{{tag>Réseau DNS}} # Notes DNS Bind9 Voir: * CIS ISC BIND DNS Server Benchmark Alternative à Bind : * [unbound](https://doc.ubuntu-fr.org/unbound) * PowerDNS * [Knot DNS](https://en.wikipedia.org/wiki/Knot_DNS) * [CoreDNS](https://coredns.io/) (cncf.io) ## Import / Export Si le transfert de zone est activé Dig gère directement ~~~bash dig -t AXFR @127.0.0.1 acme.fr > /etc/bind/db.acme.fr ~~~ Si le transfert de zone n'est pas activé on peut toujours essayer ~~~bash dig @127.0.0.1 +nocmd +multiline +noall +answer SOA acme.fr ~~~ Possibilité de travailler un peu ça (script oneshot un peu pas beau, désolé) `dig2bind.sh` ~~~bash #! /bin/bash TTL=$(dig acme.fr -t AXFR @127.0.0.1 | egrep -v '^;|^$' | awk '{print $2}' | sort -u) echo -e "\$TTL\t$TTL" dig @127.0.0.1 +nocmd +multiline +noall +answer SOA acme.fr | sed -e 's/^acme.fr./@/' | perl -p -e "s/$TTL// if /IN SOA/" | perl -p -e 's/\t+/\t/ if /IN SOA/' dig acme.fr -t AXFR @127.0.0.1 | egrep -v '^;|^$' | sed -e 's/^acme.fr./@/' | perl -p -e "s/$TTL//" | perl -p -e 's/.acme.fr.//g if /IN/' | perl -ne 'print unless $a{$_}++' | perl -p -e 's/\t+/\t/g' | grep -v SOA ~~~ ~~~bash bash dig2bind.sh > /etc/bind/db.acme.fr ~~~ ## Slave On slave Port 53 must be open on Slave (if Notify) `/etc/bind/named.conf.local` ~~~c zone "local" { type slave; masters { 192.168.15.211; }; // IP of master allow-notify { 10.8.15.215; }; file "/var/lib/bind/db.local"; allow-transfer { none; } ; }; ~~~ On Master `/etc/bind/named.conf.local` ~~~c zone "local" { type master; file "/etc/bind/db.local"; allow-transfer { localhost; 192.168.16.45; }; // IP of Slave notify yes; }; ~~~ `/etc/bind/db.local` ~~~ @ IN NS ns1.local. ns1 IN A 192.168.16.45 ~~~ Change serial in db.local and reload ## Forwarder Il peut-être nécessaire de modifier **allow-query** `/etc/bind/named.conf.options` ~~~c forwarders { 80.67.169.12; 80.67.169.40; }; allow-query { any; }; ~~~ ## Récursion Voir http://www.coursnet.com/2014/12/les-requetes-dns-recursives-iteratives.html `/etc/named.conf` ~~~c options { /* - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. - If you are building a RECURSIVE (caching) DNS server, you need to enable recursion. - If your recursive DNS server has a public IP address, you MUST enable access control to limit queries to your legitimate users. Failing to do so will cause your server to become part of large scale DNS amplification attacks. Implementing BCP38 within your network would greatly reduce such attack surface */ recursion no; /* ... */ }; ~~~ ## Désactiver IPV6 Si l'on n'utilise pas l’IPv6, on peut désactiver le protocole en éditant /etc/sysconfig/named ~~~ OPTIONS="-4" ~~~ Voir aussi les options : * `listen-on` for IPv4 addresses * `listen-on-v6` for IPv6 addresses * `query-source` for IPv4 addresses * `query-source-v6` for IPv6 addresse Exemple : ~~~ options { // Listen on all IPv4 addresses (default) listen-on { any; }; // No listen on IPv6 listen-on-v6 { none; }; }; ~~~ Il faudra également ajouter une option à /etc/named.conf. `/etc/named.conf` ~~~c options { //filter-aaaa-on-v4 yes; //option 'filter-aaaa-on-v4' no longer exists // Voir AAAA vs A6 }; ~~~ Remplacé par ~~~c plugin query "filter-aaaa.so" { filter-aaaa-on-v4 yes; filter-aaaa-on-v6 yes; filter-aaaa { 192.0.2.1; 2001:db8:2::1; }; }; ~~~ Voir aussi Prevent your server from using the learned IPv6 addresses itself during recursion ~~~c server ::/0 { bogus yes; }; ~~~ source : https://blog.microlinux.fr/bind-centos-7/ ------------------------- # Install DNS Server Bind9 ## Notes DNS use port TCP:53 and UDP:53 ## Install ~~~bash apt-get install bind9 bind9utils dnsutils ~~~ `/etc/bind/named.conf.local` ~~~c zone "local" { type master; file "/etc/bind/db.local"; allow-transfer { 10.8.16.47; }; notify yes; }; ~~~ `/etc/bind/db.local` ~~~c $TTL 604800 @ IN SOA dns.local. root.dns.local. ( 2015121606 ; serial 86400 ; refresh (1 day) 3600 ; retry (1 hour) 3600000 ; expire (5 weeks 6 days 16 hours) 86400 ; minimum (1 day) ) @ IN NS dns.local. @ IN NS ns1.local. @ IN A 10.8.15.215 dns IN A 10.8.15.215 ns1 IN A 10.8.16.47 bastion IN A 10.8.16.190 proxy IN CNAME bastion ldap IN A 10.8.16.201 ~~~ ### If server must forward `/etc/bind/named.conf.options` ~~~c forwarders { 10.8.15.1; }; allow-query { any; }; ~~~ `/etc/bind/.gitignore` ~~~ *.key *.keys db.0 db.127 db.255 db.empty db.local db.root ~~~ ## Reload ~~~bash rndc reload ~~~ ## Check ~~~bash named-checkconf named-checkzone local /etc/bind/db.local #service bind9 reload rndc reload local service bind9 status dig +short @127.0.0.1 bastion.local ~~~ ## Configure GNU/Linux client Infra VM `/etc/resolv.conf` ~~~ini #domain local search local #options rotate timeout:1 retries:1 #options edns0 nameserver 10.8.15.215 ~~~ VPN clients `/etc/resolv.conf` ~~~ini #domain local search local #options rotate timeout:1 retries:1 nameserver 10.9.0.1 ~~~ Prevent DHCP to change /etc/resolv.conf ~~~bash chattr +i /etc/resolv.conf lsattr /etc/resolv.conf ~~~ FIXME : A tester avec SystemD (/etc/systemd/resolved.conf) On openvpn-it1 (DNS Slave) `/etc/bind/named.conf.local` ~~~c zone "local" { type slave; masters { 10.8.15.215; }; allow-notify { 10.8.15.215; }; file "/var/lib/bind/db.local"; allow-transfer { 10.9.0.21; } ; }; ~~~ ## Autres ~~~bash for fqdn in $(rgrep 192.168.10.22 /etc/bind/zones | sed -e 's%^/etc/bind/zones/%%' -e 's%.db%%' | awk '{print $1}' | awk -F':' '{print $2 "." $1 }' | sed -e 's%^@.%%' | sort -n) ; do host $fqdn ; done | grep 'has address 192.168.10.22' | awk '{print $1}' ~~~ Get TTL ~~~bash dig +ttlunits +noall +answer @127.0.0.1 example.org ~~~