Bind - Revision history

Vincent: Update a zone

2016-12-16T08:28:15Z

Update a zone

← Older revision		Revision as of 08:28, 16 December 2016
Line 227:		Line 227:

	[http://dnsviz.net DNSViz]		[http://dnsviz.net DNSViz]

			== Editing a Zone ==

			=== Freeze the Zone ===
			If your zone is dynamic, you first need to freeze the zone<syntaxhighlight lang="console">
			$ sudo rndc freeze dyn.example.org
			</syntaxhighlight>If you are unsure, run the command anyway, it will show an error in case the zone is not dynamic<syntaxhighlight lang="console">
			$ sudo rndc freeze example.org
			rndc: 'freeze' failed: not dynamic
			</syntaxhighlight>

			=== Update the Zone Serial Number ===
			Edit the file of your zone (eg. <code>/etc/bind/master/example.org</code>)

			The serial is the number in the <code>SOA</code> record that looks like <code>2016123100</code>. The format is <code>yyyymmddnn</code> where <code>yyyy</code> = year, <code>mm</code> = month, <code>dd</code> = day and <code>nn</code> = a sequence number in case you update your zone more than once in the day.

			This number must increase at every zone update to make sure secondary name servers get the update properly. Otherwise you will create a desynchronization between your primary and secondary servers. This mean that some user will get the new data while some will get the old.

			If the date of your serial number has changed since last update, just change it to today's date and reset the sequence to <code>00</code>.

			If you are doing same day update, add 10 to the sequence number.
			{{Warning\|msg=}}For DNSSEC enabled zones, bind will automatically increase the serial number when performing signing operations. While the +10 above will work for most cases, it might not when you just created or updated your zone key. In this case, check the current serial by running <code>dig @ns1.example.org SOA example.org</code>

			=== Update the Needed Records ===

			=== Reload the Zone ===
			For a non dynamic zone, use<syntaxhighlight lang="console">
			$ rndc reload example.org
			zone reload queued
			</syntaxhighlight>And for a dynamic one, use<syntaxhighlight lang="console">
			$ sudo rndc thaw dyn.example.org
			A zone reload and thaw was started.
			Check the logs to see the result.
			</syntaxhighlight>In both case check the log for errors using<syntaxhighlight lang="console">
			$ sudo journalctl -n 100 -u bind9.service
			</syntaxhighlight>

	== Sign a Zone with DNSSEC ==		== Sign a Zone with DNSSEC ==

Vincent: Improve DDNS

2016-12-14T08:59:06Z

Improve DDNS

Show changes

Vincent: Fix file path

2016-12-13T08:56:24Z

Fix file path

← Older revision		Revision as of 08:56, 13 December 2016
Line 172:		Line 172:

	=== Activate Zone File ===		=== Activate Zone File ===
	Edit file <code>/etc/bind~~/master~~/named.conf.local</code> and add the following<syntaxhighlight lang="nginx">		Edit file <code>/etc/bind/named.conf.local</code> and add the following<syntaxhighlight lang="nginx">
	zone "example.org" {		zone "example.org" {
	type master;		type master;
Line 213:		Line 213:

	=== Activate Signing for your Zone ===		=== Activate Signing for your Zone ===
	Modify your zone in <code>/etc/bind/named.~~options~~.local</code> and and the following three lines <syntaxhighlight lang="nginx">		Modify your zone in <code>/etc/bind/named.conf.local</code> and and the following three lines <syntaxhighlight lang="nginx">
	zone "example.org" {		zone "example.org" {
	...		...

Vincent: DNESEC

2016-12-13T00:33:50Z

DNESEC

@@ Line 203: / Line 203: @@
 Now go to the configuration for your secondary server and register your domain name.
-=== Test your Zone ===
+=== Validate your Zone ===
-To test your zone, you can use the following tools
+To validate your zone, you can use the following tools
 [https://www.zonemaster.net/ Zonemaster]
 [http://dnsviz.net DNSViz]
 == DDNS ==

Vincent: Activate Zone

2016-12-12T22:20:49Z

Activate Zone

@@ Line 109: / Line 109: @@
 == Adding a domain ==
 Let's add a domain <code>example.org</code> to our server.
@@ Line 171: / Line 170: @@
 ;A and AAAA Records
 :Then we declare IP addresses for our name servers.
 == DDNS ==

Vincent: Document Zone File

2016-12-12T19:57:18Z

Document Zone File

← Older revision		Revision as of 19:57, 12 December 2016
Line 20:		Line 20:
	: Secondary name server are used for redundancy and load balancing. They hold a complete copy of the data from the primary server and can answer to the same queries.		: Secondary name server are used for redundancy and load balancing. They hold a complete copy of the data from the primary server and can answer to the same queries.
	; Zone		; Zone
	: A DNS zone is a portion of the DNS space. For example, if you look at [[http://dnsviz.net/d/example.org/dnssec/]], you see 3 zones. One for .(the root), one for .org and one for .example.org. Each zone contains the records for the part of the DNS space it control. For example, the last zone will contain the record for www.example.org.		: A DNS zone is a portion of the DNS space. For example, if you look at [http://dnsviz.net/d/example.org/dnssec/ example.org hierarchy], you see 3 zones. One for .(the root), one for .org and one for .example.org. Each zone contains the records for the part of the DNS space it control. For example, the last zone will contain the record for www.example.org.

	== Install ==		== Install ==
Line 131:		Line 131:

	@ SOA ns1 hostmaster (		@ SOA ns1 hostmaster (
	~~2016121200~~ ; serial		2016123100 ; serial
	12h ; Frequency of zone transfer from slave		12h ; Frequency of zone transfer from slave
	15m ; delay before slave retries after a zone transfer ~~faillure~~		15m ; delay before slave retries after a zone transfer failure
	4w ; Time a slave will keep the data in case it cannot contact the master		4w ; Time a slave will keep the data in case it cannot contact the master
	1h ; Time a cache will keep negative responses (NXDOMAIN)		1h ; Time a cache will keep negative responses (NXDOMAIN)
Line 146:		Line 146:

	</syntaxhighlight>		</syntaxhighlight>
	* ''$ORIGIN'': Default suffix for the ~~entry~~ bellow. Eg. ''ns1'' will be read as ''ns1.example.org.'' Note that the dot at the end is important. Entries that end with a dot don't get the origin added to them.		;$ORIGIN
	* ''$TTL'': Default Time To Live for entries. This is the amount of time a cache will keep a response.		:Default suffix for the entries bellow. Eg. ''ns1'' will be read as ''ns1.example.org.'' Note that the dot at the end is important. Entries that end with a dot don't get the origin added to them.
	* ''@'': This represent the ~~root~~ of the ~~domain~~. ~~It's value is replaced by~~ the value of ''~~$ORIGIN~~''.		;$TTL
			:Default Time To Live for entries. This is the amount of time a cache will keep a response.
			;SOA Record (Start of Authority)
			:This record define the global parameters of the zone. It contains the following information.
			:;Name Server
			::Any authoritative name server for the zone. Typically, you will put your primary name server.
			:;Email Address
			::Email address of the person responsible for the zone. Here the value will be expanded to ''hostmaster.example.com''. Then the first dot is replaced by a @ giving ''hostmaster@example.com''. [https://www.ietf.org/rfc/rfc2142.txt RFC 2142] recommend to use the value ''hostmaster'' here.
			:;Serial Number
			::This represent the version number of your zone file. This is used for synchronization between your primary and secondary servers.
			::Recommended format is ''yyyymmddnn'' where ''yyyy'' = year, ''mm'' = month, ''dd'' = day and ''nn'' = a sequence number in case you update your zone more than once in the day.
			:;Refresh
			::How often a secondary will poll the primary server to see if the serial number for the zone has increased. [https://www.ietf.org/rfc/rfc1912.txt RFC 1912] recommends between 20 minutes and 12 hours. Keep it to 12 hours if your secondary name servers support notify.
			:;Retry
			::If a secondary was unable to contact the primary at the last refresh, wait the retry value before trying again.
			:;Expire
			::How long a secondary will still treat its copy of the zone data as valid if it can't contact the primary.
			:;Negative TTL
			::Time during which response for non existent records are cached.
			;NS Record
			:We declare two name servers here ''ns1.example.org'' and ''ns2.example.org''.
			;A and AAAA Records
			:Then we declare IP addresses for our name servers.

	== DDNS ==		== DDNS ==

Vincent: Vocabulary: record + glue record

2016-12-12T18:57:28Z

Vocabulary: record + glue record

← Older revision		Revision as of 18:57, 12 December 2016
Line 4:		Line 4:

	== Vocabulary ==		== Vocabulary ==
			; Glue Record
			: It is possible for a zone to be the authority for its own name server. For example, the name servers for the zone google.com are ns1.google.com, ns2.google.com... This causes a chicken egg problem where to get the IP of ns1.google.com, you need to ask ns1.google.com. To solve this, it is possible to use glue records. These are additional records in the parent zone that contain the IP of the child zone name servers.
	; Primary Name Server		; Primary Name Server
	: The primary name server is the source of the data. This is the one that you use to change the data.		: The primary name server is the source of the data. This is the one that you use to change the data.
			; Record
			: A record is an entry in a zone. Records have both a type that categories the kind of data that it contain. Some common types are
			:* '''A''': used for IPv4 addresses
			:* '''AAAA''': used for IPv6 addresses
			:* '''SOA'''(Start of Authority): contain technical info about a zone
			:* '''TXT''': General purpose record that can contain freetext
			:* '''NS''': Indicate authoritative name servers for a zone
			:* '''MX''': Contain the mail server of a domain
			:* '''CNAME''': this record is an alias to another record.
	; Secondary Name Server		; Secondary Name Server
	: Secondary name server are used for redundancy and load balancing. They hold a complete copy of the data from the primary server and can answer to the same queries.		: Secondary name server are used for redundancy and load balancing. They hold a complete copy of the data from the primary server and can answer to the same queries.

Vincent: Ex

2016-12-12T17:14:46Z

@@ Line 2: / Line 2: @@
 == Prerequisites ==
 * A fixed IP address
 == Install ==
@@ Line 92: / Line 100: @@
 {{WIP}}
 Let's add a domain <code>example.org</code> to our server.
 === Zone File ===

Vincent: Zone file

2016-12-12T14:23:08Z

Zone file

@@ Line 91: / Line 91: @@
 == Adding a domain ==
 {{WIP}}
 [[Category:Linux Server]]

Vincent: sudo

2016-12-11T10:13:46Z

sudo

← Older revision		Revision as of 10:13, 11 December 2016
Line 60:		Line 60:
	=== Reload Configuration ===		=== Reload Configuration ===
	Bind9 can be told to reload its configuration using<syntaxhighlight lang="console">		Bind9 can be told to reload its configuration using<syntaxhighlight lang="console">
	# rndc reload		$ sudo rndc reload
	</syntaxhighlight>'''Warning:''' This command is working asynchronously. It is recommended to verify that everything was fine using<syntaxhighlight lang="console">		</syntaxhighlight>'''Warning:''' This command is working asynchronously. It is recommended to verify that everything was fine using<syntaxhighlight lang="console">
	# systemctl status bind9.service		$ sudo systemctl status bind9.service
	● bind9.service - BIND Domain Name Server		● bind9.service - BIND Domain Name Server
	Loaded: loaded (/lib/systemd/system/bind9.service; enabled)		Loaded: loaded (/lib/systemd/system/bind9.service; enabled)