Eric Luce
3827c16dce
These files are based on the BIND v9 ARM in FrameMaker. After these files are edited they will become the master source for the BIND v9 ARM. Still need to include style sheets and the actual XML DocBook DTD for those who do not have it.
429 lines
20 KiB
XML
429 lines
20 KiB
XML
<chapter>
|
|
<title>Nameserver Configuration</title>
|
|
<para>In this section we provide some suggested configurations along
|
|
with guidelines for their use. We also address the topic of reasonable
|
|
option setting.</para>
|
|
<sect1>
|
|
<title id="sample_configuration">Sample Configurations</title>
|
|
<sect2>
|
|
<title>A Caching-only Nameserver</title>
|
|
<para>The following sample configuration is appropriate for a caching-only
|
|
name server for use by clients internal to a corporation. All queries
|
|
from outside clients are refused.</para>
|
|
<programlisting>
|
|
// Two corporate subnets we wish to allow queries from.
|
|
acl "corpnets" { 192.168.4.0/24; 192.168.7.0/24; };
|
|
options {
|
|
directory "/etc/namedb"; // Working directory
|
|
pid-file "named.pid"; // Put pid file in working dir
|
|
allow-query { "corpnets"; };
|
|
};
|
|
// Root server hints
|
|
zone "." { type hint; file "root.hint"; };
|
|
// Provide a reverse mapping for the loopback address 127.0.0.1
|
|
zone "0.0.127.in-addr.arpa" {
|
|
type master;
|
|
file "localhost.rev";
|
|
notify no;
|
|
};
|
|
</programlisting>
|
|
</sect2>
|
|
<sect2>
|
|
<title>An Authoritative-only Nameserver</title>
|
|
<para>This sample configuration is for an authoritative-only server
|
|
that is the master server for "<filename>example.com</filename>"
|
|
and a slave for the subdomain "<filename>eng.example.com</filename>".</para>
|
|
<programlisting>
|
|
options {
|
|
directory "/etc/namedb"; // Working directory
|
|
pid-file "named.pid"; // Put pid file in working dir
|
|
allow-query { any; }; // This is the default
|
|
recursion no; // Do not provide recursive service
|
|
};
|
|
// Root server hints
|
|
zone "." { type hint; file "root.hint"; };
|
|
|
|
// Provide a reverse mapping for the loopback address 127.0.0.1
|
|
zone "0.0.127.in-addr.arpa" {
|
|
type master;
|
|
file "localhost.rev";
|
|
notify no;
|
|
};
|
|
// We are the master server for example.com
|
|
zone "example.com" {
|
|
type master;
|
|
file "example.com.db";
|
|
// IP addresses of slave servers allowed to transfer example.com
|
|
allow-transfer {
|
|
192.168.4.14;
|
|
192.168.5.53;
|
|
};
|
|
};
|
|
// We are a slave server for eng.example.com
|
|
zone "eng.example.com" {
|
|
type slave;
|
|
file "eng.example.com.bk";
|
|
// IP address of eng.example.com master server
|
|
masters { 192.168.4.12; };
|
|
};
|
|
</programlisting>
|
|
</sect2>
|
|
</sect1>
|
|
<sect1>
|
|
<title>Load Balancing</title>
|
|
<para>Primitive load balancing can be achieved in <acronym>DNS</acronym> using multiple
|
|
A records for one name.</para>
|
|
<para>For example, if you have three WWW servers with network addresses
|
|
of 10.0.0.1, 10.0.0.2 and 10.0.0.3, a set of records such as the
|
|
following means that clients will connect to each machine one third
|
|
of the time:</para>
|
|
<informaltable colsep = "0" rowsep = "0">
|
|
<tgroup cols = "5" colsep = "0" rowsep = "0"
|
|
tgroupstyle = "2Level-table">
|
|
<colspec colname = "1" colnum = "1" colsep = "0" colwidth = "0.875in"/>
|
|
<colspec colname = "2" colnum = "2" colsep = "0" colwidth = "0.500in"/>
|
|
<colspec colname = "3" colnum = "3" colsep = "0" colwidth = "0.750in"/>
|
|
<colspec colname = "4" colnum = "4" colsep = "0" colwidth = "0.750in"/>
|
|
<colspec colname = "5" colnum = "5" colsep = "0" colwidth = "2.028in"/>
|
|
<tbody>
|
|
<row rowsep = "0">
|
|
<entry colname = "1"><para>Name</para></entry>
|
|
<entry colname = "2"><para>TTL</para></entry>
|
|
<entry colname = "3"><para>CLASS</para></entry>
|
|
<entry colname = "4"><para>TYPE</para></entry>
|
|
<entry colname = "5"><para>Resource Record (RR) Data</para></entry>
|
|
</row>
|
|
<row rowsep = "0">
|
|
<entry colname = "1"><para><literal>www</literal></para></entry>
|
|
<entry colname = "2"><para><literal>600</literal></para></entry>
|
|
<entry colname = "3"><para><literal>IN</literal></para></entry>
|
|
<entry colname = "4"><para><literal>A</literal></para></entry>
|
|
<entry colname = "5"><para><literal>10.0.0.1</literal></para></entry>
|
|
</row>
|
|
<row rowsep = "0">
|
|
<entry colname = "1"><para></para></entry>
|
|
<entry colname = "2"><para><literal>600</literal></para></entry>
|
|
<entry colname = "3"><para><literal>IN</literal></para></entry>
|
|
<entry colname = "4"><para><literal>A</literal></para></entry>
|
|
<entry colname = "5"><para><literal>10.0.0.2</literal></para></entry>
|
|
</row>
|
|
<row rowsep = "0">
|
|
<entry colname = "1"><para></para></entry>
|
|
<entry colname = "2"><para><literal>600</literal></para></entry>
|
|
<entry colname = "3"><para><literal>IN</literal></para></entry>
|
|
<entry colname = "4"><para><literal>A</literal></para></entry>
|
|
<entry colname = "5"><para><literal>10.0.0.3</literal></para></entry>
|
|
</row>
|
|
</tbody>
|
|
</tgroup>
|
|
</informaltable>
|
|
<para>When a resolver queries for these records, <acronym>BIND</acronym> will rotate
|
|
them and respond to the query with the records in a different
|
|
order. In the example above, clients will randomly receive
|
|
records in the order 1, 2, 3; 2, 3, 1; and 3, 1, 2. Most clients
|
|
will use the first record returned and discard the rest.</para>
|
|
<para>For more detail on ordering responses, check the
|
|
<command>rrset-order</command> substatement in the
|
|
<command>options</command> statement, <xref
|
|
linkend="rrset_ordering"/>. This substatement is not supported in
|
|
<acronym>BIND</acronym> 9, and only the ordering scheme described above is
|
|
available.</para>
|
|
|
|
</sect1>
|
|
<sect1>
|
|
<title id="notify">Notify</title>
|
|
|
|
<para><acronym>DNS</acronym> Notify is a mechanism that allows master nameservers to
|
|
notify their slave servers of changes to a zone's data. In
|
|
response to a <command>NOTIFY</command> from a master server, the
|
|
slave will check to see that its version of the zone is the
|
|
current version and, if not, initiate a transfer.</para> <para><acronym>DNS</acronym>
|
|
Notify is fully documented in RFC 1996. See also the description
|
|
of the zone option <command>also-notify</command>, <xref
|
|
linkend="zone_transfers"/>. For more information about
|
|
<command>notify</command>, <xref
|
|
linkend="boolean_options"/>.</para>
|
|
|
|
</sect1>
|
|
<sect1>
|
|
<title>Nameserver Operations</title>
|
|
<sect2>
|
|
<title>Tools for Use With the Nameserver Daemon</title>
|
|
<para>There are several indispensable diagnostic, administrative
|
|
and monitoring tools available to the system administrator for controlling
|
|
and debugging the nameserver daemon. We describe several in this
|
|
section </para>
|
|
<sect3>
|
|
<title>Diagnostic Tools</title>
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><command>dig</command></term>
|
|
<listitem>
|
|
<para>The domain information groper (<command>dig</command>) is
|
|
a command line tool that can be used to gather information from
|
|
the Domain Name System servers. Dig has two modes: simple interactive
|
|
mode for a single query, and batch mode which executes a query for
|
|
each in a list of several query lines. All query options are accessible
|
|
from the command line.</para>
|
|
<cmdsynopsis label="Usage">
|
|
<command>dig</command>
|
|
<arg>@<replaceable>server</replaceable></arg>
|
|
<arg choice="plain"><replaceable>domain</replaceable></arg>
|
|
<arg><replaceable>query-type</replaceable></arg>
|
|
<arg><replaceable>query-class</replaceable></arg>
|
|
<arg>+<replaceable>query-option</replaceable></arg>
|
|
<arg>-<replaceable>dig-option</replaceable></arg>
|
|
<arg>%<replaceable>comment</replaceable></arg>
|
|
<!-- one of (SBR GROUP ARG COMMAND) -->
|
|
</cmdsynopsis>
|
|
<para>The usual simple use of dig will take the form</para>
|
|
<simpara><command>dig @server domain query-type query-class</command></simpara>
|
|
<para>For more information and a list of available commands and
|
|
options, see the <command>dig</command> man page.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
<varlistentry>
|
|
<term><command>host</command></term>
|
|
<listitem>
|
|
<para>The <command>host</command> utility
|
|
provides a simple <acronym>DNS</acronym> lookup using a command-line interface for
|
|
looking up Internet hostnames. By default, the utility converts
|
|
between host names and Internet addresses, but its functionality
|
|
can be extended with the use of options.</para>
|
|
<cmdsynopsis label="Usage">
|
|
<!-- one of (SBR GROUP ARG COMMAND) -->
|
|
<command>host</command>
|
|
<arg>-aCdlrTwv</arg>
|
|
<arg>-c <replaceable>class</replaceable></arg>
|
|
<arg>-N <replaceable>ndots</replaceable></arg>
|
|
<arg>-t <replaceable>type</replaceable></arg>
|
|
<arg>-W <replaceable>timeout</replaceable></arg>
|
|
<arg>-R <replaceable>retries</replaceable></arg>
|
|
<arg choice="plain"><replaceable>hostname</replaceable></arg>
|
|
<arg><replaceable>server</replaceable></arg>
|
|
</cmdsynopsis>
|
|
<para>For more information and a list of available commands and
|
|
options, see the <command>host</command> man page.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
<varlistentry>
|
|
<term><command>nslookup</command></term>
|
|
<listitem>
|
|
<para><command>nslookup</command> is a program used to query Internet
|
|
domain nameservers. <command>nslookup</command> has two modes: interactive
|
|
and non-interactive. Interactive mode allows the user to query nameservers
|
|
for information about various hosts and domains or to print a list
|
|
of hosts in a domain. Non-interactive mode is used to print just
|
|
the name and requested information for a host or domain.</para>
|
|
<cmdsynopsis label="Usage">
|
|
<command>nslookup</command>
|
|
<arg rep="repeat">-option</arg>
|
|
<group>
|
|
<arg><replaceable>host-to-find</replaceable></arg>
|
|
<arg>- <arg>server</arg></arg>
|
|
</group>
|
|
</cmdsynopsis>
|
|
<para>Interactive mode is entered when no arguments are given (the
|
|
default nameserver will be used) or when the first argument is a
|
|
hyphen (`-') and the second argument is the host name or Internet address
|
|
of a nameserver.</para>
|
|
<para>Non-interactive mode is used when the name or Internet address
|
|
of the host to be looked up is given as the first argument. The
|
|
optional second argument specifies the host name or address of a nameserver.</para>
|
|
<para>Due to its arcane user interface and frequently inconsistent
|
|
behavior, we do not recommend the use of <command>nslookup</command>.
|
|
Use <command>dig</command> instead.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</sect3>
|
|
<sect3>
|
|
<title>Administrative Tools</title>
|
|
<para>Administrative tools play an integral part in the management
|
|
of a server.</para>
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><command id="rndc">rndc</command></term>
|
|
<listitem>
|
|
<para>The remote name daemon control
|
|
(<command>rndc</command>) program allows the system
|
|
administrator to control the operation of a nameserver.
|
|
If you run <command>rndc</command> without any options
|
|
it will display a usage message as follows:</para>
|
|
<cmdsynopsis label="Usage">
|
|
<command>rndc</command>
|
|
<arg>-c <replaceable>config</replaceable></arg>
|
|
<arg>-s <replaceable>server</replaceable></arg>
|
|
<arg>-p <replaceable>port</replaceable></arg>
|
|
<arg>-y <replaceable>key</replaceable></arg>
|
|
<arg choice="plain"><replaceable>command</replaceable></arg>
|
|
<arg rep="repeat"><replaceable>command</replaceable></arg>
|
|
</cmdsynopsis>
|
|
<para><command>command</command> is one of the following
|
|
for <command>named</command>:</para>
|
|
<informaltable colsep = "0" rowsep = "0">
|
|
<tgroup cols = "2"
|
|
colsep = "0" rowsep = "0" tgroupstyle = "4Level-table">
|
|
<colspec colname = "1" colnum = "1"
|
|
colsep = "0" colwidth = "1.500in"/>
|
|
<colspec colname = "2" colnum = "2" colsep = "0"
|
|
colwidth = "3.000in"/>
|
|
<tbody>
|
|
<row rowsep = "0">
|
|
<entry colname = "1">
|
|
<para><userinput>status</userinput><footnote id="nyi1">
|
|
<para>not yet implemented</para>
|
|
</footnote></para></entry>
|
|
<entry colname = "2"><para>Display ps(1) status of named.</para></entry>
|
|
</row>
|
|
<row rowsep = "0">
|
|
<entry colname = "1"><para><userinput>dumpdb</userinput><footnoteref linkend="nyi1"/></para></entry>
|
|
<entry colname = "2"><para>Dump database and cache to /var/tmp/named_dump.db.</para></entry>
|
|
</row>
|
|
<row rowsep = "0">
|
|
<entry colname = "1"><para><userinput>reload</userinput></para></entry>
|
|
<entry colname = "2"><para>Reload configuration file and zones.</para></entry>
|
|
</row>
|
|
<row rowsep = "0">
|
|
<entry colname = "1"><para><userinput>stats</userinput><footnoteref linkend="nyi1"/></para></entry>
|
|
<entry colname = "2"><para>Dump statistics to /var/tmp/named.stats.</para></entry>
|
|
</row>
|
|
<row rowsep = "0">
|
|
<entry colname = "1"><para><userinput>trace</userinput><footnoteref linkend="nyi1"/></para></entry>
|
|
<entry colname = "2"><para>Increment debugging level by one.</para></entry>
|
|
</row>
|
|
<row rowsep = "0">
|
|
<entry colname = "1">
|
|
<para><userinput>notrace</userinput><footnoteref linkend="nyi1"/>
|
|
</para></entry>
|
|
<entry colname = "2"><para>Set debugging level to 0.</para></entry>
|
|
</row>
|
|
<row rowsep = "0">
|
|
<entry colname =
|
|
"1"><para><userinput>querylog</userinput><footnoteref linkend="nyi1"/></para></entry>
|
|
<entry colname = "2"><para>Toggle query logging.</para></entry>
|
|
</row>
|
|
<row rowsep = "0">
|
|
<entry colname =
|
|
"1"><para><userinput>stop</userinput><footnoteref linkend="nyi1"/></para></entry>
|
|
<entry colname = "2"><para>Stop the server.</para></entry>
|
|
</row>
|
|
<row rowsep = "0">
|
|
<entry colname =
|
|
"1"><para><userinput>restart</userinput><footnoteref linkend="nyi1"/></para></entry>
|
|
<entry colname = "2"><para>Restart the server.</para></entry>
|
|
</row>
|
|
</tbody>
|
|
</tgroup>
|
|
</informaltable>
|
|
<para>As noted above, <command>reload</command> is the
|
|
only command available for <acronym>BIND</acronym> 9.0.0. The other
|
|
commands, and more, are planned to be implemented for
|
|
future releases.</para>
|
|
|
|
<para>A configuration file is required, since all
|
|
communication with the server is authenticated with
|
|
digital signatures that rely on a shared secret, and
|
|
there is no way to provide that secret other than with a
|
|
configuration file. The default location for the
|
|
<command>rndc</command> configuration file is
|
|
<filename>/etc/rndc.conf</filename>, but an alternate
|
|
location can be specified with the <option>-c</option>
|
|
option.</para>
|
|
|
|
<para>The format of the configuration file is similar to
|
|
that of <filename>named.conf</filename>, but limited to
|
|
only three statements, the <command>options{}</command>,
|
|
<command>key{}</command> and <command>server{}</command>
|
|
statements. These statements are what associate the
|
|
secret keys to the servers with which they are meant to
|
|
be shared. The order of statements is not
|
|
significant.</para>
|
|
|
|
<para>The <command>options{}</command> statement has two clauses: <command>default-server</command> and <command>default-key</command>. <command>default-server</command> takes a
|
|
host name or address argument and represents the server that will
|
|
be contacted if no <option>-s</option>
|
|
option is provided on the command line. <command>default-key</command> takes
|
|
the name of key as its argument, as defined by a <command>key{}</command> statement.
|
|
In the future a <command>default-port</command> clause will be
|
|
added to specify the port to which <command>rndc</command> should
|
|
connect.</para>
|
|
<para>The <command>key{}</command> statement names a key with its
|
|
string argument. The string is required by the server to be a valid
|
|
domain name, though it need not actually be hierarchical; thus,
|
|
a string like "<userinput>rndc_key</userinput>" is a valid name.
|
|
The <command>key{}</command> statement has two clauses: <command>algorithm</command> and <command>secret</command>.
|
|
While the configuration parser will accept any string as the argument
|
|
to algorithm, currently only the string "<userinput>hmac-md5</userinput>"
|
|
has any meaning. The secret is a base-64 encoded string, typically
|
|
generated with either <command>dnssec-keygen</command> or <command>mmencode</command>.</para>
|
|
<para>The <command>server{}</command> statement uses the key clause
|
|
to associate a <command>key{}</command>-defined key with a server.
|
|
The argument to the <command>server{}</command> statement is a
|
|
host name or address (addresses must be double quoted). The argument
|
|
to the key clause is the name of the key as defined by the <command>key{}</command> statement.
|
|
A <command>port</command> clause will be added to a future release
|
|
to specify the port to which <command>rndc</command> should connect
|
|
on the given server.</para>
|
|
<para>A sample minimal configuration file is as follows:</para>
|
|
<programlisting>
|
|
key rndc_key {
|
|
algorithm "hmac-md5";
|
|
secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
|
|
};
|
|
options {
|
|
default-server localhost;
|
|
default-key rndc_key;
|
|
};
|
|
</programlisting>
|
|
<para>This file, if installed as <filename>/etc/rndc.conf</filename>,
|
|
would allow the command:</para>
|
|
<para><prompt>$ </prompt><userinput>rndc reload</userinput></para>
|
|
<para>to connect to 127.0.0.1 port 953 and cause the nameserver
|
|
to reload, if a nameserver on the local machine were running with
|
|
following controls statements:</para>
|
|
<programlisting>
|
|
controls {
|
|
inet 127.0.0.1 allow { localhost; } keys { rndc_key; };
|
|
};
|
|
</programlisting>
|
|
<para>and it had an identical key statement for
|
|
<literal>rndc_key</literal>.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
|
|
</sect3>
|
|
</sect2>
|
|
<sect2>
|
|
<title>Signals</title>
|
|
<para>Certain UNIX signals cause the name server to take specific
|
|
actions, as described in the following table. These signals can
|
|
be sent using the <command>kill</command> command.</para>
|
|
<informaltable colsep = "0" rowsep = "0"><tgroup cols = "2"
|
|
colsep = "0" rowsep = "0" tgroupstyle = "3Level-table">
|
|
<colspec colname = "1" colnum = "1" colsep = "0" colwidth = "1.125in"/>
|
|
<colspec colname = "2" colnum = "2" colsep = "0" colwidth = "4.000in"/>
|
|
<tbody>
|
|
<row rowsep = "0">
|
|
<entry colname = "1"><para><command>SIGHUP</command></para></entry>
|
|
<entry colname = "2"><para>Causes the server to read <filename>named.conf</filename> and
|
|
reload the database. </para></entry>
|
|
</row>
|
|
<row rowsep = "0">
|
|
<entry colname = "1"><para><command>SIGTERM</command></para></entry>
|
|
<entry colname = "2"><para>Causes the server to clean up and exit.</para></entry>
|
|
</row>
|
|
<row rowsep = "0">
|
|
<entry colname = "1">
|
|
<para><command>SIGINT</command></para>
|
|
</entry>
|
|
<entry colname = "2"><para>Causes the server to clean up and exit.</para></entry>
|
|
</row>
|
|
</tbody>
|
|
</tgroup>
|
|
</informaltable>
|
|
</sect2>
|
|
</sect1>
|
|
</chapter>
|