Ubuntu Wiki

This HOWTO is aimed to at people looking to learn how to configure and maintain a DNS server, such as for a network or to serve DNS zones for a domain name.

Repositories

BIND9 is available in the core Ubuntu repository. No additional repository needs to be enabled for BIND9.

Before we begin, you should be familiar with RootSudo.

Installing BIND9

The Server

$ sudo apt-get install bind9

Useful Tools (For Testing)

$ sudo apt-get install bind9-host dnsutils

Documentation (Optional)

$ sudo apt-get install bind9-docs

BIND9 Scenarios

There are many setups BIND9 may be configured.

The most useful setups are:

Caching Server

This can be useful for a broadband connection to a host or small network. By caching DNS queries, you reduce the bandwidth used and (hopefully) reducing your bandwidth used (and hopefully even your broadband bill!).

Master Server

BIND9 can be used to serve DNS records (groups of records are referred to as zones) for a registered domain name or an imaginary one (but only if used on a restricted network)

Slave Server

A slave DNS server is used to complement a Master DNS server by serving a copy of the zone(s) configured on the Master server. Slave servers are recommended in larger setups (larger networks or on the internet) if you intend to power a registered domain name, since they ensure that your DNS zone is still available, even if your Master server is not online.

Hybrids

You can even configure BIND9 to be a Caching and Master DNS server simultaneously, a Caching and a Slave server or even a Caching, Master and Slave server. All that is required is simply combining the differnet configuration examples from this document.

Stealth Servers

There are also two other common DNS server setups (used when working with zones for registered domain names), Stealth Master and Stealth Slave. These are effectively the same as Master and Slave DNS servers, but with a slight organisational difference.

For example, you have 3 DNS servers; A, B and C.

A is the Master, B and C are slaves.

If you configure your registered domain to use A and B as your domain's DNS servers, then C is a Stealth Slave. It's still a slave, but it's not going to be asked about the zone you are serving to the internet from A and B

If you configure your registerd domain to use B and C as your domain's DNS servers, then A is a stealth master. Any additional records or edits to the zone are done on A, but computers on the internet will only ever ask B and C about the zone.

DNS Record Types

There are lots of different DNS record types, but for a someone reading this document, you need only deal with these record types

Address Records

The most commonly used type of record.

www      A      1.2.3.4

Alias Records

Used to create an alias from an existing A record. You cannot create a CNAME record pointing to another CNAME record.

mail     CNAME  www
www      A      1.2.3.4

Mail Exchange Records

Used to define where email should be sent to. Must point to an A record, not a CNAME.

        MX      mail.example.com.

        [...]

mail    A       1.2.3.4

Name Server Records

Used to define which servers serve copies of this zone. It must point to an A record, not a CNAME.

This is there Master and Slave servers are definied. Stealth servers are intentionally left.

        NS     ns.example.com.

        [...]

ns      A      1.2.3.4

Configuring BIND9

BIND9 Configuration files are stored in

/etc/bind/

The main configuration is stored in the following files

/etc/bind/named.conf
/etc/bind/named.conf.options
/etc/bind/named.conf.local

Caching Server

The default configuration is setup to act as a caching server by default.

All that is required is simply adding the IP numbers of your ISP's DNS servers.

Simply uncomment and edit the following:

named.conf.options:


        [...]

        forwarders {
             1.2.3.4;
             5.6.7.8;
        };

        [...]

(where 1.2.3.4 and 5.6.7.8 are the IP numbers of your ISP's DNS servers)

Master Server

To add a DNS zone to BIND9, turning BIND9 into a Master server, all you simply have to do is:

named.conf.local:


        [...]

        zone "example.com" {
             type master;
             file "/etc/bind/db.example.com";
        };

        [...]

Now use an existing zone file as a template

$ sudo cp /etc/bind/db.local /etc/bind/db.example.com

Now, to edit our zone

db.example.com:


;
; BIND data file for local loopback interface
;
$TTL    604800
@       IN      SOA     localhost. root.localhost. (
                              1         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      localhost.
@       IN      A       127.0.0.1

Edit localhost. to the FQDN of your server, with an additional "." at the end.

Eg:

db.example.com:


;
; BIND data file for local loopback interface
;
$TTL    604800
@       IN      SOA     box.example.com. root.localhost. (
                              1         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      localhost.
@       IN      A       127.0.0.1

Edit root.localhost to be your email address, but with a "." instead of the "@", and another "." at the end.

Eg:

johndoe@exmaple.com should be added as johndoe.example.com.

Increment the Serial number (you must increment the serial number for every time you make any changes to the zone file and reload the zone by restarting BIND9. If you make multiple changes before restarting BIND9, simply increment the serial once.

Tip: Many people like to use the last date edited as the serial of a zone, such as  2005010100  which is yyyymmddss (where s is serial)

Now, you can add DNS records to the bottom of the zone. Do remember to increment the serial as you add entries though.

Slave Server

Chrooting BIND9

Chrooting BIND9 is a recommended setup from a security perspective. In a chroot enviroment, BIND9 has access to all the files and hardware devices it needs, but is unable to access any it should not need.

To chroot BIND9, simply create a chroot enviroment for it and add the additional configuration below

The Chroot Enviroment

Create the following directory structure

$ sudo mkdir -p /var/named/etc
$ sudo mkdir /var/named/dev
$ sudo mkdir -p /var/named/var/cache/bind
$ sudo mkdir /var/lib/named/var/run

Move the BIND9 configuration from /etc/bind into the Chroot enviroment, but create a symbolic link, so it can be configured and upgraded as if there is no chroot setup.

$ sudo mv /etc/bind /var/named/etc/
$ sudo ls -s /var/named/etc/bind /etc/bind

Move the BIND9 slave zones from /var/cache/bind into the Chroot enviroment, but create a symbolic link, so it can be configured and upgraded as if there is no chroot setup.

$ sudo mv /var/cache/bind /var/named/var/cache/
$ sudo ls -s /var/named/var/cache/bind /var/cache/bind

Create the devices BIND9 requires

$ sudo mknod /var/named/dev/null c 1 3
$ sudo mknod /var/named/dev/random c 1 8

Set the bind user and group to own everything in the chroot enviroment.

$ sudo chown -R bind:bind /var/named/

BIND9's Configuration

Tell BIND9 where you have created a chroot enviroment for it

/etc/default/bind9:


OPTIONS="-u bind -t /var/named"

Ubuntu's syslod Daemon Configuration

/etc/init.d/sysklogd:


        [...]

SYSLOGD="-u syslog -a /var/named/var/log"

        [...]

(Author Note: Check this config)

Restart the syslog server and BIND9

$ sudo /etc/init.d/sysklogd restart
$ sudo /etc/init.d/bind9 restart

Starting, Stopping, and Restarting BIND9

Use the following command to start BIND9 :

$ sudo /etc/init.d/bind9 start

To stop it, use :

$ sudo /etc/init.d/bind9 stop

Finally, to restart it, run

$ sudo /etc/init.d/bind9 restart

Status

To check the status of your BIND9 installation:

$ host $record localhost

or

$ dig $record @localhost

(where localhost is the system you are setting BIND9 up on. If not localhost, use the appropriate IP number.)

Tips & Tricks

Additional Possibilities

You can monitor your BIND9 server usage by installing the bindgraph package from the Universe (To enable Universe - see AddingRepositoriesHowto) and following configuration details as outlined in bindgraph's README documents

Further Information

Online Recources

[http://www.bind9.net/manuals "ISC's BIND9 Manual"]

[http://www.tldp.org/ TLDP]'s [http://www.tldp.org/HOWTO/DNS-HOWTO.html "DNS HOWTO"] (For General Overview)

Printed Resources

[http://www.oreilly.com/catalog/dns4/index.html "DNS & BIND"] - Paul Albitz & Cricket Liu - 4th Edition - [http://www.oreilly.com/ "O'Reilly Press"] ([http://www.amazon.com/exec/obidos/tg/detail/-/0596001584/ref=pd_sbs_1/002-5464085-2828062?%5Fencoding=UTF8&v=glance Amazon.com])

[http://www.oreilly.com/catalog/dnsbindckbk/inx.html "DNS & BIND Cookbook"] - Cricket Liu - 4th Edition - [http://www.oreilly.com/ "O'Reilly Press"] ([http://www.amazon.com/exec/obidos/tg/detail/-/0596004109/002-5464085-2828062?%5Fencoding=UTF8&v=glance Amazon.com])

CategoryDocumentation