Wednesday, February 1, 2012

nsupdate,the command line tool to manage BIND DNS records

nsupdate can submit Dynamic DNS Update requests as defined in RFC2136 to a name server, it is provided by “bind-utils” package.
Authentication for DNS updates
Transaction signatures (TSIG) can be used to authenticate the Dynamic DNS updates, The only supported encryption algorithm for TSIG is HMAC-MD5.
The TSIG public key is stored in a KEY record in a zone served by the name server, the TSIG private key is used by nsupdate to get authenticated.
$mkdir  /var/named/keys; cd /var/named/keys
$dnssec-keygen -a HMAC-MD5 -b 256 -n USER  server1-ddns-key
#Since HMAC-MD5 is symmetric encryption algorithm, the “key string” in private key and public key are equivalent, the public key can be deleted.
$ rm Kserver1-ddns-key.+157+00575.key 
$ cat Kserver1-ddns-key.+157+00575.private 
Private-key-format: v1.2
Algorithm: 157 (HMAC_MD5)
Key: x3NLKprWMvSMaPx75At6zA+DiWb2SvzpFzPFowc7SBU=

#Create a BIND configuration file to be included in /etc/named.conf (it is optional, the statements can be specified in /etc/named.conf directly)
$cat keys.conf
#the key name is arbitrary , but  must be the same name  specified in dnssec-keygen command line
key server1-ddns-key {
algorithm HMAC-MD5;
secret "x3NLKprWMvSMaPx75At6zA+DiWb2SvzpFzPFowc7SBU=";
$cat /etc/named.conf
include "/var/named/keys/keys.conf";
#zone allow the key to do update
zone "" IN {
type master;
file "";
allow-update { key server1-ddns-key ; };

The journal file for dynamic Update
All changes made to a zone using dynamic update are stored in the zone's journal file.
The name of the journal file is formed by appending the extension .jnl to the name of the corresponding zone file.
The updated entries are saved in .jnl file, the entries are merged to the zone file on the following conditions
1.Every 15 minutes
2."rndc freeze zone" command is issued
3.Service restart
However, the updated record in memory become effective immediately without waiting to be merged to the zone file.
In order for named process to write the journal file, the zone directory /var/named/ must be writable by named user or group
$chown root:named /var/named; chmod g+rw /var/named
nsupdate sample commands
$nsupdate -k Kserver1-ddns-key.+157+00575.private 
> server localhost
> zone
> update add 86400 A
> send
Suspend dynamic DNS update
#sometimes it is necessary to update the zone file manually, follow this order to edit zone file manually
$rndc freeze 
$rndc thaw 

#if your zone exists in multiple views, you may get this error.
$rndc freeze
rndc: 'freeze' failed: not found
#You have to specify class name (IN) and the view name in full.
$rndc freeze  IN myview-name

A wrapper script to make DNS update even easier
$./ add www5
==> Checking result: ...
Using domain server:
Name: localhost
Aliases: has address

#script content
if [[ $# -ne 4  ]]; then
cat <<END 
Usage $0 add|delete zone-name node-name data
For example:
- Add A record: $0  add web
- Add PTR record: $0  add  34
- Delete record: replace add with delete
*** It only supports A and PTR record, for other records,edit zone file manually: rndc free zone-name; vi zonefile; rndc thaw zone-name
if [[ "$node" = {1,3}(\d) ]]; then
cat >$tmpfile <<END
server $SERVER
update $cmd ${node}.${zone} $TTL $class $data
nsupdate -k $KEY -v $tmpfile
rm -f $tmpfile
[[ ${zone} = * ]] && record=$(echo ${node}.${zone}  | awk -F"." '{ print $4"."$3"."$2"."$1} ' )
echo -e "\n ==> Checking result: ${record}. ..."
host $record $SERVER


  1. hi..Im college student, thanks for sharing :)

  2. This is awesome. Thanks for the post. clears up alot

  3. I read this article. I think You put a lot of effort to create this article. I appreciate your work.
    thesis Writing Service

  4. Alot of blogs I see these days don't really provide anything that I'm interested in, but I'm most definitely interested in this one. Just thought that I would post and let you know. Nice! thank you so much! Thank you for sharing.
    Website Development company in Delhi
    Website Designing Company in Delhi

  5. Wow, amazing blog layout! How long have you been blogging for? you make blogging look easy. The overall look of your website is fantastic, let alone the content!

    Best 3D Animation Service
    Best Chatbot Development Service

  6. شركات كشف تسربات المياه بالمدينة المنورة
    عزيزي العميل لن تستهين بمشكلة تسربات المياه فعند ملاحظة وجود تسرب مياه عليكَ بالاتصال بشركتنا لأنها المكان الوحيد التي سوف يوفر لكَ كل ما تحتاج إليه من خدمات تساعدكَ على كشف تسربات المياه بالمدينة المنورة، كما أن شركة كشف تسربات المياه بالمدينة المنورة تقوم باستخدام أحدث المعدات والأدوات التي تستخدم للكشف عن تسربات المياه.

  7. Thank you so much for sharing such an amazing blog. Visit Kalakutir Pvt Ltd for the best Commercial Vehicle Painting & Branding, Godown Floor Marking Paintin and Caution & Indication Signages services in delhi,