|Version 2 (modified by 4 years ago) ( diff ),|
For those whose system is not connected to the Internet yet,
To ensure BIND will build dnssec-keymgr, install a python module as the root user:
This command will timeout:
pip3 install ply
Download file from another server:
Then run the command with the file once transferred into your build:
pip3 install ply-3.11.tar.gz
Processing ./ply-3.11.tar.gz Installing collected packages: ply
Running setup.py install for ply ... done
Successfully installed ply-3.11n
Note: https://github.com/dabeaz/ply - Alternate source
PLY is currently in maintenance mode only.
Critical bugs (if any) will be addressed, but no new features are being added.
If you are looking for a parser generator with a more modern flavor, look at the SLY Project.
02/15/2018 PLY-3.11 is last release.
More information on DLZ
To use DLZ (Dynamically Loadable Zones) in Bind
Error in creating rndc.conf file:
rndc-confgen -r /dev/urandom -b 512 > /etc/rndc.conf && sed '/conf/d;/^#/!d;s:^# ::' /etc/rndc.conf > /srv/named/etc/named.conf
The -r option has been deprecated.
See Ticket #12649 new defect BIND-9.14.5 rndc-confgen: The -r option has been deprecated.
Use this instead:
rndc-confgen -a -b 512 -t /srv/named
wrote key file "/etc/rndc.key"
wrote key file "/srv/named/etc/rndc.key"
If you ran the command with -r previously, clean up unnecessary files it created.
rm /etc/rndc.conf /srv/named/etc/rndc.conf
Notes from man page: -a option: Do automatic rndc configuration. This creates a file rndc.key in /etc (or whatever sysconfdir was specified as when BIND was built) that is read by both rndc and named on startup. The rndc.key file defines a default command channel and authentication key allowing rndc to communicate with named on the local host with no further configuration. Running rndc-confgen -a allows BIND 9 and rndc to be used as drop-in replacements for BIND 8 and ndc, with no changes to the existing BIND 8 named.conf file. If a more elaborate configuration than that generated by rndc-confgen -a is required, for example if rndc is to be used remotely, you should run rndc-confgen without the -a option and set up a rndc.conf and named.conf as directed.
-t option: Used with the -a option to specify a directory where named will run chrooted. An additional copy of the rndc.key will be written relative to this directory so that it will be found by the chrooted named.
If you want the latest root.hints file, run this:
wget ftp://rs.internic.net/domain/named.root wget https://www.internic.net/domain/named.root.md5 cp /srv/named/etc/namedb/root.hints /srv/named/etc/namedb/root.hints.old md5sum named.root |grep -f named.root.md5 && mv named.root /srv/named/etc/namedb/root.hints
If md5sum fails then the file is not updated.
Only difference as of Oct. 14th, 2019 was the Root Level B B.ROOT-SERVERS.NET. 3600000 A 126.96.36.199
And notice the addr-class "IN" is missing from the records? Not sure why that is missing there since the instructions in the book say: "A current copy of root.hints can be obtained from ftp://rs.internic.net/domain/named.root."
You can use this command to dig the file instead:
dig @a.root-servers.net . ns > db.cache cat db.cache |grep '^\.\|^[a-z]' >/srv/named/etc/namedb/root.hints
That will give you a file very close to the BLFS example.
Sanitized so no leading spaces are introduced.
But seems a bit confusing the names change from
named.root to db.cache to root.hints.
Maybe someone can explain why this is all over the place?