Practice
Task: install and perform the initial configuration of the bind DNS server (also known as named) on the Linux CentOS operating system (an OS from the RedHat family).
We will use chroot mode for bind to improve its security.
Installing
It will pull in its parent package as well — bind.
Configuring
After installing the package, we suddenly become very interested in the folder:
/var/named/chroot/etc
This is exactly where named stores its configs in our chroot mode. So, for convenience of navigating there, let's create a symlink in /etc:
That's it — now, once logged in to the server, we can browse named's settings via the convenient path
/etc/named
Now let's create the directory where the zone descriptions will live:
Now we need to create the file /var/named/chroot/named.conf, which on RHEL systems isn't created automatically even with a minimal config. Well, let's do it by hand. Here's an example of such a config with explanations of what's what and why:
Now let's create the file /var/named/chroot/etc/zones.conf
Yes, that's right, exactly that one. Under chroot it will be at the path /etc/zones.conf, so everything is fine.
This file will hold the declarations of our zones.
To test our server, let's fill in the contents of the file like this:
Now let's head over to the directory
/var/named/chroot/etc/master/
where our DNS zone configurations will be located, and create the file "test.int"
with the following contents:
Save the file and close it.
Starting and checking
Let's start our daemon and check whether it's working.
and check:
If in the response we get something like this:
Then our server is working.
The DNS server's further life
All the other zones are created in the same way, this time with real details (for example, from the .ru, .com, etc. zones). The named.conf.zones file looks roughly like this:
And for each zone we create a file with its configuration in /var/named/chroot/etc/master similar to the test.int sample configuration.
PS. Tip. Do NOT forget to put a ";" in the named config everywhere it's needed! Missing even one such semicolon will break the startup of the entire bind.
PPS. Do NOT forget to put the trailing dot "." at the end of zones that are absolute (recommended pretty much everywhere). That is, for example, if instead of "test.int." you write "test.int" in the zone config — you will get something completely different from what you expected! And accordingly, it simply won't work.
PPPS. Whenever you change a zone (any change) — don't forget to increment its serial number. And not just change it — specifically increment it. In this case a notation of the form YYYYMMDDNN, where YYYY is the 4-digit year, MM is the 2-digit month, DD is the 2-digit day, and NN is "how many times have I changed the zone today" — is quite convenient, since its numeric value will only ever increase over time.
Slave servers
In case you need to immediately set up a slave (secondary) DNS server as well — see the corresponding article.
Comments