Red Hat Enterprise Linux 5 Administration Unleashed

344CHAPTER 16Hostname Resolution with BIND. trusted-keys: Set DNSSEC (DNS Security) security roots. A security root is a publickey for a non-authoritative zone, which is known but can not be securely retrieved viaDNS. If it is listed as a trusted key, it is thought to be valid and secure. The is a semicolon-separated list of keys with each entry in the format .trusted-keys {};. view: A view defines what data is sent in a response to a DNS request. Multipleviews can be set. Refer to the “Configuring Views” section for details.. zone: Declare the zone type for the server, which can have multiple zones. Refer tothe “Configuring Zones” section for details.Configuring Control ChannelsUse the controls statement in named.conf to define control channels for the server.Control channels accept commands from the rndc utility. Only the inet control channelis currently available. Multiple control channels can be defined in the controls statementby declaring multiple inet clauses in it. Refer to the “Configuring rndc.conf” section foran explanation of the rndc utility. The controls statement uses the following syntax:controls {inet port allow { } keys { };};Replace with the IP address of the name server. Using the loopback address127.0.0.1 is recommended for high security. A port number does not have to list with unless you are not using the default port of 953.Replace with a semicolon-separated list of IP address elements: eitherindividual addresses or address ranges in the form X.X.X.X/X. Only rndc connectionrequests from these addresses are allowed, and then only if they authenticate with a keyfrom .Replace with a semicolon-separated list of key names for keys declared elsewherein the named.conf file. These are the authentication keys used by the rndc utilitywhen requesting connection to the name server. Only rndc utilities authenticating withthese keys are allowed to send commands to the name server.TIPIf the named.conf file contains secret keys, be sure to set its file permissions asrestrictive as possible so that non-authorized users can not read the key.If no controls statement is present, only rndc connections from the localhost using theauthentication key in /etc/rndc.key are accepted.