[366e29e1] | 1 | <sect2>
|
---|
[814d190] | 2 | <title>Configuring
|
---|
| 3 | <application><acronym>BIND</acronym></application></title>
|
---|
| 4 |
|
---|
| 5 | <sect3><title>Config files</title>
|
---|
| 6 | <para><filename>named.conf</filename>, <filename>root.hints</filename>,
|
---|
| 7 | <filename>127.0.0</filename>, <filename>rndc.conf</filename></para>
|
---|
| 8 | </sect3>
|
---|
| 9 |
|
---|
| 10 | <sect3><title>Configuration Information</title>
|
---|
| 11 |
|
---|
| 12 | <para>We will configure
|
---|
| 13 | <application><acronym>BIND</acronym></application> to run in a chroot
|
---|
| 14 | jail as an unprivileged user (named). This configuration is more secure
|
---|
| 15 | in that a <acronym>DNS</acronym> compromise can only affect a few files
|
---|
[ca89a835] | 16 | in the named user's <envar>HOME</envar> directory.</para>
|
---|
[814d190] | 17 |
|
---|
[a4be499] | 18 | <para>First we create the unprivileged user and group named:</para>
|
---|
[814d190] | 19 |
|
---|
[c9604039] | 20 | <screen><userinput><command>groupadd named &&
|
---|
| 21 | useradd -m -g named -s /bin/false named</command></userinput></screen>
|
---|
[814d190] | 22 |
|
---|
| 23 | <para>Then we set up some files, directories and devices needed by
|
---|
| 24 | <application><acronym>BIND</acronym></application>:</para>
|
---|
| 25 |
|
---|
| 26 | <screen><userinput><command>cd /home/named &&
|
---|
[366e29e1] | 27 | mkdir -p dev etc/namedb/slave var/run &&
|
---|
| 28 | mknod /home/named/dev/null c 1 3 &&
|
---|
| 29 | mknod /home/named/dev/random c 1 8 &&
|
---|
| 30 | chmod 666 /home/named/dev/{null,random} &&
|
---|
| 31 | mkdir /home/named/etc/namedb/pz &&
|
---|
[814d190] | 32 | cp /etc/localtime /home/named/etc</command></userinput></screen>
|
---|
[366e29e1] | 33 |
|
---|
[814d190] | 34 | <para>Create the <filename>named.conf</filename> file from which named
|
---|
| 35 | will read the location of zone files, root name servers and secure
|
---|
| 36 | <acronym>DNS</acronym> keys:</para>
|
---|
[366e29e1] | 37 |
|
---|
[814d190] | 38 | <screen><userinput><command>cat > /home/named/etc/named.conf << "EOF"</command>
|
---|
[366e29e1] | 39 | options {
|
---|
| 40 | directory "/etc/namedb";
|
---|
| 41 | pid-file "/var/run/named.pid";
|
---|
| 42 | statistics-file "/var/run/named.stats";
|
---|
| 43 |
|
---|
| 44 | };
|
---|
| 45 | controls {
|
---|
| 46 | inet 127.0.0.1 allow { localhost; } keys { rndc_key; };
|
---|
| 47 | };
|
---|
| 48 | key "rndc_key" {
|
---|
| 49 | algorithm hmac-md5;
|
---|
[c9604039] | 50 | secret "<replaceable>[c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K]</replaceable>";
|
---|
[366e29e1] | 51 | };
|
---|
| 52 | zone "." {
|
---|
| 53 | type hint;
|
---|
| 54 | file "root.hints";
|
---|
| 55 | };
|
---|
| 56 | zone "0.0.127.in-addr.arpa" {
|
---|
| 57 | type master;
|
---|
| 58 | file "pz/127.0.0";
|
---|
| 59 | };
|
---|
[ca89a835] | 60 | <command>EOF</command></userinput></screen>
|
---|
[814d190] | 61 |
|
---|
| 62 | <para>Create a zone file with the following contents:</para>
|
---|
| 63 |
|
---|
| 64 | <screen><userinput><command>cat > /home/named/etc/namedb/pz/127.0.0 << "EOF"</command>
|
---|
[366e29e1] | 65 | $TTL 3D
|
---|
| 66 | @ IN SOA ns.local.domain. hostmaster.local.domain. (
|
---|
| 67 | 1 ; Serial
|
---|
| 68 | 8H ; Refresh
|
---|
| 69 | 2H ; Retry
|
---|
| 70 | 4W ; Expire
|
---|
| 71 | 1D) ; Minimum TTL
|
---|
| 72 | NS ns.local.domain.
|
---|
| 73 | 1 PTR localhost.
|
---|
[814d190] | 74 | <command>EOF</command></userinput></screen>
|
---|
| 75 |
|
---|
| 76 | <para>Create the <filename>root.hints</filename> file with the following
|
---|
| 77 | commands:</para>
|
---|
[366e29e1] | 78 |
|
---|
[a8d6ef3a] | 79 | <note><para>Caution must be used to ensure no leading spaces in this
|
---|
[366e29e1] | 80 | file.</para></note>
|
---|
[814d190] | 81 |
|
---|
| 82 | <screen><userinput><command>cat > /home/named/etc/namedb/root.hints << "EOF"</command>
|
---|
[366e29e1] | 83 | . 6D IN NS A.ROOT-SERVERS.NET.
|
---|
| 84 | . 6D IN NS B.ROOT-SERVERS.NET.
|
---|
| 85 | . 6D IN NS C.ROOT-SERVERS.NET.
|
---|
| 86 | . 6D IN NS D.ROOT-SERVERS.NET.
|
---|
| 87 | . 6D IN NS E.ROOT-SERVERS.NET.
|
---|
| 88 | . 6D IN NS F.ROOT-SERVERS.NET.
|
---|
| 89 | . 6D IN NS G.ROOT-SERVERS.NET.
|
---|
| 90 | . 6D IN NS H.ROOT-SERVERS.NET.
|
---|
| 91 | . 6D IN NS I.ROOT-SERVERS.NET.
|
---|
| 92 | . 6D IN NS J.ROOT-SERVERS.NET.
|
---|
| 93 | . 6D IN NS K.ROOT-SERVERS.NET.
|
---|
| 94 | . 6D IN NS L.ROOT-SERVERS.NET.
|
---|
| 95 | . 6D IN NS M.ROOT-SERVERS.NET.
|
---|
| 96 | A.ROOT-SERVERS.NET. 6D IN A 198.41.0.4
|
---|
| 97 | B.ROOT-SERVERS.NET. 6D IN A 128.9.0.107
|
---|
| 98 | C.ROOT-SERVERS.NET. 6D IN A 192.33.4.12
|
---|
| 99 | D.ROOT-SERVERS.NET. 6D IN A 128.8.10.90
|
---|
| 100 | E.ROOT-SERVERS.NET. 6D IN A 192.203.230.10
|
---|
| 101 | F.ROOT-SERVERS.NET. 6D IN A 192.5.5.241
|
---|
| 102 | G.ROOT-SERVERS.NET. 6D IN A 192.112.36.4
|
---|
| 103 | H.ROOT-SERVERS.NET. 6D IN A 128.63.2.53
|
---|
| 104 | I.ROOT-SERVERS.NET. 6D IN A 192.36.148.17
|
---|
[007c615] | 105 | J.ROOT-SERVERS.NET. 6D IN A 192.58.128.30
|
---|
[366e29e1] | 106 | K.ROOT-SERVERS.NET. 6D IN A 193.0.14.129
|
---|
| 107 | L.ROOT-SERVERS.NET. 6D IN A 198.32.64.12
|
---|
| 108 | M.ROOT-SERVERS.NET. 6D IN A 202.12.27.33
|
---|
[ca89a835] | 109 | <command>EOF</command></userinput></screen>
|
---|
[814d190] | 110 |
|
---|
| 111 | <para>The <filename>root.hints</filename> file is a list of root name
|
---|
| 112 | servers. This file must be updated periodically with the
|
---|
| 113 | <command>dig</command> utility.
|
---|
[65df9fca] | 114 | Consult the <ulink url="http://www.bind9.net/Bv9ARM.html"><application><acronym>BIND</acronym></application> 9 Administrator Reference Manual</ulink> for
|
---|
[814d190] | 115 | details.</para>
|
---|
[366e29e1] | 116 |
|
---|
[ca2217b] | 117 | <para>Create the <filename>rndc.conf</filename> with the following commands:</para>
|
---|
[814d190] | 118 |
|
---|
| 119 | <screen><userinput><command>cat > /etc/rndc.conf << "EOF"</command>
|
---|
[366e29e1] | 120 | key rndc_key {
|
---|
| 121 | algorithm "hmac-md5";
|
---|
| 122 | secret
|
---|
[c9604039] | 123 | "<replaceable>[c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K]</replaceable>";
|
---|
[366e29e1] | 124 | };
|
---|
| 125 | options {
|
---|
| 126 | default-server localhost;
|
---|
| 127 | default-key rndc_key;
|
---|
| 128 | };
|
---|
[814d190] | 129 | <command>EOF</command></userinput></screen>
|
---|
| 130 |
|
---|
| 131 | <para>The <filename>rndc.conf</filename> file contains information for
|
---|
| 132 | controlling named operations with the <command>rndc</command>
|
---|
| 133 | utility.</para>
|
---|
| 134 |
|
---|
| 135 | <para>Create or modify <filename>resolv.conf</filename> to use the new
|
---|
| 136 | name server with the following commands:</para>
|
---|
[366e29e1] | 137 |
|
---|
| 138 | <note><para>Replace yourdomain.com with your own valid domain
|
---|
| 139 | name.</para></note>
|
---|
| 140 |
|
---|
[814d190] | 141 | <screen><userinput><command>cp /etc/resolv.conf /etc/resolv.conf.bak &&
|
---|
| 142 | cat > /etc/resolv.conf << "EOF"</command>
|
---|
[65df9fca] | 143 | search <replaceable>[yourdomain.com]</replaceable>
|
---|
[366e29e1] | 144 | nameserver 127.0.0.1
|
---|
[ca89a835] | 145 | <command>EOF</command></userinput></screen>
|
---|
[366e29e1] | 146 |
|
---|
| 147 | <para>Set permissions on the chroot jail with the following
|
---|
| 148 | command:</para>
|
---|
| 149 |
|
---|
[814d190] | 150 | <screen><userinput><command>chown -R named.named /home/named</command></userinput></screen>
|
---|
| 151 |
|
---|
[65df9fca] | 152 | <para>To start the DNS server at boot, install the <filename>/etc/rc.d/init.d/bind</filename>
|
---|
[ae9c528] | 153 | init script included in the <xref linkend="intro-important-bootscripts"/> package.</para>
|
---|
| 154 |
|
---|
| 155 | <screen><userinput><command>make install-bind</command></userinput></screen>
|
---|
[814d190] | 156 |
|
---|
| 157 | <para>Now start <application><acronym>BIND</acronym></application> with
|
---|
| 158 | the new boot script:</para>
|
---|
| 159 |
|
---|
| 160 | <screen><userinput><command>/etc/rc.d/init.d/bind start</command></userinput></screen>
|
---|
[366e29e1] | 161 |
|
---|
[814d190] | 162 | </sect3>
|
---|
| 163 |
|
---|
| 164 | <sect3><title>Testing <application><acronym>BIND</acronym></application></title>
|
---|
| 165 |
|
---|
| 166 | <para>Test out the new
|
---|
| 167 | <application><acronym>BIND</acronym></application> 9 installation. First
|
---|
| 168 | query the local host address with <command>dig</command>:</para>
|
---|
| 169 |
|
---|
| 170 | <screen><userinput><command>dig -x 127.0.0.1</command></userinput></screen>
|
---|
[366e29e1] | 171 |
|
---|
| 172 | <para>Now try an external name lookup, taking note of the speed
|
---|
[814d190] | 173 | difference in repeated lookups due to the caching. Run the dig command
|
---|
| 174 | twice on the same address:</para>
|
---|
[366e29e1] | 175 |
|
---|
[814d190] | 176 | <para><screen><userinput><command>dig beyond.linuxfromscratch.org &&
|
---|
| 177 | dig beyond.linuxfromscratch.org</command></userinput></screen>
|
---|
| 178 | You can see almost instantaneous results with the named caching lookups.
|
---|
| 179 | Consult <filename>bind-&bind-version;/doc/arm/Bv9ARM.html</filename>,
|
---|
| 180 | the <application><acronym>BIND</acronym></application> Administrator
|
---|
| 181 | Reference Manual for further configuration options.</para>
|
---|
| 182 |
|
---|
| 183 | </sect3>
|
---|
| 184 |
|
---|
| 185 | </sect2>
|
---|