Настройка

Существует много способов настроить BIND9. Наиболее распространенные конфигурации - это кэширующий сервер имен, первичный мастер и вторичный мастер.

1. Когда BIND9 настроен как кэширующий сервер, он ищет ответы на запросы имени и запоминает ответ на случай, если запрос придет повторно.

2. В качестве первичного мастера BIND9 читает данные зоны из локального файла и является ответственным за эту зону.

3. В качестве вторичного мастера BIND9 получает данные по зоне (целиком) с другого сервера имен, отвечающего за эту зону.

Файлы настройки DNS сохраняются в каталоге /etc/bind. Основной файл конфигурации - это /etc/bind/named.conf.

Строки include определяют имена файлов, которые содержат DNS опции. Строка directory в файле /etc/bind/named.conf.options говорит DNS где искать файлы. Все файлы, используемые BIND, будут относительными к этому каталогу.

Файл с именем /etc/bind/db.root описывает корневые сервера имен в мире. Сервера со временем меняются, поэтому файл /etc/bind/db.root должен обслуживаться сейчас и потом. Обычно это происходит в качестве обновления к пакету bind9. Секция zone определяет мастер сервер и она сохранена в файле, определяемой опцией file.

Существует возможность настроить один сервер как кэширующий сервер имен, первичный мастер и вторичный мастер одновременно. Сервер может быть началом авторизации (SOA) для одной зоны, при этом предоставляя вторичный сервис для другой. И при всем этом предоставлять кэширующий сервис в локальной сети (LAN).

The default configuration is setup to act as a caching server. All that is required is simply adding the IP Addresses of your ISP's DNS servers. Simply uncomment and edit the following in /etc/bind/named.conf.options:

forwarders {

              1.2.3.4;
              5.6.7.8;
         };

Replace 1.2.3.4 and 5.6.7.8 with the IP Adresses of actual nameservers.

Now restart the DNS server, to enable the new configuration. From a terminal prompt:

sudo service bind9 restart

See dig for information on testing a caching DNS server.

In this section BIND9 will be configured as the Primary Master for the domain example.com. Simply replace example.com with your FQDN (Fully Qualified Domain Name).

To add a DNS zone to BIND9, turning BIND9 into a Primary Master server, the first step is to edit /etc/bind/named.conf.local:

zone «example.com» {

type master;
      file "/etc/bind/db.example.com";

};

Now use an existing zone file as a template to create the /etc/bind/db.example.com file:

sudo cp /etc/bind/db.local /etc/bind/db.example.com

Edit the new zone file /etc/bind/db.example.com change localhost. to the FQDN of your server, leaving the additional «.» at the end. Change 127.0.0.1 to the nameserver's IP Address and root.localhost to a valid email address, but with a «.» instead of the usual «@» symbol, again leaving the «.» at the end. Change the comment to indicate the domain that this file is for.

Create an A record for the base domain, example.com. Also, create an A record for ns.example.com, the name server in this example:

; ; BIND data file for example.com ; $TTL 604800 @ IN SOA example.com. root.example.com. (

                            2         ; Serial
                       604800         ; Refresh
                        86400         ; Retry
                      2419200         ; Expire
                       604800 )       ; Negative Cache TTL
      IN      A       192.168.1.10

; @ IN NS ns.example.com. @ IN A 192.168.1.10 @ IN AAAA ::1 ns IN A 192.168.1.10

You must increment the Serial Number every time you make changes to the zone file. If you make multiple changes before restarting BIND9, simply increment the Serial once.

Now, you can add DNS records to the bottom of the zone file. See Common Record Types for details.

Many admins like to use the last date edited as the serial of a zone, such as 2012010100 which is yyyymmddss (where ss is the Serial Number)

Once you have made changes to the zone file BIND9 needs to be restarted for the changes to take effect:

sudo service bind9 restart

Now that the zone is setup and resolving names to IP Adresses a Reverse zone is also required. A Reverse zone allows DNS to resolve an address to a name.

Edit /etc/bind/named.conf.local and add the following:

zone «1.168.192.in-addr.arpa» {

      type master;
      file "/etc/bind/db.192";

};

Replace 1.168.192 with the first three octets of whatever network you are using. Also, name the zone file /etc/bind/db.192 appropriately. It should match the first octet of your network.

Now create the /etc/bind/db.192 file:

sudo cp /etc/bind/db.127 /etc/bind/db.192

Next edit /etc/bind/db.192 changing the basically the same options as /etc/bind/db.example.com:

; ; BIND reverse data file for local 192.168.1.XXX net ; $TTL 604800 @ IN SOA ns.example.com. root.example.com. (

                            2         ; Serial
                       604800         ; Refresh
                        86400         ; Retry
                      2419200         ; Expire
                       604800 )       ; Negative Cache TTL

; @ IN NS ns. 10 IN PTR ns.example.com.

The Serial Number in the Reverse zone needs to be incremented on each change as well. For each A record you configure in /etc/bind/db.example.com, that is for a different address, you need to create a PTR record in /etc/bind/db.192.

After creating the reverse zone file restart BIND9:

sudo service bind9 restart

Once a Primary Master has been configured a Secondary Master is needed in order to maintain the availability of the domain should the Primary become unavailable.

First, on the Primary Master server, the zone transfer needs to be allowed. Add the allow-transfer option to the example Forward and Reverse zone definitions in /etc/bind/named.conf.local:

zone «example.com» {

      type master;
file "/etc/bind/db.example.com";
      allow-transfer { 192.168.1.11; };

};

zone «1.168.192.in-addr.arpa» {

      type master;
      file "/etc/bind/db.192";
allow-transfer { 192.168.1.11; };

};

Replace 192.168.1.11 with the IP Address of your Secondary nameserver.

Restart BIND9 on the Primary Master:

sudo service bind9 restart

Next, on the Secondary Master, install the bind9 package the same way as on the Primary. Then edit the /etc/bind/named.conf.local and add the following declarations for the Forward and Reverse zones:

zone «example.com» {

type slave;
      file "db.example.com";
      masters { 192.168.1.10; };

};

zone «1.168.192.in-addr.arpa» {

type slave;
      file "db.192";
      masters { 192.168.1.10; };

};

Replace 192.168.1.10 with the IP Address of your Primary nameserver.

Restart BIND9 on the Secondary Master:

sudo service bind9 restart

In /var/log/syslog you should see something similar to (some lines have been split to fit the format of this document):

client 192.168.1.10#39448: received notify for zone '1.168.192.in-addr.arpa' zone 1.168.192.in-addr.arpa/IN: Transfer started. transfer of '100.18.172.in-addr.arpa/IN' from 192.168.1.10#53: connected using 192.168.1.11#37531 zone 1.168.192.in-addr.arpa/IN: transferred serial 5 transfer of '100.18.172.in-addr.arpa/IN' from 192.168.1.10#53: Transfer completed: 1 messages, 6 records, 212 bytes, 0.002 secs (106000 bytes/sec) zone 1.168.192.in-addr.arpa/IN: sending notifies (serial 5)

client 192.168.1.10#20329: received notify for zone 'example.com' zone example.com/IN: Transfer started. transfer of 'example.com/IN' from 192.168.1.10#53: connected using 192.168.1.11#38577 zone example.com/IN: transferred serial 5 transfer of 'example.com/IN' from 192.168.1.10#53: Transfer completed: 1 messages, 8 records, 225 bytes, 0.002 secs (112500 bytes/sec)

Note: A zone is only transferred if the Serial Number on the Primary is larger than the one on the Secondary. If you want to have your Primary Master DNS notifying Secondary DNS Servers of zone changes, you can add also-notify { ipaddress; }; in to /etc/bind/named.conf.local as shown in the example below:

zone «example.com» {

type master;
file "/etc/bind/db.example.com";
allow-transfer { 192.168.1.11; };
also-notify { 192.168.1.11; }; 
};

zone «1.168.192.in-addr.arpa» {

type master;
file "/etc/bind/db.192";
allow-transfer { 192.168.1.11; };
also-notify { 192.168.1.11; }; 
};

The default directory for non-authoritative zone files is /var/cache/bind/. This directory is also configured in AppArmor to allow the named daemon to write to it. For more information on AppArmor see AppArmor.

---