named(1M)

NAME | SYNOPSIS | DESCRIPTION | OPTIONS | USAGE | FILES | ATTRIBUTES | SUMMARY OF TRUSTED SOLARIS CHANGES | SEE ALSO | NOTES

NAME

in.named, named– Internet domain name server (DNS)

SYNOPSIS

in.named [-d debuglevel] [-p port#] [[-b| -c] config_file] [-fqrv] [-u user_name] [-g group_name] [-t directory] [-w directory] [config_file]

DESCRIPTION

in.named is the Internet domain name server. For more information on the Internet name-domain system, see RFC 1033, RFC 1034 and RFC 1035.

When run without any arguments, in.named reads the default configuration file /etc/named.conf, reads any initial data, and listens for queries. If you give a config_file argument at the end of the command line, it will override any config_file that you specified by using the -b or -c options.

The named.conf(4) configuration file controls some of the options and behavior for in.named.

In the Trusted Solaris environment, in.named listens for input requests on a multilevel port (MLP) and sends responses to the DNS client at the sensitivity label of the client's request. Thus, though in.named runs at the sensitivity label ADMIN_LOW, it can accept requests at any sensitivity label. in.named can also serve DNS clients and communicate with other DNS name servers on either Trusted Solaris hosts or non-trusted hosts.

The DNS name server running on a Trusted Solaris machine is viewed as a supplier of public information, and the name database that it maintains is considered trusted. in.named requires the trusted path attribute, and it requires that the /etc/named.boot file, zone files, and other configuration files that it uses be at the sensitivity label ADMIN_LOW. As part of the name database, these files and their contents are also considered trusted; thus in.named can query any DNS name server specified in the files. The DNS name servers specified in these files may reside on either Trusted Solaris hosts or non-trusted hosts.

OPTIONS

in.named supports the following options:

-b|c configfile

Use an alternative configuration file. The default value for configfile is /etc/named.conf. The configfile, if any, specified at the end of the command line, overrides any value specified by this argument.

-d debuglevel

Print debugging information. The value of debuglevel determines the level of messages to print. If negative, debuglevel is set to 1.

The new debugging framework is considerably more sophisticated than in previous versions of in.named. The logging statement in the configuration file allows for multiple, distinct levels of debugging for each of a large set of categories of events, for example, for queries and transfers in and out. See named.conf(4).

-f

Run this process in the foreground. The process will not fork(2). By default, in.named runs as a daemon in the background.

-g group_name

Specify the group the server should run as after it initializes. The value specified may be either a group name or a numeric group id.

-p port#

Use the specified remote port number. in.named will send queries to this port number. By default, the value is the standard port number, that is, the port number returned by getservbyname(3SOCKET) for the service domain.

The in.named command previously supported the syntax:

---

-p port#[/localport#]

---

where port# was the first port used when contacting remote servers and localport# was the service port bound by the local instance of in.named.

The current usage is equivalent to the old usage without localport# specified. This functionality can be specified with the listen-on clause options statement in the configuration file.

-q

Trace all incoming queries. This option is deprecated in favor of the queries logging category of the logging statement in named.conf. See named.conf(4).

-r

Turn recursion off in the server. Responses come only from local (primary or secondary) zones. You can use this option on root servers. By default, the server uses recursion. This option is deprecated and is overriden by the recursion clause of the options statement in the configuration file.

-t directory

Specify the directory that the server is to chroot(2) into when it finishes processing command line arguments.

-u user_name

Specify the user that the server should run as after it initializes. The value of user_name may be either a user name or a numeric user id. If the -g option is not invoked, then the group id will be the primary group of the user specified. Since initgroups(3C) is called, all of the user's group will be available to the server.

-v

Report the version and exit.

-w directory

Set the working directory of the server. The directory clause of the options statement overrides any value specified on the command line. The default working directory is the current directory (“.”).

For compatibility with older implementations any additional argument will be interpreted as the name of the configuration file. This argument overrides any config_file specified by means of the -b or -c options. If no further argument is given, then the default configuration file, /etc/named.conf is used.

USAGE

Master File Format

The master file consists of control information and a list of resources for objects in the zone. The file has the following form:

---

$INCLUDE <filename><opt_domain>
$ORIGIN <domain>
$TTL <ttl>
<domain><opt_ttl><opt_class><type><resource_record_data>

---

The fields are defined as follows:

domain

The value of domain can be ``.'' for root, ``@'' for the current origin, or a standard domain name. If domain is a standard domain name that does not end with ``.'', the current origin is appended to the domain. Domain names ending with ``.'' are not modified.

opt_domain

This field is used to define an origin for the data in an included file. It is equivalent to placing an $ORIGIN statement before the first line of the included file. This field is optional. Neither the opt_domain field nor $ORIGIN statements in the included file modify the current origin for this file.

ttl

An integer number that sets the default time-to-live for future records that do not have an explicit ttl.

opt_ttl

An optional integer number for the time-to-live field. If not set the ttl is taken from the last $TTL statement. If no $TTL statement has occurred then the SOA minimum value is used, and a warning is generated.

opt_class

The object address type. Currently only one type is supported, IN, for objects connected to the DARPA Internet.

type

This field contains one of the following tokens. The data expected in the resource_record_data field is in parentheses:

A

A host address (dotted-quad IP address).

NS

An authoritative name server (domain).

MX

A mail exchanger (domain), preceded by a preference value (0..32767), with lower numeric values representing higher logical preferences.

CNAME

The canonical name for an alias (domain).

SOA

Marks the start of a zone of authority (domain of originating host, domain address of maintainer, a serial number and the following parameters in seconds: refresh, retry, expire and minimum ttl). See RFC 883 and RFC 2308.

NULL

A NULL resource record (no format or data).

RP

A Responsible Person for some domain name (mailbox, TXT-referral).

PTR

A domain name pointer (domain).

HINFO

Host information (cpu_type, OS_type).

resource_record_data

Resource records normally end at the end of a line, but may be continued across lines between opening and closing parentheses. Comments are introduced by semicolons and continue to the end of the line.

There are other resource record types not shown here. Some resource record types may have been standardized in more recent RFCs, but they have not yet been implemented in this version of BIND

SOA Record Format

Each master zone file should begin with an SOA record for the zone. An example SOA record is as follows:

---

@ IN SOA ucbvax.Berkeley.EDU. rwh.ucbvax.Berkeley.EDU. (
                     1989020501      ; serial
                     10800   ; refresh
                     3600    ; retry
                     3600000 ; expire
                     86400 ) ; minimum

---

The SOA specifies a serial number, which should be changed each time the master file is changed. Note that the serial number can be given as a dotted number, but this is a very unwise thing to do since the translation to normal integers is by means of concatenation rather than multiplication and addition. You can spell out the year, month, day of month, and 0..99 version number and still fit inside the unsigned 32-bit size of this field. (It's true that we will have to rethink this strategy in the year 4294, but we're not worried about it.)

Secondary servers check the serial number at intervals specified by the refresh time in seconds; if the serial number changes, a zone transfer will be done to load the new data. If a master server cannot be contacted when a refresh is due, the retry time specifies the interval at which refreshes should be attempted. If a master server cannot be contacted within the interval given by the expire time, all data from the zone is discarded by secondary servers. The minimum value is the cache time-to-live for negative answers. See RFC 2308.

FILES

In the Trusted Solaris environment, these files have a sensitivity label of ADMIN_LOW:

/etc/named.conf

default name server configuration file.

/var/run/named.pid

the process ID.

srvcwd

in.named's current working directory, usually set by the "directory" options statement in named.conf.

srvcwd/named_dump.db

dump of the name server database.

srvcwd/named.run

debug output.

srvcwd/named.stats

name server statistics data.

ATTRIBUTES

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWcsu
Interface Stability	Standard BIND 8.2.2 patch

SUMMARY OF TRUSTED SOLARIS CHANGES

in.named accepts requests at any sensitivity label and replies at the sensitivity label of the client's request. in.named can serve DNS clients and can communicate with other DNS servers that are on Trusted Solaris hosts or non-trusted hosts.

Files used by in.named should be protected from unauthorized access by having the sensitivity label ADMIN_LOW.

Invoking in.named requires the trusted path attribute, an effective UID of 0, a process sensitivity label of ADMIN_LOW, and the following privileges: net_mac_read, net_privaddr, net_upgrade_sl, proc_setclr, sys_trans_label, sys_net_config, and sys_config.

SEE ALSO

Trusted Solaris 8 HW 12/02 Reference Manual

chroot(2), fork(2), resolver(3RESOLV), resolv.conf(4)

SunOS 5.8 Reference Manual

kill(1), named-xfer(1M), syslogd(1M), signal(3C), syslog(3C), getservbyname(3SOCKET), attributes(5)

Andrews, M. RFC 2308, Negative Caching of DNS Queries (DNS NCACHE). Network Working Group. March 1998.

Braden, R., editor. RFC 1123, Requirements for Internet Hosts - Applications and Support . Network Working Group. October 1989.

Lotter, M. RFC 1033, Domain Administrators Operations Guide. Network Working Group. November 1987.

Mockapetris, Paul. RFC 882, Domain Names - Concepts and Facilities. Network Working Group. November 1983.

Mockapetris, Paul. RFC 883, Domain Names - Implementation and Specification. Network Working Group. November 1983.

Mockapetris, Paul. RFC 973, Domain System Changes and Observations. Network Working Group. January 1986.

Mockapetris, Paul. RFC 1034, Domain Names - Concepts and Facilities. Network Working Group. November 1987.

Mockapetris, Paul. RFC 1035, Domain Names - Implementation and Specification. Network Working Group. November 1987.

Partridge, Craig. RFC 974, Mail Routing and the Domain System. Network Working Group. January 1986.

Vixie, Paul, Dunlap, Kevin J., Karels, Michael J., Name Server Operations Guide for BIND Internet Software Consortium. 1996.

NOTES

The boot file directives domain and suffixes are now obsolete. They have been replaced by a resolver-based implementation of suffixing for partially-qualified domain names. The earlier mechanisms failed under a number of situations, for example, when the local name server did not have complete information.

The following signals have the specified effect when sent to the server process using the kill(1) command:

SIGHUP

Causes the server to read named.conf and reload the database. SIGHUP will also cause the server to check the serial number on all secondary zones.

SIGINT

Dumps the current database and cache to named_dump.db.

SIGILL

Dumps statistics data into named.stats. Statistics data is appended to the file.

SIGTERM

Saves any modified dynamic zones to the file system and shuts down the server.

SIGUSR1

Turns on debugging. Each additional SIGUSR1 signal increments the debug level.

SIGUSR2

Turns off debugging completely.

SIGWINCH

Toggles logging of all incoming queries by means of syslog(3C).

Trusted Solaris 8 HW 12/02  Last Revised 28 Sept 2002

NAME | SYNOPSIS | DESCRIPTION | OPTIONS | USAGE | FILES | ATTRIBUTES | SUMMARY OF TRUSTED SOLARIS CHANGES | SEE ALSO | NOTES