122 lines
4.1 KiB
Groff
122 lines
4.1 KiB
Groff
.TH "kresd" "8" "@date@" "CZ.NIC" "Knot Resolver @version@"
|
|
.\"
|
|
.\" kresd.8 -- kresd daemon manpage
|
|
.\"
|
|
.\" Copyright (c) CZ.NIC. All rights reserved.
|
|
.\"
|
|
.\" SPDX-License-Identifier: GPL-3.0-or-later
|
|
.\"
|
|
.\"
|
|
.SH "NAME"
|
|
.B kresd
|
|
\- full caching DNSSEC-enabled Knot Resolver @version@.
|
|
.SH "SYNOPSIS"
|
|
.B kresd
|
|
.RB [ \-a | \-\-addr
|
|
.IR addr[@port] ]
|
|
.RB [ \-t | \-\-tls
|
|
.IR addr[@port] ]
|
|
.RB [ \-S | \-\-fd
|
|
.IR fd ]
|
|
.RB [ \-T | \-\-tlsfd
|
|
.IR fd ]
|
|
.RB [ \-c | \-\-config
|
|
.IR config ]
|
|
.RB [ \-n | \-\-noninteractive ]
|
|
.RB [ \-q | \-\-quiet ]
|
|
.RB [ \-v | \-\-verbose ]
|
|
.RB [ \-V | \-\-version ]
|
|
.RB [ \-h | \-\-help ]
|
|
.IR [rundir]
|
|
.SH "DESCRIPTION"
|
|
.B Knot Resolver is a DNSSEC-enabled full caching resolver.
|
|
.P
|
|
Default mode of operation: when it receives a DNS query it iteratively
|
|
asks authoritative nameservers starting from root zone (.) and ending
|
|
with a nameservers authoritative for queried name. Automatic DNSSEC means
|
|
verification of integrity of authoritative responses by following
|
|
keys and signatures starting from root. Root trust anchor is automatically
|
|
bootstrapped from IANA, or you can provide a file with root trust anchors
|
|
(same format as Unbound or BIND9 root keys file).
|
|
|
|
The daemon also caches intermediate answers into cache, which by default
|
|
uses LMDB memory-mapped database. This has a significant advantage over
|
|
in-memory caches as the process may be stopped and restarted without
|
|
loss of cache entries. In multi-user scenario a shared cache
|
|
is potential privacy/security issue, with kresd each user can have resolver cache
|
|
in their private directory and use it in similar fashion to keychain.
|
|
|
|
.P
|
|
To use a locally running
|
|
.B kresd
|
|
for resolving put
|
|
.sp
|
|
.RS 6n
|
|
nameserver 127.0.0.1
|
|
.RE
|
|
.sp
|
|
into
|
|
.IR resolv.conf (5)
|
|
and start
|
|
.B kresd
|
|
|
|
.P
|
|
The daemon may be configured also as a plain forwarder using query policies.
|
|
This requires using a config file. Please refer to documentation for
|
|
configuration file options. It is available at
|
|
\fIhttps://knot-resolver.readthedocs.io\fR or in package documentation
|
|
(available as knot-resolver-doc package in most distributions).
|
|
|
|
The available CLI options are:
|
|
.TP
|
|
.B \-a\fI addr[@port]\fR, \fB\-\-addr=\fI<addr[@port]>
|
|
Listen on given address (and port) pair. If no port is given, \fI53\fR is used as a default.
|
|
Option may be passed multiple times to listen on more addresses.
|
|
.TP
|
|
.B \-t\fI addr[@port]\fR, \fB\-\-tls=\fI<addr[@port]>
|
|
Listen using TLS on given address (and port) pair. If no port is
|
|
given, \fI853\fR is used as a default. Option may be passed multiple
|
|
times to listen on more addresses.
|
|
.TP
|
|
.B \-S\fI fd\fR, \fB\-\-fd=\fI<fd>
|
|
Listen on given file descriptor(s), passed by supervisor.
|
|
Option may be passed multiple times to listen on more file descriptors.
|
|
.TP
|
|
.B \-T\fI fd\fR, \-\-tlsfd=\fI<fd>
|
|
Listen using TLS on given file descriptor(s), passed by supervisor.
|
|
Option may be passed multiple times to listen on more file descriptors.
|
|
.TP
|
|
.B \-c\fI config\fR, \fB\-\-config=\fI<config>
|
|
Set the config file with settings for kresd to read instead of reading the
|
|
file at the default location (\fIconfig\fR).
|
|
.TP
|
|
.B \-f\fI N\fR, \fB\-\-forks=\fI<N>
|
|
This option is deprecated since 5.0.0!
|
|
|
|
With this option, the daemon is started in non-interactive mode and instead creates a
|
|
UNIX socket in \fIrundir\fR that the operator can connect to for interactive session.
|
|
A number greater than 1 forks the daemon N times, all forks will bind to same addresses
|
|
and the kernel will load-balance between them on Linux with \fISO_REUSEPORT\fR support.
|
|
|
|
If you want multiple concurrent processes supervised in this way,
|
|
they should be supervised independently (see \fBkresd.systemd(7)\fR).
|
|
.TP
|
|
.B \-n\fR, \fB\-\-noninteractive
|
|
Daemon will refrain from entering into read-eval-print loop for stdin+stdout.
|
|
.TP
|
|
.B \-q\fR, \fB\-\-quiet
|
|
Daemon will refrain from printing the command prompt.
|
|
.TP
|
|
.B \-v\fR, \fB\-\-verbose
|
|
Increase logging to debug level.
|
|
.TP
|
|
.B \-h
|
|
Show short command-line option help.
|
|
.TP
|
|
.B \-V
|
|
Show the version.
|
|
.SH "SEE ALSO"
|
|
@man_seealso_systemd@\fIhttps://knot-resolver.readthedocs.io/en/v@version@/\fR
|
|
.SH "AUTHORS"
|
|
.B kresd
|
|
developers are mentioned in the AUTHORS file in the distribution.
|