dnssec-signzone

title: dnssec-signzone(8)

summary: DNSSEC zone signing tool

text:
# dnssec-signzone(8)

## NAME
dnssec-signzone - DNSSEC zone signing tool

## SYNOPSIS
dnssec-signzone [-a] [-c class] [-d directory] [-D] [-E engine] [-e end-time] [-f output-file] [-g] [-h] [-i interval] [-I input-format] [-j jitter] [-K directory] [-k key] [-L serial] [-M maxttl] [-N soa-serial-format] [-o origin] [-O output-format] [-P] [-Q] [-q] [-R] [-S] [-s start-time] [-T ttl] [-t] [-u] [-v level] [-V] [-X extended end-time] [-x] [-z] [-3 salt] [-H iterations] [-A] {zonefile} [key...]

## DESCRIPTION
dnssec-signzone signs a zone; it generates NSEC and RRSIG records and produces a signed version of the zone. The security status of delegations from the signed zone (that is, whether the child zones are secure) is determined by the presence or absence of a keyset file for each child zone.

## OPTIONS
-a

This option verifies all generated signatures.

-c class

This option specifies the DNS class of the zone.

-C

This option sets compatibility mode, in which a keyset-zonename file is generated in addition to dsset-zonename when signing a zone, for use by older versions of dnssec-signzone.

-d directory

This option indicates the directory where BIND 9 should look for dsset- or keyset- files.

-D

This option indicates that only those record types automatically managed by dnssec-signzone, i.e., RRSIG, NSEC, NSEC3 and NSEC3PARAM records, should be included in the output. If smart signing (-S) is used, DNSKEY records are also included. The resulting file can be included in the original zone file with $INCLUDE. This option cannot be combined with -O raw, -O map, or serial-number updating.

-E engine

This option specifies the hardware to use for cryptographic operations, such as a secure key store used for signing, when applicable. When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL engine identifier that drives the cryptographic accelerator or hardware service module (usually pkcs11). When BIND is built with native PKCS#11 cryptography (--enable-native-pkcs11), it defaults to the path of the PKCS#11 provider library specified via --with-pkcs11.

-g

This option indicates that DS records for child zones should be generated from a dsset- or keyset- file. Existing DS records are removed.

-K directory

This option specifies the directory to search for DNSSEC keys. If not specified, it defaults to the current directory.

-k key

This option tells BIND 9 to treat the specified key as a key-signing key, ignoring any key flags. This option may be specified multiple times.

-M maxttl

This option sets the maximum TTL for the signed zone. Any TTL higher than maxttl in the input zone is reduced to maxttl in the output. This provides certainty as to the largest possible TTL in the signed zone, which is useful to know when rolling keys. The maxttl is the longest possible time before signatures that have been retrieved by resolvers expire from resolver caches. Zones that are signed with this option should be configured to use a matching max-zone-ttl in named.conf. (Note: This option is incompatible with -D, because it modifies non-DNSSEC data in the output zone.)

-s start-time

This option specifies the date and time when the generated RRSIG records become valid. This can be either an absolute or relative time. An absolute start time is indicated by a number in YYYYMMDDHHMMSS notation; 20000530144500 denotes 14:45:00 UTC on May 30th, 2000. A relative start time is indicated by +N, which is N seconds from the current time. If no start-time is specified, the current time minus 1 hour (to allow for clock skew) is used.

-e end-time

This option specifies the date and time when the generated RRSIG records expire. As with start-time, an absolute time is indicated in YYYYMMDDHHMMSS notation. A time relative to the start time is indicated with +N, which is N seconds from the start time. A time relative to the current time is indicated with now+N. If no end-time is specified, 30 days from the start time is the default. end-time must be later than start-time.

-X extended end-time

This option specifies the date and time when the generated RRSIG records for the DNSKEY RRset expire. This is to be used in cases when the DNSKEY signatures need to persist longer than signatures on other records; e.g., when the private component of the KSK is kept offline and the KSK signature is to be refreshed manually. As with end-time, an absolute time is indicated in YYYYMMDDHHMMSS notation. A time relative to the start time is indicated with +N, which is N seconds from the start time. A time relative to the current time is indicated with now+N. If no extended end-time is specified, the value of end-time is used as the default. (end-time, in turn, defaults to 30 days from the start time.) extended end-time must be later than start-time.

-f output-file

This option indicates the name of the output file containing the signed zone. The default is to append .signed to the input filename. If output-file is set to -, then the signed zone is written to the standard output, with a default output format of full.

-h

This option prints a short summary of the options and arguments to dnssec-signzone.

-V

This option prints version information.

-i interval

This option indicates that, when a previously signed zone is passed as input, records may be re-signed. The interval option specifies the cycle interval as an offset from the current time, in seconds. If a RRSIG record expires after the cycle interval, it is retained; otherwise, it is considered to be expiring soon and it is replaced. The default cycle interval is one quarter of the difference between the signature end and start times. So if neither end-time nor start-time is specified, dnssec-signzone generates signatures that are valid for 30 days, with a cycle interval of 7.5 days. Therefore, if any existing RRSIG records are due to expire in less than 7.5 days, they are replaced.

-I input-format

This option sets the format of the input zone file. Possible formats are text (the default), raw, and map. This option is primarily intended to be used for dynamic signed zones, so that the dumped zone file in a non-text format containing updates can be signed directly. This option is not useful for non-dynamic zones.

-j jitter

When signing a zone with a fixed signature lifetime, all RRSIG records issued at the time of signing expire simultaneously. If the zone is incrementally signed, i.e., a previously signed zone is passed as input to the signer, all expired signatures must be regenerated at approximately the same time. The jitter option specifies a jitter window that is used to randomize the signature expire time, thus spreading incremental signature regeneration over time. Signature lifetime jitter also, to some extent, benefits validators and servers by spreading out cache expiration, i.e., if large numbers of RRSIGs do not expire at the same time from all caches, there is less congestion than if all validators need to refetch at around the same time.

-L serial

When writing a signed zone to "raw" or "map" format, this option sets the "source serial" value in the header to the specified serial number. (This is expected to be used primarily for testing purposes.)

-n ncpus

This option specifies the number of threads to use. By default, one thread is started for each detected CPU.

-N soa-serial-format

This option sets the SOA serial number format of the signed zone. Possible formats are keep (the default), increment, unixtime, and date.

keep

This format indicates that the SOA serial number should not be modified.

increment

This format increments the SOA serial number using RFC 1982 arithmetic.

unixtime

This format sets the SOA serial number to the number of seconds since the beginning of the Unix epoch, unless the serial number is already greater than or equal to that value, in which case it is simply incremented by one.

date

This format sets the SOA serial number to today's date, in YYYYMMDDNN format, unless the serial number is already greater than or equal to that value, in which case it is simply incremented by one.

-o origin

This option sets the zone origin. If not specified, the name of the zone file is assumed to be the origin.

-O output-format

This option sets the format of the output file containing the signed zone. Possible formats are text (the default), which is the standard textual representation of the zone; full, which is text output in a format suitable for processing by external scripts; and map, raw, and raw=N, which store the zone in binary formats for rapid loading by named. raw=N specifies the format version of the raw zone file: if N is 0, the raw file can be read by any version of named; if N is 1, the file can be read by release 9.9.0 or higher. The default is 1.

-P

This option disables post-sign verification tests. The post-sign verification tests ensure that for each algorithm in use there is at least one non-revoked self-signed KSK key, that all revoked KSK keys are self-signed, and that all records in the zone are signed by the algorithm. This option skips these tests.

-Q

This option removes signatures from keys that are no longer active. Normally, when a previously signed zone is passed as input to the signer, and a DNSKEY record has been removed and replaced with a new one, signatures from the old key that are still within their validity period are retained. This allows the zone to continue to validate with cached copies of the old DNSKEY RRset. The -Q option forces dnssec-signzone to remove signatures from keys that are no longer active. This enables ZSK rollover using the procedure described in RFC 4641#4.2.1.1 ("Pre-Publish Key Rollover").

-q

This option enables quiet mode, which suppresses unnecessary output. Without this option, when dnssec-signzone is run it prints three pieces of information to standard output: the number of keys in use; the algorithms used to verify the zone was signed correctly and other status information; and the filename containing the signed zone. With the option that output is suppressed, leaving only the filename.

-R

This option removes signatures from keys that are no longer published. This option is similar to -Q, except it forces dnssec-signzone to remove signatures from keys that are no longer published. This enables ZSK rollover using the procedure described in RFC 4641#4.2.1.2 ("Double Signature Zone Signing Key Rollover").

-S

This option enables smart signing, which instructs dnssec-signzone to search the key repository for keys that match the zone being signed, and to include them in the zone if appropriate. When a key is found, its timing metadata is examined to determine how it should be used, according to the following rules. Each successive rule takes priority over the prior ones:

If no timing metadata has been set for the key, the key is published in the zone and used to sign the zone. If the key's publication date is set and is in the past, the key is published in the zone.

If the key's activation date is set and is in the past, the key is published (regardless of publication date) and used to sign the zone.

If the key's revocation date is set and is in the past, and the key is published, then the key is revoked, and the revoked key is used to sign the zone.

If either the key's unpublication or deletion date is set and in the past, the key is NOT published or used to sign the zone, regardless of any other metadata.

If the key's sync publication date is set and is in the past, synchronization records (type CDS and/or CDNSKEY) are created.

If the key's sync deletion date is set and is in the past, synchronization records (type CDS and/or CDNSKEY) are removed.

-T ttl

This option specifies a TTL to be used for new DNSKEY records imported into the zone from the key repository. If not specified, the default is the TTL value from the zone's SOA record. This option is ignored when signing without -S, since DNSKEY records are not imported from the key repository in that case. It is also ignored if there are any pre-existing DNSKEY records at the zone apex, in which case new records' TTL values are set to match them, or if any of the imported DNSKEY records had a default TTL value. In the event of a conflict between TTL values in imported keys, the shortest one is used.

-t

This option prints statistics at completion.

-u

This option updates the NSEC/NSEC3 chain when re-signing a previously signed zone. With this option, a zone signed with NSEC can be switched to NSEC3, or a zone signed with NSEC3 can be switched to NSEC or to NSEC3 with different parameters. Without this option, dnssec-signzone retains the existing chain when re-signing.

-v level

This option sets the debugging level.

-x

This option indicates that BIND 9 should only sign the DNSKEY, CDNSKEY, and CDS RRsets with key-signing keys, and should omit signatures from zone-signing keys. (This is similar to the dnssec-dnskey-kskonly yes; zone option in named.)

-z

This option indicates that BIND 9 should ignore the KSK flag on keys when determining what to sign. This causes KSK-flagged keys to sign all records, not just the DNSKEY RRset. (This is similar to the update-check-ksk no; zone option in named.)

-3 salt

This option generates an NSEC3 chain with the given hex-encoded salt. A dash (-) can be used to indicate that no salt is to be used when generating the NSEC3 chain. NOTE:

-3 - is the recommended configuration. Adding salt provides no practical benefits.

-H iterations

This option indicates that, when generating an NSEC3 chain, BIND 9 should use this many iterations. The default is 10. WARNING:

Values greater than 0 cause interoperability issues and also increase the risk of CPU-exhausting DoS attacks. The default value has not been changed because the best practices has changed only after BIND 9.16 reached Extended Support Version status.

-A

This option indicates that, when generating an NSEC3 chain, BIND 9 should set the OPTOUT flag on all NSEC3 records and should not generate NSEC3 records for insecure delegations. WARNING:

Do not use this option unless all its implications are fully understood. This option is intended only for extremely large zones (comparable to com.) with sparse secure delegations.

Using this option twice (i.e., -AA) turns the OPTOUT flag off for all records. This is useful when using the -u option to modify an NSEC3 chain which previously had OPTOUT set.

zonefile

This option sets the file containing the zone to be signed.

key

This option specifies which keys should be used to sign the zone. If no keys are specified, the zone is examined for DNSKEY records at the zone apex. If these records are found and there are matching private keys in the current directory, they are used for signing.

## EXAMPLE
The following command signs the example.com zone with the ECDSAP256SHA256 key generated by dnssec-keygen (Kexample.com.+013+17247). Because the -S option is not being used, the zone's keys must be in the master file (db.example.com). This invocation looks for dsset files in the current directory, so that DS records can be imported from them (-g).

```
% dnssec-signzone -g -o example.com db.example.com \
Kexample.com.+013+17247
db.example.com.signed
%
```

In the above example, dnssec-signzone creates the file db.example.com.signed. This file should be referenced in a zone statement in the named.conf file.

This example re-signs a previously signed zone with default parameters. The private keys are assumed to be in the current directory.

```
% cp db.example.com.signed db.example.com
% dnssec-signzone -o example.com db.example.com
db.example.com.signed
%
```

## SEE ALSO
dnssec-keygen(8), BIND 9 Administrator Reference Manual, RFC 4033, RFC 4641.

## AUTHOR
Internet Systems Consortium

## COPYRIGHT
2024, Internet Systems Consortium


dnssec-verify

package: bind

title: dnssec-verify(8)

summary: DNSSEC zone verification tool

text:
# dnssec-verify(8)

## NAME
dnssec-verify - DNSSEC zone verification tool

## SYNOPSIS
dnssec-verify [-c class] [-E engine] [-I input-format] [-o origin] [-q] [-v level] [-V] [-x] [-z] {zonefile}

## DESCRIPTION
dnssec-verify verifies that a zone is fully signed for each algorithm found in the DNSKEY RRset for the zone, and that the NSEC/NSEC3 chains are complete.

## OPTIONS
-c class

This option specifies the DNS class of the zone.

-E engine

This option specifies the cryptographic hardware to use, when applicable. When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL engine identifier that drives the cryptographic accelerator or hardware service module (usually pkcs11). When BIND is built with native PKCS#11 cryptography (--enable-native-pkcs11), it defaults to the path of the PKCS#11 provider library specified via --with-pkcs11.

-I input-format

This option sets the format of the input zone file. Possible formats are text (the default) and raw. This option is primarily intended to be used for dynamic signed zones, so that the dumped zone file in a non-text format containing updates can be verified independently. This option is not useful for non-dynamic zones.

-o origin

This option indicates the zone origin. If not specified, the name of the zone file is assumed to be the origin.

-v level

This option sets the debugging level.

-V

This option prints version information.

-q

This option sets quiet mode, which suppresses output. Without this option, when dnssec-verify is run it prints to standard output the number of keys in use, the algorithms used to verify the zone was signed correctly, and other status information. With this option, all non-error output is suppressed, and only the exit code indicates success.

-x

This option verifies only that the DNSKEY RRset is signed with key-signing keys. Without this flag, it is assumed that the DNSKEY RRset is signed by all active keys. When this flag is set, it is not an error if the DNSKEY RRset is not signed by zone-signing keys. This corresponds to the -x option in dnssec-signzone.

-z

This option indicates that the KSK flag on the keys should be ignored when determining whether the zone is correctly signed. Without this flag, it is assumed that there is a non-revoked, self-signed DNSKEY with the KSK flag set for each algorithm, and that RRsets other than DNSKEY RRset are signed with a different DNSKEY without the KSK flag set. With this flag set, BIND 9 only requires that for each algorithm, there be at least one non-revoked, self-signed DNSKEY, regardless of the KSK flag state, and that other RRsets be signed by a non-revoked key for the same algorithm that includes the self-signed key; the same key may be used for both purposes. This corresponds to the -z option in dnssec-signzone.

zonefile

This option indicates the file containing the zone to be signed.

## SEE ALSO
dnssec-signzone(8), BIND 9 Administrator Reference Manual, RFC 4033.

## AUTHOR
Internet Systems Consortium

## COPYRIGHT
2024, Internet Systems Consortium


filter-aaaa

title: filter-aaaa(8)

text:
# filter-aaaa(8)

## NAME
filter-aaaa - filter AAAA in DNS responses when A is present

## SYNOPSIS
plugin query "filter-aaaa.so" [{ parameters }];

## DESCRIPTION
filter-aaaa.so is a query plugin module for named, enabling named to omit some IPv6 addresses when responding to clients.

Until BIND 9.12, this feature was implemented natively in named and enabled with the filter-aaaa ACL and the filter-aaaa-on-v4 and filter-aaaa-on-v6 options. These options are now deprecated in named.conf but can be passed as parameters to the filter-aaaa.so plugin, for example:

```
plugin query "/usr/local/lib/filter-aaaa.so" {

        filter-aaaa-on-v4 yes;

        filter-aaaa-on-v6 yes;

        filter-aaaa { 192.0.2.1; 2001:db8:2::1; };
};
```

This module is intended to aid transition from IPv4 to IPv6 by withholding IPv6 addresses from DNS clients which are not connected to the IPv6 Internet, when the name being looked up has an IPv4 address available. Use of this module is not recommended unless absolutely necessary.

Note: This mechanism can erroneously cause other servers not to give AAAA records to their clients. If a recursing server with both IPv6 and IPv4 network connections queries an authoritative server using this mechanism via IPv4, it is denied AAAA records even if its client is using IPv6.

## OPTIONS
filter-aaaa

This option specifies a list of client addresses for which AAAA filtering is to be applied. The default is any.

filter-aaaa-on-v4

If set to yes, this option indicates that the DNS client is at an IPv4 address, in filter-aaaa. If the response does not include DNSSEC signatures, then all AAAA records are deleted from the response. This filtering applies to all responses, not only authoritative ones. If set to break-dnssec, then AAAA records are deleted even when DNSSEC is enabled. As suggested by the name, this causes the response to fail to verify, because the DNSSEC protocol is designed to detect deletions.

This mechanism can erroneously cause other servers not to give AAAA records to their clients. If a recursing server with both IPv6 and IPv4 network connections queries an authoritative server using this mechanism via IPv4, it is denied AAAA records even if its client is using IPv6.

filter-aaaa-on-v6

This option is identical to filter-aaaa-on-v4, except that it filters AAAA responses to queries from IPv6 clients instead of IPv4 clients. To filter all responses, set both options to yes.

## SEE ALSO
BIND 9 Administrator Reference Manual.

## AUTHOR
Internet Systems Consortium

## COPYRIGHT
2024, Internet Systems Consortium


named

title: named(8)

summary: Internet domain name server

text:
# named(8)

## NAME
named - Internet domain name server

## SYNOPSIS
named [ [-4] | [-6] ] [-c config-file] [-C] [-d debug-level] [-D string] [-E engine-name] [-f] [-g] [-L logfile] [-M option] [-m flag] [-n #cpus] [-p port] [-s] [-S #max-socks] [-t directory] [-U #listeners] [-u user] [-v] [-V] [-X lock-file] [-x cache-file]

## DESCRIPTION
named is a Domain Name System (DNS) server, part of the BIND 9 distribution from ISC. For more information on the DNS, see RFC 1033, RFC 1034, and RFC 1035.

When invoked without arguments, named reads the default configuration file /etc/named.conf, reads any initial data, and listens for queries.

## OPTIONS
-4

This option tells named to use only IPv4, even if the host machine is capable of IPv6. -4 and -6 are mutually exclusive.

-6

This option tells named to use only IPv6, even if the host machine is capable of IPv4. -4 and -6 are mutually exclusive.

-c config-file

This option tells named to use config-file as its configuration file instead of the default, /etc/named.conf. To ensure that the configuration file can be reloaded after the server has changed its working directory due to to a possible directory option in the configuration file, config-file should be an absolute pathname.

-C

This option prints out the default built-in configuration and exits. NOTE: This is for debugging purposes only and is not an accurate representation of the actual configuration used by named at runtime.

-d debug-level

This option sets the daemon's debug level to debug-level. Debugging traces from named become more verbose as the debug level increases.

-D string

This option specifies a string that is used to identify a instance of named in a process listing. The contents of string are not examined.

-E engine-name

When applicable, this option specifies the hardware to use for cryptographic operations, such as a secure key store used for signing. When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL engine identifier that drives the cryptographic accelerator or hardware service module (usually pkcs11). When BIND is built with native PKCS#11 cryptography (--enable-native-pkcs11), it defaults to the path of the PKCS#11 provider library specified via --with-pkcs11.

-f

This option runs the server in the foreground (i.e., do not daemonize).

-g

This option runs the server in the foreground and forces all logging to stderr.

-L logfile

This option sets the log to the file logfile by default, instead of the system log.

-M option

This option sets the default (comma-separated) memory context options. The possible flags are:

- external: use system-provided memory allocation functions; this is the implicit default.

- internal: use the internal memory manager.

- fill: fill blocks of memory with tag values when they are allocated or freed, to assist debugging of memory problems; this is the implicit default if named has been compiled with --enable-developer.

- nofill: disable the behavior enabled by fill; this is the implicit default unless named has been compiled with --enable-developer.

-m flag

This option turns on memory usage debugging flags. Possible flags are usage, trace, record, size, and mctx. These correspond to the ISC_MEM_DEBUGXXXX flags described in <isc/mem.h>.

-n #cpus

This option controls the number of CPUs that named assumes the presence of. If not specified, named tries to determine the number of CPUs present automatically; if it fails, a single CPU is assumed to be present. named creates two threads per each CPU present (one thread for receiving and sending client traffic and another thread for sending and receiving resolver traffic) and then on top of that a single thread for handling time-based events.

-p port

This option listens for queries on port. If not specified, the default is port 53.

-s

This option writes memory usage statistics to stdout on exit.

NOTE:

This option is mainly of interest to BIND 9 developers and may be removed or changed in a future release.

-S #max-socks

This option allows named to use up to #max-socks sockets. The default value is 21000 on systems built with default configuration options, and 4096 on systems built with configure --with-tuning=small.

WARNING:

This option should be unnecessary for the vast majority of users. The use of this option could even be harmful, because the specified value may exceed the limitation of the underlying system API. It is therefore set only when the default configuration causes exhaustion of file descriptors and the operational environment is known to support the specified number of sockets. Note also that the actual maximum number is normally slightly fewer than the specified value, because named reserves some file descriptors for its internal use.

-t directory

This option tells named to chroot to directory after processing the command-line arguments, but before reading the configuration file.

WARNING:

This option should be used in conjunction with the -u option, as chrooting a process running as root doesn't enhance security on most systems; the way chroot is defined allows a process with root privileges to escape a chroot jail.

-U #listeners

This option tells named the number of #listeners worker threads to listen on, for incoming UDP packets on each address. If not specified, named calculates a default value based on the number of detected CPUs: 1 for 1 CPU, and the number of detected CPUs minus one for machines with more than 1 CPU. This cannot be increased to a value higher than the number of CPUs. If -n has been set to a higher value than the number of detected CPUs, then -U may be increased as high as that value, but no higher. On Windows, the number of UDP listeners is hardwired to 1 and this option has no effect.

-u user

This option sets the setuid to user after completing privileged operations, such as creating sockets that listen on privileged ports.

NOTE:

On Linux, named uses the kernel's capability mechanism to drop all root privileges except the ability to bind to a privileged port and set process resource limits. Unfortunately, this means that the -u option only works when named is run on kernel 2.2.18 or later, or kernel 2.3.99-pre3 or later, since previous kernels did not allow privileges to be retained after setuid.

-v

This option reports the version number and exits.

-V

This option reports the version number, build options, supported cryptographics algorithms, and exits.

-X lock-file

This option acquires a lock on the specified file at runtime; this helps to prevent duplicate named instances from running simultaneously. Use of this option overrides the lock-file option in named.conf. If set to none, the lock file check is disabled.

-x cache-file

This option loads data from cache-file into the cache of the default view.

WARNING:

This option must not be used in normal operations. It is only of interest to BIND 9 developers and may be removed or changed in a future release.

## SIGNALS
In routine operation, signals should not be used to control the nameserver; rndc should be used instead.

SIGHUP

This signal forces a reload of the server.

SIGINT, SIGTERM

These signals shut down the server.

The result of sending any other signals to the server is undefined.

## CONFIGURATION
The named configuration file is too complex to describe in detail here. A complete description is provided in the BIND 9 Administrator Reference Manual.

named inherits the umask (file creation mode mask) from the parent process. If files created by named, such as journal files, need to have custom permissions, the umask should be set explicitly in the script used to start the named process.

## FILES
/etc/named.conf

The default configuration file.

/var/run/named/named.pid

The default process-id file.

## SEE ALSO
RFC 1033, RFC 1034, RFC 1035, named-checkconf(8), named-checkzone(8), rndc(8), named.conf(5), BIND 9 Administrator Reference Manual.

## AUTHOR
Internet Systems Consortium

## COPYRIGHT
2024, Internet Systems Consortium


named-checkconf

title: named-checkconf(8)

text:
# named-checkconf(8)

## NAME
named-checkconf - named configuration file syntax checking tool

## SYNOPSIS
named-checkconf [-chjlvz] [-p [-x ]] [-t directory] {filename}

## DESCRIPTION
named-checkconf checks the syntax, but not the semantics, of a named configuration file. The file, along with all files included by it, is parsed and checked for syntax errors. If no file is specified, /etc/named.conf is read by default.

Note: files that named reads in separate parser contexts, such as rndc.key and bind.keys, are not automatically read by named-checkconf. Configuration errors in these files may cause named to fail to run, even if named-checkconf was successful. However, named-checkconf can be run on these files explicitly.

## OPTIONS
-h

This option prints the usage summary and exits.

-j

When loading a zonefile, this option instructs named to read the journal if it exists.

-l

This option lists all the configured zones. Each line of output contains the zone name, class (e.g. IN), view, and type (e.g. primary or secondary).

-c

This option specifies that only the "core" configuration should be checked. This suppresses the loading of plugin modules, and causes all parameters to plugin statements to be ignored.

-i

This option ignores warnings on deprecated options.

-p

This option prints out the named.conf and included files in canonical form if no errors were detected. See also the -x option.

-t directory

This option instructs named to chroot to directory, so that include directives in the configuration file are processed as if run by a similarly chrooted named.

-v

This option prints the version of the named-checkconf program and exits.

-x

When printing the configuration files in canonical form, this option obscures shared secrets by replacing them with strings of question marks (?). This allows the contents of named.conf and related files to be shared - for example, when submitting bug reports - without compromising private data. This option cannot be used without -p.

-z

This option performs a test load of all zones of type primary found in named.conf.

filename

This indicates the name of the configuration file to be checked. If not specified, it defaults to /etc/named.conf.

## RETURN VALUES
named-checkconf returns an exit status of 1 if errors were detected and 0 otherwise.

## SEE ALSO
named(8), named-checkzone(8), BIND 9 Administrator Reference Manual.

## AUTHOR
Internet Systems Consortium

## COPYRIGHT
2024, Internet Systems Consortium


named-checkzone

title: named-checkzone(8)

text:
# named-checkzone(8)

## NAME
named-checkzone - zone file validity checking or converting tool

## SYNOPSIS
named-checkzone [-d] [-h] [-j] [-q] [-v] [-c class] [-f format] [-F format] [-J filename] [-i mode] [-k mode] [-m mode] [-M mode] [-n mode] [-l ttl] [-L serial] [-o filename] [-r mode] [-s style] [-S mode] [-t directory] [-T mode] [-w directory] [-D] [-W mode] {zonename} {filename}

## DESCRIPTION
named-checkzone checks the syntax and integrity of a zone file. It performs the same checks as named does when loading a zone. This makes named-checkzone useful for checking zone files before configuring them into a name server.

## OPTIONS
-d

This option enables debugging.

-h

This option prints the usage summary and exits.

-q

This option sets quiet mode, which only sets an exit code to indicate successful or failed completion.

-v

This option prints the version of the named-checkzone program and exits.

-j

When loading a zone file, this option tells named to read the journal if it exists. The journal file name is assumed to be the zone file name with the string .jnl appended.

-J filename

When loading the zone file, this option tells named to read the journal from the given file, if it exists. This implies -j.

-c class

This option specifies the class of the zone. If not specified, IN is assumed.

-i mode

This option performs post-load zone integrity checks. Possible modes are full (the default), full-sibling, local, local-sibling, and none. Mode full checks that MX records refer to A or AAAA records (both in-zone and out-of-zone hostnames). Mode local only checks MX records which refer to in-zone hostnames.

Mode full checks that SRV records refer to A or AAAA records (both in-zone and out-of-zone hostnames). Mode local only checks SRV records which refer to in-zone hostnames.

Mode full checks that delegation NS records refer to A or AAAA records (both in-zone and out-of-zone hostnames). It also checks that glue address records in the zone match those advertised by the child. Mode local only checks NS records which refer to in-zone hostnames or verifies that some required glue exists, i.e., when the name server is in a child zone.

Modes full-sibling and local-sibling disable sibling glue checks, but are otherwise the same as full and local, respectively.

Mode none disables the checks.

-f format

This option specifies the format of the zone file. Possible formats are text (the default), raw, and map.

-F format

This option specifies the format of the output file specified. For named-checkzone, this does not have any effect unless it dumps the zone contents. Possible formats are text (the default), which is the standard textual representation of the zone, and map, raw, and raw=N, which store the zone in a binary format for rapid loading by named. raw=N specifies the format version of the raw zone file: if N is 0, the raw file can be read by any version of named; if N is 1, the file can only be read by release 9.9.0 or higher. The default is 1.

-k mode

This option performs check-names checks with the specified failure mode. Possible modes are fail, warn (the default), and ignore.

-l ttl

This option sets a maximum permissible TTL for the input file. Any record with a TTL higher than this value causes the zone to be rejected. This is similar to using the max-zone-ttl option in named.conf.

-L serial

When compiling a zone to raw or map format, this option sets the "source serial" value in the header to the specified serial number. This is expected to be used primarily for testing purposes.

-m mode

This option specifies whether MX records should be checked to see if they are addresses. Possible modes are fail, warn (the default), and ignore.

-M mode

This option checks whether a MX record refers to a CNAME. Possible modes are fail, warn (the default), and ignore.

-n mode

This option specifies whether NS records should be checked to see if they are addresses. Possible modes are fail, warn (the default), and ignore.

-o filename

This option writes the zone output to filename. If filename is -, then the zone output is written to standard output.

-r mode

This option checks for records that are treated as different by DNSSEC but are semantically equal in plain DNS. Possible modes are fail, warn (the default), and ignore.

-s style

This option specifies the style of the dumped zone file. Possible styles are full (the default) and relative. The full format is most suitable for processing automatically by a separate script. The relative format is more human-readable and is thus suitable for editing by hand. This does not have any effect unless it dumps the zone contents. It also does not have any meaning if the output format is not text.

-S mode

This option checks whether an SRV record refers to a CNAME. Possible modes are fail, warn (the default), and ignore.

-t directory

This option tells named to chroot to directory, so that include directives in the configuration file are processed as if run by a similarly chrooted named.

-T mode

This option checks whether Sender Policy Framework (SPF) records exist and issues a warning if an SPF-formatted TXT record is not also present. Possible modes are warn (the default) and ignore.

-w directory

This option instructs named to chdir to directory, so that relative filenames in master file $INCLUDE directives work. This is similar to the directory clause in named.conf.

-D

This option dumps the zone file in canonical format.

-W mode

This option specifies whether to check for non-terminal wildcards. Non-terminal wildcards are almost always the result of a failure to understand the wildcard matching algorithm (RFC 4592). Possible modes are warn (the default) and ignore.

zonename

This indicates the domain name of the zone being checked.

filename

This is the name of the zone file.

## RETURN VALUES
named-checkzone returns an exit status of 1 if errors were detected and 0 otherwise.

## SEE ALSO
named(8), named-checkconf(8), named-compilezone(8), RFC 1035, BIND 9 Administrator Reference Manual.

## AUTHOR
Internet Systems Consortium

## COPYRIGHT
2024, Internet Systems Consortium


named-compilezone

title: named-compilezone(8)

text:
# named-compilezone(8)

## NAME
named-compilezone - zone file validity checking or converting tool

## SYNOPSIS
named-compilezone [-d] [-h] [-j] [-q] [-v] [-c class] [-f format] [-F format] [-J filename] [-i mode] [-k mode] [-m mode] [-M mode] [-n mode] [-l ttl] [-L serial] [-r mode] [-s style] [-S mode] [-t directory] [-T mode] [-w directory] [-D] [-W mode] {-o filename} {zonename} {filename}

## DESCRIPTION
named-compilezone checks the syntax and integrity of a zone file, and dumps the zone contents to a specified file in a specified format. It applies strict check levels by default, since the dump output is used as an actual zone file loaded by named. When manually specified otherwise, the check levels must at least be as strict as those specified in the named configuration file.

## OPTIONS
-d

This option enables debugging.

-h

This option prints the usage summary and exits.

-q

This option sets quiet mode, which only sets an exit code to indicate successful or failed completion.

-v

This option prints the version of the named-checkzone program and exits.

-j

When loading a zone file, this option tells named to read the journal if it exists. The journal file name is assumed to be the zone file name with the string .jnl appended.

-J filename

When loading the zone file, this option tells named to read the journal from the given file, if it exists. This implies -j.

-c class

This option specifies the class of the zone. If not specified, IN is assumed.

-i mode

This option performs post-load zone integrity checks. Possible modes are full (the default), full-sibling, local, local-sibling, and none. Mode full checks that MX records refer to A or AAAA records (both in-zone and out-of-zone hostnames). Mode local only checks MX records which refer to in-zone hostnames.

Mode full checks that SRV records refer to A or AAAA records (both in-zone and out-of-zone hostnames). Mode local only checks SRV records which refer to in-zone hostnames.

Mode full checks that delegation NS records refer to A or AAAA records (both in-zone and out-of-zone hostnames). It also checks that glue address records in the zone match those advertised by the child. Mode local only checks NS records which refer to in-zone hostnames or verifies that some required glue exists, i.e., when the name server is in a child zone.

Modes full-sibling and local-sibling disable sibling glue checks, but are otherwise the same as full and local, respectively.

Mode none disables the checks.

-f format

This option specifies the format of the zone file. Possible formats are text (the default), raw, and map.

-F format

This option specifies the format of the output file specified. For named-checkzone, this does not have any effect unless it dumps the zone contents. Possible formats are text (the default), which is the standard textual representation of the zone, and map, raw, and raw=N, which store the zone in a binary format for rapid loading by named. raw=N specifies the format version of the raw zone file: if N is 0, the raw file can be read by any version of named; if N is 1, the file can only be read by release 9.9.0 or higher. The default is 1.

-k mode

This option performs check-names checks with the specified failure mode. Possible modes are fail (the default), warn, and ignore.

-l ttl

This option sets a maximum permissible TTL for the input file. Any record with a TTL higher than this value causes the zone to be rejected. This is similar to using the max-zone-ttl option in named.conf.

-L serial

When compiling a zone to raw or map format, this option sets the "source serial" value in the header to the specified serial number. This is expected to be used primarily for testing purposes.

-m mode

This option specifies whether MX records should be checked to see if they are addresses. Possible modes are fail, warn (the default), and ignore.

-M mode

This option checks whether a MX record refers to a CNAME. Possible modes are fail, warn (the default), and ignore.

-n mode

This option specifies whether NS records should be checked to see if they are addresses. Possible modes are fail (the default), warn, and ignore.

-o filename

This option writes the zone output to filename. If filename is -, then the zone output is written to standard output. This is mandatory for named-compilezone.

-r mode

This option checks for records that are treated as different by DNSSEC but are semantically equal in plain DNS. Possible modes are fail, warn (the default), and ignore.

-s style

This option specifies the style of the dumped zone file. Possible styles are full (the default) and relative. The full format is most suitable for processing automatically by a separate script. The relative format is more human-readable and is thus suitable for editing by hand.

-S mode

This option checks whether an SRV record refers to a CNAME. Possible modes are fail, warn (the default), and ignore.

-t directory

This option tells named to chroot to directory, so that include directives in the configuration file are processed as if run by a similarly chrooted named.

-T mode

This option checks whether Sender Policy Framework (SPF) records exist and issues a warning if an SPF-formatted TXT record is not also present. Possible modes are warn (the default) and ignore.

-w directory

This option instructs named to chdir to directory, so that relative filenames in master file $INCLUDE directives work. This is similar to the directory clause in named.conf.

-D

This option dumps the zone file in canonical format. This is always enabled for named-compilezone.

-W mode

This option specifies whether to check for non-terminal wildcards. Non-terminal wildcards are almost always the result of a failure to understand the wildcard matching algorithm (RFC 4592). Possible modes are warn (the default) and ignore.

zonename

This indicates the domain name of the zone being checked.

filename

This is the name of the zone file.

## RETURN VALUES
named-compilezone returns an exit status of 1 if errors were detected and 0 otherwise.

## SEE ALSO
named(8), named-checkconf(8), named-checkzone(8), RFC 1035, BIND 9 Administrator Reference Manual.

## AUTHOR
Internet Systems Consortium

## COPYRIGHT
2024, Internet Systems Consortium


named-journalprint

title: named-journalprint(8)

text:
# named-journalprint(8)

## NAME
named-journalprint - print zone journal in human-readable form

## SYNOPSIS
named-journalprint [-c serial] [-dux] {journal}

## DESCRIPTION
named-journalprint scans the contents of a zone journal file, printing it in a human-readable form, or, optionally, converting it to a different journal file format.

Journal files are automatically created by named when changes are made to dynamic zones (e.g., by nsupdate). They record each addition or deletion of a resource record, in binary format, allowing the changes to be re-applied to the zone when the server is restarted after a shutdown or crash. By default, the name of the journal file is formed by appending the extension .jnl to the name of the corresponding zone file.

named-journalprint converts the contents of a given journal file into a human-readable text format. Each line begins with add or del, to indicate whether the record was added or deleted, and continues with the resource record in master-file format.

The -c (compact) option provides a mechanism to reduce the size of a journal by removing (most/all) transactions prior to the specified serial number. Note: this option must not be used while named is running, and can cause data loss if the zone file has not been updated to contain the data being removed from the journal. Use with extreme caution.

The -x option causes additional data about the journal file to be printed at the beginning of the output and before each group of changes.

The -u (upgrade) and -d (downgrade) options recreate the journal file with a modified format version. The existing journal file is replaced. -d writes out the journal in the format used by versions of BIND up to 9.16.11; -u writes it out in the format used by versions since 9.16.13. (9.16.12 is omitted due to a journal-formatting bug in that release.) Note that these options must not be used while named is running.

## SEE ALSO
named(8), nsupdate(1), BIND 9 Administrator Reference Manual.

## AUTHOR
Internet Systems Consortium

## COPYRIGHT
2024, Internet Systems Consortium


title: nsec3hash(8)

summary: generate NSEC3 hash

text:
# nsec3hash(8)

## NAME
nsec3hash - generate NSEC3 hash

## SYNOPSIS
nsec3hash {salt} {algorithm} {iterations} {domain}

nsec3hash -r {algorithm} {flags} {iterations} {salt} {domain}

## DESCRIPTION
nsec3hash generates an NSEC3 hash based on a set of NSEC3 parameters. This can be used to check the validity of NSEC3 records in a signed zone.

If this command is invoked as nsec3hash -r, it takes arguments in order, matching the first four fields of an NSEC3 record followed by the domain name: algorithm, flags, iterations, salt, domain. This makes it convenient to copy and paste a portion of an NSEC3 or NSEC3PARAM record into a command line to confirm the correctness of an NSEC3 hash.

## ARGUMENTS
salt

This is the salt provided to the hash algorithm.

algorithm

This is a number indicating the hash algorithm. Currently the only supported hash algorithm for NSEC3 is SHA-1, which is indicated by the number 1; consequently "1" is the only useful value for this argument.

flags

This is provided for compatibility with NSEC3 record presentation format, but is ignored since the flags do not affect the hash.

iterations

This is the number of additional times the hash should be performed.

domain

This is the domain name to be hashed.

## SEE ALSO
BIND 9 Administrator Reference Manual, RFC 5155.

## AUTHOR
Internet Systems Consortium

## COPYRIGHT
2024, Internet Systems Consortium


rndc

title: rndc(8)

summary: name server control utility

text:
# rndc(8)

## NAME
rndc - name server control utility

## SYNOPSIS
rndc [-b source-address] [-c config-file] [-k key-file] [-s server] [-p port] [-q] [-r] [-V] [-y key_id] [[-4] | [-6]] {command}

## DESCRIPTION
rndc controls the operation of a name server; it supersedes the ndc utility. If rndc is invoked with no command line options or arguments, it prints a short summary of the supported commands and the available options and their arguments.

rndc communicates with the name server over a TCP connection, sending commands authenticated with digital signatures. In the current versions of rndc and named, the only supported authentication algorithms are HMAC-MD5 (for compatibility), HMAC-SHA1, HMAC-SHA224, HMAC-SHA256 (default), HMAC-SHA384, and HMAC-SHA512. They use a shared secret on each end of the connection, which provides TSIG-style authentication for the command request and the name server's response. All commands sent over the channel must be signed by a key_id known to the server.

rndc reads a configuration file to determine how to contact the name server and decide what algorithm and key it should use.

## OPTIONS
-4

This option indicates use of IPv4 only.

-6

This option indicates use of IPv6 only.

-b source-address

This option indicates source-address as the source address for the connection to the server. Multiple instances are permitted, to allow setting of both the IPv4 and IPv6 source addresses.

-c config-file

This option indicates config-file as the configuration file instead of the default, /etc/rndc.conf.

-k key-file

This option indicates key-file as the key file instead of the default, /etc/rndc.key. The key in /etc/rndc.key is used to authenticate commands sent to the server if the config-file does not exist.

-s server

server is the name or address of the server which matches a server statement in the configuration file for rndc. If no server is supplied on the command line, the host named by the default-server clause in the options statement of the rndc configuration file is used.

-p port

This option instructs BIND 9 to send commands to TCP port port instead of its default control channel port, 953.

-q

This option sets quiet mode, where message text returned by the server is not printed unless there is an error.

-r

This option instructs rndc to print the result code returned by named after executing the requested command (e.g., ISC_R_SUCCESS, ISC_R_FAILURE, etc.).

-V

This option enables verbose logging.

-y key_id

This option indicates use of the key key_id from the configuration file. For control message validation to succeed, key_id must be known by named with the same algorithm and secret string. If no key_id is specified, rndc first looks for a key clause in the server statement of the server being used, or if no server statement is present for that host, then in the default-key clause of the options statement. Note that the configuration file contains shared secrets which are used to send authenticated control commands to name servers, and should therefore not have general read or write access.

## COMMANDS
A list of commands supported by rndc can be seen by running rndc without arguments.

Currently supported commands are:

addzone zone [class [view]] configuration

This command adds a zone while the server is running. This command requires the allow-new-zones option to be set to yes. The configuration string specified on the command line is the zone configuration text that would ordinarily be placed in named.conf. The configuration is saved in a file called viewname.nzf (or, if named is compiled with liblmdb, an LMDB database file called viewname.nzd). viewname is the name of the view, unless the view name contains characters that are incompatible with use as a file name, in which case a cryptographic hash of the view name is used instead. When named is restarted, the file is loaded into the view configuration so that zones that were added can persist after a restart.

This sample addzone command adds the zone example.com to the default view:

rndc addzone example.com '{ type master; file "example.com.db"; };'

(Note the brackets around and semi-colon after the zone configuration text.)

See also rndc delzone and rndc modzone.

delzone [-clean] zone [class [view]]

This command deletes a zone while the server is running. If the -clean argument is specified, the zone's master file (and journal file, if any) are deleted along with the zone. Without the -clean option, zone files must be deleted manually. (If the zone is of type secondary or stub, the files needing to be removed are reported in the output of the rndc delzone command.)

If the zone was originally added via rndc addzone, then it is removed permanently. However, if it was originally configured in named.conf, then that original configuration remains in place; when the server is restarted or reconfigured, the zone is recreated. To remove it permanently, it must also be removed from named.conf.

See also rndc addzone and rndc modzone.

dnssec ( -status | -rollover -key id [-alg algorithm] [-when time] | -checkds [-key id [-alg algorithm]] [-when time] ( published | withdrawn )) zone [class [view]]

This command allows you to interact with the "dnssec-policy" of a given zone. rndc dnssec -status show the DNSSEC signing state for the specified zone.

rndc dnssec -rollover allows you to schedule key rollover for a specific key (overriding the original key lifetime).

rndc dnssec -checkds informs named that the DS for a specified zone's key-signing key has been confirmed to be published in, or withdrawn from, the parent zone. This is required in order to complete a KSK rollover. The -key id and -alg algorithm arguments can be used to specify a particular KSK, if necessary; if there is only one key acting as a KSK for the zone, these arguments can be omitted. The time of publication or withdrawal for the DS is set to the current time by default, but can be overridden to a specific time with the argument -when time, where time is expressed in YYYYMMDDHHMMSS notation.

dnstap ( -reopen | -roll [number] )

This command closes and re-opens DNSTAP output files. rndc dnstap -reopen allows the output file to be renamed externally, so that named can truncate and re-open it.

rndc dnstap -roll causes the output file to be rolled automatically, similar to log files. The most recent output file has ".0" appended to its name; the previous most recent output file is moved to ".1", and so on. If number is specified, then the number of backup log files is limited to that number.

dumpdb [-all | -cache | -zones | -adb | -bad | -expired | -fail] [view ...]

This command dumps the server's caches (default) and/or zones to the dump file for the specified views. If no view is specified, all views are dumped. (See the dump-file option in the BIND 9 Administrator Reference Manual.)

flush

This command flushes the server's cache.

flushname name [view]

This command flushes the given name from the view's DNS cache and, if applicable, from the view's nameserver address database, bad server cache, and SERVFAIL cache.

flushtree name [view]

This command flushes the given name, and all of its subdomains, from the view's DNS cache, address database, bad server cache, and SERVFAIL cache.

freeze [zone [class [view]]]

This command suspends updates to a dynamic zone. If no zone is specified, then all zones are suspended. This allows manual edits to be made to a zone normally updated by dynamic update, and causes changes in the journal file to be synced into the master file. All dynamic update attempts are refused while the zone is frozen. See also rndc thaw.

halt [-p]

This command stops the server immediately. Recent changes made through dynamic update or IXFR are not saved to the master files, but are rolled forward from the journal files when the server is restarted. If -p is specified, named's process ID is returned. This allows an external process to determine when named has completed halting. See also rndc stop.

loadkeys [zone [class [view]]]

This command fetches all DNSSEC keys for the given zone from the key directory. If they are within their publication period, they are merged into the zone's DNSKEY RRset. Unlike rndc sign, however, the zone is not immediately re-signed by the new keys, but is allowed to incrementally re-sign over time. This command requires that the zone be configured with a dnssec-policy, or that the auto-dnssec zone option be set to maintain, and also requires the zone to be configured to allow dynamic DNS. (See "Dynamic Update Policies" in the Administrator Reference Manual for more details.)

managed-keys (status | refresh | sync | destroy) [class [view]]

This command inspects and controls the "managed-keys" database which handles RFC 5011 DNSSEC trust anchor maintenance. If a view is specified, these commands are applied to that view; otherwise, they are applied to all views.

- When run with the status keyword, this prints the current status of the managed-keys database.

- When run with the refresh keyword, this forces an immediate refresh query to be sent for all the managed keys, updating the managed-keys database if any new keys are found, without waiting the normal refresh interval.

- When run with the sync keyword, this forces an immediate dump of the managed-keys database to disk (in the file managed-keys.bind or (viewname.mkeys). This synchronizes the database with its journal file, so that the database's current contents can be inspected visually.

- When run with the destroy keyword, the managed-keys database is shut down and deleted, and all key maintenance is terminated. This command should be used only with extreme caution. Existing keys that are already trusted are not deleted from memory; DNSSEC validation can continue after this command is used. However, key maintenance operations cease until named is restarted or reconfigured, and all existing key maintenance states are deleted.

Running rndc reconfig or restarting named immediately after this command causes key maintenance to be reinitialized from scratch, just as if the server were being started for the first time. This is primarily intended for testing, but it may also be used, for example, to jumpstart the acquisition of new keys in the event of a trust anchor rollover, or as a brute-force repair for key maintenance problems.

modzone zone [class [view]] configuration

This command modifies the configuration of a zone while the server is running. This command requires the allow-new-zones option to be set to yes. As with addzone, the configuration string specified on the command line is the zone configuration text that would ordinarily be placed in named.conf. If the zone was originally added via rndc addzone, the configuration changes are recorded permanently and are still in effect after the server is restarted or reconfigured. However, if it was originally configured in named.conf, then that original configuration remains in place; when the server is restarted or reconfigured, the zone reverts to its original configuration. To make the changes permanent, it must also be modified in named.conf.

See also rndc addzone and rndc delzone.

notify zone [class [view]]

This command resends NOTIFY messages for the zone.

notrace

This command sets the server's debugging level to 0. See also rndc trace.

nta [( -class class | -dump | -force | -remove | -lifetime duration)] domain [view]

This command sets a DNSSEC negative trust anchor (NTA) for domain, with a lifetime of duration. The default lifetime is configured in named.conf via the nta-lifetime option, and defaults to one hour. The lifetime cannot exceed one week. A negative trust anchor selectively disables DNSSEC validation for zones that are known to be failing because of misconfiguration rather than an attack. When data to be validated is at or below an active NTA (and above any other configured trust anchors), named aborts the DNSSEC validation process and treats the data as insecure rather than bogus. This continues until the NTA's lifetime has elapsed.

NTAs persist across restarts of the named server. The NTAs for a view are saved in a file called name.nta, where name is the name of the view; if it contains characters that are incompatible with use as a file name, a cryptographic hash is generated from the name of the view.

An existing NTA can be removed by using the -remove option.

An NTA's lifetime can be specified with the -lifetime option. TTL-style suffixes can be used to specify the lifetime in seconds, minutes, or hours. If the specified NTA already exists, its lifetime is updated to the new value. Setting lifetime to zero is equivalent to -remove.

If -dump is used, any other arguments are ignored and a list of existing NTAs is printed. Note that this may include NTAs that are expired but have not yet been cleaned up.

Normally, named periodically tests to see whether data below an NTA can now be validated (see the nta-recheck option in the Administrator Reference Manual for details). If data can be validated, then the NTA is regarded as no longer necessary and is allowed to expire early. The -force parameter overrides this behavior and forces an NTA to persist for its entire lifetime, regardless of whether data could be validated if the NTA were not present.

The view class can be specified with -class. The default is class IN, which is the only class for which DNSSEC is currently supported.

All of these options can be shortened, i.e., to -l, -r, -d, -f, and -c.

Unrecognized options are treated as errors. To refer to a domain or view name that begins with a hyphen, use a double-hyphen (--) on the command line to indicate the end of options.

querylog [(on | off)]

This command enables or disables query logging. For backward compatibility, this command can also be used without an argument to toggle query logging on and off. Query logging can also be enabled by explicitly directing the queries category to a channel in the logging section of named.conf, or by specifying querylog yes; in the options section of named.conf.

reconfig

This command reloads the configuration file and loads new zones, but does not reload existing zone files even if they have changed. This is faster than a full reload when there is a large number of zones, because it avoids the need to examine the modification times of the zone files.

recursing

This command dumps the list of queries named is currently recursing on, and the list of domains to which iterative queries are currently being sent. The first list includes all unique clients that are waiting for recursion to complete, including the query that is awaiting a response and the timestamp (seconds since the Unix epoch) of when named started processing this client query.

The second list comprises of domains for which there are active (or recently active) fetches in progress. It reports the number of active fetches for each domain and the number of queries that have been passed (allowed) or dropped (spilled) as a result of the fetches-per-zone limit. (Note: these counters are not cumulative over time; whenever the number of active fetches for a domain drops to zero, the counter for that domain is deleted, and the next time a fetch is sent to that domain, it is recreated with the counters set to zero).

refresh zone [class [view]]

This command schedules zone maintenance for the given zone.

reload

This command reloads the configuration file and zones. As no zone is specified, the reloading of the zones happens asynchronously.

reload zone [class [view]]

This command reloads the given zone.

retransfer zone [class [view]]

This command retransfers the given secondary zone from the primary server. If the zone is configured to use inline-signing, the signed version of the zone is discarded; after the retransfer of the unsigned version is complete, the signed version is regenerated with new signatures.

scan

This command scans the list of available network interfaces for changes, without performing a full reconfig or waiting for the interface-interval timer.

secroots [-] [view ...]

This command dumps the security roots (i.e., trust anchors configured via trust-anchors, or the managed-keys or trusted-keys statements [both deprecated], or dnssec-validation auto) and negative trust anchors for the specified views. If no view is specified, all views are dumped. Security roots indicate whether they are configured as trusted keys, managed keys, or initializing managed keys (managed keys that have not yet been updated by a successful key refresh query). If the first argument is -, then the output is returned via the rndc response channel and printed to the standard output. Otherwise, it is written to the secroots dump file, which defaults to named.secroots, but can be overridden via the secroots-file option in named.conf.

See also rndc managed-keys.

serve-stale (on | off | reset | status) [class [view]]

This command enables, disables, resets, or reports the current status of the serving of stale answers as configured in named.conf. If serving of stale answers is disabled by rndc-serve-stale off, then it remains disabled even if named is reloaded or reconfigured. rndc serve-stale reset restores the setting as configured in named.conf.

rndc serve-stale status reports whether serving of stale answers is currently enabled, disabled by the configuration, or disabled by rndc. It also reports the values of stale-answer-ttl and max-stale-ttl.

showzone zone [class [view]]

This command prints the configuration of a running zone. See also rndc zonestatus.

sign zone [class [view]]

This command fetches all DNSSEC keys for the given zone from the key directory (see the key-directory option in the BIND 9 Administrator Reference Manual). If they are within their publication period, they are merged into the zone's DNSKEY RRset. If the DNSKEY RRset is changed, then the zone is automatically re-signed with the new key set. This command requires that the zone be configured with a dnssec-policy, or that the auto-dnssec zone option be set to allow or maintain, and also requires the zone to be configured to allow dynamic DNS. (See "Dynamic Update Policies" in the BIND 9 Administrator Reference Manual for more details.)

See also rndc loadkeys.

signing [(-list | -clear keyid/algorithm | -clear all | -nsec3param ( parameters | none ) | -serial value ) zone [class [view]]

This command lists, edits, or removes the DNSSEC signing-state records for the specified zone. The status of ongoing DNSSEC operations, such as signing or generating NSEC3 chains, is stored in the zone in the form of DNS resource records of type sig-signing-type. rndc signing -list converts these records into a human-readable form, indicating which keys are currently signing or have finished signing the zone, and which NSEC3 chains are being created or removed. rndc signing -clear can remove a single key (specified in the same format that rndc signing -list uses to display it), or all keys. In either case, only completed keys are removed; any record indicating that a key has not yet finished signing the zone is retained.

rndc signing -nsec3param sets the NSEC3 parameters for a zone. This is the only supported mechanism for using NSEC3 with inline-signing zones. Parameters are specified in the same format as an NSEC3PARAM resource record: hash algorithm, flags, iterations, and salt, in that order.

Currently, the only defined value for hash algorithm is 1, representing SHA-1. The flags may be set to 0 or 1, depending on whether the opt-out bit in the NSEC3 chain should be set. iterations defines the number of additional times to apply the algorithm when generating an NSEC3 hash. The salt is a string of data expressed in hexadecimal, a hyphen (-) if no salt is to be used, or the keyword auto, which causes named to generate a random 64-bit salt.

The only recommended configuration is rndc signing -nsec3param 1 0 0 - zone, i.e. no salt, no additional iterations, no opt-out.

WARNING:

Do not use extra iterations, salt, or opt-out unless all their implications are fully understood. A higher number of iterations causes interoperability problems and opens servers to CPU-exhausting DoS attacks.

rndc signing -nsec3param none removes an existing NSEC3 chain and replaces it with NSEC.

rndc signing -serial value sets the serial number of the zone to value. If the value would cause the serial number to go backwards, it is rejected. The primary use of this parameter is to set the serial number on inline signed zones.

stats

This command writes server statistics to the statistics file. (See the statistics-file option in the BIND 9 Administrator Reference Manual.)

status

This command displays the status of the server. Note that the number of zones includes the internal bind/CH zone and the default ./IN hint zone, if there is no explicit root zone configured.

stop -p

This command stops the server, making sure any recent changes made through dynamic update or IXFR are first saved to the master files of the updated zones. If -p is specified, named(8)`'s process ID is returned. This allows an external process to determine when ``named has completed stopping. See also rndc halt.

sync -clean [zone [class [view]]]

This command syncs changes in the journal file for a dynamic zone to the master file. If the "-clean" option is specified, the journal file is also removed. If no zone is specified, then all zones are synced.

tcp-timeouts [initial idle keepalive advertised]

When called without arguments, this command displays the current values of the tcp-initial-timeout, tcp-idle-timeout, tcp-keepalive-timeout, and tcp-advertised-timeout options. When called with arguments, these values are updated. This allows an administrator to make rapid adjustments when under a denial-of-service (DoS) attack. See the descriptions of these options in the BIND 9 Administrator Reference Manual for details of their use.

thaw [zone [class [view]]]

This command enables updates to a frozen dynamic zone. If no zone is specified, then all frozen zones are enabled. This causes the server to reload the zone from disk, and re-enables dynamic updates after the load has completed. After a zone is thawed, dynamic updates are no longer refused. If the zone has changed and the ixfr-from-differences option is in use, the journal file is updated to reflect changes in the zone. Otherwise, if the zone has changed, any existing journal file is removed. If no zone is specified, the reloading happens asynchronously. See also rndc freeze.

trace

This command increments the server's debugging level by one.

trace level

This command sets the server's debugging level to an explicit value. See also rndc notrace.

tsig-delete keyname [view]

This command deletes a given TKEY-negotiated key from the server. This does not apply to statically configured TSIG keys.

tsig-list

This command lists the names of all TSIG keys currently configured for use by named in each view. The list includes both statically configured keys and dynamic TKEY-negotiated keys.

validation (on | off | status) [view ...]``

This command enables, disables, or checks the current status of DNSSEC validation. By default, validation is enabled. The cache is flushed when validation is turned on or off to avoid using data that might differ between states.

zonestatus zone [class [view]]

This command displays the current status of the given zone, including the master file name and any include files from which it was loaded, when it was most recently loaded, the current serial number, the number of nodes, whether the zone supports dynamic updates, whether the zone is DNSSEC signed, whether it uses automatic DNSSEC key management or inline signing, and the scheduled refresh or expiry times for the zone. See also rndc showzone.

rndc commands that specify zone names, such as reload, retransfer, or zonestatus, can be ambiguous when applied to zones of type redirect. Redirect zones are always called ., and can be confused with zones of type hint or with secondary copies of the root zone. To specify a redirect zone, use the special zone name -redirect, without a trailing period. (With a trailing period, this would specify a zone called "-redirect".)

## LIMITATIONS
There is currently no way to provide the shared secret for a key_id without using the configuration file.

Several error messages could be clearer.

## SEE ALSO
rndc.conf(5), rndc-confgen(8), named(8), named.conf(5), ndc(8), BIND 9 Administrator Reference Manual.

## AUTHOR
Internet Systems Consortium

## COPYRIGHT
2024, Internet Systems Consortium


rndc-confgen

title: rndc-confgen(8)

summary: rndc key generation tool

text:
# rndc-confgen(8)

## NAME
rndc-confgen - rndc key generation tool

## SYNOPSIS
rndc-confgen [-a] [-A algorithm] [-b keysize] [-c keyfile] [-h] [-k keyname] [-p port] [-s address] [-t chrootdir] [-u user]

## DESCRIPTION
rndc-confgen generates configuration files for rndc. It can be used as a convenient alternative to writing the rndc.conf file and the corresponding controls and key statements in named.conf by hand. Alternatively, it can be run with the -a option to set up a rndc.key file and avoid the need for a rndc.conf file and a controls statement altogether.

## OPTIONS
-a

This option sets automatic rndc configuration, which creates a file rndc.key in /etc (or a different sysconfdir specified when BIND was built) that is read by both rndc and named on startup. The rndc.key file defines a default command channel and authentication key allowing rndc to communicate with named on the local host with no further configuration. If a more elaborate configuration than that generated by rndc-confgen -a is required, for example if rndc is to be used remotely, run rndc-confgen without the -a option and set up rndc.conf and named.conf as directed.

-A algorithm

This option specifies the algorithm to use for the TSIG key. Available choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, and hmac-sha512. The default is hmac-sha256.

-b keysize

This option specifies the size of the authentication key in bits. The size must be between 1 and 512 bits; the default is the hash size.

-c keyfile

This option is used with the -a option to specify an alternate location for rndc.key.

-h

This option prints a short summary of the options and arguments to rndc-confgen.

-k keyname

This option specifies the key name of the rndc authentication key. This must be a valid domain name. The default is rndc-key.

-p port

This option specifies the command channel port where named listens for connections from rndc. The default is 953.

-s address

This option specifies the IP address where named listens for command-channel connections from rndc. The default is the loopback address 127.0.0.1.

-t chrootdir

This option is used with the -a option to specify a directory where named runs chrooted. An additional copy of the rndc.key is written relative to this directory, so that it is found by the chrooted named.

-u user

This option is used with the -a option to set the owner of the generated rndc.key file. If -t is also specified, only the file in the chroot area has its owner changed.

## EXAMPLES
To allow rndc to be used with no manual configuration, run:

rndc-confgen -a

To print a sample rndc.conf file and the corresponding controls and key statements to be manually inserted into named.conf, run:

rndc-confgen

## SEE ALSO
rndc(8), rndc.conf(5), named(8), BIND 9 Administrator Reference Manual.

## AUTHOR
Internet Systems Consortium

## COPYRIGHT
2024, Internet Systems Consortium


tsig-keygen

title: tsig-keygen(8)

summary: TSIG key generation tool

text:
# tsig-keygen(8)

## NAME
tsig-keygen - TSIG key generation tool

## SYNOPSIS
tsig-keygen [-a algorithm] [-h] [name]

## DESCRIPTION
tsig-keygen is an utility that generates keys for use in TSIG signing. The resulting keys can be used, for example, to secure dynamic DNS updates to a zone, or for the rndc command channel.

A domain name can be specified on the command line to be used as the name of the generated key. If no name is specified, the default is tsig-key.

## OPTIONS
-a algorithm

This option specifies the algorithm to use for the TSIG key. Available choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, and hmac-sha512. The default is hmac-sha256. Options are case-insensitive, and the "hmac-" prefix may be omitted.

-h

This option prints a short summary of options and arguments.

## SEE ALSO
nsupdate(1), named.conf(5), named(8), BIND 9 Administrator Reference Manual.

## AUTHOR
Internet Systems Consortium

## COPYRIGHT
2024, Internet Systems Consortium


bing

package: bing

title: bing(8)

text:
# bing(8)

## NAME
bing - compute point to point throughput using two sizes of ICMP ECHO_REQUEST packets to pairs of remote hosts.

## SYNOPSIS
bing [dDnrRPvVwz] [-c count] [-e samples] [-f samplefile] [-i wait] [-p pattern] [-s small packetsize] [-S big packetsize] host1 host2 [...]

## DESCRIPTION
Bing determines bandwidth on a point-to-point link by sending ICMP ECHO_REQUEST packets and measuring their roundtrip times for different packet sizes on each end of the link.

host1 is supposed to be the nearest end of the link, while host2 is the other end.

The options are as follows:

-c count

Stop after count resets of the stats. Useful only in conjunction with the -e option. Defaults to 1.

-d

Set the SO_DEBUG option on the socket being used.

-D

Display the measured throughput at every received packet. By default, it is displayed only when the computed value changes, which itself changes only when the minimum roundtrip time for one of the packet sizes changes.

-e samples

Reset stats after sending samples ECHO_REQUEST packets.

-f samplefile

Saves the bandwidth measurements to the file samplefile.

-i wait

Wait wait seconds for each ECHO_REPLY packet. The default is to wait for four seconds.

-n

Numeric output only. No attempt will be made to lookup symbolic names for host addresses.

-P

Be pedantic regarding round-trip times. Normally, bing assumes that the roundtrip time for a small packet should always be smaller than the roundtrip time for a big packet to the same host, that for a given size the roundtrip time for host1 should always be smaller than the roundtrip time for host2, and that the increase in the roundtrip time between host1 and host2 should always be bigger for big packets than for small packets.

Bing takes advantage of this to better determine the minimum roundtrip times.

Option -P disables this behaviour, in the unlikely event it could be of any use someday. Even IP/X25 links are not weird enough to require this, though.

-p pattern

You may specify up to 16 ``pad'' bytes to fill out the packet you send. This is useful for diagnosing data-dependent problems in a network. For example, ``-p ff'' will cause the sent packet to be filled with all ones.

-R

Record route. Includes the RECORD_ROUTE option in the ECHO_REQUEST packet and displays the route buffer on returned packets. Note that the IP header is only large enough for nine such routes. Many hosts ignore or discard this option.

-r

Bypass the normal routing tables and send directly to a host on an attached network. If the host is not on a directly-attached network, an error is returned. This option can be used to ping a local host through an interface that has no route through it (e.g., after the interface was dropped by routed(8)).

-s small packetsize

Specifies the number of data bytes to be sent in the small packets. The default and minimum value is 44.

-S big packetsize

Specifies the number of data bytes to be sent in the big packets. The default is 108. The size should be chosen so that big packet roundtrip times are long enough to be accurately measured (depending on clock resolution and number of hops).

-u size increment

Specifies that bing should start sending packets of the size of small packetsize and then increase the size by size increment until it reaches big packetsize.

-v

Verbose output. ICMP packets other than ECHO_RESPONSE that are received are listed.

-V

Very verbose output. The roundtrip time of each received echo is displayed.

-w

Display possible warnings about roundtrip times all the time. By default, warnings are printed only at the end.

-z

Fill packets with uncompressible (pseudo-random) data.

Round-trip times and packet loss statistics are computed. If duplicate packets are received, they are not included in the packet loss calculation, although the round trip time of these packets is used in calculating the minimum/average/maximum round-trip time numbers. When the specified number of loops have been made or if the program is terminated with a SIGINT, a brief summary is displayed.

This program is intended for use in network testing, measurement and management. Because of the load it can impose on the network, it is unwise to use bing during normal operations or from automated scripts.

## BUGS
Many Hosts and Gateways ignore the RECORD_ROUTE option.

The maximum IP header length is too small for options like RECORD_ROUTE to be completely useful. There's not much that that can be done about this, however.

Some of the final stats (average throughputs) almost never give a even marginally correct result.

## SEE ALSO
netstat(1), ifconfig(8), ping(8), routed(8), traceroute(8)

## AUTHOR
Pierre Beyssac <pb@fasterix.freenix.fr>

Port to Windows: Francois Gouget <fgouget@mygale.org>


binkd

package: binkd

title: binkd(8)

text:
# binkd(8)

## NAME
binkd - transfer files between two Fidonet systems over TCP/IP

## SYNOPSIS
binkd [-CcDipqrsvdmh] [ -P node ] config-file

## DESCRIPTION
Binkd is a Fidonet mailer designed to operate via TCP/IP networks. As a FTN-compatible internet daemon, it makes possible efficient utilization of TCP/IP protocol suite as a transport layer in FTN-based (Fido Technology Network) networks.

Binkd expects your spool for Fido-like networks to be in BSO ("Bink style outbound") or optionaly ASO ("Amiga style outbound") format. BSO is also used by ifmail and BinkleyTerm mailers.

## OPTIONS
-C

Binkd running with this option will reread the configuration file if it is changed. The modification time of the configuration file is checked every 60 seconds and on every incoming and outgoing connection.

-c

Start client only. Normally Binkd starts both server and client.

-D

Run Binkd as a daemon (cannot be used for client-only mode).

-i

Run Binkd from inetd.

-P

Poll a node. An empty *.ilo file in the outbound will be created, which will force Binkd to connect to and to receive mail from the node ( Binkd will also add "Node node * -" record to the table-of-nodes in Binkd ´s memory if there is no entry for the node in the configuration file).

-p

Start client manager, process polls, quit if the queue seems to be empty after the next rescan. Implies -c.

-q

Quiet mode. Turns off printq, conlog and percents statements of configuration.

-r

Disable crypt traffic.

-s

Start server only. Normally Binkd starts both server and client.

-v

Be verbose. Binkd -v will dump binkd's version and quit.

-vv

Dump version and compiled-in options.

-d

Dump parsed config and exit.

-m

Disable CRAM-MD5 authorization. Implies -r.

-h

Print help message.

## SIGNALS
SIGHUP

Causes Binkd to reload it's config.

## ENVIROMENT
BINKD_LOG

log file name. Binkd uses this enviroment variable if the logfile token is not defined in the config file

## SEE ALSO
inetd(8)

Binkd FAQ, Binkd User Guide, Binkd homepage http://binkd.grumbler.org, http://www.corbina.net/~maloff/binkd/ ftp://happy.kiev.ua/pub/fidosoft/mailer/binkd/

## AUTHORS
Dima Maloff <maloff@tts.magadan.su> and others.

This manual page is based on "Binkd User Guide" by nsoveiko@doe.carleton.ca (Nick Soveiko)

## REPORTING BUGS
Report bugs to <binkd-bugs@happy.kiev.ua>


bitlbee

package: bitlbee

title: bitlbee(8)

summary: IRC gateway to IM chat networks

text:
# bitlbee(8)

## NAME
BitlBee - IRC gateway to IM chat networks

## SYNOPSIS
bitlbee [-I] [-c configuration file] [-d configuration directory]

bitlbee -D [-i address] [-p port number] [-n] [-v] [-c configuration file] [-d configuration directory]

bitlbee -h

## DESCRIPTION
BitlBee is an IRC daemon that can talk to instant messaging networks and acts as a gateway. Users can connect to the server with any normal IRC client and see their 'buddy list' in &bitlbee.

bitlbee should be called by inetd(8), or you can run it as a stand-alone daemon.

## OPTIONS
-I

Run in inetd(8) mode. This is the default setting, you usually don't have to specify this option.

-D

Run in daemon mode. In this mode, BitlBee forks to the background and waits for new connections. All clients will be served from one process.

-F

Run in ForkDaemon mode. This is similar to ordinary daemon mode, but every client gets its own process. Easier to set up than inetd mode, and without the possible stability issues.

-i address

Only useful when running in daemon mode, to specify the network interface (identified by IP address) to which the daemon should attach. Use this if you don't want BitlBee to listen on every interface (which is the default behaviour).

-p port number

Only useful when running in daemon mode, to specify the port number on which BitlBee should listen for connections. 6667 is the default value.

-n

Only useful when running in daemon mode. This option prevents BitlBee from forking into the background.

-v

Be more verbose. This only works together with the -n flag.

-c path to other configuration file

Use a different configuration file.

-d path to user settings directory

BitlBee normally saves every user's settings in /var/lib/bitlbee/. If you want the settings to be stored somewhere else (for example, if you don't have write permissions in the default location), use this option.

-h

Show help information.

## COMMANDS
To get a complete list of commands, please use the help commands command in the &bitlbee channel.

## SEE ALSO
ircd(8), inetd(8), inetd.conf(5), gaim(1).

http://www.bitlbee.org/

For more information on using BitlBee, once connected, you should use the on-line help system.

## BUGS
Of course there are bugs. If you find some, please report them at http://bugs.bitlbee.org/.

## LICENSE
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple PLace, Suite 330, Boston, MA 02111-1307 USA

## AUTHORS

Wilmer van der Gaast <wilmer@gaast.net>


bld

package: bld

title: bld(8)

text:
# bld(8)

## NAME
bld - A black list daemon

## SYNOPSIS
bld -h | [option]

## OPTIONS
-v

Output version information and exit

-n

Do not fork to become a daemon

-a address

Address to bind to

-p port

Port to listen to

-l number

Log verbosity (between 0 and 3)

-t number

Minimum time interval before blacklisting

-m number

Maximum submissions in time interval

-i number

IP list size

-b number

Blacklist size

-e number

Blacklist expiration

-P filename

Filename where to save PID

-T number

Timeout for client connections

-u user

User to run as

-g group

Group to run as

-f filename

Use a specific configuration file

-A filename

Filename where to find ACLs

-W filename

Filename where to find whitelist

-B filename

Filename where to store blacklist

-I filename

Filename where to store whole IP list

## DESCRIPTION
By default, the bld daemon listens to requests on port 2905. Requests are either IP addresses submissions or checks against the black list.

bld uses a very simple algorithm to decide whether to add IP addresses to the blacklist or not. The first time an IP address is submitted, it is added to an internal list with a timestamp and all further requests increment a counter for this IP. As soon as the minimum time interval is elapsed (default: 30 seconds), and if a maximum requests ratio is reached (default: 10 submissions in the 30 seconds interval), the IP is put in the blacklist. It is then blacklisted for a configurable time (default: 900 seconds).

## PROTOCOL
Requests sent to bld are rather simple. Each request or reply is followed by a linefeed and a carriage return. A client may only send one request per TCP session. As of now, two commands may be used: ip (address submission) and ip? (ask if address is blacklisted).

ip=a.b.c.d submits an IP address. The server acknowledges either with a 200 code if the address is not blacklisted or a 421 if it is.

ipdecr=a.b.c.d decrements the internal counter for an IP address. The lowest value for the counter is zero. The server always acknowledges with a 200 code.

ip?=a.b.c.d asks if address is blacklisted. The server reply may be 421 if it is or 200 if it's not.

ipbl=a.b.c.d forces the insertion in the blacklist. The server acknowledges with a 200 code.

If using IP based restrictions, the server reply may be 600 if the client is not in the correct ACL to perform a request. Any other error will generate a reply with a 500 error code.

## NOTES
bld binds to localhost by default and accepts any local request, so please make sure that only trusted users can establish a connection to the daemon. Please check that all authorized hosts meet the minimal security requirements before changing this parameter even if using an access control list (see bld_acl.conf(5)).

bld will log some statistics if it receives the SIGUSR1 signal. SIGUSR2 is used to force a dump of both lists in bld working directory.

## FILES
/etc/bld.conf /etc/bld_acl.conf /etc/bld_whitelist.conf /var/run/bld/bld.pid /var/run/bld/bld_iplist.dump /var/run/bld/bld_blacklist.dump

## SEE ALSO
bld.conf(5) bld_acl.conf(5) bld_whitelist.conf(5) bldread(8) bldquery(8) bldsubmit(8) blddecr(8)

## AUTHOR
Olivier Beyssac <obld@r14.freenix.org>


bld-mrtg.pl

title: bld-mrtg.pl(8)

text:
# bld-mrtg.pl(8)

## NAME
bld-mrtg.pl - return MRTG-friendly statistics about local BLD status

## SYNOPSIS
bld-mrtg.pl

## DESCRIPTION
bld-mrtg.pl reads bld daemon dump files and prints statistics about the number of currently blacklisted IPs and the number of IPs added within the last 5 minutes. The default output is MRTG-friendly.

## SEE ALSO
bld(8) bldread(8)

## AUTHOR
Olivier Beyssac <obld@r14.freenix.org>


title: bld-pf_log.pl(8)

text:
# bld-pf_log.pl(8)

## NAME
bld-pf_log.pl - feed BLD with Postifx log files

## SYNOPSIS
bld-pf_log.pl

## DESCRIPTION
bld-pf_log.pl reads mail logs and submits to a bld daemon anything that looks like a "user unknown" Postfix log line. This script gets its information from stdin, so the easiest way to use it is like this:

tail -f /path/to/postfix/logfile | bld-pf_log.pl

You may have to provide various options to the tail program in order to support file modifications such as log rotations.

## SEE ALSO
bld(8) bldread(8) tail(1)

## AUTHOR
Olivier Beyssac <obld@r14.freenix.org>


title: bld-pf_policy(8)

text:
# bld-pf_policy(8)

## NAME
bld-postfix_policy - BLD policy server for Postfix

## SYNOPSIS
bld-postfix_policy [-v] [host [port]]

## OPTIONS
-v

Log information to syslog

host and port

Connect to a BLD running on a different host and port (default localhost:2905)

## DESCRIPTION
bld-postfix_policy implements a policy server for Postfix. It is a safe interface to BLD: any error (eg unable to connect to the daemon) returns a "dunno" action instead of a reject code.

Please read Postfix documentation on how to install a policy server.

## SEE ALSO
bld(8) postfix(1)

## AUTHOR
Olivier Beyssac <obld@r14.freenix.org>


blddecr

title: blddecr(8)

text:
# blddecr(8)

## NAME
blddecr - decrement the counter of an IP address on a bld host

## SYNOPSIS
blddecr [host [port]] ip

## DESCRIPTION
blddecr asks the bld daemon listening on host:port (default localhost:2905) to decrement the counter for ip.

## SEE ALSO
bld(8) bldread(8) bldquery(8) bldinsert(8) blddecr(8)

## AUTHOR
Olivier Beyssac <obld@r14.freenix.org>


bldinsert

title: bldinsert(8)

text:
# bldinsert(8)

## NAME
bldsubmit - submit an IP address to a bld host

## SYNOPSIS
bldinsert [host [port]] ip

## DESCRIPTION
bldinsert adds ip to blacklist of the bld daemon listening on host:port (default localhost:2905).

## SEE ALSO
bld(8) bldread(8) bldquery(8) bldsubmit(8) blddecr(8)

## AUTHOR
Olivier Beyssac <obld@r14.freenix.org>


bldquery

title: bldquery(8)

text:
# bldquery(8)

## NAME
bldquery - query a bld host

## SYNOPSIS
bldquery [host [port]] ip

## DESCRIPTION
bldquery asks the bld daemon listening on host:port (default localhost:2905) if ip is blacklisted or not.

## SEE ALSO
bld(8) bldread(8) bldsubmit(8) bldinsert(8) blddecr(8)

## AUTHOR
Olivier Beyssac <obld@r14.freenix.org>


bldread

title: bldread(8)

text:
# bldread(8)

## NAME
bldread - read bld dumps

## SYNOPSIS
bld -h | filename

## OPTIONS
-h display usage

## DESCRIPTION
bldread is the utility designed to read bld dump files. It outputs semicolon separated values in the following order:

- IP address (`a.b.c.d')

- Insertion time (timestamp in seconds)

- Last update (timestamp in seconds)

- Number of submissions during the interval

- Second submissions counter

- options bitfield (`1' if forced insertion, no other options yet)

- Blacklist flag (`1' if blacklisted, `0' otherwise)

- Internal pointer value for debugging purposes

- Another internal pointer value for debugging purposes

## FILES
/var/run/bld/bld_iplist.dump /var/run/bld/bld_blacklist.dump

## SEE ALSO
bld(8) bldquery(8) bldsubmit(8) bldinsert(8) blddecr(8)

## AUTHOR
Olivier Beyssac <obld@r14.freenix.org>


bldsubmit

title: bldsubmit(8)

text:
# bldsubmit(8)

## NAME
bldsubmit - submit an IP address to a bld host

## SYNOPSIS
bldsubmit [host [port]] ip

## DESCRIPTION
bldsubmit submits ip to the bld daemon listening on host:port (default localhost:2905).

## SEE ALSO
bld(8) bldread(8) bldquery(8) bldinsert(8) blddecr(8)

## AUTHOR
Olivier Beyssac <obld@r14.freenix.org>


blkiomon

package: blktrace

title: blkiomon(8)

text:
# blkiomon(8)

## NAME
blkiomon - monitor block device I/O based o blktrace data

## SYNOPSIS
blkiomon -I interval [ -h file ] [ -b file ] [ -d file ] [ -D file ] [ -Q path_name -q msg_queue_id -m msg_id ] [ -V ]

## DESCRIPTION
blkiomon is a block device I/O monitor. It periodically generates per-device request size and request latency statistics from blktrace data. It provides histograms as well as data that can be used to calculate min, max, average and variance. For this purpose, it consumes D and C traces read from stdin. Note, that this doesn't work for logical volumes, as high-level drivers don't see the completion of the events (C).

There are options for binary output and human-readable output to files and stdout. Output to a message queue is supported as well.

There is no need to use blkparse with blkiomon. blkiomon is capable of consuming binary output written to stdout by blktrace.

## OPTIONS
-I interval

--interval=interval

Set sample interval

-h file

--human-readable=file

Human-readable output file. Use '-' for stdout.

-b file

--binary=file

Binary output file. Use '-' for stdout.

-d file

--dump-lldd=file

Output file for data emitted by low level device driver.

-D file

--debug=file

Output file for debugging data. Use '-' for stdout.

-Q path_name

--msg-queue=path_name

Sets path_name as path name for existing message queue to be used for binary output.

-q msg_queue_id

--msg-queue-id=msg_queue_id

Sets msg_queue_id as ID for an existing message queue to be used for binary output.

-m msg_id

--msg-id=msg_id

Sets msg_id as message identifier to be used for binary output messages written to an existing message queue.

-V

--version

Print program version.

## EXAMPLES
To get I/O statistics for /dev/sdw every 10 seconds for a period of one hour, use the following command:

% blktrace /dev/sdw -a issue -a complete -w 3600 -o - | blkiomon -I 10 -h -

## AUTHORS
blkiomon and this man page were written by Martin Peschke.

## REPORTING BUGS
Report bugs to <linux-btrace@vger.kernel.org>

## COPYRIGHT
Copyright © 2008 IBM Corp.

This is free software. You may redistribute copies of it under the terms of the GNU General Public License <http://www.gnu.org/licenses/gpl.html>. There is NO WARRANTY, to the extent permitted by law.

## SEE ALSO
btrace (8), blktrace (8), blkparse (1), verify_blkparse (1), blkrawverify (1), btt (1)