Professional Documents
Culture Documents
BIND9ServerHowto
Content Cleanup Required
This article should be cleaned-up to follow the content standards in the Wiki Guide. More info...
Background Contents
Note: There are some issues with this Howto, too numerable to fix quickly, and it 1. Background
requires bringing up to standard. I'm mentioning this to help anyone to avoid the 2. Introduction
unnecessary time trying to resolve their DNS, owing the the inconsistencies in this 3. Installation
document, particularly if you're new to DNS configuration. One example is here... 4. BIND9 Configuration Scenarios
1. Caching Server
box IN A 192.168.1.10 2. Primary Master Server
... in all other places, the document uses the machine name example ns. Here it 3. Secondary Master Server
4. Hybrids
changes to box (I believe the author was simply trying to show that additional
5. Stealth Servers
computers would be listed, but failed to use a different address for box. I modified the
example file to give box an address of 192.168.1.21). 5. DNS Record Types
1. Address Records
Introduction 2. Alias Records
3. Mail Exchange Records
Domain Name Service (DNS) is an Internet service that maps IP addresses and fully 4. Name Server Records
qualified domain names (FQDN) to one another. In this way, DNS alleviates the need
6. Configuring BIND9
to remember IP addresses. Computers that run DNS are called name servers. Ubuntu
1. Caching Server configuration
ships with BIND (Berkley Internet Naming Daemon), the most widely deployed DNS
1. Testing
server.
2. Primary Master Server configuration
This guide is aimed at people looking to learn how to configure and maintain a DNS
1. Zone File
server, such as for a network (caching name server) or to serve DNS zones for a
2. Reverse Zone File
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
2. Reverse Zone File
domain name. 3. Testing
Caching Server
In this configuration BIND9 will find the answer to name queries and remember the answer for the next query. This can be useful for a slow internet
connection. By caching DNS queries, you will reduce bandwidth and (more importantly) latency.
Hybrids
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
You can even configure BIND9 to be a Caching and Primary Master DNS server simultaneously, a Caching and a Secondary Master server or even
a Caching, Primary Master and Secondary Master server. All that is required is simply combining the different configuration examples.
Stealth Servers
There are also two other common DNS server setups (used when working with zones for registered domain names), Stealth Primary and Stealth
Secondary. These are effectively the same as Primary and Secondary DNS servers, but with a slight organizational difference.
If you configure your registered domain to use A and B as your domain's DNS servers, then C is a Stealth Secondary. It's still a secondary, but it's
not going to be asked about the zone you are serving to the internet from A and B
If you configure your registered domain to use B and C as your domain's DNS servers, then A is a stealth primary. Any additional records or edits
to the zone are done on A, but computers on the internet will only ever ask B and C about the zone.
Address Records
The most commonly used type of record. This record maps an IP Address to a hostname.
www IN A 1.2.3.4
Alias Records
Used to create an alias from an existing A record. You can create a CNAME record pointing to another CNAME record. But it doubles the number
of requests made to the nameserver, thus making it an inefficient way to do so.
IN MX 10 mail.example.com.
[...]
mail IN A 1.2.3.4
This is where Primary and Secondary servers are defined. Stealth servers are intentionally omitted.
IN NS ns.example.com.
[...]
ns IN A 1.2.3.4
Configuring BIND9
BIND9 Configuration files are stored in:
/etc/bind/
/etc/bind/named.conf
/etc/bind/named.conf.options
/etc/bind/named.conf.local
All that is required is simply adding the IP numbers of your ISP's DNS servers.
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
[...]
forwarders {
1.2.3.4;
5.6.7.8;
};
[...]
(where 1.2.3.4 and 5.6.7.8 are the IP numbers of your ISP's DNS servers)
Testing
If you installed the dnsutils package you can test your setup using the dig command:
dig -x 127.0.0.1
[...]
The dig command can also be used to query other domains for example:
dig google.com
If you "dig" a domain name multiple times you should see a drastic improvement in the Query time: between the first and second query. This is
due to the server caching the query.
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
Primary Master Server configuration
In this section BIND9 will be configured as the primary master for the domain example.com. Simply replace example.com with your fully qualified
domain name.
Zone File
To add a DNS zone to BIND9, turning BIND9 into a Primary Master server, all you have to do is edit named.conf.local:
[...]
zone "example.com" {
type master;
file "/etc/bind/db.example.com";
};
[...]
Edit the new zone file /etc/bind/db.example.com change localhost. to the FQDN of your server, leaving the additional "." at the end.
Change 127.0.0.1 to the nameserver's IP Address and root.localhost to a valid email address, but with a "." instead of the "@". also
leaving the "." at the end.
Also, create an A record for ns.example.com the name server in this example:
;
; BIND data file for local loopback interface
;
$TTL 604800
@ IN SOA ns.example.com. root.example.com. (
1 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
;
@ IN NS ns.example.com.
ns IN A 192.168.1.10
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
;also list other computers
box IN A 192.168.1.21
You must increment the serial number every time you make changes to the zone file. If you make multiple changes before restarting BIND9, simply
increment the serial once.
Now, you can add DNS records to the bottom of the zone.
Tip: Many people like to use the last date edited as the serial of a zone, such as 2005010100 which is yyyymmddss (where s is serial)
Once you've made a change to the zone file BIND9 will need to be restarted for the changes to take effect:
zone "1.168.192.in-addr.arpa" {
type master;
notify no;
file "/etc/bind/db.192";
};
Note: replace 1.168.192 with the first three octets of whatever private network you are using. Also, name the zone file db.192 in the example
appropriately.
Next edit /etc/bind/db.192 changing the basically the same options as in /etc/bind/db.example.com:
;
; BIND reverse data file for local loopback interface
;
$TTL 604800
@ IN SOA ns.example.com. root.example.com. (
2 ; Serial
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
;
@ IN NS ns.
10 IN PTR ns.example.com.
The serial number in the reverse zone needs to be incremented on each changes as well. For each A record you configure in
/etc/bind/db.example.com you need to create a PTR record in /etc/bind/db.192.
Testing
You should now be able to ping example.com and have it resolve to the host configured above:
ping example.com
You can also use the named-checkzone utility that is part of the bind9 package:
and
This is a great way to make sure you haven't made any mistakes before restarting bind9.
You can use the dig utility to test the reverse zone as well as the new domain name:
First, on the primary master server, the zone transfer needs to be allowed. Add the allow-transfer option to the sample Forward and Reverse zone
definition in /etc/bind/named.conf.local:
[...]
zone "example.com" {
type master;
file "/etc/bind/db.example.com";
allow-transfer { @ip_secondary; };
};
[...]
zone "1.168.192.in-addr.arpa" {
type master;
notify no;
file "/etc/bind/db.192";
allow-transfer { @ip_secondary; };
};
[...]
Note: replace @ip_secondary with the actual IP Address of your secondary server.
Next, on the Secondary Master, install the bind9 package the same way as the primary. Then edit the /etc/bind/named.conf.local and
add the following declarations for the Forward and Reverse zones:
[...]
zone "example.com" {
type slave;
file "/var/cache/bind/db.example.com";
masters { @ip_master; };
};
[...]
zone "1.168.192.in-addr.arpa" {
type slave;
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
file "/var/cache/bind/db.192";
masters { @ip_master; };
};
[...]
Note: replace @ip_master with the IP Address of the Primary. The zone file must be in /var/cache/bind/ because, by default, AppArmor only
allows write access inside it (this was made specifically for a slave configuration. See AppArmor's configuration in
/etc/apparmor.d/usr.sbin.named).
Restart the server, and in /var/log/syslog you should see something similar to:
Note: A zone is only transfered if the Serial Number on the Primary is larger than the one on the Secondary.
Testing
Testing the Secondary Master can be done using the same methods as the Primary. Also, you could shutdown BIND9 on the Primary then try
pinging example.com from a host configured to use the Secondary as well as the Primary for name resolution. If all goes well the Secondary should
resolve example.com.
Chrooting BIND9
Chrooting BIND9 is a recommended setup from a security perspective if you don't have AppArmor installed. In a chroot enviroment, BIND9 has
access to all the files and hardware devices it needs, but is unable to access anything it should not need. AppArmor is installed by default on
recent Ubuntu releases. Unless you've explicitly disabled AppArmor, you might want to read this before you decide to attempt a chrooted bind. If
you still want to go forward with it, you'll need this information, which isn't covered in the instructions that follow here.
To chroot BIND9, simply create a chroot enviroment for it and add the additional configuration below
or
This is where the files for all slave zones will be kept. This increases security, by stopping the ability of an attacker to edit any of your master zone
files if they do gain access as the bind user. Accordingly, all slave file names in the /chroot/named/etc/named.conf file will need to have directory
names that designate the slave directory. An example zone definition is listed below.
zone "my.zone.com." {
type slave;
file "slaves/my.zone.com.dns";
masters {
10.1.1.10;
};
};
Give the user bind access to the /chroot/named/var/run directory that will be used to strore PID and statistical data.
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
BIND9's Configuration
Edit the bind startup options found in /etc/default/bind9. Change the line the reads:
/etc/default/bind9:
OPTIONS="-u bind"
So that it reads
/etc/default/bind9:
The -t option changes the root directory from which bind operates to be /chroot/named. The -c option tells Bind that the configuration file is located
at /etc/named.conf. Remember that this path is relative to the root set by -t.
The named.conf file must also recieve extra options in order to run correctly below is a minimal set of options:
/chroot/named/etc/named.conf:
options {
directory "/etc/namedb";
pid-file "/var/run/named.pid";
statistics-file "/var/run/named.stats";
};
[...]
[...]
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
Restart the syslog server and BIND9
$ sudo /etc/init.d/sysklogd restart
$ sudo /etc/init.d/bind9 restart
At this point you should check /var/log/messages for any errors that may have been thrown by bind.
Status
To check the status of your BIND9 installation:
$ host localhost
or
$ dig @localhost
(where localhost is the system you are setting BIND9 up on. If not localhost, use the appropriate IP number.)
Logging
BIND9 has a wide variety of logging configuration options available. There are two main options to BIND9 logging the channel option configures
where logs go, and the category option determines what to log.
Next we will configure BIND9 to send debug messages related to DNS queries to a separate file.
Channel Option
First, we need to configure a channel to specify which file to send the messages to. Edit /etc/bind/named.conf.local and add the
following:
logging {
channel query.log {
file "/var/log/query.log";
// Set the severity to dynamic to see all the debug messages.
severity dynamic;
};
};
Category Option
Next, configure a category to send all DNS queries to the query file:
logging {
channel query.log {
file "/var/lib/bind/query.log";
// Set the severity to dynamic to see all the debug messages.
severity debug 3;
};
Note: the debug option can be set from 1 to 3. If a level isn't specified level 1 is the default.
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com
You should see the file /var/log/query.log fill with BIND9 log information. This is a simple example of the BIND9 logging options available see
bind9.net manual for more information.
Additional Possibilities
You can monitor your BIND9 server usage by installing the bindgraph package from the Universe (To enable Universe - see
AddingRepositoriesHowto) and following configuration details as outlined in bindgraph's README documents
Further Information
Online Recources
"ISC's BIND9 Manual"
Printed Resources
"DNS & BIND" - Paul Albitz & Cricket Liu - 5th Edition - "O'Reilly Press" (Amazon.com)
DNS & BIND Cookbook - Cricket Liu - 4th Edition - "O'Reilly Press" (Amazon.com)
CategoryNetworking CategoryInternet
BIND9Serv erHowto (last edited 2016-07-08 14:55:48 by gweatherby )
The material on this wiki is available under a free license, see Copyright / License for details
You can contribute to this wiki, see Wiki Guide for details
open in browser PRO version Are you a developer? Try out the HTML to PDF API pdfcrowd.com