rndc-confgen [ -a ] [ -b keysize ] [ -c keyfile ] [ -h ] [ -k keyname ] [-p port ] [ -r randomfile ] [ -s address ] [ -t chrootdir ] [ -u user ]
Generates configuration files for the rndc command.
The rndc-confgen command generates configuration files for the rndc command. You can use this command as a convenient alternative to writing the rndc.conf file, the corresponding controls, and key statements in named.conf by hand. You can run the rndc-confgen command with the -a flag to set up a rndc.key file. Doing this avoids the need for a rndc.conf file and a controls statement.
| Item | Description |
|---|---|
| -a | Performs automatic rndc configuration. This creates a file rndc.key in /etc (or whatever sysconfdir was specified as when BIND was built) that is read by both the rndc command and the named daemon on startup. The rndc.key file defines a default command channel and authentication key allowing the rndc command to communicate with the named daemon on the local host with no further configuration. |
| -b keysize | Specifies the size of the authentication key in bits. Must be between 1 and 512 bits. The default is 128. |
| -c keyfile | Used with the -a flag to specify an alternate location for rndc.key. |
| -h | Prints a short summary of the options and arguments of the rndc-confgen command. |
| -k keyname | Specifies the key name of the rndc authentication key. This must be a valid domain name. The default is rndc-key. |
| -p port | Specifies the command channel port where the named daemon listens for connections from rndc. The default is 953. |
| -r randomfile | Specifies a source of random data for generating the authorization. If the operating system does not provide a /dev/random or equivalent device, the default source of randomness is keyboard input. The randomfile argument specifies the name of a character device or file containing random data to be used instead of the default. The keyboard value indicates that keyboard input must be used. |
| -s address | Specifies the IP address where the named daemon listens for command channel connections from rndc. The default is the loopback address 127.0.0.1. |
| -t chrootdir | Used with the -a flag to specify a directory where the named daemon runs chrooted. An additional copy of the rndc.key will be written relative to this directory so that it will be found by the chrooted named. |
| -u user | Used with the -a flag to set the owner of the rndc.key file generated. If the -t flag is also specified, only the file in the chroot area has its owner changed. |
rndc-confgen -a rndc-confgen