Tutorial BIND9
BIND is a suite of DNS software. Its most prominent component, named (pronounced name-dee, short for name daemon), performs both of the main DNS server roles, acting as an authoritative name server for DNS zones and as a recursive resolver in the network. Also contained in the suite are various administration tools such as nsupdate and dig, and a DNS resolver interface library.
Features
Important features of BIND 9 include:
- TSIG
- nsupdate
- IPv6
- RNDC (remote name daemon control)
- views
- multiprocessor support
- Response Rate Limiting (RRL)
- DNSSEC, and
- Broad portability
RNDC enables remote configuration updates, using a shared secret to provide encryption for local and remote terminals during each session.
Installation
The package bind9 will be used for installation.
sudo apt install bind9
and then if you want to also install the documentation (very useful):
sudo apt install bind9-doc
Testing
Use these tools to check BIND configurations:
- named-checkconf
- named-checkzone
After ensuring the configs are correct, make several queries:
Eg.:dig @127.0.0.1 yahoo.com
Carefully review the output:
labuser@labmachine:~$ dig @localhost yahoo.com ; <<>> DiG 9.18.24-1-Debian <<>> @localhost yahoo.com ; (2 servers found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26347 ;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ;; QUESTION SECTION: ;yahoo.com. IN A ;; ANSWER SECTION: yahoo.com. 1428 IN A 74.6.143.25 yahoo.com. 1428 IN A 74.6.231.21 yahoo.com. 1428 IN A 98.137.11.164 yahoo.com. 1428 IN A 98.137.11.163 yahoo.com. 1428 IN A 74.6.143.26 yahoo.com. 1428 IN A 74.6.231.20 ;; Query time: 0 msec ;; SERVER: ::1#53(localhost) (UDP) ;; WHEN: Thu Jul 25 11:01:56 UTC 2024 ;; MSG SIZE rcvd: 134
Additional Config
By default, it only allows query from localhost. To enable query from your networks, setup appropiately in BIND config.
options {
directory "/var/cache/bind";
recursion yes; # enables recursive queries
allow-recursion { 10.0.0.0/8 ; }; # allows recursive queries from LAN clients
listen-on { 10.9.0.19; }; # listen on specified IP only
allow-transfer { none; }; # disable zone transfers by default
forwarders {
1.1.1.1;
8.8.8.8;
};
. . .
};
Testing
Test from other computers on the network. Observe the responses.
Lab: Check and fix issues that arise during testing.
Authoritative Configuration
Earlier, we configured BIND for recursive usage. Now we will be configuring BIND for authoritative usage.
Adding a new Zone
Use the following example to add a new zone. In this example we create a new file lab1.com.np.zone with the following content:
Do not forget to replace 'lab1.com.np` with your correct domain.
$ORIGIN lab1.com.np. $TTL 86400 @ IN SOA dns1.lab1.com.np. hostmaster.lab1.com.np. ( 2024071501 ; serial 21600 ; refresh after 6 hours 3600 ; retry after 1 hour 604800 ; expire after 1 week 86400 ) ; minimum TTL of 1 day IN NS dns1.lab1.com.np. IN NS dns2.lab1.com.np. IN MX 10 mail.lab1.com.np. IN MX 20 mail2.lab1.com.np. dns1 IN A 10.0.1.1 dns2 IN A 10.0.1.2 server1 IN A 10.0.1.5 server2 IN A 10.0.1.6 ftp IN A 10.0.1.3 IN A 10.0.1.4 mail IN CNAME server1 mail2 IN CNAME server2 www IN CNAME server1
Now, you need to include the recently configured zone into BIND config by
sudo nano /etc/bind/named.conf.local
Add the following entry
zone "lab1.com.np" { type master; file "/etc/bind/lab1.com.np.zone"; };
Then, reload BIND:
rndc reconfig
or (there is some difference between these commands)
rndc reload
Now run tests from your computer and others on the network.
Making Changes
Edit the zone file, add new entries, make a few changes, remove some and check whether they are propagated correctly.
Editing:
- Use your favorite editor to make all changes to the file
- Increment the Zone serial number
- Save the file
- Reload the zone
rndc reload lab1.com.np - Checking
- Troubleshooting
Secondary Zone
Now that we have a good understanding of zone, changes and upadating them, lets add a secondary zone. Team up with another group and add their domain to yours as secondary:
- Group 1 add lab2
- Group 2 add lab3
- ...
- Group 6 add lab1
Work with the other group to allow permissions, ensure the zone is transferred and changes are propagated promptly.
On the secondary server, add the zone into named.conf.local:
zone "lab1.com.np" {
type slave;
file "/etc/bind/lab1.com.np.zone";
masters { 10.9.0.31; };
};
Be sure to use the correct IP and zones, using above as an example.
On the origin server, you will have to allow zone transfer to the appropriate servers:
allow-transfer {
10.9.0.31; # lab1
10.9.0.32; # lab2
};
When editing the zone file, be careful about the syntax.
Once done, reload BIND using rndc command.
