[root@localhost sbin]# ./named -v
bind 9.5.1-p3-v3.0.9
问题现象：
[root@localhost sbin]# ./rndc flush -p 10056
rndc: connect failed: 127.0.0.1#953: connection refused
问题分析：
看报错认为rndc使用的953端口，将端口换为953后报同样的错误
首先看了下bind的named.conf文件
......
include "/home/alipms/zxtest/bind981/etc/rndc.key";
controls {
inet 127.0.0.1 port 10056 allow { 127.0.0.1; } keys { "rndc-key"; };
};
......
再看下rndc.key
key "rndc-key" {
algorithm hmac-md5;
secret "zwKd/d9neRFzJ8v/FVB8oA==";
};
最后查看了下bind的启动日志：
......
23-Jan-2014 08:47:55.106 command channel listening on 127.0.0.1#10056
......
可以确定rndc使用的是10056端口
[root@localhost sbin]# ./rndc -h
Usage: rndc [-b address] [-c config] [-s server] [-p port]
[-k key-file ] [-y key] [-V] command
......
可以看到是rndc命令输入有误
解决方式：
将命令换为：
[root@localhost sbin]# ./rndc -p 10056 flush
查看bind日志为：
23-Jan-2014 09:15:33.387 received control channel command 'flush'
23-Jan-2014 09:15:33.388 flushing caches in all views succeeded
PS:
可以使用rndc-confgen直接生成rndc.key，rndc-confgen和rndc在同一目录下
[root@localhost sbin]# ./rndc-confgen -h
Usage:
rndc-confgen [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] [-s addr] [-t chrootdir] [-u user]
-a: generate just the key clause and write it to keyfile (/home/alipms/zxtest/bind981/etc/rndc.key)
-b bits: from 1 through 512, default 128; total length of the secret
-c keyfile: specify an alternate key file (requires -a)
-k keyname: the name as it will be used in named.conf and rndc.conf
-p port: the port named will listen on and rndc will connect to
-r randomfile: source of random data (use "keyboard" for key timing)
-s addr: the address to which rndc should connect
-t chrootdir: write a keyfile in chrootdir as well (requires -a)
-u user: set the keyfile owner to "user" (requires -a)
[root@localhost sbin]# ./rndc-confgen -p 10056 > ./rndc.key
查看生成的rndc.key
# Start of rndc.conf
key "rndc-key" {
algorithm hmac-md5;
secret "FT/3Iknv/lqLDlJFp9MkkQ==";
}; options {
default-key "rndc-key";
default-server 127.0.0.1;
default-port 10056;
};
# End of rndc.conf # Use with the following in named.conf, adjusting the allow list as needed:
# key "rndc-key" {
# algorithm hmac-md5;
# secret "FT/3Iknv/lqLDlJFp9MkkQ==";
# };
#
# controls {
# inet 127.0.0.1 port 10056
# allow { 127.0.0.1; } keys { "rndc-key"; };
# };
# End of named.conf
然后将注释部分：
key "rndc-key" {
algorithm hmac-md5;
secret "FT/3Iknv/lqLDlJFp9MkkQ==";
};
controls {
inet 127.0.0.1 port 10056
allow { 127.0.0.1; } keys { "rndc-key"; };
};
拷贝至named.conf文件中或拷贝至特定文件中，然后将该文件include至named.conf文件中即可