DNS and file system messed up...

Matthew Seaman m.seaman at infracaninophile.co.uk
Sat Jul 9 08:14:41 UTC 2011

On 08/07/2011 23:04, Gary Kline wrote:
> On Fri, Jul 08, 2011 at 10:01:45AM +0100, Matthew Seaman wrote:
>> Date: Fri, 08 Jul 2011 10:01:45 +0100
>> From: Matthew Seaman <m.seaman at infracaninophile.co.uk>
>> Subject: Re: DNS and file system messed up...
>> To: freebsd-questions at freebsd.org
>> On 08/07/2011 08:25, Doug Hardie wrote:
>>> On 7 July 2011, at 22:58, Gary Kline wrote:
>>>>>>> Jul  7 10:16:33 ethic named[54366]: none:0: open: /etc/named.conf: file not found
>>>>>>> Jul  7 10:17:56 ethic named[54371]: starting BIND 9.3.6-P1 -c /var/named/etc/namedb/named.conf
>>> The first one that fails is looking for /etc/named.conf.  The second
>>> one shows its in /var/named/etc/named/named.conf
>>> Those are different locations.  I suspect you have named_flags setup
>>> in rc.conf pointing to /etc/namedb/named.conf rather than the right
>>> location.  Its also possible that its not set in rc.conf but defaults
>>> in either the rc script or /etc/rc.d/named.  On my system it appears
>>> to default in /etc/rc.d/named.
>> FreeBSD defaults to running named chrooted.  /etc/namedb is actually a
>> symbolic link:
> hi matthew,
> i found an in-depth post you wrote re mtree yesterday ( 07july ),
> but i figured it was over my head in resetting anything i might need
> to reset.  i was going to write you offlist.  decided to ask the
> entire list.
>> % ls -la /etc/namedb
>> lrwxr-xr-x  1 root  wheel  21 Jul  6 06:24 /etc/namedb@ ->
>> /var/named/etc/namedb
>> so the files referenced are in fact exactly the same file.  However, the
>> flags from the log extract don't look like the defaults to me.  (I'm
>> running the dns/bind98 port, and the equivalent info from the log line
>> is '-t /var/named -u bind')
> i was using bind98 rather than the earlier bind9 which is out of
> date.  but bind98 gave me troubles with the rndc.key and other, so i
> chose to go back  with what worked.  --first thing is to get this
> working with the older bind9.  FWIW, both bind9's  given me the same 
> error and failure.  i have walked thru the named script to the point
> where it creates the symlink.  regardless, i cannot understand the
> error and failure messages.  i only know that my kill -9 and my 
> initialization "by hand" work.  
>> Gary, what named related settings do you have in /etc/rc.conf?  You
>> almost certainly don't need anything more than:
>> named_enable="YES"
>> and perhaps
>> syslogd_flags="-ss -l /var/named/var/run/log"
>> so named can log to the system syslog.
> Hmmm [&c].  as you may have seen in my post to Doug H. i only have 
> --
> named_enable="YES"
> named_program="/usr/local/sbin/named"
> named_pidfile="/var/run/named/pid"

OK.  The good news is that the configuration that works for the system
built-in version of named will work for the dns/bind98 port with very
minor changes, if any.

First:  where everything should live

   /etc/namedb/named.conf --- named's config file
   /etc/namedb/master     --- zone files this server is master for
   /etc/namedb/slave      --- zone files this server slaves from
                              another master (rw by named)
   /etc/named/working     --- named's working directory (rw by named)
   /etc/rndc.conf         --- config file for rndc

There are various other files and directories under /etc/namedb which
you may or may not need depending on how you configure named; in any
case, just leave them in their default locations and with the
permissions the system gives them.  (You can use mtree(8) to fix them up
if necessary -- but that's a whole other posting)

Now, although named defaults to running chrooted into /var/namedb, you
don't need to mention that path explicitly anywhere in the config.  In
fact, you should think about the configuration as if there was no
chrooting happening at all.

Second: rc.conf settings

  syslogd_flags="-ss -l /var/named/var/run/log"

should be all you need to use the built-in version of named.

Third: rndc configuration

  Generate a new rndc key and a config file by:

   # rndc-confgen > /etc/named/rndc.conf

This should create a new file /etc/namedb/rndc.conf preconfigured to
work with the named instance on the localhost.  Look at the text of
the file -- commented out there's a chunk of stuff to copy into
named.conf  So let's do that.

If the file contains:

# key "rndc-key" {
# 	algorithm hmac-md5;
# 	secret "0ABCDE123+45+67890==";
# };
# controls {
# 	inet port 953
# 		allow {; } keys { "rndc-key"; };
# };

Then copy that without the '#' quotes into named.conf  In fact, I find
it helps to add a control for access to ::1 as well.  So add this text
to /etc/namedb/named.conf:

key "rndc-key" {
    algorithm hmac-md5;
    secret "0ABCDE123+45+67890==";

controls {
    inet port 953
        allow {; } keys { "rndc-key"; };
    inet ::1 port 953
        allow { ::1; } keys { "rndc-key"; };

Fourth: set up named.conf

As I don't no much about the config you want, I'm going to have to keep
this to generalities.

In the options section you should have some standard boiler-plate:

options {
    directory           "/etc/namedb/working";
    pid-file            "/var/run/named/pid";
    dump-file           "/var/dump/named_dump.db";
    statistics-file     "/var/stats/named.stats";
    memstatistics-file  "/var/stats/named.memstats";

For security purposes you can turn off named's built-in version display etc.

    version             none;
    hostname            none;
    server-id           none;

Also for security purposes, configure named to use as many UDP ports as

    use-v4-udp-ports   { range 1024 65535; };
    use-v6-udp-ports   { range 1024 65535; };

There's a bunch of other stuff I could talk about to go into options,
but that's a matter of individual choice and this message is long enough
already.  One of the more important things I'm glossing over is the
'recursion' setting -- this needs to be carefully restricted to only
being available to your own network, as there are plenty of nasty
attacks that are enabled by opening recursion to the world.

When it comes to zone file statements, on slight gotcha is that you
should give /absolute/ filenames -- that's a consequence of the
'directory' setting above.  Remember the bit about pretending that
chrooting isn't happening? It applies here.  So, for instance,
you'ld want something like this for localhost:

    zone "localhost"
        type master;
        file "/etc/namedb/master/localhost-forward";
    zone "127.in-addr.arpa"
        type master;
        file "/etc/namedb/master/localhost-reverse";

    // RFC 1912-style zone for IPv6 localhost address
    zone "0.ip6.arpa"
        type master;
        file "/etc/namedb/master/localhost-reverse";

Those zone files should be present as part of the standard system.
Note: you can use ACLs and/or views to control access to these localhost
zones.  It's only your local trusted clients that need any access.

For zones that you are serving to the general public -- ie. the zones
you are authoritative for, you'ld have something like this:

    zone "infracaninophile.co.uk" {
        type master;
        file "/etc/namedb/master/infracaninophile.co.uk";
        allow-query {
        allow-transfer {

Fifth: testing

Use named-checkconf to test that your config is going to work:

    # named-checkconf /etc/namedb/named.conf && echo "Everything is OK"

If named-checkconf prints anything out, that's a problem which needs to
be fixed.  named-checkconf remaining silent is a good sign.

Sixth: start named up

    # /etc/rc.d/named start

Look at the logging output in /var/log/messages to check everything is
running OK, and test that rndc works by 'rndc status'

Seventh: there is no seventh.

Well, actually, changes you would need to make to use the dns/bind98
port.  Very few.

Check that /usr/local/etc/rndc.conf is a symlink to /etc/named/rndc.conf
-- this should be created automatically when you install the port.

Use /usr/local/sbin/named-checkconf to verify that your named.conf is OK
with the newer named version.  Unless you're using DNSSEC it almost
certainly will be.

Stop named running and add


to /etc/rc.conf  Restart named.  Done.



Dr Matthew J Seaman MA, D.Phil.                   7 Priory Courtyard
                                                  Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey     Ramsgate
JID: matthew at infracaninophile.co.uk               Kent, CT11 9PW

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 267 bytes
Desc: OpenPGP digital signature
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20110709/661c6c78/signature.pgp

More information about the freebsd-questions mailing list