Module 5 BIND Configuration. named.conf – controls operational features Located - Linux: /etc/named.conf /etc/bind/named.conf Located- BSD: /usr/local/etc/named.conf.

Module 5

BIND Configuration

BIND Configuration named.conf – controls operational

features Located - Linux:

/etc/named.conf /etc/bind/named.conf

Located- BSD: /usr/local/etc/named.conf

Located – Windows: $systemroot%\system32\dns\etc\named.conf

BIND named.conf Contains 3 types of info: Comments Clauses – collections of statements Statements – individual statements

within clauses Include – in-situ inclusion from

separate files (used for admin/security)

BIND – named.conf

/* C-style comment format needs opening and closing markers** but allows multiple lines or *//* single lines or */zone /* in-line comment does not terminate line */ in {some zone statements};// C++-style comments have single line format, no closing required...some statement; // comment ends this line# SHELL/PERL-style comments have single lines, no closing required some statement; # comment ends this line

BIND – named.conf Clauses ACL – Access Control Lists Controls – remote acces (rndc) Logging – controls logging features Options – global options View – allows separate configurations in

same server Zone – defines the zones that are

supported Key – used for security data (typically

included)

BIND - Statements Over 120 statements available Many valid in one or more clauses Some valid in only single clauses Pro DNS and BIND classifies them:

Transfer Query Operations Security

BIND – Typical named.conf// change log// 1. changed by M.E. on 24th Januaryacl "name" {... // acl clauses if present generally come first // to avoid forward references};key "name" {... // key clauses if present must appear // before being referenced};logging { // requires at least a file // statement unless using syslog // order not important with BIND 9};options { // other statements (as required)};// zones statements including 'required' zoneszone {....};

BIND – View named.confoptions { // global options // other statements as required};view "first" { // view specific statements (options) // view specific zone clauses // including required zones zone { }; ..... zone { };}; // end of view "first" view "second" { // view specific statements (options) // view specific zone clauses // including required zones zone { }; zone { };}; // end of view "second"

BIND – View Clause Each view clause is matched to incoming

queries using: Match-clients Match-destinations Match-recursion-only

View clause order is important Tested in order in which views are defined Unmatched fall through to next view clause

BIND – View Clause Use Mixed Local/public IPs

External – public hosts Internal – local hosts

Mixed services Internal caching External Authoritative

Split horizons different IPs to different sources

BIND – match-clients

match-clients { address_match_element; ... };match-clients { 10.2.3.0/8;172.16.30.0/16;!192.168.0.0/16; };

BIND – match-destinations

match-destinations { address_match_element; ... };match-destinations { 192.168.0.3; };

BIND – match-recursive-only

match-recursive-only (yes | no);match-recursive-only yes;

BIND – Match combined// named.conf fragmentview "recursive-external" { match-clients {!10.2.3.4/24;}; match-recursive-only yes; // other view statements zone "example.com" in { .... };};

BIND Logging defaults logs to syslog or MS Events logging clause is very powerful

(complex!) Single or multiple files (channels) type of output (category) severity of message

BIND Logging Clauselogging { [ channel channel_name { ( file path name [ versions ( number | unlimited ) ] [ size size_spec ] | syslog syslog_facility | stderr | null ); [ severity (critical | error | warning | notice | info | debug [ level ] | dynamic ); ] [ print-category yes | no; ] [ print-severity yes | no; ] [ print-time yes | no; ] }; ] [ category category_name { channel_name ; [ channel_name ; ... ] }; ] ...};

BIND Logging Example

// log to /var/log/named/example.log all events from info UP in severity (no debug)// uses 3 files in rotation swaps files when size reaches 250K// failure messages up to this point are in (syslog) /var/log/messages// logging{ channel example_log{ file "/var/log/named/example.log" versions 3 size 250k; severity info; }; category default{ example_log; };};

BIND – zone Clause Defines the zones to be supported Authoritative zones Root-server zone (hints) Special zones

Loopback address (forward/reverse) Local IPs (RFC 1918 - reverse map) IPv4/Ipv6 as required

BIND – Required zones Caching DNS

Root-servers (hints) Loopback (forward/reverse) Local IPs (IPv4/IPv6)

Authoritative DNS Zones supported Loopback (forward/reverse)

BIND – caching zones // required zone for recursive queries zone "." { type hint; file "root.servers"; };// required local host domain zone "localhost" in{ type master; file "master.localhost"; allow-update{none;}; }; // localhost reverse map zone "0.0.127.IN-ADDR.ARPA" in{ type master; file "localhost.rev";}; // reverse map for local address at example.com // uses 192.168.254.0 for illustration zone "254.168.192.IN-ADDR.ARPA" in{ type master; file "view/192.168.254.rev.internal"; };

BIND – Authoritative zones // required zone for authoritative queries zone "example.com" { type master; // private zone files including local hosts file "master.example.com"; allow-update{none;}; }; // required local host domain zone "localhost" in{ type master; file "master.localhost"; allow-update{none;}; }; // localhost reverse map zone "0.0.127.IN-ADDR.ARPA" in{ type master; file "localhost.rev"; allow-update{none;}; };

BIND – Close Resolver Open Caching DNS (Resolver)

can be used in DDoS Defaults to recursion yes;

Closed Caching DNS (Resolver) Limit IPs allowed to access use allow-recursion {x.x.x.x;}; From BIND 9.4 if no limits defaults to allow-query-cache {localnets;localhost;};

Implicit is not good

BIND - OPEN Resolvers

BIND Closed Resolver# Authoritative only# inhibit all recursionrecursion no;

# Any Resolver (caching) functionrecursion yes; // default!# use an appropriate local address scope statement# to limit recursion requests to local usersallow-recursion {192.168.2.0/24;}; // change IPs as required

# OR if the DNS server's IPs and netmasks cover the whole # local network you can use:allow-recursion {"localnets";};

# OR if a personal system # hard limits on readinglisten-on {127.0.0.1;}; // or listen-on {localhost;};listen-on-v6 {::1;}; // OR listen-on-v6 {localhost;};

# OR allow-recursion {"localhost";};

Quick Quiz BIND’s configuration file name? One path to this file on Linux? Name two types of clauses? What is the view clause used for? One BIND statement used to control view

clauses? Is the hints file necessary for an

Authoritative only DNS? Why do you need a reverse map for RFC

1918 Ips?

Configure BIND9 on PC Check IP address (command prompt-> ipconfig) From directory module-5-config copy

named.conf.win-cache root.servers master.localhost localhost.rev

to c:\windows\sysWOW64\dns\etc rename named.conf.win-cache to named.conf Stop MS DNS client - Start ISC BIND service http://zytrax.com/books/dns/ch5/win2k.html

Configure BIND9 on *nix Check IP address (command prompt-> ifconfig) From directory module-5-config copy

named.conf.unix-cache root.servers master.localhost localhost.rev 192.168.192.rev

to /etc or /usr/local/etc as appropriate edit named.conf.unix-cache as required rename named.conf.unix-cache to named.conf Start BIND9 (service named start) http://zytrax.com/books/dns/ch5

Exercise – BIND Configuration

Save zone file master.example.com as master.example.net

Change all necessary names Add Second MX server (lower priority)

server using mail1.example.net Address record for mail1.example.net (IP

192.168.2.0) Add zone example.net to named.conf