cloudnative wiki

bind9

3 min read

bind9

Managing DNS zones with BIND9 involves several steps, from installing and configuring BIND9 to creating and managing zone files. Here’s a detailed guide on how to manage DNS zones with BIND9:

1. Installation

First, you need to install BIND9 on your server. On a Debian-based system, you can do this using:

sudo apt-get update
sudo apt-get install bind9

On a Red Hat-based system, you can use:

sudo yum install bind bind-utils

2. Configuration Files

BIND9 configuration is primarily managed through two files:

  • /etc/bind/named.conf: The main configuration file.
  • /etc/bind/named.conf.local: For local zone configurations.
  • /etc/bind/named.conf.options: For global server options.

3. Configuring the DNS Server

Edit the named.conf.local file to define your DNS zones.

sudo nano /etc/bind/named.conf.local

Add entries for your zones. For example:

zone "example.com" {
    type master;
    file "/etc/bind/zones/db.example.com";
};
 
zone "0.168.192.in-addr.arpa" {
    type master;
    file "/etc/bind/zones/db.192.168.0";
};

4. Creating Zone Files

Next, create the directory for your zone files if it doesn’t exist:

sudo mkdir -p /etc/bind/zones

Create the zone file for your domain:

sudo nano /etc/bind/zones/db.example.com

Add the following content to the zone file, customizing it for your domain:

$TTL    604800
@       IN      SOA     ns1.example.com. admin.example.com. (
                                3         ; Serial
                           604800         ; Refresh
                            86400         ; Retry
                          2419200         ; Expire
                           604800 )       ; Negative Cache TTL
;
@       IN      NS      ns1.example.com.
@       IN      NS      ns2.example.com.
@       IN      A       192.168.0.1
@       IN      AAAA    ::1
ns1     IN      A       192.168.0.2
ns2     IN      A       192.168.0.3
www     IN      A       192.168.0.4

Create the reverse zone file:

sudo nano /etc/bind/zones/db.192.168.0

Add the following content:

$TTL    604800
@       IN      SOA     ns1.example.com. admin.example.com. (
                                3         ; Serial
                           604800         ; Refresh
                            86400         ; Retry
                          2419200         ; Expire
                           604800 )       ; Negative Cache TTL
;
@       IN      NS      ns1.example.com.
@       IN      NS      ns2.example.com.
1       IN      PTR     example.com.
2       IN      PTR     ns1.example.com.
3       IN      PTR     ns2.example.com.
4       IN      PTR     www.example.com.

5. Setting File Permissions

Ensure that BIND9 has the proper permissions to read the zone files:

sudo chown -R bind:bind /etc/bind/zones

6. Checking Configuration

Check the configuration for any errors using:

sudo named-checkconf
sudo named-checkzone example.com /etc/bind/zones/db.example.com
sudo named-checkzone 0.168.192.in-addr.arpa /etc/bind/zones/db.192.168.0

7. Starting and Enabling BIND9

Start and enable the BIND9 service:

sudo systemctl start bind9
sudo systemctl enable bind9

8. Testing the Configuration

Use tools like dig or nslookup to test your DNS server.

dig @localhost example.com
dig @localhost -x 192.168.0.1

Advanced Configuration

For more advanced configurations, you might want to set up:

  • DNSSEC: Adds a layer of security by signing your DNS records.
  • Dynamic DNS (DDNS): Allows automatic updates to DNS records.
  • Slave Zones: For redundancy and load balancing.
  • Views: To provide different responses based on the source of the query.

Example of DNSSEC Configuration

Here’s a simple example of how to sign a zone with DNSSEC:

  1. Generate keys:
dnssec-keygen -a RSASHA256 -b 2048 -n ZONE example.com
dnssec-keygen -f KSK -a RSASHA256 -b 2048 -n ZONE example.com
  1. Sign the zone file:
dnssec-signzone -A -3 $(head -c 1000 /dev/urandom | sha1sum | cut -b 1-16) -N INCREMENT -o example.com -t /etc/bind/zones/db.example.com
  1. Update the named.conf.local to include the keys:
zone "example.com" {
    type master;
    file "/etc/bind/zones/db.example.com.signed";
    key-directory "/etc/bind/keys";
    auto-dnssec maintain;
    inline-signing yes;
};
  1. Restart BIND9:
sudo systemctl restart bind9

Conclusion

Managing DNS zones with BIND9 involves creating and configuring zone files, ensuring proper permissions, and testing the setup. Advanced features like DNSSEC and Dynamic DNS can enhance security and functionality. BIND9 is a powerful and flexible DNS server that is widely used in various environments.

Graph View