Problem Bind

[tyu38]

Witam.

 

Postawilem dwa serwery na Red Hacie. Usługa DNS dziala bez problemu chrootowskim srodowisku.

 

 

Postanowilem zrobic to samo, na Fedorze 12 jako wirtualnym komputerze ( vmware server ). Niestety, za zadne skarby bind nie chce wspolpracowac. Postaram sie po koleji opisac kroki, ktore wykonalem na Red Hacie i Fedorze 12.

 

Podczas instalacji systemu od razu zaznaczylem pakiet binda, nastepnie dokonalem potrzebnych aktualizacji ( yum update ).

 

Co ciekawe, w Red Hacie named dziala w chroocie i widzi plik named.conf ( /var/named/chroot/etc/ ), pliki root.servers oraz db.serwer.testowy znajduja sie w /var/named/chroot/var/named/data

 

named.conf:

 

// MASTER & CACHING NAME SERVER for EXAMPLE, INC.
// maintained by: me myself alone
// CHANGELOG:
// 1. 9 july 2003 - did something
// 2. 16 july 2003 - did something else
// 3. 23 july 2003 - did something more
//
options {
  directory "/var/named/";
  // version statement - inhibited for security
  // (avoids hacking any known weaknesses)    
  version "get lost";
  // optional - disables all transfers 
  // slaves allowed in zone clauses
  allow-transfer {"none";};
    // Closed DNS - permits only local IPs to issue recursive queries 
  // remove if an Open DNS required to support all users 
  // or add additional ranges 
# allow-recursion {192.168.3.0/24;};
};
//
// log to /var/log/named/example.log all events from 
// info UP in severity (no debug)
// defaults to use 3 files in rotation
// BIND 8.x logging MUST COME FIRST in this file
// BIND 9.x parses the whole file before using the log
// failure messages up to this point are in (syslog) 
// typically /var/log/message
  logging{
  channel example_log{
   file "/var/log/named/example.log" versions 3 size 2m;
   severity info;
   print-severity yes;
   print-time yes;
   print-category yes;
};
category default{
  example_log;
};
};

zone "." {
  type hint;
  file "/var/named/data/root.servers";
};
zone "testowa" in {
  type master;
  file "/var/named/data/db.serwer.testowa";
};

 

root.serwers:

 

;       This file holds the information on root name servers needed to
;       initialize cache of Internet domain name servers
;       (e.g. reference this file in the "cache  .  "
;       configuration file of BIND domain name servers).
;
;       This file is made available by InterNIC 
;       under anonymous FTP as
;           file                /domain/named.root
;           on server           FTP.INTERNIC.NET
;       -OR-                    RS.INTERNIC.NET
;
;       last update:    Jan 29, 2004
;       related version of root zone:   2004012900
;
;
; formerly NS.INTERNIC.NET
;
.                        3600000  IN  NS    A.ROOT-SERVERS.NET.
A.ROOT-SERVERS.NET.      3600000      A     198.41.0.4
;
; formerly NS1.ISI.EDU
;
.                        3600000      NS    B.ROOT-SERVERS.NET.
B.ROOT-SERVERS.NET.      3600000      A     192.228.79.201
;
; formerly C.PSI.NET
;
.                        3600000      NS    C.ROOT-SERVERS.NET.
C.ROOT-SERVERS.NET.      3600000      A     192.33.4.12
;
; formerly TERP.UMD.EDU
;
.                        3600000      NS    D.ROOT-SERVERS.NET.
D.ROOT-SERVERS.NET.      3600000      A     128.8.10.90
;
; formerly NS.NASA.GOV
;
.                        3600000      NS    E.ROOT-SERVERS.NET.
E.ROOT-SERVERS.NET.      3600000      A     192.203.230.10
;
; formerly NS.ISC.ORG
;
.                        3600000      NS    F.ROOT-SERVERS.NET.
F.ROOT-SERVERS.NET.      3600000      A     192.5.5.241
;
; formerly NS.NIC.DDN.MIL
;
.                        3600000      NS    G.ROOT-SERVERS.NET.
G.ROOT-SERVERS.NET.      3600000      A     192.112.36.4
;
; formerly AOS.ARL.ARMY.MIL
;
.                        3600000      NS    H.ROOT-SERVERS.NET.
H.ROOT-SERVERS.NET.      3600000      A     128.63.2.53
;
; formerly NIC.NORDU.NET
;
.                        3600000      NS    I.ROOT-SERVERS.NET.
I.ROOT-SERVERS.NET.      3600000      A     192.36.148.17
;
; operated by VeriSign, Inc.
;
.                        3600000      NS    J.ROOT-SERVERS.NET.
J.ROOT-SERVERS.NET.      3600000      A     192.58.128.30
;
; operated by RIPE NCC
;
.                        3600000      NS    K.ROOT-SERVERS.NET.
K.ROOT-SERVERS.NET.      3600000      A     193.0.14.129 
;
; operated by ICANN
;
.                        3600000      NS    L.ROOT-SERVERS.NET.
L.ROOT-SERVERS.NET.      3600000      A     198.32.64.12
;
; operated by WIDE
;
.                        3600000      NS    M.ROOT-SERVERS.NET.
M.ROOT-SERVERS.NET.      3600000      A     202.12.27.33
; End of File

 

 

db.serwer.testowa:

 

$ORIGIN testowa.
$TTL 86400
@     IN     SOA    ns1.testowa.     root.testowa. (
                    2009113001; serial
                    21600    ; refresh after 6 hours
                    3600     ; retry after 1 hour
                    604800; expire after 1 week
                    86400 )  ; minimum TTL of 1 day

      IN     NS     ns1.testowa.
ns1             IN     A       192.168.10.124    
serwer         IN     A       192.168.10.124

 

Wszystko ladnie dziala, jednak probujac zrobic to samo na Fedorze od razu natrafilem na problemy. Chociaz stworzyl sobie katalog chroot i odzwzorowal drzewo katalogow, to i tak nie zwraca uwagi na nie. Laduje plik named.conf z /etc, zamiast z /var/named/etc/ jak w RH. Postanowilem skofigurowac w takim razie binda bez srodowiska chrotowskeigo, niestety nie dziala.

named.conf

 

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

options {
        listen-on port 53 { 127.0.0.1; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { localhost; };
        recursion yes;
        dnssec-enable yes;
        dnssec-validation yes;
        dnssec-lookaside . trust-anchor dlv.isc.org.;
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

zone "testowa" in {
type master;
file "/var/named/db.serwer.testowa";
};

include "/etc/named.rfc1912.zones";

include "/etc/pki/dnssec-keys//named.dnssec.keys";
include "/etc/pki/dnssec-keys//dlv/dlv.isc.org.conf";

 

Pliku root.serwers nie tworzylem poniewaz, plik named.ca pełni jego role.

 

Plik db.serwer.testowa wyglada tak samo jak w RH, oprocz adresow IP

 

$ORIGIN testowa.
$TTL 86400
@     IN     SOA    ns1.testowa.     root.testowa. (
                    20100412; serial
                    21600    ; refresh after 6 hours
                    3600     ; retry after 1 hour
                    604800; expire after 1 week
                    86400 )  ; minimum TTL of 1 day

      IN     NS     ns1.testowa.
ns1             IN     A       192.168.137.51    
serwer         IN     A       192.168.137.51

 

Usluga uruchamie sie bez błedow, logi tez niczego nie wykazuja:

 

named.run:

 

zone 0.in-addr.arpa/IN: NS '0.in-addr.arpa' has no address records (A or AAAA)
zone 0.in-addr.arpa/IN: loaded serial 0
zone 1.0.0.127.in-addr.arpa/IN: NS '1.0.0.127.in-addr.arpa' has no address records (A or AAAA)
zone 1.0.0.127.in-addr.arpa/IN: loaded serial 0
zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: NS '1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa' has no address records (A or AAAA)
zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 0
zone localhost.localdomain/IN: loaded serial 0
zone localhost/IN: loaded serial 0
zone testowa/IN: loaded serial 20100412
running

 

 

Po wywolaniu komendy:

 

[root@localhost named]# named-checkzone testowa /var/named/db.serwer.testowa
zone testowa/IN: loaded serial 20100412
OK

 

 

Instalowalem system 3 razy od poczatku, moje pomysly sie skonczyly, prosze o pomoc.

[@sunrise]

A w /etc/sysconfig/named masz ustawione

ROOTDIR="/var/named/chroot"?