Using rndc

Configuration Files

Before attempting to use the rndc command, verify that the proper configuration lines are in place in the necessary files. Most likely, your configuration files are not properly set if you run rndc and see a message that states:

rndc: connect: connection refused

controls {
  inet 127.0.0.1 allow { localhost; } keys { <key-name>; };
};

key "<key-name>" {
  algorithm hmac-md5;
  secret "<key-value>";
};

dnssec-keygen -a hmac-md5 -b <bit-length> -n HOST <key-file-name>

/etc/rndc.conf

To configure rndc to automatically use the key specified in /etc/named.conf for the localhost, three statements are needed. The options statement allows you to set the default server and key for rndc to use, as seen in Figure 14-23.

options { default-server localhost; default-key "<key-name>"; };

Figure 14-23. Sample options statement in /etc/rndc.conf

Optionally, the rndc command can be told to use a default key when accessing a particular server, as seen in Figure 14-24.

server localhost { key "<key-name>"; };

Figure 14-24. Sample server statement in /etc/rndc.conf

However, this server statement is only really helpful if you connect to multiple servers with rndc.

The key is the most important statement in /etc/rndc.conf.

key "<key-name>" { algorithm hmac-md5; secret "<key-value>"; };

Figure 14-25. Sample key statement in /etc/rndc.conf

The <key-name> and <key-value> should be exactly the same as their settings in /etc/named.conf.

To test all of the settings, try the rndc reload command. You should see response similar to this:

rndc: reload command successful

If the command was not successful, carefully go over the /etc/named.conf and /etc/rndc.conf files and look for errors.

	Caution
	You should make sure that unprivileged users cannot read or write the /etc/rndc.conf file.

Command Line Options

An rndc command takes the following form:

rndc <options> <command> <command-options>

The <options> area is not required, and you do not have to use <command-options> unless the command requires them.

When executing rndc on a properly configured localhost, the following commands are available:

• halt — Stops the named service immediately.

• querylog — Turns on logging of all queries made by clients to this nameserver.

• refresh — Refreshes the nameserver's database.

• reload — Tells the nameserver to reload the zone files but keep all other previously cached responses. This allows you to make changes to zone files and have them take effect on your master and slave servers without losing all stored name resolutions.

  If your changes only affected a particular zone, you can tell named to only reload that one zone. Type the name of the zone after the reload command.

• stats — Dumps the current named stats to the /var/named/named.stats file.

• stop — Stops the server gracefully, saving any dynamic update and IXFR data before exiting.

Occasionally, you may want to override the default settings in the /etc/rndc.conf file. The following options are available:

• -c <configuration-file> — Tells rndc to use a configuration file other than the default /etc/rndc.conf.

• -p <port-number> — Specifies a different port number to use for the rndc connection other than the default 953.

• -s <server> — Tells rndc to send the command to a server other than the default-server option in /etc/rndc.conf file.

  In order for this to work, you must have configured the other named service to accept commands from your host and have the key for that nameservice.

• -y <key-name> — Allows you to specify a key other than the default-key option in /etc/rndc.conf file.

Additional information about these options can be found in the rndc man page.