963 lines
16 KiB
HTML
963 lines
16 KiB
HTML
<!--
|
|
- Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
|
|
- Copyright (C) 2001-2003 Internet Software Consortium.
|
|
-
|
|
- Permission to use, copy, modify, and distribute this software for any
|
|
- purpose with or without fee is hereby granted, provided that the above
|
|
- copyright notice and this permission notice appear in all copies.
|
|
-
|
|
- THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
|
|
- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
- AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
|
|
- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
|
- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
|
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
|
- PERFORMANCE OF THIS SOFTWARE.
|
|
-->
|
|
|
|
<!-- $Id: nsupdate.html,v 1.9.2.3.2.5 2004/08/22 23:38:59 marka Exp $ -->
|
|
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML
|
|
><HEAD
|
|
><TITLE
|
|
>nsupdate</TITLE
|
|
><META
|
|
NAME="GENERATOR"
|
|
CONTENT="Modular DocBook HTML Stylesheet Version 1.7"></HEAD
|
|
><BODY
|
|
CLASS="REFENTRY"
|
|
BGCOLOR="#FFFFFF"
|
|
TEXT="#000000"
|
|
LINK="#0000FF"
|
|
VLINK="#840084"
|
|
ALINK="#0000FF"
|
|
><H1
|
|
><A
|
|
NAME="AEN1"
|
|
></A
|
|
>nsupdate</H1
|
|
><DIV
|
|
CLASS="REFNAMEDIV"
|
|
><A
|
|
NAME="AEN8"
|
|
></A
|
|
><H2
|
|
>Name</H2
|
|
>nsupdate -- Dynamic DNS update utility</DIV
|
|
><DIV
|
|
CLASS="REFSYNOPSISDIV"
|
|
><A
|
|
NAME="AEN11"
|
|
></A
|
|
><H2
|
|
>Synopsis</H2
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>nsupdate</B
|
|
> [<VAR
|
|
CLASS="OPTION"
|
|
>-d</VAR
|
|
>] [<VAR
|
|
CLASS="OPTION"
|
|
>-y <VAR
|
|
CLASS="REPLACEABLE"
|
|
>keyname:secret</VAR
|
|
></VAR
|
|
> | <VAR
|
|
CLASS="OPTION"
|
|
>-k <VAR
|
|
CLASS="REPLACEABLE"
|
|
>keyfile</VAR
|
|
></VAR
|
|
>] [<VAR
|
|
CLASS="OPTION"
|
|
>-t <VAR
|
|
CLASS="REPLACEABLE"
|
|
>timeout</VAR
|
|
></VAR
|
|
>] [<VAR
|
|
CLASS="OPTION"
|
|
>-u <VAR
|
|
CLASS="REPLACEABLE"
|
|
>udptimeout</VAR
|
|
></VAR
|
|
>] [<VAR
|
|
CLASS="OPTION"
|
|
>-r <VAR
|
|
CLASS="REPLACEABLE"
|
|
>udpretries</VAR
|
|
></VAR
|
|
>] [<VAR
|
|
CLASS="OPTION"
|
|
>-v</VAR
|
|
>] [filename]</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="REFSECT1"
|
|
><A
|
|
NAME="AEN35"
|
|
></A
|
|
><H2
|
|
>DESCRIPTION</H2
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>nsupdate</B
|
|
>
|
|
is used to submit Dynamic DNS Update requests as defined in RFC2136
|
|
to a name server.
|
|
This allows resource records to be added or removed from a zone
|
|
without manually editing the zone file.
|
|
A single update request can contain requests to add or remove more than one
|
|
resource record.</P
|
|
><P
|
|
>Zones that are under dynamic control via
|
|
<B
|
|
CLASS="COMMAND"
|
|
>nsupdate</B
|
|
>
|
|
or a DHCP server should not be edited by hand.
|
|
Manual edits could
|
|
conflict with dynamic updates and cause data to be lost.</P
|
|
><P
|
|
>The resource records that are dynamically added or removed with
|
|
<B
|
|
CLASS="COMMAND"
|
|
>nsupdate</B
|
|
>
|
|
have to be in the same zone.
|
|
Requests are sent to the zone's master server.
|
|
This is identified by the MNAME field of the zone's SOA record.</P
|
|
><P
|
|
>The
|
|
<VAR
|
|
CLASS="OPTION"
|
|
>-d</VAR
|
|
>
|
|
option makes
|
|
<B
|
|
CLASS="COMMAND"
|
|
>nsupdate</B
|
|
>
|
|
operate in debug mode.
|
|
This provides tracing information about the update requests that are
|
|
made and the replies received from the name server.</P
|
|
><P
|
|
>Transaction signatures can be used to authenticate the Dynamic DNS
|
|
updates.
|
|
These use the TSIG resource record type described in RFC2845 or the
|
|
SIG(0) record described in RFC3535 and RFC2931.
|
|
TSIG relies on a shared secret that should only be known to
|
|
<B
|
|
CLASS="COMMAND"
|
|
>nsupdate</B
|
|
> and the name server.
|
|
Currently, the only supported encryption algorithm for TSIG is
|
|
HMAC-MD5, which is defined in RFC 2104.
|
|
Once other algorithms are defined for TSIG, applications will need to
|
|
ensure they select the appropriate algorithm as well as the key when
|
|
authenticating each other.
|
|
For instance suitable
|
|
<SPAN
|
|
CLASS="TYPE"
|
|
>key</SPAN
|
|
>
|
|
and
|
|
<SPAN
|
|
CLASS="TYPE"
|
|
>server</SPAN
|
|
>
|
|
statements would be added to
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>/etc/named.conf</TT
|
|
>
|
|
so that the name server can associate the appropriate secret key
|
|
and algorithm with the IP address of the
|
|
client application that will be using TSIG authentication.
|
|
SIG(0) uses public key cryptography. To use a SIG(0) key, the public
|
|
key must be stored in a KEY record in a zone served by the name server.
|
|
<B
|
|
CLASS="COMMAND"
|
|
>nsupdate</B
|
|
>
|
|
does not read
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>/etc/named.conf</TT
|
|
>.</P
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>nsupdate</B
|
|
>
|
|
uses the
|
|
<VAR
|
|
CLASS="OPTION"
|
|
>-y</VAR
|
|
>
|
|
or
|
|
<VAR
|
|
CLASS="OPTION"
|
|
>-k</VAR
|
|
>
|
|
option (with an HMAC-MD5 key) to provide the shared secret needed to generate
|
|
a TSIG record for authenticating Dynamic DNS update requests.
|
|
These options are mutually exclusive.
|
|
With the
|
|
<VAR
|
|
CLASS="OPTION"
|
|
>-k</VAR
|
|
>
|
|
option,
|
|
<B
|
|
CLASS="COMMAND"
|
|
>nsupdate</B
|
|
>
|
|
reads the shared secret from the file
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>keyfile</VAR
|
|
>,
|
|
whose name is of the form
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>K{name}.+157.+{random}.private</TT
|
|
>.
|
|
For historical
|
|
reasons, the file
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>K{name}.+157.+{random}.key</TT
|
|
>
|
|
must also be present. When the
|
|
<VAR
|
|
CLASS="OPTION"
|
|
>-y</VAR
|
|
>
|
|
option is used, a signature is generated from
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>keyname:secret.</VAR
|
|
>
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>keyname</VAR
|
|
>
|
|
is the name of the key,
|
|
and
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>secret</VAR
|
|
>
|
|
is the base64 encoded shared secret.
|
|
Use of the
|
|
<VAR
|
|
CLASS="OPTION"
|
|
>-y</VAR
|
|
>
|
|
option is discouraged because the shared secret is supplied as a command
|
|
line argument in clear text.
|
|
This may be visible in the output from
|
|
<SPAN
|
|
CLASS="CITEREFENTRY"
|
|
><SPAN
|
|
CLASS="REFENTRYTITLE"
|
|
>ps</SPAN
|
|
>(1)</SPAN
|
|
>
|
|
or in a history file maintained by the user's shell.</P
|
|
><P
|
|
>The <VAR
|
|
CLASS="OPTION"
|
|
>-k</VAR
|
|
> may also be used to specify a SIG(0) key used
|
|
to authenticate Dynamic DNS update requests. In this case, the key
|
|
specified is not an HMAC-MD5 key.</P
|
|
><P
|
|
>By default
|
|
<B
|
|
CLASS="COMMAND"
|
|
>nsupdate</B
|
|
>
|
|
uses UDP to send update requests to the name server unless they are too
|
|
large to fit in a UDP request in which case TCP will be used.
|
|
The
|
|
<VAR
|
|
CLASS="OPTION"
|
|
>-v</VAR
|
|
>
|
|
option makes
|
|
<B
|
|
CLASS="COMMAND"
|
|
>nsupdate</B
|
|
>
|
|
use a TCP connection.
|
|
This may be preferable when a batch of update requests is made.</P
|
|
><P
|
|
>The <VAR
|
|
CLASS="OPTION"
|
|
>-t</VAR
|
|
> option sets the maximum time a update request can
|
|
take before it is aborted. The default is 300 seconds. Zero can be used
|
|
to disable the timeout.</P
|
|
><P
|
|
>The <VAR
|
|
CLASS="OPTION"
|
|
>-u</VAR
|
|
> option sets the UDP retry interval. The default is
|
|
3 seconds. If zero the interval will be computed from the timeout interval
|
|
and number of UDP retries.</P
|
|
><P
|
|
>The <VAR
|
|
CLASS="OPTION"
|
|
>-r</VAR
|
|
> option sets the number of UDP retries. The default is
|
|
3. If zero only one update request will be made.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="REFSECT1"
|
|
><A
|
|
NAME="AEN82"
|
|
></A
|
|
><H2
|
|
>INPUT FORMAT</H2
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>nsupdate</B
|
|
>
|
|
reads input from
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>filename</VAR
|
|
>
|
|
or standard input.
|
|
Each command is supplied on exactly one line of input.
|
|
Some commands are for administrative purposes.
|
|
The others are either update instructions or prerequisite checks on the
|
|
contents of the zone.
|
|
These checks set conditions that some name or set of
|
|
resource records (RRset) either exists or is absent from the zone.
|
|
These conditions must be met if the entire update request is to succeed.
|
|
Updates will be rejected if the tests for the prerequisite conditions fail.</P
|
|
><P
|
|
>Every update request consists of zero or more prerequisites
|
|
and zero or more updates.
|
|
This allows a suitably authenticated update request to proceed if some
|
|
specified resource records are present or missing from the zone.
|
|
A blank input line (or the <B
|
|
CLASS="COMMAND"
|
|
>send</B
|
|
> command) causes the
|
|
accumulated commands to be sent as one Dynamic DNS update request to the
|
|
name server.</P
|
|
><P
|
|
>The command formats and their meaning are as follows:
|
|
<P
|
|
></P
|
|
><DIV
|
|
CLASS="VARIABLELIST"
|
|
><DL
|
|
><DT
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>server</B
|
|
> {servername} [port]</P
|
|
></DT
|
|
><DD
|
|
><P
|
|
>Sends all dynamic update requests to the name server
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>servername</VAR
|
|
>.
|
|
When no server statement is provided,
|
|
<B
|
|
CLASS="COMMAND"
|
|
>nsupdate</B
|
|
>
|
|
will send updates to the master server of the correct zone.
|
|
The MNAME field of that zone's SOA record will identify the master
|
|
server for that zone.
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>port</VAR
|
|
>
|
|
is the port number on
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>servername</VAR
|
|
>
|
|
where the dynamic update requests get sent.
|
|
If no port number is specified, the default DNS port number of 53 is
|
|
used.</P
|
|
></DD
|
|
><DT
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>local</B
|
|
> {address} [port]</P
|
|
></DT
|
|
><DD
|
|
><P
|
|
>Sends all dynamic update requests using the local
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>address</VAR
|
|
>.
|
|
|
|
When no local statement is provided,
|
|
<B
|
|
CLASS="COMMAND"
|
|
>nsupdate</B
|
|
>
|
|
will send updates using an address and port chosen by the system.
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>port</VAR
|
|
>
|
|
can additionally be used to make requests come from a specific port.
|
|
If no port number is specified, the system will assign one. </P
|
|
></DD
|
|
><DT
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>zone</B
|
|
> {zonename}</P
|
|
></DT
|
|
><DD
|
|
><P
|
|
>Specifies that all updates are to be made to the zone
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>zonename</VAR
|
|
>.
|
|
If no
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>zone</VAR
|
|
>
|
|
statement is provided,
|
|
<B
|
|
CLASS="COMMAND"
|
|
>nsupdate</B
|
|
>
|
|
will attempt determine the correct zone to update based on the rest of the input.</P
|
|
></DD
|
|
><DT
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>class</B
|
|
> {classname}</P
|
|
></DT
|
|
><DD
|
|
><P
|
|
>Specify the default class.
|
|
If no <VAR
|
|
CLASS="PARAMETER"
|
|
>class</VAR
|
|
> is specified the default class is
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>IN</VAR
|
|
>.</P
|
|
></DD
|
|
><DT
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>key</B
|
|
> {name} {secret}</P
|
|
></DT
|
|
><DD
|
|
><P
|
|
>Specifies that all updates are to be TSIG signed using the
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>keyname</VAR
|
|
> <VAR
|
|
CLASS="PARAMETER"
|
|
>keysecret</VAR
|
|
> pair.
|
|
The <B
|
|
CLASS="COMMAND"
|
|
>key</B
|
|
> command
|
|
overrides any key specified on the command line via
|
|
<VAR
|
|
CLASS="OPTION"
|
|
>-y</VAR
|
|
> or <VAR
|
|
CLASS="OPTION"
|
|
>-k</VAR
|
|
>.</P
|
|
></DD
|
|
><DT
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>prereq nxdomain</B
|
|
> {domain-name}</P
|
|
></DT
|
|
><DD
|
|
><P
|
|
>Requires that no resource record of any type exists with name
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>domain-name</VAR
|
|
>.</P
|
|
></DD
|
|
><DT
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>prereq yxdomain</B
|
|
> {domain-name}</P
|
|
></DT
|
|
><DD
|
|
><P
|
|
>Requires that
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>domain-name</VAR
|
|
>
|
|
exists (has as at least one resource record, of any type).</P
|
|
></DD
|
|
><DT
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>prereq nxrrset</B
|
|
> {domain-name} [class] {type}</P
|
|
></DT
|
|
><DD
|
|
><P
|
|
>Requires that no resource record exists of the specified
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>type</VAR
|
|
>,
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>class</VAR
|
|
>
|
|
and
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>domain-name</VAR
|
|
>.
|
|
If
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>class</VAR
|
|
>
|
|
is omitted, IN (internet) is assumed.</P
|
|
></DD
|
|
><DT
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>prereq yxrrset</B
|
|
> {domain-name} [class] {type}</P
|
|
></DT
|
|
><DD
|
|
><P
|
|
>This requires that a resource record of the specified
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>type</VAR
|
|
>,
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>class</VAR
|
|
>
|
|
and
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>domain-name</VAR
|
|
>
|
|
must exist.
|
|
If
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>class</VAR
|
|
>
|
|
is omitted, IN (internet) is assumed.</P
|
|
></DD
|
|
><DT
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>prereq yxrrset</B
|
|
> {domain-name} [class] {type} {data...}</P
|
|
></DT
|
|
><DD
|
|
><P
|
|
>The
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>data</VAR
|
|
>
|
|
from each set of prerequisites of this form
|
|
sharing a common
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>type</VAR
|
|
>,
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>class</VAR
|
|
>,
|
|
and
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>domain-name</VAR
|
|
>
|
|
are combined to form a set of RRs. This set of RRs must
|
|
exactly match the set of RRs existing in the zone at the
|
|
given
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>type</VAR
|
|
>,
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>class</VAR
|
|
>,
|
|
and
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>domain-name</VAR
|
|
>.
|
|
The
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>data</VAR
|
|
>
|
|
are written in the standard text representation of the resource record's
|
|
RDATA.</P
|
|
></DD
|
|
><DT
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>update delete</B
|
|
> {domain-name} [ttl] [class] [type [data...]]</P
|
|
></DT
|
|
><DD
|
|
><P
|
|
>Deletes any resource records named
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>domain-name</VAR
|
|
>.
|
|
If
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>type</VAR
|
|
>
|
|
and
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>data</VAR
|
|
>
|
|
is provided, only matching resource records will be removed.
|
|
The internet class is assumed if
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>class</VAR
|
|
>
|
|
is not supplied. The
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>ttl</VAR
|
|
>
|
|
is ignored, and is only allowed for compatibility.</P
|
|
></DD
|
|
><DT
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>update add</B
|
|
> {domain-name} {ttl} [class] {type} {data...}</P
|
|
></DT
|
|
><DD
|
|
><P
|
|
>Adds a new resource record with the specified
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>ttl</VAR
|
|
>,
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>class</VAR
|
|
>
|
|
and
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>data</VAR
|
|
>.</P
|
|
></DD
|
|
><DT
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>show</B
|
|
> </P
|
|
></DT
|
|
><DD
|
|
><P
|
|
>Displays the current message, containing all of the prerequisites and
|
|
updates specified since the last send.</P
|
|
></DD
|
|
><DT
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>send</B
|
|
> </P
|
|
></DT
|
|
><DD
|
|
><P
|
|
>Sends the current message. This is equivalent to entering a blank line.</P
|
|
></DD
|
|
><DT
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>answer</B
|
|
> </P
|
|
></DT
|
|
><DD
|
|
><P
|
|
>Displays the answer.</P
|
|
></DD
|
|
></DL
|
|
></DIV
|
|
> </P
|
|
><P
|
|
>Lines beginning with a semicolon are comments and are ignored.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="REFSECT1"
|
|
><A
|
|
NAME="AEN255"
|
|
></A
|
|
><H2
|
|
>EXAMPLES</H2
|
|
><P
|
|
>The examples below show how
|
|
<B
|
|
CLASS="COMMAND"
|
|
>nsupdate</B
|
|
>
|
|
could be used to insert and delete resource records from the
|
|
<SPAN
|
|
CLASS="TYPE"
|
|
>example.com</SPAN
|
|
>
|
|
zone.
|
|
Notice that the input in each example contains a trailing blank line so that
|
|
a group of commands are sent as one dynamic update request to the
|
|
master name server for
|
|
<SPAN
|
|
CLASS="TYPE"
|
|
>example.com</SPAN
|
|
>.
|
|
|
|
<PRE
|
|
CLASS="PROGRAMLISTING"
|
|
># nsupdate
|
|
> update delete oldhost.example.com A
|
|
> update add newhost.example.com 86400 A 172.16.1.1
|
|
> send</PRE
|
|
></P
|
|
><P
|
|
>Any A records for
|
|
<SPAN
|
|
CLASS="TYPE"
|
|
>oldhost.example.com</SPAN
|
|
>
|
|
are deleted.
|
|
and an A record for
|
|
<SPAN
|
|
CLASS="TYPE"
|
|
>newhost.example.com</SPAN
|
|
>
|
|
it IP address 172.16.1.1 is added.
|
|
The newly-added record has a 1 day TTL (86400 seconds)
|
|
<PRE
|
|
CLASS="PROGRAMLISTING"
|
|
># nsupdate
|
|
> prereq nxdomain nickname.example.com
|
|
> update add nickname.example.com 86400 CNAME somehost.example.com
|
|
> send</PRE
|
|
></P
|
|
><P
|
|
>The prerequisite condition gets the name server to check that there
|
|
are no resource records of any type for
|
|
<SPAN
|
|
CLASS="TYPE"
|
|
>nickname.example.com</SPAN
|
|
>.
|
|
|
|
If there are, the update request fails.
|
|
If this name does not exist, a CNAME for it is added.
|
|
This ensures that when the CNAME is added, it cannot conflict with the
|
|
long-standing rule in RFC1034 that a name must not exist as any other
|
|
record type if it exists as a CNAME.
|
|
(The rule has been updated for DNSSEC in RFC2535 to allow CNAMEs to have
|
|
RRSIG, DNSKEY and NSEC records.)</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="REFSECT1"
|
|
><A
|
|
NAME="AEN268"
|
|
></A
|
|
><H2
|
|
>FILES</H2
|
|
><P
|
|
></P
|
|
><DIV
|
|
CLASS="VARIABLELIST"
|
|
><DL
|
|
><DT
|
|
><CODE
|
|
CLASS="CONSTANT"
|
|
>/etc/resolv.conf</CODE
|
|
></DT
|
|
><DD
|
|
><P
|
|
>used to identify default name server</P
|
|
></DD
|
|
><DT
|
|
><CODE
|
|
CLASS="CONSTANT"
|
|
>K{name}.+157.+{random}.key</CODE
|
|
></DT
|
|
><DD
|
|
><P
|
|
>base-64 encoding of HMAC-MD5 key created by
|
|
<SPAN
|
|
CLASS="CITEREFENTRY"
|
|
><SPAN
|
|
CLASS="REFENTRYTITLE"
|
|
>dnssec-keygen</SPAN
|
|
>(8)</SPAN
|
|
>.</P
|
|
></DD
|
|
><DT
|
|
><CODE
|
|
CLASS="CONSTANT"
|
|
>K{name}.+157.+{random}.private</CODE
|
|
></DT
|
|
><DD
|
|
><P
|
|
>base-64 encoding of HMAC-MD5 key created by
|
|
<SPAN
|
|
CLASS="CITEREFENTRY"
|
|
><SPAN
|
|
CLASS="REFENTRYTITLE"
|
|
>dnssec-keygen</SPAN
|
|
>(8)</SPAN
|
|
>.</P
|
|
></DD
|
|
></DL
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="REFSECT1"
|
|
><A
|
|
NAME="AEN292"
|
|
></A
|
|
><H2
|
|
>SEE ALSO</H2
|
|
><P
|
|
><SPAN
|
|
CLASS="CITEREFENTRY"
|
|
><SPAN
|
|
CLASS="REFENTRYTITLE"
|
|
>RFC2136</SPAN
|
|
></SPAN
|
|
>,
|
|
<SPAN
|
|
CLASS="CITEREFENTRY"
|
|
><SPAN
|
|
CLASS="REFENTRYTITLE"
|
|
>RFC3007</SPAN
|
|
></SPAN
|
|
>,
|
|
<SPAN
|
|
CLASS="CITEREFENTRY"
|
|
><SPAN
|
|
CLASS="REFENTRYTITLE"
|
|
>RFC2104</SPAN
|
|
></SPAN
|
|
>,
|
|
<SPAN
|
|
CLASS="CITEREFENTRY"
|
|
><SPAN
|
|
CLASS="REFENTRYTITLE"
|
|
>RFC2845</SPAN
|
|
></SPAN
|
|
>,
|
|
<SPAN
|
|
CLASS="CITEREFENTRY"
|
|
><SPAN
|
|
CLASS="REFENTRYTITLE"
|
|
>RFC1034</SPAN
|
|
></SPAN
|
|
>,
|
|
<SPAN
|
|
CLASS="CITEREFENTRY"
|
|
><SPAN
|
|
CLASS="REFENTRYTITLE"
|
|
>RFC2535</SPAN
|
|
></SPAN
|
|
>,
|
|
<SPAN
|
|
CLASS="CITEREFENTRY"
|
|
><SPAN
|
|
CLASS="REFENTRYTITLE"
|
|
>RFC2931</SPAN
|
|
></SPAN
|
|
>,
|
|
<SPAN
|
|
CLASS="CITEREFENTRY"
|
|
><SPAN
|
|
CLASS="REFENTRYTITLE"
|
|
>named</SPAN
|
|
>(8)</SPAN
|
|
>,
|
|
<SPAN
|
|
CLASS="CITEREFENTRY"
|
|
><SPAN
|
|
CLASS="REFENTRYTITLE"
|
|
>dnssec-keygen</SPAN
|
|
>(8)</SPAN
|
|
>. </P
|
|
></DIV
|
|
><DIV
|
|
CLASS="REFSECT1"
|
|
><A
|
|
NAME="AEN315"
|
|
></A
|
|
><H2
|
|
>BUGS</H2
|
|
><P
|
|
>The TSIG key is redundantly stored in two separate files.
|
|
This is a consequence of nsupdate using the DST library
|
|
for its cryptographic operations, and may change in future
|
|
releases.</P
|
|
></DIV
|
|
></BODY
|
|
></HTML
|
|
>
|