Tuesday, February 22, 2011

Centos - Bind9 setup

package: Bind
              Bind-chroot


After install, copy
named.conf from /usr/share/doc/bind-9.3.6/sample/etc/named.conf
to
/var/named/chroot/etc/

In order for rndc to connect to a named service, there must be a controls statement in the BIND server's /etc/named.conf file.

The controls statement, shown in the following example, allows rndc to connect from the localhost.

controls {
inet 127.0.0.1 allow { localhost; }
keys { <key-name>; };
};

This statement tells named to listen on the default TCP port 953 of the loopback address and allow rndc commands coming from the localhost, if the proper key is given. The <key-name> specifies a name in the key statement within the /etc/named.conf file. The next example illustrates a sample key statement.

key "<key-name>" {
algorithm hmac-md5;
secret "<key-value>";
};

The key is the most important statement in /etc/rndc.conf.

key "<key-name>" {
algorithm hmac-md5;
secret "<key-value>";
};

The <key-name> and <key-value> should be exactly the same as their settings in /etc/named.conf.
To match the keys specified in the target server's /etc/named.conf, add the following lines to /etc/rndc.conf.

options {
default-server localhost;
default-key "<key-name>";
};


ZONE
open named.conf and edit
vi /var/named/chroot/etc/named.conf

---------------------------------------------------------------------------------------------------------
        zone "gab.lan" {
                type master;
                file "gab.lan.zone";
        };
--------------------------------------------------------------------------------------------------------
save it and exit
then at /var/named/chroot/var/named/
create gab.lan.zone
open and edit it 
--------------------------------------------------------------------------------------------------------
$TTL 3h

@       IN      SOA     gab.lan.  root (
                        2011022101;
                        30m; refresh
                        15m; retry interval
                        1W; expire
                        1D); negative cache TTL


@               IN      NS      ns.gab.lan.
forum          IN      A       169.0.0.1.
wiki             IN      A       169.0.0.2.


ns               IN       A       169.0.0.0
--------------------------------------------------------------------------------------------------------

save and exit.
then make a soft link to /var/named
ln -s /var/named/chroot/var/named/gab.lan.zone /var/named/gab.lan.zone

then start the services
/etc/init.d/named start
then you can check the status by using
/etc/init.d/named status

Use dig to check if it is running

dig wiki.gab.lan

if it is setup correct, it will show something like this
------------------------------------------------------------------------------------------------------
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_5.3 <<>> wiki.gab.lan
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50877
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;wiki.gab.lan.            IN      A

;; ANSWER SECTION:
wiki.gab.lan.     10800   IN      A       169.0.0.2

;; AUTHORITY SECTION:
gab.lan.          10800   IN      NS      gab.lan.

;; Query time: 0 msec
;; SERVER: 172.30.10.98#53(172.30.10.98)
;; WHEN: Tue Feb 22 12:18:35 2011
;; MSG SIZE  rcvd: 80
-----------------------------------------------------------------------------------------------------


Highlight out

please highlight out this part from named.conf

----------------------------------------------------------------------------------------------------------

// All BIND 9 zones are in a "view", which allow different zones to be served
// to different types of client addresses, and for options to be set for groups
// of zones.
//
// By default, if named.conf contains no "view" clauses, all zones are in the
// "default" view, which matches all clients.
//
// If named.conf contains any "view" clause, then all zones MUST be in a view;
// so it is recommended to start off using views to avoid having to restructure
// your configuration files in the future.
//
#view "localhost_resolver"
#{
/* This view sets up named to be a localhost resolver ( caching only nameserver ).
 * If all you want is a caching-only nameserver, then you need only define this view:
 */
#       match-clients           { localhost; };
#       match-destinations      { localhost; };
#       recursion yes;
        # all views must contain the root hints zone:
#       include "/etc/named.root.hints";

        /* these are zones that contain definitions for all the localhost
         * names and addresses, as recommended in RFC1912 - these names should
         * ONLY be served to localhost clients:
         */
#       include "/etc/named.rfc1912.zones";
#};
#view "internal"
#{
/* This view will contain zones you want to serve only to "internal" clients
   that connect via your directly attached LAN interfaces - "localnets" .
 */
#       match-clients           { localnets; };
#       match-destinations      { localnets; };
#       recursion yes;
        // all views must contain the root hints zone:
#       include "/etc/named.root.hints";

        // include "named.rfc1912.zones";
        // you should not serve your rfc1912 names to non-localhost clients.
        // These are your "authoritative" internal zones, and would probably
        // also be included in the "localhost_resolver" view above :

#       zone "my.internal.zone" {
#               type master;
#               file "my.internal.zone.db";
#       };
#       zone "my.slave.internal.zone" {
#               type slave;
#               file "slaves/my.slave.internal.zone.db";
#               masters { /* put master nameserver IPs here */ 127.0.0.1; } ;
#               // put slave zones in the slaves/ directory so named can update them
#       };
#       zone "my.ddns.internal.zone" {
#               type master;
#               allow-update { key ddns_key; };
#               file "slaves/my.ddns.internal.zone.db";
#               // put dynamically updateable zones in the slaves/ directory so named can update them
#       };
#};
#key ddns_key
#{
#       algorithm hmac-md5;
#       secret "use /usr/sbin/dns-keygen to generate TSIG keys";
#};
#view    "external"
#{
#/* This view will contain zones you want to serve only to "external" clients
# * that have addresses that are not on your directly attached LAN interface subnets:
# */
#       match-clients           { any; };
#       match-destinations      { any; };
#
#       recursion no;
#       // you'd probably want to deny recursion to external clients, so you don't
#        // end up providing free DNS service to all takers
#
#       allow-query-cache { none; };
#       // Disable lookups for any cached data and root hints
#
#       // all views must contain the root hints zone:
#       include "/etc/named.root.hints";
#
#       // These are your "authoritative" external zones, and would probably
#        // contain entries for just your web and mail servers:
#
#       zone "my.external.zone" {
#               type master;
#               file "my.external.zone.db";
#       };
#};
 
-----------------------------------------------------------------------------------------------------------------

Change the current Linux DNS point back to yourself at
system-config-network


Reverse Zone

at named.conf, add this zone into it

---------------------------------------------------------------------------------------------------------------
        zone "0.0.169.in-addr.arpa." {
                type master;
                file "db.0.0.169";
        };
---------------------------------------------------------------------------------------------------------------
then at /var/named/chroot/var/named
create a db.0.0.169
open and edit it like this

-------------------------------------------------------------------------------------------------------------- 
$TTL 3h

@       IN      SOA     gab.lan.  root (
                        2011022101;
                        30m; refresh
                        15m; retry interval
                        1W; expire
                        1D); negative cache TTL


@               IN      NS      ns.gab.lan.
1                 IN      PTR    forum.gab.lan.
2                 IN      PTR    wiki.gab.lan.
 
--------------------------------------------------------------------------------------------------------------
save it and reload the services
/etc/init.d/named reload

then try to use dig to see success or not
dig -x 169.0.0.1
and you should get something like this
--------------------------------------------------------------------------------------------------------------; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_5.3 <<>> -x 169.0.0.1
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16382
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;1.0.0.169.in-addr.arpa.    IN      PTR

;; ANSWER SECTION:
1.0.0.169.in-addr.arpa. 10800 IN    PTR     forum.gab.lan.0.0.169.in-addr.arpa.

;; AUTHORITY SECTION:
0.0.169.in-addr.arpa. 10800   IN      NS      gab.lan.0.0.169.in-addr.arpa.

;; Query time: 0 msec
;; SERVER: 172.30.10.98#53(172.30.10.98)
;; WHEN: Tue Feb 22 12:37:06 2011
;; MSG SIZE  rcvd: 96
---------------------------------------------------------------------------------------------------------------

Master - Slave

At slave server install and etup bind
open named.conf and add this zone

--------------------------------------------------------------------------------------------------------------
zone "gab.lan" {
     type slave;
     master {192.168.0.0;};
};
--------------------------------------------------------------------------------------------------------------

DNS Round Robin (DNSRR) load balancing

to balance 2 server or more together, just need to add another A entry for that server
example

www     IN     A     192.160.0.1
www     IN     A     192.168.0.2