LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
Search this Thread
Old 05-09-2011, 06:11 PM   #1
iPatch
LQ Newbie
 
Registered: Oct 2009
Posts: 18

Rep: Reputation: 9
Setting, configuring, authoritative or stealth DNS Domain Name Server Red Hat


Recently, the admin of the current server that has been hosting my blog gave me the option to upgrade my current server configuration, but I needed to spend some cash, and get my own domain name (done). I decided to go the godaddy.com route to purchase a domain name.

Well, with purchasing my domain, and getting a my virtual Linux server comes setting up DNS. I have no prior experience setting up DNS using BIND so (insert thread). The admin of the virtual server, which also admins the equipment on which the virtual server resides recommended setting up BIND on the virtual server to use his DNS servers, and keep the version of BIND running on my virtual server protected by having BIND run in "stealth mode".

In the order of simplicity I am going to establish the following values in the spirit of KISS

Distribution: Red Hat (Scientific Linux 6.0 Carbon)
Domain name: mysite.com
Static WAN IP: 1.2.3.4
Static WAN IP (netmask): 255.255.255.255 or /32

Question 1
How would I configure the named.conf file to be setup in "stealth mode" so that I am using the local copy of BIND on the virtual server to point to a master DNS server?

Question 1.1
What would a sample named.conf look like for using BIND in stealth?

Question 1.2
What would a sample mysite.zone file look like for stealth setup?

Questions 2

What would a sample named.conf file look like for authoritative server look like?

Question 2.1

What would a sample mysite.zone file look like for an authoritative server look like?


Here are snippets for my current named.conf and mysite.zone

named.conf

Code:
##########################################################################
# File: /etc/named.conf
##########################################################################
# BIND configuration file
#########################################################################
# maintained by: me
##########################################################################
# Examples: /usr/share/doc/bind*/sample/ for example configuration files
##########################################################################
# CHANGELOG:
# 1. change1
#########################################################################

// Only one "options" statement is allowed in this configuration file.

options
{
   directory "/var/named";    // default directory

   // SECURITY - version statement - inhibited
   // avoids hacking any known weaknesses
   version "not currently available";

   // Additions added from Red Hat config - named.conf
   //   listen-on-v6 port { ::1; };
   listen-on port 53 { 127.0.0.1; };
   listen-on port 53 { any; };

   // specify dump file
   dump-file   "/var/named/data/cache_dump.db";
   statistics-file "/var/named/data/named_stats.txt";
   memstatistics-file "/var/named/data/named_mem_stats.txt";

   // Addtions added from Red Hat config - named.conf
   allow-query { localhost; };
   recursion yes;

   dnssec-enable yes;
   dnssec-validation yes;
   dnssec-lookaside auto;

   // Path to ISC DLV key
   bindkeys-file "/etc/named.iscdlv.key";
};


// Logging for DNS and BIND

logging
{
   channel default_debug {
            file "data/named.run";
            severity dynamic;
            };
};

// INTERNAL - provide recursive queries and caching for goodguys

view "goodguys" {
   match-clients { 127.0.0.1; }; // local network
      recursion yes;

      // ZONE - allows the name server 
      // ZONE - to talk to the 13 authoritative name servers

      zone "." IN {
         type hint;
         file "named.ca";
      };

      include "/etc/named.rfc1912.zones";

// ZONE - mysite.com

      zone "mysite.com" {
         type master;
         // private zone file including local hosts
         file "zones/internal/master.mysite.com.internal";
      };

      // ZONE - required local host domain - commented out to get working - already exists

      //zone "localhost" in {
        // type master;
        // file "zones/internal/master.localhost";
        // allow-update { none; };
     // };

      // ZONE - required reverse map

      zone "0.0.127.in-addr.arpa" in {
       type master;
       file "zones/internal/localhost.rev";
       allow-update { none; };
      };

  }; // INTERNAL - endview

// EXTERNAL - provides view for badguys

view "external" { // What the Internet will see

   // This view will contain zones you want to serve only to "external"
   // clients that have addresses that are not on your directly attached
   //  LAN interface subnets:


    match-clients       { any; };
    match-destinations  { any; };

    // you'd prbably want to deny recursion to external clients, so you don't
    // end up providing free DNS service to all takers
    recursion no;

    // These are your "authoritative" external zones, and would probably
    // contain entries for just your web and mail servers:

    // the class "in" stands for Internet

   zone "3.2.1.in-addr.arpa" {
      type master;
      file "zones/external/84.114.207.in-addr.arpa.zone";   
   };

   zone "mysite.com" {
      type master;
      file "zones/external/mysite.com.zone";
      allow-update { none; };
   };
   // EXTERNAL - endview
};
mysite.zone
Code:
; File: /var/named/zones/external/mysite.com.zone
;
; Zone file for mysite.com
;
; The full Forward zone file
;
;
$TTL 86400 
@     IN    SOA      ns1.mysite.com.    admin.mysite.com. (
                     200110507 ;  serial#
                     3600  ;  refresh, seconds
                     3600  ; retry, seconds
                     3600  ; expire, seconds
                     3600  ; minimum, seconds
)
      IN    NS       ns1.mysite.com
      IN    NS       ns2.mysite.com

www   IN    A        1.2.3.4
Any and all suggestions and examples are greatly appreciated.

cheers
-C
 
Old 05-10-2011, 12:41 AM   #2
bathory
Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 10,937

Rep: Reputation: 1330Reputation: 1330Reputation: 1330Reputation: 1330Reputation: 1330Reputation: 1330Reputation: 1330Reputation: 1330Reputation: 1330Reputation: 1330
Hi,

Have a look at the various examples here

Regards
 
1 members found this post helpful.
Old 05-10-2011, 09:27 AM   #3
iPatch
LQ Newbie
 
Registered: Oct 2009
Posts: 18

Original Poster
Rep: Reputation: 9
Thanks, I'll give that run through in a minute.
 
Old 05-12-2011, 01:49 PM   #4
iPatch
LQ Newbie
 
Registered: Oct 2009
Posts: 18

Original Poster
Rep: Reputation: 9
So a little more googlefu presented this -> http://www.unixwiz.net/techtips/bind9-chroot.html

I now have BIND 9 running in a chroot jail.
 
1 members found this post helpful.
Old 05-12-2011, 03:16 PM   #5
TB0ne
Guru
 
Registered: Jul 2003
Location: Birmingham, Alabama
Distribution: SuSE, RedHat, Slack,CentOS
Posts: 14,762

Rep: Reputation: 2613Reputation: 2613Reputation: 2613Reputation: 2613Reputation: 2613Reputation: 2613Reputation: 2613Reputation: 2613Reputation: 2613Reputation: 2613Reputation: 2613
Quote:
Originally Posted by iPatch View Post
So a little more googlefu presented this -> http://www.unixwiz.net/techtips/bind9-chroot.html

I now have BIND 9 running in a chroot jail.
Outstanding. Thank you for posting your solution, and how you found it. So many folks never do.
 
  


Reply

Tags
bind, bind9, dns


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Why Can't I get an authoritative answer from a DNS server. windbadboy Linux - Newbie 3 04-23-2011 09:27 AM
Why Can't I get an authoritative answer from a DNS server. windbadboy General 1 04-23-2011 08:45 AM
First domain registered, need help with setting up DNS server pokey Linux - Networking 4 03-13-2009 10:16 PM
Authoritative DNS for a sub domain sbabcock23 Linux - Networking 5 06-03-2007 07:18 PM
What makes a DNS server authoritative. Strider22 Linux - Networking 1 11-17-2005 01:06 PM


All times are GMT -5. The time now is 12:10 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration