Using Rndc; Configuring /Etc/Named.conf - Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual

Chapter 17. Berkeley Internet Name Domain (BIND)
zone "1.0.10.in-addr.arpa" IN {
type master;
file "example.com.rr.zone";
allow-update { none; };
};
There is very little difference between this example and a standard zone statement, except for the
zone name. Note that a reverse name resolution zone requires the first three blocks of the IP address
reversed followed by .in-addr.arpa. This allows the single block of IP numbers used in the reverse
name resolution zone file to be associated with the zone.

17.4. Using rndc

BIND includes a utility called rndc which allows command line administration of the named daemon
from the localhost or a remote host.
In order to prevent unauthorized access to the named daemon, BIND uses a shared secret key
authentication method to grant privileges to hosts. This means an identical key must be present in
both /etc/named.conf and the rndc configuration file, /etc/rndc.conf.
Note
If you have installed the bind-chroot package, the BIND service will run in the /var/
named/chroot environment. All configuration files will be moved there. As such, the
rndc.conf file is located in /var/named/chroot/etc/rndc.conf.
Note that since the rndc utility does not run in a chroot environment, /etc/rndc.conf
is a symlink to /var/named/chroot/etc/rndc.conf.

17.4.1. Configuring /etc/named.conf

In order for rndc to connect to a named service, there must be a controls statement in the BIND
server's /etc/named.conf file.
The controls statement, shown in the following example, allows rndc to connect from the localhost.
controls {
inet 127.0.0.1
allow { localhost; } keys { <key-name>; };
};
This statement tells named to listen on the default TCP port 953 of the loopback address and allow
rndc commands coming from the localhost, if the proper key is given. The <key-name> specifies a
name in the key statement within the /etc/named.conf file. The next example illustrates a sample
key statement.
key "<key-name>" {
algorithm hmac-md5;
secret "<key-value>";
};
218