| blob | 7c246f8a793cdabaa051a1f7f8e00d9478d127d0 |
1 .\" $NetBSD$
2 .\"
3 .\" @(#) Id: nslint.8,v 1.1 2001/12/21 04:12:03 marka Exp (LBL)
4 .\"
5 .\" Copyright (c) 1994, 1996, 1997, 1999, 2001
6 .\" The Regents of the University of California. All rights reserved.
7 .\" All rights reserved.
8 .\"
9 .\" Redistribution and use in source and binary forms, with or without
10 .\" modification, are permitted provided that: (1) source code distributions
11 .\" retain the above copyright notice and this paragraph in its entirety, (2)
12 .\" distributions including binary code include the above copyright notice and
13 .\" this paragraph in its entirety in the documentation or other materials
14 .\" provided with the distribution, and (3) all advertising materials mentioning
15 .\" features or use of this software display the following acknowledgement:
16 .\" ``This product includes software developed by the University of California,
17 .\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
18 .\" the University nor the names of its contributors may be used to endorse
19 .\" or promote products derived from this software without specific prior
20 .\" written permission.
21 .\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
22 .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
23 .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
24 .\"
25 .TH nslint 8 "20 March 2001"
26 .UC 4
27 .SH NAME
28 nslint - perform consistency checks on dns files
29 .SH SYNOPSIS
30 .B nslint
31 [
32 .B -d
33 ] [
34 .B -b
35 .I named.boot
36 ] [
37 .B -B
38 .I nslint.boot
39 ]
40 .br
41 .B nslint
42 [
43 .B -d
44 ] [
45 .B -c
46 .I named.conf
47 ] [
48 .B -C
49 .I nslint.conf
50 ]
51 .SH DESCRIPTION
52 .B Nslint
53 reads the nameserver configuration files and performs a number of
54 consistency checks on the dns records. If any problems are discovered,
55 error messages are displayed on
56 .I stderr
57 and
58 .B nslint
59 exits with a non-zero status.
60 .LP
61 Here is a short list of errors
62 .B nslint
63 detects:
64 .IP
65 Records that are malformed.
66 .IP
67 Names that contain dots but are missing a trailing dot.
68 .IP
69 .B PTR
70 records with names that are missing a trailing dot.
71 .IP
72 Names that contain illegal characters (rfc1034).
73 .IP
74 .B A
75 records
76 without matching
77 .B PTR
78 records
79 .IP
80 .B PTR
81 records
82 without matching
83 .B A
84 records
85 .IP
86 Names with more than one address on the same subnet.
87 .IP
88 Addresses in use by more than one name.
89 .IP
90 Names with
91 .B CNAME
92 and other records (rfc1033).
93 .IP
94 Unknown service and/or protocol keywords in
95 .B WKS
96 records.
97 .IP
98 Missing quotes.
99 .LP
100 .SH OPTIONS
101 .TP
102 .B -b
103 Specify an alternate
104 .I named.boot
105 file. The default is
106 .IR /etc/named.boot .
107 .TP
108 .TP
109 .B -c
110 Specify an alternate
111 .I named.conf
112 file. The default is
113 .IR /etc/named.conf .
114 .TP
115 .B -B
116 Specify an alternate
117 .I nslint.boot
118 file. The default is
119 .I nslint.boot
120 in the last
121 .B directory
122 line processed in
123 .I named.boot
124 (or the current working directory).
125 This file is processed like a second
126 .IR named.boot .
127 The most common use is to tell
128 .B nslint
129 about
130 .B A
131 records that match
132 .B PTR
133 records that point outside the domains listed in
134 .IR named.boot .
135 .TP
136 .B -C
137 Specify an alternate
138 .I nslint.conf
139 file. The default is
140 .I nslint.conf
141 in the last
142 .B directory
143 line processed in
144 .I named.conf
145 (or the current working directory).
146 This file is processed like a second
147 .IR named.conf .
148 .TP
149 .B -d
150 Raise the debugging level. Debugging information is
151 displayed on
152 .IR stdout .
153 .LP
154 .B Nslint
155 knows how to read old style
156 .I named.boot
157 and BIND 8's new
158 .I named.conf
159 files. If both files exist,
160 .B nslint
161 will prefer
162 .I named.conf
163 (on the theory that you forgot to delete
164 .I named.boot
165 when you upgraded to BIND 8).
166 .LP
167 .SH "ADVANCED CONFIGURATION"
168 There are some cases where it is necessary to use the
169 advanced configuration features of
170 .BR nslint .
171 Advanced configuration is done with the
172 .I nslint.boot
173 file.
174 .LP
175 The most common is when a site has a demilitarized zone (DMZ).
176 The problem here is that the DMZ network will have
177 .B PTR
178 records for hosts outside its domain. For example lets say
179 we have
180 .I 128.0.rev
181 with:
182 .LP
183 .RS
184 .nf
185 .sp .5
186 1.1 604800 in ptr gateway.lbl.gov.
187 2.1 604800 in ptr gateway.es.net.
188 .sp .5
189 .fi
190 .RE
191 .LP
192 Obviously we will define an
193 .B A
194 record for
195 .I gateway.lbl.gov
196 pointing to
197 .I 128.0.1.1
198 but we will get errors because there is no
199 .B A
200 record defined for
201 .IR gateway.es.net .
202 The solution is to create a
203 .I nslint.boot
204 file (in the same directory as the other dns files)
205 with:
206 .LP
207 .RS
208 .nf
209 .sp .5
210 primary es.net nslint.es.net
211 .sp .5
212 .fi
213 .RE
214 .LP
215 And then create the file
216 .I nslint.es.net
217 with:
218 .LP
219 .RS
220 .nf
221 .sp .5
222 gateway 1 in a 128.0.1.2
223 .sp .5
224 .fi
225 .RE
226 .LP
227 Another problem occurs when there is a
228 .B CNAME
229 that points to a host outside the local domains. Let's say we have
230 .I info.lbl.gov
231 pointing to
232 .IR larry.es.net :
233 .LP
234 .RS
235 .nf
236 .sp .5
237 info 604800 in cname larry.es.net.
238 .sp .5
239 .fi
240 .RE
241 .LP
242 In this case we would need:
243 .LP
244 .RS
245 .nf
246 .sp .5
247 primary es.net nslint.es.net
248 .sp .5
249 .fi
250 .RE
251 .LP
252 in
253 .I nslint.boot
254 and:
255 .LP
256 .RS
257 .nf
258 .sp .5
259 larry 1 in txt "place holder"
260 .sp .5
261 .fi
262 .RE
263 .LP
264 .IR nslint.es.net .
265 .LP
266 One last problem
267 when a pseudo host is setup to allow two more
268 more actual hosts provide a service. For, let's say that
269 .I lbl.gov
270 contains:
271 .LP
272 .RS
273 .nf
274 .sp .5
275 server 604800 in a 128.0.6.6
276 server 604800 in a 128.0.6.94
277 ;
278 tom 604800 in a 128.0.6.6
279 tom 604800 in mx 0 lbl.gov.
280 ;
281 jerry 604800 in a 128.0.6.94
282 jerry 604800 in mx 0 lbl.gov.
283 .sp .5
284 .fi
285 .RE
286 .LP
287 In this case
288 .B nslint
289 would complain about missing
290 .B PTR
291 records and ip addresses in use by more than one host.
292 To suppress these warnings, add you would the lines:
293 .LP
294 .RS
295 .nf
296 .sp .5
297 primary lbl.gov nslint.lbl.gov
298 primary 0.128.in-addr.arpa nslint.128.0.rev
299 .sp .5
300 .fi
301 .RE
302 .LP
303 to
304 .I nslint.boot
305 and create
306 .I nslint.lbl.gov
307 with:
308 .LP
309 .RS
310 .nf
311 .sp .5
312 server 1 in allowdupa 128.0.6.6
313 server 1 in allowdupa 128.0.6.94
314 .sp .5
315 .fi
316 .RE
317 .LP
318 and create
319 .I nslint.128.0.rev
320 with:
321 .LP
322 .RS
323 .nf
324 .sp .5
325 6.6 604800 in ptr server.lbl.gov.
326 94.6 604800 in ptr server.lbl.gov.
327 .sp .5
328 .fi
329 .RE
330 .LP
331 In this example, the
332 .B allowdupa
333 keyword tells
334 .B nslint
335 that it's ok for
336 .I 128.0.6.6
337 and
338 .I 128.0.6.94
339 to be shared by
340 .IR server.lbl.gov ,
341 .IR tom.lbl.gov ,
342 and
343 .IR jerry.lbl.gov .
344 .LP
345 One last
346 .B nslint
347 feature helps detect hosts that have mistakenly had two ip addresses
348 assigned on the same subnet. This can happen when two different
349 people request an ip address for the same hostname or when someone
350 forgets an address has been assigned and requests a new number.
351 .LP
352 To detect such
353 .B A
354 records, add a
355 .B nslint
356 section to your
357 .I nslint.conf
358 containing something similar to:
359 .LP
360 .RS
361 .nf
362 .sp .5
363 nslint {
364 .RS
365 network "128.0.6/22";
366 network "128.0.6 255.255.252.0";
367 .RE
368 };
369 .sp .5
370 .fi
371 .RE
372 .LP
373 The two network lines in this example are equivalent ways of saying the same
374 thing; that subnet
375 .I 128.0.6
376 has a 22 bit wide subnet mask.
377 .LP
378 If you are using
379 .IR nslint.boot ,
380 the syntax would be:
381 .LP
382 .RS
383 .nf
384 .sp .5
385 network 128.0.6/22
386 network 128.0.6 255.255.252.0
387 .sp .5
388 .fi
389 .RE
390 .LP
391 Again this shows two ways of saying the same thing.
392 .LP
393 Using information from the above
394 .B network
395 statement,
396 .B nslint
397 would would flag the following
398 .B A
399 records as being in error:
400 .LP
401 .RS
402 .nf
403 .sp .5
404 server 1 in a 128.0.6.48
405 server 1 in a 128.0.7.16
406 .sp .5
407 .fi
408 .RE
409 .LP
410 Note that if you specify any
411 .B network
412 lines in your
413 .I nslint.conf
414 or
415 .I nslint.boot
416 files,
417 .B nslint
418 requires you to include lines for all networks;
419 otherwise you might forget to add
420 .B network
421 lines for new networks.
422 .LP
423 .SH FILES
424 .na
425 .nh
426 .nf
427 /etc/named.boot - default named configuration file
428 nslint.boot - default nslint configuration file
429 .ad
430 .hy
431 .fi
432 .LP
433 .SH "SEE ALSO"
434 .na
435 .nh
436 .IR named (8),
437 rfc1033,
438 rfc1034
439 .ad
440 .hy
441 .SH AUTHOR
442 Craig Leres of the
443 Lawrence Berkeley National Laboratory, University of California, Berkeley, CA.
444 .LP
445 The current version is available via anonymous ftp:
446 .LP
447 .RS
448 .I ftp://ftp.ee.lbl.gov/nslint.tar.gz
449 .RE
450 .SH BUGS
451 Please send bug reports to nslint@ee.lbl.gov.
452 .LP
453 Not everyone is guaranteed to agree with all the checks done.