[GH-ISSUE #464] RFC2136 NSUPDATE support algo:name secret instead of algo: secret #337

New issue

Open

opened 2026-02-26 10:30:56 +03:00 by kerem · 2 comments

kerem commented

2026-02-26 10:30:56 +03:00

Owner

Originally created by @vg on GitHub (Jun 7, 2020).
Original GitHub issue: https://github.com/nsupdate-info/nsupdate.info/issues/464

Example

nsupdate <<EOF
  server ns1.dynv6.com
  zone yourhost.dynv6.com
  update delete yourhost.dynv6.com A
  update add yourhost.dynv6.com 60 A 127.0.0.1
  update delete yourhost.dynv6.com AAAA
  update add yourhost.dynv6.com 60 AAAA ::1
  key hmac-sha256:_123._tsig.dynv6.com YourSHAREDsecret==
  send
EOF

instead of

key hmac-sha256: YourSHAREDsecret==

Originally created by @vg on GitHub (Jun 7, 2020). Original GitHub issue: https://github.com/nsupdate-info/nsupdate.info/issues/464 Example ``` nsupdate <<EOF server ns1.dynv6.com zone yourhost.dynv6.com update delete yourhost.dynv6.com A update add yourhost.dynv6.com 60 A 127.0.0.1 update delete yourhost.dynv6.com AAAA update add yourhost.dynv6.com 60 AAAA ::1 key hmac-sha256:_123._tsig.dynv6.com YourSHAREDsecret== send EOF ``` instead of `key hmac-sha256: YourSHAREDsecret==`

kerem commented

2026-02-26 10:30:57 +03:00

Author

Owner

@ThomasWaldmann commented on GitHub (Jun 7, 2020):

This issue tracker is about https://nsupdate.info/ software, not about the nsupdate commandline tool.

@ThomasWaldmann commented on GitHub (Jun 7, 2020): This issue tracker is about https://nsupdate.info/ software, not about the `nsupdate` commandline tool.

kerem commented

2026-02-26 10:30:57 +03:00

Author

Owner

@vg commented on GitHub (Jun 7, 2020):

@ThomasWaldmann My request was for https://nsupdate.info/ not nsupdate command.
Apart from the Nameserver update algorithm and Nameserver update secret, need an option to provide something like _123._tsig.dynv6.com to an external auth dns server.

Nameserver update algorithm
HMAC_SHA512 is fine for bind9 (you can change this later, if needed)

Nameserver update secret
Shared secret that allows updating this zone (base64 encoded)

@vg commented on GitHub (Jun 7, 2020): @ThomasWaldmann My request was for [https://nsupdate.info/](https://nsupdate.info/) not `nsupdate` command. Apart from the Nameserver update algorithm and Nameserver update secret, need an option to provide something like `_123._tsig.dynv6.com` to an external auth dns server. ``` Nameserver update algorithm HMAC_SHA512 is fine for bind9 (you can change this later, if needed) Nameserver update secret Shared secret that allows updating this zone (base64 encoded) ```