Version 2 (modified by Kevin, 4 years ago) ( diff )




For those whose system is not connected to the Internet yet,
To ensure BIND will build dnssec-keymgr, install a python module as the root user:

This command will timeout:

pip3 install ply

Download file from another server:


Then run the command with the file once transferred into your build:

pip3 install ply-3.11.tar.gz

Processing ./ply-3.11.tar.gz Installing collected packages: ply

Running install for ply ... done

Successfully installed ply-3.11n

Note: - Alternate source PLY is currently in maintenance mode only.
Critical bugs (if any) will be addressed, but no new features are being added.
If you are looking for a parser generator with a more modern flavor, look at the SLY Project.
02/15/2018 PLY-3.11 is last release.

More information on DLZ To use DLZ (Dynamically Loadable Zones) in Bind

Error in creating rndc.conf file:

rndc-confgen -r /dev/urandom -b 512 > /etc/rndc.conf &&
sed '/conf/d;/^#/!d;s:^# ::' /etc/rndc.conf > /srv/named/etc/named.conf

The -r option has been deprecated.

See Ticket #12649 new defect BIND-9.14.5 rndc-confgen: The -r option has been deprecated.

Use this instead:

rndc-confgen -a -b 512 -t /srv/named

wrote key file "/etc/rndc.key"
wrote key file "/srv/named/etc/rndc.key"

If you ran the command with -r previously, clean up unnecessary files it created.

rm /etc/rndc.conf /srv/named/etc/rndc.conf

Notes from man page: -a option: Do automatic rndc configuration. This creates a file rndc.key in /etc (or whatever sysconfdir was specified as when BIND was built) that is read by both rndc and named on startup. The rndc.key file defines a default command channel and authentication key allowing rndc to communicate with named on the local host with no further configuration. Running rndc-confgen -a allows BIND 9 and rndc to be used as drop-in replacements for BIND 8 and ndc, with no changes to the existing BIND 8 named.conf file. If a more elaborate configuration than that generated by rndc-confgen -a is required, for example if rndc is to be used remotely, you should run rndc-confgen without the -a option and set up a rndc.conf and named.conf as directed.

-t option: Used with the -a option to specify a directory where named will run chrooted. An additional copy of the rndc.key will be written relative to this directory so that it will be found by the chrooted named.

If you want the latest root.hints file, run this:

cp /srv/named/etc/namedb/root.hints /srv/named/etc/namedb/root.hints.old
md5sum named.root |grep -f named.root.md5 && mv named.root /srv/named/etc/namedb/root.hints

If md5sum fails then the file is not updated.

Only difference as of Oct. 14th, 2019 was the Root Level B B.ROOT-SERVERS.NET. 3600000 A

And notice the addr-class "IN" is missing from the records? Not sure why that is missing there since the instructions in the book say: "A current copy of root.hints can be obtained from"

You can use this command to dig the file instead:

dig  .  ns > db.cache
cat db.cache |grep '^\.\|^[a-z]' >/srv/named/etc/namedb/root.hints

That will give you a file very close to the BLFS example. Sanitized so no leading spaces are introduced. But seems a bit confusing the names change from
named.root to db.cache to root.hints.

Maybe someone can explain why this is all over the place?

Note: See TracWiki for help on using the wiki.