 </p>
 222               </td>
 223 </tr>
 224 <tr>
 225 <td>
 226                 <p></p>
 227               </td>
 228 <td>
 229                 <p>
 230                   <code class="literal">600</code>
 231                 </p>
 232               </td>
 233 <td>
 234                 <p>
 235                   <code class="literal">IN</code>
 236                 </p>
 237               </td>
 238 <td>
 239                 <p>
 240                   <code class="literal">A</code>
 241                 </p>
 242               </td>
 243 <td>
 244                 <p>
 245                   <code class="literal">10.0.0.2</code>
 246                 </p>
 247               </td>
 248 </tr>
 249 <tr>
 250 <td>
 251                 <p></p>
 252               </td>
 253 <td>
 254                 <p>
 255                   <code class="literal">600</code>
 256                 </p>
 257               </td>
 258 <td>
 259                 <p>
 260                   <code class="literal">IN</code>
 261                 </p>
 262               </td>
 263 <td>
 264                 <p>
 265                   <code class="literal">A</code>
 266                 </p>
 267               </td>
 268 <td>
 269                 <p>
 270                   <code class="literal">10.0.0.3</code>
 271                 </p>
 272               </td>
 273 </tr>
 274 </tbody>
 275 </table></div>
 276 <p>
 277         When a resolver queries for these records, <acronym class="acronym">BIND</acronym> will rotate
 278         them and respond to the query with the records in a different
 279         order.  In the example above, clients will randomly receive
 280         records in the order 1, 2, 3; 2, 3, 1; and 3, 1, 2. Most clients
 281         will use the first record returned and discard the rest.
 282       </p>
 283 <p>
 284         For more detail on ordering responses, check the
 285         <span><strong class="command">rrset-order</strong></span> sub-statement in the
 286         <span><strong class="command">options</strong></span> statement, see
 287         <a href="Bv9ARM.ch06.html#rrset_ordering">RRset Ordering</a>.
 288       </p>
 289 </div>
 290 <div class="sect1" lang="en">
 291 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 292 <a name="id2568391"></a>Name Server Operations</h2></div></div></div>
 293 <div class="sect2" lang="en">
 294 <div class="titlepage"><div><div><h3 class="title">
 295 <a name="id2568396"></a>Tools for Use With the Name Server Daemon</h3></div></div></div>
 296 <p>
 297           This section describes several indispensable diagnostic,
 298           administrative and monitoring tools available to the system
 299           administrator for controlling and debugging the name server
 300           daemon.
 301         </p>
 302 <div class="sect3" lang="en">
 303 <div class="titlepage"><div><div><h4 class="title">
 304 <a name="diagnostic_tools"></a>Diagnostic Tools</h4></div></div></div>
 305 <p>
 306             The <span><strong class="command">dig</strong></span>, <span><strong class="command">host</strong></span>, and
 307             <span><strong class="command">nslookup</strong></span> programs are all command
 308             line tools
 309             for manually querying name servers.  They differ in style and
 310             output format.
 311           </p>
 312 <div class="variablelist"><dl>
 313 <dt><span class="term"><a name="dig"></a><span><strong class="command">dig</strong></span></span></dt>
 314 <dd>
 315 <p>
 316                   The domain information groper (<span><strong class="command">dig</strong></span>)
 317                   is the most versatile and complete of these lookup tools.
 318                   It has two modes: simple interactive
 319                   mode for a single query, and batch mode which executes a
 320                   query for
 321                   each in a list of several query lines. All query options are
 322                   accessible
 323                   from the command line.
 324                 </p>
 325 <div class="cmdsynopsis"><p><code class="command">dig</code>  [@<em class="replaceable"><code>server</code></em>]  <em class="replaceable"><code>domain</code></em>  [<em class="replaceable"><code>query-type</code></em>] [<em class="replaceable"><code>query-class</code></em>] [+<em class="replaceable"><code>query-option</code></em>] [-<em class="replaceable"><code>dig-option</code></em>] [%<em class="replaceable"><code>comment</code></em>]</p></div>
 326 <p>
 327                   The usual simple use of <span><strong class="command">dig</strong></span> will take the form
 328                 </p>
 329 <p>
 330                   <span><strong class="command">dig @server domain query-type query-class</strong></span>
 331                 </p>
 332 <p>
 333                   For more information and a list of available commands and
 334                   options, see the <span><strong class="command">dig</strong></span> man
 335                   page.
 336                 </p>
 337 </dd>
 338 <dt><span class="term"><span><strong class="command">host</strong></span></span></dt>
 339 <dd>
 340 <p>
 341                   The <span><strong class="command">host</strong></span> utility emphasizes
 342                   simplicity
 343                   and ease of use.  By default, it converts
 344                   between host names and Internet addresses, but its
 345                   functionality
 346                   can be extended with the use of options.
 347                 </p>
 348 <div class="cmdsynopsis"><p><code class="command">host</code>  [-aCdlnrsTwv] [-c <em class="replaceable"><code>class</code></em>] [-N <em class="replaceable"><code>ndots</code></em>] [-t <em class="replaceable"><code>type</code></em>] [-W <em class="replaceable"><code>timeout</code></em>] [-R <em class="replaceable"><code>retries</code></em>] [-m <em class="replaceable"><code>flag</code></em>] [-4] [-6]  <em class="replaceable"><code>hostname</code></em>  [<em class="replaceable"><code>server</code></em>]</p></div>
 349 <p>
 350                   For more information and a list of available commands and
 351                   options, see the <span><strong class="command">host</strong></span> man
 352                   page.
 353                 </p>
 354 </dd>
 355 <dt><span class="term"><span><strong class="command">nslookup</strong></span></span></dt>
 356 <dd>
 357 <p><span><strong class="command">nslookup</strong></span>
 358                   has two modes: interactive and
 359                   non-interactive. Interactive mode allows the user to
 360                   query name servers for information about various
 361                   hosts and domains or to print a list of hosts in a
 362                   domain. Non-interactive mode is used to print just
 363                   the name and requested information for a host or
 364                   domain.
 365                 </p>
 366 <div class="cmdsynopsis"><p><code class="command">nslookup</code>  [-option...] [[<em class="replaceable"><code>host-to-find</code></em>] |  [- [server]]]</p></div>
 367 <p>
 368                   Interactive mode is entered when no arguments are given (the
 369                   default name server will be used) or when the first argument
 370                   is a
 371                   hyphen (`-') and the second argument is the host name or
 372                   Internet address
 373                   of a name server.
 374                 </p>
 375 <p>
 376                   Non-interactive mode is used when the name or Internet
 377                   address
 378                   of the host to be looked up is given as the first argument.
 379                   The
 380                   optional second argument specifies the host name or address
 381                   of a name server.
 382                 </p>
 383 <p>
 384                   Due to its arcane user interface and frequently inconsistent
 385                   behavior, we do not recommend the use of <span><strong class="command">nslookup</strong></span>.
 386                   Use <span><strong class="command">dig</strong></span> instead.
 387                 </p>
 388 </dd>
 389 </dl></div>
 390 </div>
 391 <div class="sect3" lang="en">
 392 <div class="titlepage"><div><div><h4 class="title">
 393 <a name="admin_tools"></a>Administrative Tools</h4></div></div></div>
 394 <p>
 395             Administrative tools play an integral part in the management
 396             of a server.
 397           </p>
 398 <div class="variablelist"><dl>
 399 <dt>
 400 <a name="named-checkconf"></a><span class="term"><span><strong class="command">named-checkconf</strong></span></span>
 401 </dt>
 402 <dd>
 403 <p>
 404                   The <span><strong class="command">named-checkconf</strong></span> program
 405                   checks the syntax of a <code class="filename">named.conf</code> file.
 406                 </p>
 407 <div class="cmdsynopsis"><p><code class="command">named-checkconf</code>  [-jvz] [-t <em class="replaceable"><code>directory</code></em>] [<em class="replaceable"><code>filename</code></em>]</p></div>
 408 </dd>
 409 <dt>
 410 <a name="named-checkzone"></a><span class="term"><span><strong class="command">named-checkzone</strong></span></span>
 411 </dt>
 412 <dd>
 413 <p>
 414                   The <span><strong class="command">named-checkzone</strong></span> program
 415                   checks a master file for
 416                   syntax and consistency.
 417                 </p>
 418 <div class="cmdsynopsis"><p><code class="command">named-checkzone</code>  [-djqvD] [-c <em class="replaceable"><code>class</code></em>] [-o <em class="replaceable"><code>output</code></em>] [-t <em class="replaceable"><code>directory</code></em>] [-w <em class="replaceable"><code>directory</code></em>] [-k <em class="replaceable"><code>(ignore|warn|fail)</code></em>] [-n <em class="replaceable"><code>(ignore|warn|fail)</code></em>] [-W <em class="replaceable"><code>(ignore|warn)</code></em>]  <em class="replaceable"><code>zone</code></em>  [<em class="replaceable"><code>filename</code></em>]</p></div>
 419 </dd>
 420 <dt>
 421 <a name="named-compilezone"></a><span class="term"><span><strong class="command">named-compilezone</strong></span></span>
 422 </dt>
 423 <dd><p>
 424                   Similar to <span><strong class="command">named-checkzone,</strong></span> but
 425                   it always dumps the zone content to a specified file
 426                   (typically in a different format).
 427                 </p></dd>
 428 <dt>
 429 <a name="rndc"></a><span class="term"><span><strong class="command">rndc</strong></span></span>
 430 </dt>
 431 <dd>
 432 <p>
 433                   The remote name daemon control
 434                   (<span><strong class="command">rndc</strong></span>) program allows the
 435                   system
 436                   administrator to control the operation of a name server.
 437                   Since <acronym class="acronym">BIND</acronym> 9.2, <span><strong class="command">rndc</strong></span>
 438                   supports all the commands of the BIND 8 <span><strong class="command">ndc</strong></span>
 439                   utility except <span><strong class="command">ndc start</strong></span> and
 440                   <span><strong class="command">ndc restart</strong></span>, which were also
 441                   not supported in <span><strong class="command">ndc</strong></span>'s
 442                   channel mode.
 443                   If you run <span><strong class="command">rndc</strong></span> without any
 444                   options
 445                   it will display a usage message as follows:
 446                 </p>
 447 <div class="cmdsynopsis"><p><code class="command">rndc</code>  [-c <em class="replaceable"><code>config</code></em>] [-s <em class="replaceable"><code>server</code></em>] [-p <em class="replaceable"><code>port</code></em>] [-y <em class="replaceable"><code>key</code></em>]  <em class="replaceable"><code>command</code></em>  [<em class="replaceable"><code>command</code></em>...]</p></div>
 448 <p>See <a href="man.rndc.html" title="rndc"><span class="refentrytitle"><span class="application">rndc</span></span>(8)</a> for details of
 449                   the available <span><strong class="command">rndc</strong></span> commands.
 450                 </p>
 451 <p>
 452                   <span><strong class="command">rndc</strong></span> requires a configuration file,
 453                   since all
 454                   communication with the server is authenticated with
 455                   digital signatures that rely on a shared secret, and
 456                   there is no way to provide that secret other than with a
 457                   configuration file.  The default location for the
 458                   <span><strong class="command">rndc</strong></span> configuration file is
 459                   <code class="filename">/etc/rndc.conf</code>, but an
 460                   alternate
 461                   location can be specified with the <code class="option">-c</code>
 462                   option.  If the configuration file is not found,
 463                   <span><strong class="command">rndc</strong></span> will also look in
 464                   <code class="filename">/etc/rndc.key</code> (or whatever
 465                   <code class="varname">sysconfdir</code> was defined when
 466                   the <acronym class="acronym">BIND</acronym> build was
 467                   configured).
 468                   The <code class="filename">rndc.key</code> file is
 469                   generated by
 470                   running <span><strong class="command">rndc-confgen -a</strong></span> as
 471                   described in
 472                   <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and
 473           Usage">the section called &#8220;<span><strong class="command">controls</strong></span> Statement Definition and
 474           Usage&#8221;</a>.
 475                 </p>
 476 <p>
 477                   The format of the configuration file is similar to
 478                   that of <code class="filename">named.conf</code>, but
 479                   limited to
 480                   only four statements, the <span><strong class="command">options</strong></span>,
 481                   <span><strong class="command">key</strong></span>, <span><strong class="command">server</strong></span> and
 482                   <span><strong class="command">include</strong></span>
 483                   statements.  These statements are what associate the
 484                   secret keys to the servers with which they are meant to
 485                   be shared.  The order of statements is not
 486                   significant.
 487                 </p>
 488 <p>
 489                   The <span><strong class="command">options</strong></span> statement has
 490                   three clauses:
 491                   <span><strong class="command">default-server</strong></span>, <span><strong class="command">default-key</strong></span>,
 492                   and <span><strong class="command">default-port</strong></span>.
 493                   <span><strong class="command">default-server</strong></span> takes a
 494                   host name or address argument  and represents the server
 495                   that will
 496                   be contacted if no <code class="option">-s</code>
 497                   option is provided on the command line.
 498                   <span><strong class="command">default-key</strong></span> takes
 499                   the name of a key as its argument, as defined by a <span><strong class="command">key</strong></span> statement.
 500                   <span><strong class="command">default-port</strong></span> specifies the
 501                   port to which
 502                   <span><strong class="command">rndc</strong></span> should connect if no
 503                   port is given on the command line or in a
 504                   <span><strong class="command">server</strong></span> statement.
 505                 </p>
 506 <p>
 507                   The <span><strong class="command">key</strong></span> statement defines a
 508                   key to be used
 509                   by <span><strong class="command">rndc</strong></span> when authenticating
 510                   with
 511                   <span><strong class="command">named</strong></span>.  Its syntax is
 512                   identical to the
 513                   <span><strong class="command">key</strong></span> statement in <code class="filename">named.conf</code>.
 514                   The keyword <strong class="userinput"><code>key</code></strong> is
 515                   followed by a key name, which must be a valid
 516                   domain name, though it need not actually be hierarchical;
 517                   thus,
 518                   a string like "<strong class="userinput"><code>rndc_key</code></strong>" is a valid
 519                   name.
 520                   The <span><strong class="command">key</strong></span> statement has two
 521                   clauses:
 522                   <span><strong class="command">algorithm</strong></span> and <span><strong class="command">secret</strong></span>.
 523                   While the configuration parser will accept any string as the
 524                   argument
 525                   to algorithm, currently only the strings
 526                   "<strong class="userinput"><code>hmac-md5</code></strong>",
 527                   "<strong class="userinput"><code>hmac-sha1</code></strong>",
 528                   "<strong class="userinput"><code>hmac-sha224</code></strong>",
 529                   "<strong class="userinput"><code>hmac-sha256</code></strong>",
 530                   "<strong class="userinput"><code>hmac-sha384</code></strong>"
 531                   and "<strong class="userinput"><code>hmac-sha512</code></strong>"
 532                   have any meaning.  The secret is a base-64 encoded string
 533                   as specified in RFC 3548.
 534                 </p>
 535 <p>
 536                   The <span><strong class="command">server</strong></span> statement
 537                   associates a key
 538                   defined using the <span><strong class="command">key</strong></span>
 539                   statement with a server.
 540                   The keyword <strong class="userinput"><code>server</code></strong> is followed by a
 541                   host name or address.  The <span><strong class="command">server</strong></span> statement
 542                   has two clauses: <span><strong class="command">key</strong></span> and <span><strong class="command">port</strong></span>.
 543                   The <span><strong class="command">key</strong></span> clause specifies the
 544                   name of the key
 545                   to be used when communicating with this server, and the
 546                   <span><strong class="command">port</strong></span> clause can be used to
 547                   specify the port <span><strong class="command">rndc</strong></span> should
 548                   connect
 549                   to on the server.
 550                 </p>
 551 <p>
 552                   A sample minimal configuration file is as follows:
 553                 </p>
 554 <pre class="programlisting">
 555 key rndc_key {
 556      algorithm "hmac-sha256";
 557      secret
 558        "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
 559 };
 560 options {
 561      default-server 127.0.0.1;
 562      default-key    rndc_key;
 563 };
 564 </pre>
 565 <p>
 566                   This file, if installed as <code class="filename">/etc/rndc.conf</code>,
 567                   would allow the command:
 568                 </p>
 569 <p>
 570                   <code class="prompt">$ </code><strong class="userinput"><code>rndc reload</code></strong>
 571                 </p>
 572 <p>
 573                   to connect to 127.0.0.1 port 953 and cause the name server
 574                   to reload, if a name server on the local machine were
 575                   running with
 576                   following controls statements:
 577                 </p>
 578 <pre class="programlisting">
 579 controls {
 580         inet 127.0.0.1
 581             allow { localhost; } keys { rndc_key; };
 582 };
 583 </pre>
 584 <p>
 585                   and it had an identical key statement for
 586                   <code class="literal">rndc_key</code>.
 587                 </p>
 588 <p>
 589                   Running the <span><strong class="command">rndc-confgen</strong></span>
 590                   program will
 591                   conveniently create a <code class="filename">rndc.conf</code>
 592                   file for you, and also display the
 593                   corresponding <span><strong class="command">controls</strong></span>
 594                   statement that you need to
 595                   add to <code class="filename">named.conf</code>.
 596                   Alternatively,
 597                   you can run <span><strong class="command">rndc-confgen -a</strong></span>
 598                   to set up
 599                   a <code class="filename">rndc.key</code> file and not
 600                   modify
 601                   <code class="filename">named.conf</code> at all.
 602                 </p>
 603 </dd>
 604 </dl></div>
 605 </div>
 606 </div>
 607 <div class="sect2" lang="en">
 608 <div class="titlepage"><div><div><h3 class="title">
 609 <a name="id2569465"></a>Signals</h3></div></div></div>
 610 <p>
 611           Certain UNIX signals cause the name server to take specific
 612           actions, as described in the following table.  These signals can
 613           be sent using the <span><strong class="command">kill</strong></span> command.
 614         </p>
 615 <div class="informaltable"><table border="1">
 616 <colgroup>
 617 <col>
 618 <col>
 619 </colgroup>
 620 <tbody>
 621 <tr>
 622 <td>
 623                   <p><span><strong class="command">SIGHUP</strong></span></p>
 624                 </td>
 625 <td>
 626                   <p>
 627                     Causes the server to read <code class="filename">named.conf</code> and
 628                     reload the database.
 629                   </p>
 630                 </td>
 631 </tr>
 632 <tr>
 633 <td>
 634                   <p><span><strong class="command">SIGTERM</strong></span></p>
 635                 </td>
 636 <td>
 637                   <p>
 638                     Causes the server to clean up and exit.
 639                   </p>
 640                 </td>
 641 </tr>
 642 <tr>
 643 <td>
 644                   <p><span><strong class="command">SIGINT</strong></span></p>
 645                 </td>
 646 <td>
 647                   <p>
 648                     Causes the server to clean up and exit.
 649                   </p>
 650                 </td>
 651 </tr>
 652 </tbody>
 653 </table></div>
 654 </div>
 655 </div>
 656 </div>
 657 <div class="navfooter">
 658 <hr>
 659 <table width="100%" summary="Navigation footer">
 660 <tr>
 661 <td width="40%" align="left">
 662 <a accesskey="p" href="Bv9ARM.ch02.html">Prev</a> </td>
 663 <td width="20%" align="center"> </td>
 664 <td width="40%" align="right"> <a accesskey="n" href="Bv9ARM.ch04.html">Next</a>
 665 </td>
 666 </tr>
 667 <tr>
 668 <td width="40%" align="left" valign="top">Chapter 2. <acronym class="acronym">BIND</acronym> Resource Requirements </td>
 669 <td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
 670 <td width="40%" align="right" valign="top"> Chapter 4. Advanced DNS Features</td>
 671 </tr>
 672 </table>
 673 </div>
 674 <p style="text-align: center;">BIND 9.10.2-P4</p>
 675 </body>
 676 </html>