“UbuntuHelp:BIND9ServerHowto”的版本间的差异

2007年5月13日 (日) 12:35的版本

文章出处:

https://help.ubuntu.com/community/BIND9ServerHowto

点击翻译:

English

This HOWTO is aimed to at people looking to learn how to configure and maintain a DNS server, such as for a network or to serve DNS zones for a domain name.

Repositories

BIND9 is available in the core Ubuntu repository. No additional repository needs to be enabled for BIND9.

Before we begin, you should be familiar with RootSudo.

Installing BIND9

The Server

$ sudo apt-get install bind9

Useful Tools (For Testing)

$ sudo apt-get install bind9-host dnsutils

Documentation (Optional)

$ sudo apt-get install bind9-doc

BIND9 Scenarios

There are many setups BIND9 may be configured.

The most useful setups are:

Caching Server

This can be useful for a broadband connection to a host or small network. By caching DNS queries, you reduce the bandwidth used and (hopefully) reducing your bandwidth used (and hopefully even your broadband bill!).

Master Server

BIND9 can be used to serve DNS records (groups of records are referred to as zones) for a registered domain name or an imaginary one (but only if used on a restricted network)

Slave Server

A slave DNS server is used to complement a Master DNS server by serving a copy of the zone(s) configured on the Master server. Slave servers are recommended in larger setups (larger networks or on the internet) if you intend to power a registered domain name, since they ensure that your DNS zone is still available, even if your Master server is not online.

Hybrids

You can even configure BIND9 to be a Caching and Master DNS server simultaneously, a Caching and a Slave server or even a Caching, Master and Slave server. All that is required is simply combining the differnet configuration examples from this document.

Stealth Servers

There are also two other common DNS server setups (used when working with zones for registered domain names), Stealth Master and Stealth Slave. These are effectively the same as Master and Slave DNS servers, but with a slight organisational difference.

For example, you have 3 DNS servers; A, B and C.

A is the Master, B and C are slaves.

If you configure your registered domain to use A and B as your domain's DNS servers, then C is a Stealth Slave. It's still a slave, but it's not going to be asked about the zone you are serving to the internet from A and B

If you configure your registerd domain to use B and C as your domain's DNS servers, then A is a stealth master. Any additional records or edits to the zone are done on A, but computers on the internet will only ever ask B and C about the zone.

DNS Record Types

There are lots of different DNS record types, but for a someone reading this document, you need only deal with these record types

Address Records

The most commonly used type of record.

www      IN    A      1.2.3.4

Alias Records

Used to create an alias from an existing A record. You cannot create a CNAME record pointing to another CNAME record.

mail     IN    CNAME  www
www      IN    A      1.2.3.4

Mail Exchange Records

Used to define where email should be sent to. Must point to an A record, not a CNAME.

 
        IN    MX      mail.example.com.

        [...]

mail    IN    A       1.2.3.4

Name Server Records

Used to define which servers serve copies of this zone. It must point to an A record, not a CNAME.

This is where Master and Slave servers are definied. Stealth servers are intentionally omitted.

        IN    NS     ns.example.com.

        [...]

ns      IN    A      1.2.3.4

Configuring BIND9

BIND9 Configuration files are stored in

/etc/bind/

The main configuration is stored in the following files

/etc/bind/named.conf
/etc/bind/named.conf.options
/etc/bind/named.conf.local

Caching Server

The default configuration is setup to act as a caching server by default.

All that is required is simply adding the IP numbers of your ISP's DNS servers.

Simply uncomment and edit the following:

named.conf.options:


        [...]

        forwarders {
             1.2.3.4;
             5.6.7.8;
        };

        [...]

(where 1.2.3.4 and 5.6.7.8 are the IP numbers of your ISP's DNS servers)

Master Server

To add a DNS zone to BIND9, turning BIND9 into a Master server, all you simply have to do is:

named.conf.local:


        [...]

        zone "example.com" {
             type master;
             file "/etc/bind/db.example.com";
        };

        [...]

Now use an existing zone file as a template

$ sudo cp /etc/bind/db.local /etc/bind/db.example.com

Now, to edit our zone

db.example.com:


;
; BIND data file for local loopback interface
;
$TTL    604800
@       IN      SOA     localhost. root.localhost. (
                              1         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      localhost.
@       IN      A       127.0.0.1

Edit localhost. to the FQDN of your server, with an additional "." at the end.

Eg:

db.example.com:


;
; BIND data file for local loopback interface
;
$TTL    604800
@       IN      SOA     box.example.com. root.localhost. (
                              1         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      localhost.
@       IN      A       127.0.0.1

Edit root.localhost to be your email address, but with a "." instead of the "@", and another "." at the end.

Eg:

[email protected] should be added as johndoe.example.com.

Increment the Serial number (you must increment the serial number for every time you make any changes to the zone file and reload the zone by restarting BIND9. If you make multiple changes before restarting BIND9, simply increment the serial once.

Tip: Many people like to use the last date edited as the serial of a zone, such as 2005010100 which is yyyymmddss (where s is serial)

Now, you can add DNS records to the bottom of the zone. Do remember to increment the serial as you add entries though.

Slave Server

First, on the master server, you have to allow the zone transfer. The sample zone definition in /etc/bind/named.conf.local should like this:

        [...]

        zone "example.com" {
             type master;
             file "/etc/bind/db.example.com";
             allow-transfer {
                 @ip_slave;
             };
        };

        [...]

On the slave, you have to proceed to the same installation that was done on the master. Then edit the /etc/bind/named.conf.local and add the following declaration for the zone:

        [...]

        zone "example.com" {
             type slave;
             file "/etc/bind/db.example.com";
             masters { @ip_master; };
        };        

        [...]

Restart the server, you should see in /var/log/syslog something like:

syslog.5.gz:May 14 23:33:53 smith named[5064]: zone example.com/IN: transferred serial 2006051401
syslog.5.gz:May 14 23:33:53 smith named[5064]: transfer of 'example.com/IN' from 10.0.0.202#53: end of transfer

Chrooting BIND9

Chrooting BIND9 is a recommended setup from a security perspective. In a chroot enviroment, BIND9 has access to all the files and hardware devices it needs, but is unable to access anything it should not need.

To chroot BIND9, simply create a chroot enviroment for it and add the additional configuration below

The Chroot Enviroment

Create the following directory structure

$ sudo mkdir -p /chroot/named
$ cd /chroot/named
$ sudo mkdir -p dev etc/namedb/slave var/run

Set permissions for chroot environment

$ sudo chown root:root /chroot
$ sudo chmod 700 /chroot
$ sudo chown bind:bind /chroot/named
$ sudo chmod 700 /chroot/named

Create or move the bind configuration file.

$ sudo touch /chroot/named/etc/named.conf

or

$ sudo cp /etc/named.conf /chroot/named/etc

Give write permissions to the user bind for /chroot/named/etc/namedb/slave directory.

$ sudo chown bind:bind /chroot/named/etc/namedb/slave

This is where the files for all slave zones will be kept. This increases security, by stopping the ability of an attacker to edit any of your master zone files if they do gain access as the bind user. Accordingly, all slave file names in the /chroot/named/etc/named.conf file will need to have directory names that designate the slave directory. An example zone definition is listed below.

zone “my.zone.com.” {
	type slave;
	file “slaves/my.zone.com.dns”;
	masters {
		10.1.1.10;
	};
};

Create the devices BIND9 requires

$ sudo mknod /chroot/named/dev/null c 1 3
$ sudo mknod /chroot/named/dev/random c 1 8

Give the user bind access to the /chroot/named/var/run directory that will be used to strore PID and statistical data.

$ sudo chown bind:bind /chroot/named/var/run

BIND9's Configuration

Edit the bind startup options found in /etc/default/bind9. Change the line the reads:

/etc/default/bind9:

OPTIONS=”-u bind”

So that it reads

/etc/default/bind9:


OPTIONS="-u bind -t /var/named -t /chroot/named -c /etc/named.conf"

The -t option changes the root directory from which bind operates to be /chroot/named. The -c option tells Bind that the configuration file is located at /etc/named.conf. Remember that this path is relative to the root set by -t.

The named.conf file must also recieve extra options in order to run correctly below is a minimal set of options:

/chroot/named/etc/named.conf:

options {
    directory "/etc/namedb";
    pid-file "/var/run/named.pid";
    statistics-file "/var/run/named.stats";
};

Ubuntu's syslod Daemon Configuration

/etc/init.d/sysklogd:


        [...]

SYSLOGD="-u syslog -a /chroot/named/dev/log"

        [...]

(Author Note: Check this config)

Restart the syslog server and BIND9

$ sudo /etc/init.d/sysklogd restart
$ sudo /etc/init.d/bind9 restart

At this point you should check /var/log/messages for any errors that may have been thrown by bind.

Starting, Stopping, and Restarting BIND9

Use the following command to start BIND9 :

$ sudo /etc/init.d/bind9 start

To stop it, use :

$ sudo /etc/init.d/bind9 stop

Finally, to restart it, run

$ sudo /etc/init.d/bind9 restart

Status

To check the status of your BIND9 installation:

$ host $record localhost

or

$ dig $record @localhost

(where localhost is the system you are setting BIND9 up on. If not localhost, use the appropriate IP number.)

Tips & Tricks

Additional Possibilities

You can monitor your BIND9 server usage by installing the bindgraph package from the Universe (To enable Universe - see AddingRepositoriesHowto) and following configuration details as outlined in bindgraph's README documents

Further Information

Online Recources

"ISC's BIND9 Manual"

TLDP's "DNS HOWTO" (For General Overview)

"Chroot BIND Howto"

Printed Resources

"DNS & BIND" - Paul Albitz & Cricket Liu - 4th Edition - "O'Reilly Press" (Amazon.com)

"DNS & BIND Cookbook" - Cricket Liu - 4th Edition - "O'Reilly Press" (Amazon.com)

CategoryDocumentation