BIND Configuration Files

/etc/named.conf

The /etc/named.conf file is a collection of statements using nested options placed in ellipses { }. A sample /etc/named.conf file is organized similar to Figure 14-2.

<statement-1> ["<statement-1-name>"] [<statement-1-class>] {
   <option-1>;
   <option-2>;
   <option-N>;
};

<statement-2> ["<statement-2-name>"] [<statement-2-class>] {
   <option-1>;
   <option-2>;
   <option-N>;
};

<statement-N> ["<statement-N-name>"] [<statement-N-class>] {
   <option-1>;
   <option-2>;
   <option-N>;
};

The "<statement-name>" is only needed with acl, include, server, view, and zone statements. The <statement-N-class> may only be specified with the zone statement.

Comments may be placed in /etc/named in nested C-style characters /* */ or after // and # characters.

The following statements may be used in /etc/named.conf:

• acl <acl-name> — Configures an access control list of IP addresses to be allowed or disallowed certain named services. Most of the time, individual IP addresses or IP network notation (such as 10.0.1.0/24) is used identify the exact IPs.

  A few access control lists are already defined, so you do not have to configure an acl statement to define them:

  • any — Matches every IP address.

  • localhost — Matches any IP address in use by the local system.

  • localnets — Matches any IP address on any network that the local system connects to with its interfaces.

  • none — Matches no IP addresses.

  When utilized with other /etc/named.conf statements and their options, acl statements can be very useful in ensuring the proper use of your BIND nameserver. Consider the example in Figure 14-3.

  acl black-hats { 10.0.2.0/24; 192.168.0.0/24; }; acl red-hats { 10.0.1.0/24; }; options { blackhole { black-hats; }; allow-query { red-hats; }; allow-recursion { red-hats; }; }

  Figure 14-3. Example of acl statements in use

  This named.conf contains two access control lists (black-hats and red-hats.

• controls — Configures various security requirements necessary to use the rndc command to administer the named service.

  See the section called /etc/named.conf to see how the controls statement should look, including various options that may only be used with it.

• include "<file-name>" — Includes the specified file within the current configuration file, allowing sensitive configuration data (such as keys) to be placed in a separate file with permissions that prevent non-privileged users from reading it.

• key "<key-name>" — Defines a particular key by name. Keys are used to authenticate various actions, such as secure updates or the use of the rndc command. Two options are used with key:

  • algorithm <algorithm-name> — The type of algorithm used, such as dsa or hmac-md5.

  • secret "<key-value>" — The encrypted key.

  See Figure 14-22 for an example of a key statement.

• logging — Allows for the use of multiple types of logs, called channels. By using the channel option within the logging statement, a customized type of log, with its own file name (file), size limit (size), versioning (version), and level of importance (severity), can be constructed. Once a customized channel has been defined, a category option is used the categorize the channel and begin logging when named is restarted.

  By default, named logs standard messages to the syslog daemon, which places them in /var/log/messages as its default. This occurs due to the fact that several standard channels are built into BIND with various severity levels, such as one that handles informational logging messages (default_syslog) and another that specifically handles debugging messages (default_debug). A default category, called default, uses the built-in channels to do normal logging without any special configuration.

  Customizing the logging process can be a very detailed process and is beyond the scope of this chapter. For information on creating custom BIND logs, see the BIND 9 Administrator Reference Manual.

• options — Assigns values to many assorted options, including the use of forwarders, the location of the named working directory, the names of the various files, and much more.

  The following options are among the most commonly used:

  • allow-query — Specifies which hosts are allowed to query this nameserver. By default, all hosts are allowed to query. An access control list or collection of IP addresses or networks may be used here to only allow particular hosts to query the nameserver.

  • allow-recursion — Similar to allow-query, except it applies to recursive queries. By default, all hosts are allowed to perform recursive queries on the nameserver.

  • directory — Changes the named working directory to something other than the default /var/named.

  • forward — Controls how forwarding occurs, if the forwarders option contains valid IP addresses designating where to sent requests.

    If the first option is used, then the nameservers specified in the forwarders option are queried first for the information, and if they do not have it, named will attempt the resolution itself.

    If the only option is used, named will not attempt the resolution itself if the forwarders are not successful.

  • forwarders — Specifies a list of nameservers where requests should be forwarded for resolution.

  • listen-on — Specifies the network interface that named will use to listen for queries. By default, all interfaces are used.

    This option is useful if you have more than one network interface and would like to limit the systems that can make requests of your nameserver. For example, if you have a machine serving as a gateway and a nameserver, and you would like to block any requests except those that originate from your private network, your listen-on option might look like Figure 14-4.

    options { listen-on { 10.0.1.1; }; };

    Figure 14-4. Example of listen-on option

    In this way, only requests that arrive from the network interface serving the private network (10.0.1.1) will be accepted.

  • notify — Controls whether named notifies the slave servers when a zone is updated. The default is yes, but you can set this to no, to prevent slaves from being notified, or explicit, to only notify servers in an also-notify list.

  • pid-file — Allows you to specify the location of the process ID file created by named when it starts.

  • statistics-file — Allows you to specify the location of where the statistics file is written. By default, named statistics are saved in /var/named/named.stats.

  Dozens of other options are also available, many of which rely upon one another to work properly. See the BIND 9 Administrator Reference Manual for more details.

• server — Defines particular options that affect how named should act toward remote nameservers, especially regarding notifications and zone transfers.

  The transfer-format option controls whether one resource records is send with each message (one-answer) or multiple resource records are sent with each message (many-answers). While many-answers is more efficient, only newer BIND nameservers understand it.

• trusted-keys — Contains assorted public keys used for DNSSEC. See the section called Security for an introduction to BIND security.

• view "<view-name>" — Creates special views that respond with a particular type of information depending upon the host contacting the nameserver. This allows some hosts to receive one answer regarding a particular zone while other hosts receive totally different information. Alternatively, certain zones may only be made available to particular trusted hosts while non-trusted hosts may still make queries for other zones.

  Multiple views may be used, so long as their names are unique. The match-clients option specifies the IP addresses that apply to a particular view. Any option statements may also be used within a view, overriding the global options already configured for named. Most view statements contain multiple zone statements that apply to the match-clients list. The order in which view statements are listed is important, as the first view statement that matches a particular client's IP address is used.

  See the section called Multiple Views for more information about the view statement.

• zone "<zone-name>" — Specifies particular zones for which this nameserver is authoritative. The zone statement is primarily used to specify the file containing the zone's configuration and pass certain options about that zone to named that override other global option statements used in /etc/named.conf.

  The name of the zone is important, as it is the default value assigned to the $ORIGIN directive used in the zone file and is appended to non-FQDNs. So, for example, if this zone statement defines the namespace for domain.com, you should use domain.com as the <zone-name> so it will be placed at the end of hostnames used in the zone file.

  The most common zone statement options include:

  • allow-query — Specifies the clients that are allowed to request information about this zone. The default is to allow all query requests.

  • allow-transfer — Specifies the slave servers that are allowed to request a transfer of the zone's information. The default is to allow all transfer requests.

  • allow-update — Specifies the hosts that are allowed to dynamically update information in their zone. The default is to deny all dynamic update requests.

    	Caution
    	Be very careful about allowing hosts to update information about their zone. Do not enable this option unless the host specified is completely trusted. It is a much better idea to have an administrator manually update the zone's records and reload the named service, if possible.

  • file — Specifies the name of the file in the named working directory (by default /var/named) that contains the zone's configuration data.

  • masters — Used if the zone is defined as a slave type. The masters option tells a slave's named the IP address(es) from which to request authoritative zone information.

  • notify — Works in a similar manner to the notify option used with the option statement.

  • type — Defines the type of zone. The following types may be used:

    • forward — Tells the nameserver to forward all requests for information about this zone to other nameservers.

    • hint — A special type of zone that is used to point to the root nameservers, which are used to resolve queries when a zone is not otherwise known. You should not need to configure a hint zone beyond the default in /etc/named.conf.

    • master — Designates this nameserver as authoritative for this zone. A zone should be set as the master type if you have the zone's configuration files on this system.

    • slave — Designates this nameserver as a slave server for this zone, telling named to request the zone's configuration files from the master nameserver's IP address for that zone.

  • zone-statistics — Tells named to keep statistics concerning this zone, writing them to either the default location (/var/named/named.stats) or the place specially designated by the statistics-file option in the server statement, if it exists.

zone "domain.com" IN {
  type master;
  file "domain.com.zone";
  allow-update { none; };
};

zone "domain.com" {
  type slave;
  file "domain.com.zone";
  masters { 192.168.0.1; };
};

Zone Files

Zone files, which contain information about a particular namespace, are stored in the named working directory. By default, this is /var/named. Each zone file is named according to the file option data in the zone statement, usually in a way that relates to the domain in question and identifies the file as containing zone data, such as example.com.zone.

Each zone file may contain directives and resource records. Directives tell the nameserver to do a certain thing or apply a special setting to the zone. Resource records define the parameters of the zone, assigning an identity within the zone's namespace to particular systems. Directives are optional, but resource records are required to provide nameservice to that zone. All directives and resource records should go on their own lines.

Comments can be placed after semicolon characters (;) in zone files.

$ORIGIN domain.com
$TTL 86400
@     IN     SOA    dns1.domain.com.     hostmaster.domain.com. (
                    2001062501 ; serial
                    21600      ; refresh after 6 hours
                    3600       ; retry after 1 hour
                    604800     ; expire after 1 week
                    86400 )    ; minimum TTL of 1 day

      IN     NS     dns1.domain.com.
      IN     NS     dns2.domain.com.

      IN     MX     10     mail.domain.com.
      IN     MX     20     mail2.domain.com.

             IN     A       10.0.1.5

server1      IN     A       10.0.1.5
server2      IN     A       10.0.1.7
dns1         IN     A       10.0.1.2
dns2         IN     A       10.0.1.3

ftp          IN     CNAME   server1
mail         IN     CNAME   server1
mail2        IN     CNAME   server2
www          IN     CNAME   server2

<last-IP-digit>      IN     PTR    <FQDN-of-system>

$ORIGIN 1.0.10.in-addr.arpa
$TTL 86400
@     IN     SOA    dns1.domain.com.     hostmaster.domain.com. (
                    2001062501 ; serial
                    21600      ; refresh after 6 hours
                    3600       ; retry after 1 hour
                    604800     ; expire after 1 week
                    86400 )    ; minimum TTL of 1 day

      IN     NS     dns1.domain.com.
      IN     NS     dns2.domain.com.

20    IN     PTR    alice.domain.com.
21    IN     PTR    betty.domain.com.
22    IN     PTR    charlie.domain.com.
23    IN     PTR    doug.domain.com.
24    IN     PTR    ernest.domain.com.
25    IN     PTR    fanny.domain.com.

zone "1.0.10.in-addr.arpa" IN {
  type master;
  file "domain.com.rr.zone";
  allow-update { none; };
};