rndc(1)

NAME

rndc — name server control utility

SYNOPSIS

rndc [-c config-file] [-k keyfile] [-p port] [-s server] [-V] [-y key_id] [command]

DESCRIPTION

The rndc command allows the system administrator to control the operation of a name server. If rndc is invoked without any command line options or operands, it prints a short summary of the supported commands and the available options.

rndc communicates with the name server over a TCP connection, sending commands authenticated with digital signatures. In the current versions of rndc, the only supported encryption algorithm is HMAC-MD5, which uses a shared secret on each end of the connection. This provides TSIG-style authentication for the command request and the name server's response. All commands sent over the channel must be signed by a key_id known to the server.

rndc reads its configuration file (the default is /etc/rndc.conf) to determine how to contact the name server and to decide what algorithm and keys it should use.

Options

-c config-file: Specify an alternate configuration file. The default configuration file is /etc/rndc.conf.
-k keyfile: Use keyfile as the key file instead of the default, /etc/rndc.key. The key in the key file is used to authenticate commands sent to the server if the configuration file does not exist.
-p port: Send commands to TCP port number port on the system running the name server. The BIND 9 default control channel port is 953.
-s server: Specify the server on which this command is run. server is the name or address of a server that matches a server statement in the rndc configuration file. The default is the host named by the default-server clause in the options statement of the rndc configuration file.
-V: Provide debugging information. This option is primarily of interest to the BIND 9 developers.
-y key_id: Use the key_id from the rndc configuration file. key_id must also be known to named with the same algorithm and secret string for control message validation to succeed. If the -y option is not specified, rndc first looks for a key clause in the server statement of the rndc configuration file. If there is no server statement for that host, then it uses the default-key clause of the options statement of the rndc configuration file.

Operands

command

One of the following:

dumpdb: Dump the current contents of the cache into the file defined by the dump-file directive of the options statement in the named configuration file. For details and defaults, see named.conf(4).
flush: Flush all the server's caches.
flush view: Flush the server's cache for a view.
flushname name: Flush the given name from the server's caches.
freeze zone: Retransfer the given zone without checking serial number. See also the thaw command.
halt: Stop the server without saving pending updates. See also the stop command.
halt -p: Stop the server without saving pending updates, reporting the process ID to standard output. See also the stop command.
notrace: Set the debugging level to 0. See also the trace command.
querylog: Toggle query logging.
reconfig: Reload configuration file and new zones only.
recursing: Dump the queries that are currently recursing, into the file named.recursing.
refresh zone: Schedule immediate zone maintenance for the given zone.
reload: Reload configuration file and zones.
reload zone: Reload the given zone.
retransfer zone: Retransfer a single zone without checking serial number.
stats: Write server statistics to the statistics file as specified by the statistics-file clause of the options statement in the named configuration file. For details and defaults, see named.conf(4).
status: Display the status of the server.
stop: Save pending updates to master files and stop the server. See also the halt command.
stop -p: Save pending updates to master files and stop the server, reporting the process ID to standard output. See also the halt command.
thaw zone: Enable updates to a frozen dynamic zone and reload it. See also the freeze command.
trace: Increment the debugging level by 1. See also the notrace command.
trace level: Set the debugging level to level. See also the notrace command.

WARNINGS

The configuration file for rndc contains shared secrets that are used to send authenticated control commands to name servers. Therefore, it should not have general read or write access.

rndc does not yet support all the commands of the BIND 8 ndc utility.

There is currently no way to provide the shared secret for a key_id without using the configuration file.

AUTHOR

rndc was developed by the Internet Systems Consortium (ISC).

FILES

/etc/named.conf: Default configuration file for named.
/etc/rndc.conf: Default configuration file for rndc.
/etc/rndc.key: Alternate default configuration file for rndc.

rndc(1)

Technical documentation

» Table of Contents

» Index