wiki:TipAndDoc/network/named

Version 23 (modified by mitty, 13 years ago) (diff)

--

  1. view
  2. master/slave
  3. disable ipv6
  4. logging
  5. DHCPとの連携
    1. journal file error
    2. dumping master file error
    3. zone -> allow-update (DDNS)
  6. security

view

  • 一部だけ「view」は出来ない 
    /etc/bind/named.conf.local:29: when using 'view' statements, all zones must be in views

master/slave

disable ipv6

logging

DHCPとの連携

journal file error

  • /var/log/named.log 
    Nov  8 09:57:43 iqus named[22728]: journal file /etc/bind/db.local.mitty.jp.jnl does not exist, creating it
Nov  8 09:57:43 iqus named[22728]: /etc/bind/db.local.mitty.jp.jnl: create: permission denied
Nov  8 09:57:43 iqus named[22728]: client 192.168.0.254#47526: updating zone 'local.mitty.jp/IN': error: journal open failed: unexpected error
  • ls -ld /etc/bind 
    drwxr-sr-x 3 root bind 4096 2009-11-07 21:05 /etc/bind
  • sudo chmod g+w /etc/bind
    • これではエラーが回避できず
  • /var/log/syslog 
    Nov  8 23:28:29 iqus kernel: [312571.679444] audit(1257690509.463:10): type=1503 operation="inode_create" requested_mask="w::" denied_mask="w::" name="/etc/bind/db.local.mitty.jp.jnl" pid=30150 profile="/usr/sbin/named" namespace="default"
  • => vim /etc/bind/named.conf.local 
    +       journal "/var/cache/bind/db.XXX.XXX.XXX.jnl";
    • 正常にjournal fileが作られるようになる => /var/log/named.log 
      Nov  8 23:53:03 iqus named[30562]: client 192.168.0.254#56809: updating zone 'XXXXXX.mitty.jp/IN': adding an RR at 'centos-vmserver.XXXXXX.mitty.jp' A
Nov  8 23:53:03 iqus named[30562]: client 192.168.0.254#56809: updating zone 'XXXXXX.mitty.jp/IN': adding an RR at 'centos-vmserver.XXXXXX.mitty.jp' TXT
Nov  8 23:53:03 iqus named[30562]: journal file /var/cache/bind/db.XXX.YYY.ZZZ.jnl does not exist, creating it
Nov  8 23:53:03 iqus named[30562]: client 192.168.0.254#53532: updating zone '0.168.192.in-addr.arpa/IN': deleting rrset at 'XYZ.0.168.192.in-addr.arpa' PTR
Nov  8 23:53:03 iqus named[30562]: client 192.168.0.254#53532: updating zone '0.168.192.in-addr.arpa/IN': adding an RR at 'XYZ.0.168.192.in-addr.arpa' PTR
Nov  8 23:53:03 iqus named[30562]: journal file /var/cache/bind/db.AAA.BBB.CCC.jnl does not exist, creating it

dumping master file error

  • 別のエラーが出るようになった 
    Nov  9 00:05:23 iqus named[30562]: dumping master file: /etc/bind/tmp-FGx045qweZ: open: permission denied
Nov  9 00:05:26 iqus named[30562]: dumping master file: /etc/bind/tmp-CvcG3F8k3Y: open: permission denied
Nov  9 00:19:31 iqus named[30562]: dumping master file: /etc/bind/tmp-bMgPQWQEjV: open: permission denied
Nov  9 00:19:36 iqus named[30562]: dumping master file: /etc/bind/tmp-iPDZvphXag: open: permission denied
  • named.conf.local内ではzone fileを相対パスで指定し、zone file自体は/var/cache/bind/*に置くように変更する
    • named.conf.optionsで「directory "/var/cache/bind";」と指定されている
    • #journalfileerrorのエラーも同時に(根源的に)解決出来る
  • => vim /etc/bind/named.conf.local 
    -   file "/etc/bind/db.XXX.XXX.XXX";
+   file "db.XXX.XXX.XXX";
    allow-update {
        127.0.0.1;
        XXX.XXX.XXX.0/24;
    };
-   journal "/var/cache/bind/db.XXX.XXX.XXX.jnl";

zone -> allow-update (DDNS)

  • DHCPdとBINDが同じサーバで動いている場合
    • 127.0.0.1;
    • そのサーバのIPを指定すれば良い模様
  • もっとも、 ​http://ftp.isc.org/isc/bind9/cur/9.7/doc/arm/Bv9ARM.pdf で「allow-update」について「Note that allowing updates based on the requestor’s IP address is insecure; see Section 7.3 for details.」とあるように、IPアドレスによる制限は使わない方が良い。

security

  • 再帰問い合わせを問答無用(LAN/WAN/localhost全て)で無効にするには以下のように設定するのが早い。 
    options {
	recursion no;
};