dig [@server] [-b ] [address-c ] [class-f ] [filename-k ] [filename-p ] [port#-q ] [name-t ] [type-x ] [addr-y ] [name:key-4] [-6] [name] [type] [class] [queryopt...]
dig [@server] [-b ] [address-c ] [class-f ] [filename-k ] [filename-p ] [port#-q ] [name-t ] [type-x ] [addr-y ] [[hmac:]name:key-4] [-6] [name] [type] [class] [queryopt...]
dig [-h]
dig [global-queryopt...] [query...]
dig (domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and @@ -73,7 +73,7 @@
The -b option sets the source IP address of the query
to address. This must be a valid
@@ -200,6 +200,7 @@
responses using transaction signatures (TSIG), specify a TSIG key file
using the -k option. You can also specify the TSIG
key itself on the command line using the -y option;
+ hmac is the type of the TSIG, default HMAC-MD5,
name is the name of the TSIG key and
key is the actual key. The key is a
base-64
@@ -218,7 +219,7 @@
dig provides a number of query options which affect the way in which lookups are made and the results displayed. Some of @@ -537,7 +538,7 @@
The BIND 9 implementation of dig supports @@ -583,7 +584,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
If dig has been built with IDN (internationalized domain name) support, it can accept and display non-ASCII domain names. @@ -597,14 +598,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
host(1), named(8), dnssec-keygen(8), @@ -612,7 +613,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
There are probably too many query options.
diff --git a/bin/nsupdate/nsupdate.8 b/bin/nsupdate/nsupdate.8 index b3ecdda61e..4b51187599 100644 --- a/bin/nsupdate/nsupdate.8 +++ b/bin/nsupdate/nsupdate.8 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: nsupdate.8,v 1.37 2005/10/13 03:13:59 marka Exp $ +.\" $Id: nsupdate.8,v 1.38 2006/01/27 05:17:11 marka Exp $ .\" .hy 0 .ad l @@ -30,7 +30,7 @@ nsupdate \- Dynamic DNS update utility .SH "SYNOPSIS" .HP 9 -\fBnsupdate\fR [\fB\-d\fR] [[\fB\-y\ \fR\fB\fIkeyname:secret\fR\fR] [\fB\-k\ \fR\fB\fIkeyfile\fR\fR]] [\fB\-t\ \fR\fB\fItimeout\fR\fR] [\fB\-u\ \fR\fB\fIudptimeout\fR\fR] [\fB\-r\ \fR\fB\fIudpretries\fR\fR] [\fB\-v\fR] [filename] +\fBnsupdate\fR [\fB\-d\fR] [[\fB\-y\ \fR\fB\fI[hmac:]\fR\fIkeyname:secret\fR\fR] [\fB\-k\ \fR\fB\fIkeyfile\fR\fR]] [\fB\-t\ \fR\fB\fItimeout\fR\fR] [\fB\-u\ \fR\fB\fIudptimeout\fR\fR] [\fB\-r\ \fR\fB\fIudpretries\fR\fR] [\fB\-v\fR] [filename] .SH "DESCRIPTION" .PP \fBnsupdate\fR @@ -68,7 +68,7 @@ uses the \fB\-y\fR or \fB\-k\fR -option (with an HMAC\-MD5 key) to provide the shared secret needed to generate a TSIG record for authenticating Dynamic DNS update requests. These options are mutually exclusive. With the +option to provide the shared secret needed to generate a TSIG record for authenticating Dynamic DNS update requests, default type HMAC\-MD5. These options are mutually exclusive. With the \fB\-k\fR option, \fBnsupdate\fR @@ -79,7 +79,7 @@ reads the shared secret from the file must also be present. When the \fB\-y\fR option is used, a signature is generated from -\fIkeyname:secret.\fR\fIkeyname\fR +[\fIhmac:\fR]\fIkeyname:secret.\fR\fIkeyname\fR is the name of the key, and \fIsecret\fR is the base64 encoded shared secret. Use of the diff --git a/bin/nsupdate/nsupdate.html b/bin/nsupdate/nsupdate.html index 23e1131b13..8fa5b2984b 100644 --- a/bin/nsupdate/nsupdate.html +++ b/bin/nsupdate/nsupdate.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - + @@ -29,10 +29,10 @@nsupdate [-d] [[-y ] | [keyname:secret-k ]] [keyfile-t ] [timeout-u ] [udptimeout-r ] [udpretries-v] [filename]
nsupdate [-d] [[-y ] | [[hmac:]keyname:secret-k ]] [keyfile-t ] [timeout-u ] [udptimeout-r ] [udpretries-v] [filename]
nsupdate
is used to submit Dynamic DNS Update requests as defined in RFC2136
to a name server.
@@ -93,38 +93,27 @@
/etc/named.conf.
nsupdate
- uses the -y or -k
- option (with an HMAC-MD5 key) to provide the shared secret needed to
- generate
- a TSIG record for authenticating Dynamic DNS update requests.
- These options are mutually exclusive.
- With the
- -k
- option,
- nsupdate
- reads the shared secret from the file
- keyfile,
+ uses the -y or -k option
+ to provide the shared secret needed to generate a TSIG record
+ for authenticating Dynamic DNS update requests, default type
+ HMAC-MD5. These options are mutually exclusive. With the
+ -k option, nsupdate reads
+ the shared secret from the file keyfile,
whose name is of the form
- K{name}.+157.+{random}.private.
- For historical
- reasons, the file
- K{name}.+157.+{random}.key
- must also be present. When the
- -y
- option is used, a signature is generated from
- keyname:secret.
- keyname
- is the name of the key,
- and
- secret
- is the base64 encoded shared secret.
- Use of the
- -y
- option is discouraged because the shared secret is supplied as a command
- line argument in clear text.
- This may be visible in the output from
- ps(1)
- or in a history file maintained by the user's shell.
+ K{name}.+157.+{random}.private. For
+ historical reasons, the file
+ K{name}.+157.+{random}.key must also be
+ present. When the -y option is used, a
+ signature is generated from
+ [hmac:]keyname:secret.
+ keyname is the name of the key, and
+ secret is the base64 encoded shared
+ secret. Use of the -y option is discouraged
+ because the shared secret is supplied as a command line
+ argument in clear text. This may be visible in the output
+ from
+ ps(1) or in a history file maintained by the user's
+ shell.
The -k may also be used to specify a SIG(0) key used
@@ -164,7 +153,7 @@
The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index a3ac86af63..4e9b3aa9e3 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - +
@@ -63,37 +63,37 @@ Usage
The algorithm_id is a string
- that specifies a security/authentication algorithm. The only
- algorithm currently supported with TSIG authentication is
- hmac-md5. The
+ that specifies a security/authentication algorithm. Named
+ supports hmac-md5,
+ hmac-sha1, hmac-sha224,
+ hmac-sha256, hmac-sha384
+ and hmac-sha512 TSIG authentication.
+ Truncated hashes are supported by appending the minimum
+ number of required bits preceeded by a dash, e.g.
+ hmac-sha1-80. The
secret_string is the secret
- to be
- used by the algorithm, and is treated as a base-64 encoded
- string.
+ to be used by the algorithm, and is treated as a base-64
+ encoded string.
logging { [ channelchannel_name{ ( filepath name@@ -1074,7 +1078,7 @@The logging statement configures a @@ -1108,7 +1112,7 @@
All log output goes to one or more channels; you can make as many of them as you want. @@ -1627,7 +1631,7 @@ category notify { null; };
This is the grammar of the lwres statement in the
named.conffile: @@ -1642,7 +1646,7 @@ category notify { null; };The lwres statement configures the name @@ -1693,14 +1697,14 @@ category notify { null; };
mastersname[portip_port] { (masters_list|ip_addr[portip_port] [keykey] ) ; [...] };masters lists allow for a common set of masters to be easily used by @@ -1709,7 +1713,7 @@ category notify { null; };
This is the grammar of the options statement in the
named.conffile: @@ -2740,7 +2744,7 @@ options {The forwarding facility can be used to create a large site-wide cache on a few servers, reducing traffic over links to external @@ -2784,7 +2788,7 @@ options {
Dual-stack servers are used as servers of last resort to work around @@ -2949,7 +2953,7 @@ options {
The interfaces and ports that the server will answer queries from may be specified using the listen-on option. listen-on takes @@ -3029,7 +3033,7 @@ listen-on-v6 port 1234 { !2001:db8::/32; any; };
If the server doesn't know the answer to a question, it will query other name servers. query-source specifies @@ -3309,7 +3313,7 @@ query-source-v6 address * port *;
avoid-v4-udp-ports and avoid-v6-udp-ports specify a list of IPv4 and IPv6 UDP ports that will not be used as system @@ -3323,7 +3327,7 @@ query-source-v6 address * port *;
The server's usage of many system resources can be limited. Scaled values are allowed when specifying resource limits. For @@ -3383,7 +3387,7 @@ query-source-v6 address * port *;
The following options set limits on the server's resource consumption that are enforced internally by the @@ -3461,7 +3465,7 @@ query-source-v6 address * port *;
- cleaning-interval
@@ -4474,7 +4478,7 @@ query-source-v6 address * port *;
trusted-keys {stringnumbernumbernumberstring; [stringnumbernumbernumberstring; [...]] @@ -4483,7 +4487,7 @@ query-source-v6 address * port *;The trusted-keys statement defines @@ -4526,7 +4530,7 @@ query-source-v6 address * port *;
The view statement is a powerful feature @@ -4700,10 +4704,10 @@ view "external" {