Server Installation/BIND

Je nach Einsatzzweck gibt es zwei Arten von DNS Server Installationen. Auf Gateway Servern betreiben wir Caching-DNS incl. einen Transfer der Opennet internen DNS Zonen. Zentral betreiben wir einen Authoritative-DNS für die öffentlichen und internen Opennet DNS Zonen.

Opennet Gateway Server: Caching NS

| warning = #b22222 solid;background-color: #ffdddd;"> | caution = #f28500 solid;background-color: #ffffaa;"> | approval = #00ff00 solid;background-color: #deffde;"> | proposal = #9932cc solid;background-color: #e4d8ff;"> | detail = #f4c430 solid;background-color: #fbfbfb;"> | protection = #bba solid;background-color: #fbfbfb;"> | notice | #default = #1e90ff solid;background-color: #fbfbfb;"> }} {{#switch: | blank | none =

| #default =

}}

{{#if: | {{#ifeq:|none

 | 

| }} }}

• Erforderliche Pakete installieren: bind9
• falls noch kein rndc-Key - rndc absichern per rndc-conf -a
• mkdir /var/log/bind; chown bind /var/log/bind
• /etc/bind/named.conf.options:

acl opennet { 
  127.0.0.1; 192.168.0.0/16; 172.16.0.0/12; 10.0.0.0/8; 
  139.30.241.202;
};
key dnskey.opennet {
       algorithm hmac-md5;
       secret "<<<<Key von anderem Gateway holen>>>>";
};
server 139.30.241.202 {
       keys dnskey.opennet;
};
server 192.168.10.2 {
       keys dnskey.opennet;
};
options {
  directory "/var/cache/bind";
  auth-nxdomain no;    # conform to RFC1035
  allow-recursion { opennet; };
  allow-transfer { opennet; }; 
  listen-on-v6 { any; };    # activate IPv6
  check-names slave ignore;    # ignoriert unterstrich in Domainnamen vom ON 
};
logging {
        channel logfile {
          file "/var/log/bind/named.log" versions 2 size 1M;
          print-time yes;
#          syslog local2;
          print-category yes;
          print-severity yes;
          severity info;
        };
        category default { logfile;  };
        category general { logfile; };
#        category queries { null;  };
#        category lame-servers { null; };
#        category update { null; };
};

• /etc/bind/named.conf.local:

// on - forward (includes vpn)
zone "on." {
        type    slave;
        file    "db.on";
        masters {139.30.241.202; 192.168.10.2; };
};
//on - reverse
zone "168.192.in-addr.arpa" {
        type    slave;
        file    "db.192.168";
        masters {139.30.241.202; 192.168.10.2; };
};
//on-vpn - reverse
zone "1.10.in-addr.arpa" {
        type    slave;
        file    "db.10.1";
        masters {139.30.241.202; 192.168.10.2; };
};
//on-ugw - reverse
zone "2.10.in-addr.arpa" {
        type    slave;
        file    "db.10.2";
        masters {139.30.241.202; 192.168.10.2; };
};

• lokale Namensauflösung /etc/resolv.conf:

search on
nameserver 127.0.0.1

• Überschreiben der Namensauflösung durch ppp-Einwahl unterbinden - /etc/ppp/peers/provider:

#usepeerdns

• Nameserver starten: /etc/init.d/bind9 start
• Funktion prüfen: ps aux|grep bind und rndc status
• Fehlermeldungen suchen: grep named /var/log/daemon.log|tail -20 bzw. tail /var/log/bind/named.log (falls Logfile vorhanden)
• Zonen-Transfer manuell durchführen: rndc retransfer on

Opennet Dienste Server: Authoritative NS

Konfiguration

// opennet 
include "/etc/bind/keys/opennet-transfer.key";
include "/etc/bind/keys/opennet-dyndns-aps.key";
include "/etc/bind/acls/opennet-internetx.acl";
options {
   directory "/var/cache/bind";
   dnssec-validation auto;
   auth-nxdomain no;    # conform to RFC1035
   listen-on-v6 { any; };
   // opennet
  version "opennet";
   recursion no;
   allow-query { any; };
   allow-transfer { 
     127.0.0.1; 
     key dnskey.opennet;
     internetx;
   };
};

Fehlersuche

named-checkconf -z

DNSSEC (Zone Signing)

Ab Bind 9.9 via "inline-signing": https://kb.isc.org/article/AA-00626/0/Inline-Signing-in-ISC-BIND-9.9.0-Examples.html

• DNS Keys pro Zone anlegen (nur einmalig notwendig):

cd /etc/bind
chown bind:bind keys zones
cd keys
dnssec-keygen <zone>
dnssec-keygen -fk <zone>

• DNSSEC Keys /etc/bind/named.conf.options aktivieren:

options {
   ....
   dnssec-enable yes;
   key-directory "/etc/bind/keys";
}

• Konfiguration der Zone um DNSSEC erweitern:

zone "<zone>" IN {
   auto-dnssec maintain;
   inline-signing yes;
}

• Signing ausführen und Kontrolle:

rndc reconfig
rndc signing -list <zone>
   Done signing with key .../RSASHA1
   Done signing with key .../RSASHA1
dig <zone> DNSKEY +multiline

• anschließend den Key Signing Key (KSK, DNSKEY 257) via BASE64 (eine Zeile, keine Leerzeichen!) beim zuständigen Registrar eintragen lassen