Professional Documents
Culture Documents
Centos Rhel 5 Bind9 DNS Server Guide
Centos Rhel 5 Bind9 DNS Server Guide
Guide to the BIND9 DNS of Red Hat Enterprise Linux / CentOS Linux !
by Vivek Gite <vivek@nixcraft.com>, 2008 nixCraft. All rig t! re!erve". < tt#$%%&&&.cyberciti.bi'>
"arnin#s
(o not attem#t to im#lement any of t e recommen"ation! in t i! g)i"e &it o)t fir!t te!ting in a non#ro")ction environment. * i! "oc)ment i! only a g)i"e containing recommen"e" !ec)rity !etting! for +,-( !oft&are. ,t i! not meant to re#lace &ell !tr)ct)re" #olicy or !o)n" .)"gment. /)rt ermore t i! g)i"e "oe! not a""re!! !ite0!#ecific config)ration concern!. Config)ration c ange! "e!cribe" in t i! "oc)ment a##ly only to 1e" 2at 3nter#ri!e 4in)x 5.x or Cent67 4in)x 5.x. * ey may or may not tran!late gracef)lly to ot er o#erating !y!tem!.
Re&uired pa'(a#es
<o) nee" to in!tall t e follo&ing #ackage!. =. )ind 0 +,-( incl)"e! a (-7 !erver 8name":, & ic re!olve! o!t name! to ,> a""re!!e!? a re!olver library 8ro)tine! for a##lication! to )!e & en interfacing &it (-7:? an" tool! for verifying t at t e (-7 !erver i! o#erating #ro#erly. 2. )ind*'hroot 0 A c root r)ntime environment for t e ,7C +,-( (-7 !erver, name". * i! #ackage contain! a tree of file! & ic can be )!e" a! a c root .ail for t e name" #rogram from t e +,-( #ackage. @. )ind*utils 0 +in"0)til! contain! a collection of )tilitie! for A)erying (-7 8(omain -ame 7y!tem: name !erver! to fin" o)t information abo)t ,nternet o!t!. * e!e tool! &ill #rovi"e yo) &it t e ,> a""re!!e! for given o!t name!, a! &ell a! ot er information abo)t regi!tere" "omain! an" net&ork a""re!!e!. <o) ! o)l" in!tall bin"0)til! if yo) nee" to get information from (-7 name !erver!.
/$ar/na+ed/'hroot/ 0 +,-( .ail "irectory. 7tore all yo)r config)ration an" 'one "ata ere. /$ar/na+ed/'hroot/de$/ 0 (evice file "irectory )!e" by name" .ail. /$ar/na+ed/'hroot/et'/ 0 <o) nee" to !tore name".conf an" ot er config file ere. /$ar/na+ed/'hroot/$ar/na+ed/ 0 Done an" log "ata file!.
TC- port 0 $ ,t i! only )!e" & en t e re!#on!e "ata !i'e excee"! 5=2 byte!, or for !)c ta!k! a! 'one tran!fer to !lave % !econ"ary !erver!. /D- port 0 $ (-7 #rimarily )!e! ;(> on #ort 5@ to !erve reA)e!t!.
>lea!e note t at !ome o#erating !y!tem! !)c a! 2>0;E are kno&n to ave re!olver im#lementation! t at )!e *C> for all A)erie!, even & en ;(> &o)l" !)ffice. * erefor yo) nee" to kee# o#en bot #ort! )!ing fire&all !oft&are !)c a! netfilter.
* e "omain name t e re!o)rce recor" refer! to. /or e.g. &&& * e ty#e of t e re!o)rce recor" !)c a! A, IE etc
Des'ription * e time to live of t e 11. 7igne" time in !econ"! t at 11 !tay! vali". Cla!! co"e. ,t can be ,- 8,nternet:. * i! t)torial only cover! ,- cla!! for *C>%,> internet comm)nication? b)t ot er #o!!iblitie! incl)"e! C2A67net 8C2: an" 2e!io" 827:.
1(A*A Act)al "ata a!!oicate" &it t e "omain. An exam#le of >1 ma"e of five fiel"!$
ns1 3600 ! " 202.54.1.1
The 3ain DNS Re'ord T,pes Re'ord T,pe A AAAA C-AI3 IE -7 >*1 *E* 76A L3< La)el A""re!! Canonical -ame Iail eEc anger -ame !erver >ointer *ext 7tart 6f A)t ority Des'ription ,>vB @2 bit o!t ,> a""re!! !)c a! 202.5B.=.2 7et an alia! for a "omain name. /or e.g. fee"!.cyberciti.bi' i! an alia! for g !.google.com A li!t of mail !erver! for "omain to & ic to !en" for "omain name. /or e.g. cyberciti.bi' mail i! !en" to mail.nixcraft.net. A li!t of a)t oritative name !erver for t e "omain. /or e.g. t eo!.in regi!tere" &it n!=.nixcraft.net an" n!2.nixcraft.net. Io!tly )!e" to !et rever!e name re!ol)tion. A text !tring )#to 255 byte! long. ,t i! )!e" to !et o!t "e!cri#tion or anti !#am config)ration!. 7et t e !tart of a 'one of a)t ority. ;!)ally )!e" on ma!ter bin" !erver. 7et * e !erverG! #)blic key for *7,G an" (-773C.
*, lo11in1 ' chann#l d#fault.d#bu1 ' fil# -data$nam#d.run-, s#%#rity dynamic, *, *, $+ $+ $+ 2#t localhost and oth#r +$ includ# -$#tc$nam#d.rfc1912.)on#s-, 2#t root s#r%#r +$ includ# -$#tc$nam#d.root.hints-, 2#t our )on# stuff +$ includ# -$#tc$nam#d.conf.local-,
listen*on*$4 5 none6 76 0 (i!able ,>vJ !)##ort. *o t)rn on ,>vJ !)##ort re#lace none &it act)al ,>vJ ,> a""re!! or any key&or". listen*on 5 898! :!;!;6 76 0 4i!ten on 202.5B.=.= ,>vB a""re!!. dire'tor, </$ar/na+ed<6 0 +,-( "irectory to !tore log! an" 'one "ata. du+p*file <data/'a'he=du+p!d)<6 0 * e #at name of t e file t e !erver ")m#! t e "ataba!e to & en in!tr)cte" to "o !o &it rn"c ")m#"b comman". statisti's*file <data/na+ed=stats!txt<6 0 * e #at name of t e file t e !erver a##en"! !tati!tic! to & en in!tr)cte" to "o !o )!ing rn"c !tat!. +e+statisti's*file <data/na+ed=+e+=stats!txt<6 0 * e #at name of t e file t e !erver &rite! memory )!age !tati!tic! to on exit. dnsse'*ena)le ,es6 0 3nable (-773C !)##ort in name". re'ursion no6 0 (o not #rovi"e rec)r!ive !ervice to any client!. allo%*notif, 5 898! :!;!;6 ;99! !;!;6 76 0 7#ecifie! & ic o!t! are allo&e" to notify t i! !erver, a !lave, of 'one c ange! in a""ition to t e 'one ma!ter!. $ersion <nixCraft dns ser$er<6 0 7et +,-( ver!ion n)mber. * i! i! !ec)rity mea!)re for +in" not to reveal it! ver!ion n)mber. auth*nxdo+ain no6 0 * i! conform to 1/C=0@5. lo##in# 5 !!! 76 0 +,-( #rovi"e! vario)! fine t)ning o#tion! for !erver to log me!!age!. * e !everity cla)!e &ork! like !y!logMNO! 9#rioritie!9, exce#t t at t ey can al!o be )!e" if yo) are &riting !traig t to a file rat er t an )!ing !y!log. C annel! &it "ynamic !everity )!e t e !erverG! global "eb)g level to "etermine & at me!!age! to #rint.
3ore a)out 'o++ents * e follo&ing i! not ing b)t comment "efine" )!ing C !tyle$
$+ 2#t localhost and oth#r +$
*,
*, $+ $+
$+
61
# s#r%ic# nam#d r#start
*7,G i! available for +,-( v8.2 an" above. *7,G )!e! ! are" !ecret! an" a one0&ay a! f)nction to a)t enticate (-7 me!!age!. *7,G i! ea!y an" lig t&eig t for re!olver! an" name".
Ho% it %or(s.
=. 3ac name !erver a""! a *7,G recor" t e "ata !ection of a "n! !erver0to0!erver A)erie! an" me!!age. 2. * e *7,G recor" !ign! t e (-7 me!!age, #roving t at t e me!!ageG! !en"er a" a cry#togra# ic key ! are" &it t e receiver an" t at t e me!!age &a!nGt mo"ifie" after it left t e !en"er. @. *7,G )!e! a one0&ay a! f)nction to #rovi"e a)t entication an" "ata integrity. 6)r !am#le !et)#$
Ia!ter name!erver$ n!=.nixcraft.com 0 202.5B.=.= 7lave name!erver$ n!2.nixcraft.com 0 =C0.5.=.= +,-( config)ration i! !tore" in /etc/bind/ "irectory. Done "ata i! !tore" in /etc/bind/named.conf file.
F ere,
0a 7#ecify t e encry#tion algorit m. 0b 7#ecify t e key !i'e. 0n 7#ecify t e namety#e. A namety#e can be a D6-3, 267*, 3-*,*<, or ;731. ;!)ally, yo) nee" to )!e 267* or D6-3 !)c a! t eo!.in
* e above "n!!ec0keygen #rogram create" t&o file! a! follo&!. +ot .key an" .#rivate file! are generate" for !ymmetric encry#tion algorit m! !)c a! 2IAC0I(5, even t o)g t e #)blic an" #rivate key are eA)ivalent$
Arnd'*(e,!B; CB4:8 8!(e, 0 Contain! t e #)blic key. * e .key file contain! a (-7 L3< recor" t at can be in!erte" into a 'one file. Arnd'*(e,!B; CB4:8 8!pri$ate 0 Contain! t e #rivate key. * e .#rivate file contain! algorit m0!#ecific fiel"!.
6#en %var%name"%c root%etc%t!ig.key file, enter$ # %i $%ar$nam#d$chroot$#tc$tsi1.<#y -o& yo) nee" to create t!ig.key file on +aster ser$er a! follo&!$
<#y -83"!=593- ' al1orithm hmac-md5, s#cr#t -0;nu3=dsF%))lm8I6M3c#"==-, *, # =la%# s#r%#r 6 # 1
s#r%#r 190.5.1.1 ' <#ys ' 83"!=593, *, *, ################################ # f you ha%# 3rd sla%# s#r%#r /ith #s#r%#r 64.1.2.3 ' # <#ys ' # 83"!=593, # *, #*, ################################
6 64.1.2.3
/ir!t block i! not ing b)t key!. *7,G key! are config)re" )!ing t e key! !)b!tatement!. * e key! !)b!tatement! inform a name !erver to !ign A)erie! an" 'one tran!fer reA)e!t! !ent to a #artic)lar remote name !erver. ,n o)r ca!e t e above !)b!tatement inform! t e ma!ter !erver, to !ign all reA)e!t! to t e o!t !lave !erver K5.55.2.=00 &it t e key calle" *1A-7/31. * e !erver !tatementG! key! cla)!e to tell t e !lave name !erver to !ign all 'one tran!fer reA)e!t! an" A)erie! !ent to it! ma!ter !erver an" vice ver!e. 7ave an" clo!e t e file. 6#en name".conf file, enter$ # %i $%ar$nam#d$chroot$#tc$nam#d.conf A##en" t e follo&ing line$
includ# -$#tc$tsi1.<#y-,
7ave an" clo!e t e file. 1e!tart name"$ # rndc r#load 61 # s#r%ic# nam#d r#start
Derif, TSGI
Fatc yo)r ma!ter +,-( "n! !erver log file or !y!tem log file, enter$ # tail -f $%ar$lo1$m#ssa1#s 61 # tail -f $%ar$lo1$syslo1 61 # 1r#& Oth#os.in$ !O $%ar$lo1$syslo1
>urther Resour'es
* e follo&ing re!o)rce! #rovi"e more "etaile" information abo)t t e +,-(C !oft&are$ =. man #age! 0 bin", name".conf 2. +in"C >ro.ect