source: server/other/bind.xml@ 1c2cfae1

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 6.0 6.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 1c2cfae1 was 1c2cfae1, checked in by DJ Lucas <dj@…>, 19 years ago

fixed root servers and made mention of logging for bind 9

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@3044 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 14.0 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN"
3 "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7<!ENTITY bind-download-http "http://gd.tuwien.ac.at/infosys/servers/isc/bind9/&bind-version;/bind-&bind-version;.tar.gz">
8<!ENTITY bind-download-ftp "ftp://ftp.isc.org/isc/bind9/&bind-version;/bind-&bind-version;.tar.gz">
9<!ENTITY bind-size "4.6 MB">
10<!ENTITY bind-buildsize "138 MB">
11<!ENTITY bind-time "0.67 SBU">
12
13]>
14
15<sect1 id="bind" xreflabel="BIND-&bind-version;">
16<sect1info>
17<othername>$LastChangedBy$</othername>
18<date>$Date$</date>
19</sect1info>
20<?dbhtml filename="bind.html"?>
21<title><acronym>BIND</acronym>-&bind-version;</title>
22
23<sect2>
24<title>Introduction to <application><acronym>BIND</acronym></application></title>
25
26<para>The <application><acronym>BIND</acronym></application> package
27provides a <acronym>DNS</acronym> server and client utilities. If you
28are only interested in the utilities, refer to the <xref linkend="bind-utils"/>.</para>
29
30<sect3><title>Package information</title>
31<itemizedlist spacing='compact'>
32<listitem><para>Download (HTTP): <ulink url="&bind-download-http;"/></para></listitem>
33<listitem><para>Download (FTP): <ulink url="&bind-download-ftp;"/></para></listitem>
34<listitem><para>Download size: &bind-size;</para></listitem>
35<listitem><para>Estimated Disk space required: &bind-buildsize;</para></listitem>
36<listitem><para>Estimated build time: &bind-time;</para></listitem></itemizedlist>
37</sect3>
38
39<sect3><title><application><acronym>BIND</acronym></application> dependencies</title>
40<sect4><title>Optional</title>
41<para>
42<xref linkend="openssl"/>,
43<xref linkend="db"/>,
44<xref linkend="openjade"/> and
45<xref linkend="jadetex"/>
46</para></sect4>
47</sect3>
48
49</sect2>
50
51<sect2>
52<title>Installation of <application><acronym>BIND</acronym></application></title>
53
54<para>Install <application><acronym>BIND</acronym></application> by
55running the following commands:</para>
56
57<screen><userinput><command>./configure --prefix=/usr --sysconfdir=/etc &amp;&amp;
58make &amp;&amp;
59make install</command></userinput></screen>
60
61</sect2>
62
63<sect2>
64<title>Configuring
65<application><acronym>BIND</acronym></application></title>
66
67<sect3><title>Config files</title>
68<para><filename>named.conf</filename>, <filename>root.hints</filename>,
69<filename>127.0.0</filename>, <filename>rndc.conf</filename></para>
70</sect3>
71
72<sect3><title>Configuration Information</title>
73
74<para><application><acronym>BIND</acronym></application> will configured
75to run in a chroot jail as an unprivileged user (named). This configuration
76is more secure in that a <acronym>DNS</acronym> compromise can only affect
77a few files in the named user's <envar>HOME</envar> directory.</para>
78
79<para>Create the unprivileged user and group named:</para>
80
81<screen><userinput><command>groupadd named &amp;&amp;
82useradd -m -g named -s /bin/false named</command></userinput></screen>
83
84<para>Set up some files, directories and devices needed by
85<application><acronym>BIND</acronym></application>:</para>
86
87<screen><userinput><command>cd /home/named &amp;&amp;
88mkdir -p dev etc/namedb/slave var/run &amp;&amp;
89mknod /home/named/dev/null c 1 3 &amp;&amp;
90mknod /home/named/dev/random c 1 8 &amp;&amp;
91chmod 666 /home/named/dev/{null,random} &amp;&amp;
92mkdir /home/named/etc/namedb/pz &amp;&amp;
93cp /etc/localtime /home/named/etc</command></userinput></screen>
94
95<para>Then, generate a key for use in the <filename>named.conf</filename>
96and <filename>rdnc.conf</filename> files using the
97<command>rndc-confgen</command> command:</para>
98
99<screen><userinput><command>rndc-confgen -b 512 | grep -m 1 "secret" | cut -d '"' -f 2</command></userinput></screen>
100
101<para>Create the <filename>named.conf</filename> file from which named
102will read the location of zone files, root name servers and secure
103<acronym>DNS</acronym> keys:</para>
104
105<screen><userinput><command>cat &gt; /home/named/etc/named.conf &lt;&lt; "EOF"</command>
106 options {
107 directory "/etc/namedb";
108 pid-file "/var/run/named.pid";
109 statistics-file "/var/run/named.stats";
110
111 };
112 controls {
113 inet 127.0.0.1 allow { localhost; } keys { rndc_key; };
114 };
115 key "rndc_key" {
116 algorithm hmac-md5;
117 secret "<replaceable>[Insert secret from rndc-confgen's output here]</replaceable>";
118 };
119 zone "." {
120 type hint;
121 file "root.hints";
122 };
123 zone "0.0.127.in-addr.arpa" {
124 type master;
125 file "pz/127.0.0";
126 };
127
128// Bind 9 now logs by default through syslog (except debug).
129// These are the default logging rules.
130
131logging {
132 category default { default_syslog; default_debug; };
133 category unmatched { null; };
134
135 channel default_syslog {
136 syslog daemon; // send to syslog's daemon
137 // facility
138 severity info; // only send priority info
139 // and higher
140 };
141
142 channel default_debug {
143 file "named.run"; // write to named.run in
144 // the working directory
145 // Note: stderr is used instead
146 // of "named.run"
147 // if the server is started
148 // with the '-f' option.
149 severity dynamic; // log at the server's
150 // current debug level
151 };
152
153 channel default_stderr {
154 stderr; // writes to stderr
155 severity info; // only send priority info
156 // and higher
157 };
158
159 channel null {
160 null; // toss anything sent to
161 // this channel
162 };
163};
164
165
166
167<command>EOF</command></userinput></screen>
168
169<para>Create the <filename>rndc.conf</filename> with the following commands:</para>
170
171<screen><userinput><command>cat &gt; /etc/rndc.conf &lt;&lt; "EOF"</command>
172key rndc_key {
173algorithm "hmac-md5";
174 secret
175 "<replaceable>[Insert secret from rndc-confgen's output here]</replaceable>";
176 };
177options {
178 default-server localhost;
179 default-key rndc_key;
180};
181<command>EOF</command></userinput></screen>
182
183<para>The <filename>rndc.conf</filename> file contains information for
184controlling named operations with the <command>rndc</command>
185utility.</para>
186
187<para>Create a zone file with the following contents:</para>
188
189<screen><userinput><command>cat &gt; /home/named/etc/namedb/pz/127.0.0 &lt;&lt; "EOF"</command>
190$TTL 3D
191@ IN SOA ns.local.domain. hostmaster.local.domain. (
192 1 ; Serial
193 8H ; Refresh
194 2H ; Retry
195 4W ; Expire
196 1D) ; Minimum TTL
197 NS ns.local.domain.
1981 PTR localhost.
199<command>EOF</command></userinput></screen>
200
201<para>Create the <filename>root.hints</filename> file with the following
202commands:</para>
203
204<note><para>Caution must be used to ensure no leading spaces in this
205file.</para></note>
206
207<screen><userinput><command>cat &gt; /home/named/etc/namedb/root.hints &lt;&lt; "EOF"</command>
208. 6D IN NS A.ROOT-SERVERS.NET.
209. 6D IN NS B.ROOT-SERVERS.NET.
210. 6D IN NS C.ROOT-SERVERS.NET.
211. 6D IN NS D.ROOT-SERVERS.NET.
212. 6D IN NS E.ROOT-SERVERS.NET.
213. 6D IN NS F.ROOT-SERVERS.NET.
214. 6D IN NS G.ROOT-SERVERS.NET.
215. 6D IN NS H.ROOT-SERVERS.NET.
216. 6D IN NS I.ROOT-SERVERS.NET.
217. 6D IN NS J.ROOT-SERVERS.NET.
218. 6D IN NS K.ROOT-SERVERS.NET.
219. 6D IN NS L.ROOT-SERVERS.NET.
220. 6D IN NS M.ROOT-SERVERS.NET.
221A.ROOT-SERVERS.NET. 6D IN A 198.41.0.4
222B.ROOT-SERVERS.NET. 6D IN A 192.228.79.201
223C.ROOT-SERVERS.NET. 6D IN A 192.33.4.12
224D.ROOT-SERVERS.NET. 6D IN A 128.8.10.90
225E.ROOT-SERVERS.NET. 6D IN A 192.203.230.10
226F.ROOT-SERVERS.NET. 6D IN A 192.5.5.241
227G.ROOT-SERVERS.NET. 6D IN A 192.112.36.4
228H.ROOT-SERVERS.NET. 6D IN A 128.63.2.53
229I.ROOT-SERVERS.NET. 6D IN A 192.36.148.17
230J.ROOT-SERVERS.NET. 6D IN A 192.58.128.30
231K.ROOT-SERVERS.NET. 6D IN A 193.0.14.129
232L.ROOT-SERVERS.NET. 6D IN A 198.32.64.12
233M.ROOT-SERVERS.NET. 6D IN A 202.12.27.33
234<command>EOF</command></userinput></screen>
235
236<para>The <filename>root.hints</filename> file is a list of root name
237servers. This file must be updated periodically with the
238<command>dig</command> utility. A current copy of root.hints can be
239obtained from <ulink url="ftp://rs.internic.net/domain/named.root" />.
240Consult the <ulink url="http://www.bind9.net/Bv9ARM.html"><application><acronym>BIND</acronym></application> 9 Administrator Reference Manual</ulink> for
241details.</para>
242
243<para>Create or modify <filename>resolv.conf</filename> to use the new
244name server with the following commands:</para>
245
246<note><para>Replace yourdomain.com with your own valid domain
247name.</para></note>
248
249<screen><userinput><command>cp /etc/resolv.conf /etc/resolv.conf.bak &amp;&amp;
250cat &gt; /etc/resolv.conf &lt;&lt; "EOF"</command>
251search <replaceable>[yourdomain.com]</replaceable>
252nameserver 127.0.0.1
253<command>EOF</command></userinput></screen>
254
255<para>Set permissions on the chroot jail with the following
256command:</para>
257
258<screen><userinput><command>chown -R named.named /home/named</command></userinput></screen>
259
260<para>To start the DNS server at boot, install the <filename>/etc/rc.d/init.d/bind</filename>
261init script included in the <xref linkend="intro-important-bootscripts"/> package.</para>
262
263<screen><userinput><command>make install-bind</command></userinput></screen>
264
265<para>Now start <application><acronym>BIND</acronym></application> with
266the new boot script:</para>
267
268<screen><userinput><command>/etc/rc.d/init.d/bind start</command></userinput></screen>
269
270</sect3>
271
272<sect3><title>Testing <application><acronym>BIND</acronym></application></title>
273
274<para>Test out the new
275<application><acronym>BIND</acronym></application> 9 installation. First
276query the local host address with <command>dig</command>:</para>
277
278<screen><userinput><command>dig -x 127.0.0.1</command></userinput></screen>
279
280<para>Now try an external name lookup, taking note of the speed
281difference in repeated lookups due to the caching. Run the dig command
282twice on the same address:</para>
283
284<para><screen><userinput><command>dig www.linuxfromscratch.org &amp;&amp;
285dig www.linuxfromscratch.org</command></userinput></screen>
286You can see almost instantaneous results with the named caching lookups.
287Consult <filename>bind-&bind-version;/doc/arm/Bv9ARM.html</filename>,
288the <application><acronym>BIND</acronym></application> Administrator
289Reference Manual for further configuration options.</para>
290
291</sect3>
292
293</sect2>
294
295<sect2>
296<title>Contents</title>
297
298<para>The <application><acronym>BIND</acronym></application> package contains
299<command>dig</command>,
300<command>host</command>,
301<command>isc-config.sh</command>,
302<command>nslookup</command>,
303<command>rndc</command>,
304<command>rndc-confgen</command>,
305<command>named-checkconf</command>,
306<command>named-checkzone</command>,
307<command>lwresd</command>,
308<command>named</command>,
309<command>dnssec-signzone</command>,
310<command>dnssec-signkey</command>,
311<command>dnssec-keygen</command>,
312<command>dnssec-makekeyset</command> and
313<command>nsupdate</command>.</para>
314</sect2>
315
316<sect2><title>Description</title>
317
318<sect3><title>dig</title>
319<para><command>dig</command> interrogates <acronym>DNS</acronym>
320servers.</para></sect3>
321
322<sect3><title>host</title>
323<para><command>host</command> is a utility for <acronym>DNS</acronym>
324lookups.</para></sect3>
325
326<sect3><title>nslookup</title>
327<para><command>nslookup</command> is a program used to query Internet
328domain nameservers.</para></sect3>
329
330<sect3><title>rndc</title>
331<para><command>rndc</command> controls the operation of
332<application><acronym>BIND</acronym></application>.</para></sect3>
333
334<sect3><title>rndc-confgen</title>
335<para><command>rndc-confgen</command> generates
336<filename>rndc.conf</filename> files.</para></sect3>
337
338<sect3><title>named-checkconf</title>
339<para><command>named-checkconf</command> checks the syntax of
340<filename>named.conf</filename> files.</para></sect3>
341
342<sect3><title>named-checkzone</title>
343<para><command>named-checkzone</command> checks zone file
344validity.</para></sect3>
345
346<sect3><title>lwresd</title>
347<para><command>lwresd</command> is a caching-only name server for local
348process use.</para></sect3>
349
350<sect3><title>named</title>
351<para><command>named</command> is the name server daemon.</para></sect3>
352
353<sect3><title>dnssec-signzone</title>
354<para><command>dnssec-signzone</command> generates signed versions of
355zone files.</para></sect3>
356
357<sect3><title>dnssec-signkey</title>
358<para><command>dnssec-signkey</command> signs zone file key
359sets.</para></sect3>
360
361<sect3><title>dnssec-keygen</title>
362<para><command>dnssec-keygen</command> is a key generator for secure
363<acronym>DNS</acronym>.</para></sect3>
364
365<sect3><title>dnssec-makekeyset</title>
366<para><command>dnssec-makekeyset</command> generates a key set from one
367or more keys created by dnssec-keygen.</para></sect3>
368
369<sect3><title>nsupdate</title>
370<para><command>nsupdate</command> is used to submit
371<acronym>DNS</acronym> update requests.</para></sect3>
372
373</sect2>
374
375</sect1>
376
Note: See TracBrowser for help on using the repository browser.