BIND 9 Administrator Reference Manual I S C Copyright c 2004, 2005, 2006, 2007, 2008, 2009, 2010 Internet Systems Consortium, Inc. (”ISC”) Copyright c 2000, 2001, 2002, 2003 Internet Software Consortium. Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies. THE SOFTWARE IS PROVIDED ”AS IS” AND ISC DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 2 Contents 1 Introduction 9 1.1 Scope of Document . 9 1.2 Organization of This Document . 9 1.3 Conventions Used in This Document . 9 1.4 The Domain Name System (DNS) . 10 1.4.1 DNS Fundamentals . 10 1.4.2 Domains and Domain Names . 10 1.4.3 Zones . 10 1.4.4 Authoritative Name Servers . 11 1.4.4.1 The Primary Master . 11 1.4.4.2 Slave Servers . 11 1.4.4.3 Stealth Servers . 11 1.4.5 Caching Name Servers . 12 1.4.5.1 Forwarding . 12 1.4.6 Name Servers in Multiple Roles . 12 2 BIND Resource Requirements 13 2.1 Hardware requirements . 13 2.2 CPU Requirements . 13 2.3 Memory Requirements . 13 2.4 Name Server Intensive Environment Issues . 13 2.5 Supported Operating Systems . 14 3 Name Server Configuration 15 3.1 Sample Configurations . 15 3.1.1 A Caching-only Name Server . 15 3.1.2 An Authoritative-only Name Server . 15 3.2 Load Balancing . 16 3.3 Name Server Operations . 17 3.3.1 Tools for Use With the Name Server Daemon . 17 3.3.1.1 Diagnostic Tools . 17 3.3.1.2 Administrative Tools . 17 3.3.2 Signals . 20 4 Advanced DNS Features 21 4.1 Notify . 21 4.2 Dynamic Update . 21 4.2.1 The journal file . 21 4.3 Incremental Zone Transfers (IXFR) . 22 4.4 Split DNS . 22 4.4.1 Example split DNS setup . 23 4.5 TSIG . 25 4.5.1 Generate Shared Keys for Each Pair of Hosts . 26 4.5.1.1 Automatic Generation . 26 4.5.1.2 Manual Generation . 26 4.5.2 Copying the Shared Secret to Both Machines . 26 4.5.3 Informing the Servers of the Key’s Existence . 26 4.5.4 Instructing the Server to Use the Key . 27 4.5.5 TSIG Key Based Access Control . 27 4.5.6 Errors . 27 4.6 TKEY . 27 4.7 SIG(0) . 28 4.8 DNSSEC . 28 3 CONTENTS 4.8.1 Generating Keys . 28 4.8.2 Signing the Zone . 29 4.8.3 Configuring Servers . 29 4.9 DNSSEC, Dynamic Zones, and Automatic Signing . 31 4.9.1 Converting from insecure to secure . 31 4.9.2 Dynamic DNS update method . 31 4.9.3 Fully automatic zone signing . 32 4.9.4 Private-type records . 32 4.9.5 DNSKEY rollovers via UPDATE . 33 4.9.6 NSEC3PARAM rollovers via UPDATE . 33 4.9.7 Converting from NSEC to NSEC3 . 33 4.9.8 Converting from NSEC3 to NSEC . 33 4.9.9 Converting from secure to insecure . 33 4.9.10 Periodic re-signing . 34 4.9.11 NSEC3 and OPTOUT . 34 4.10 Dynamic Trust Anchor Management . 34 4.10.1 Validating Resolver . 34 4.10.2 Authoritative Server . 34 4.11 PKCS #11 (Cryptoki) support . 35 4.11.1 Prerequisites . 35 4.11.1.1 Building OpenSSL for the AEP Keyper on Linux . 36 4.11.1.2 Building OpenSSL for the SCA 6000 on Solaris . 37 4.11.2 Building BIND 9 with PKCS#11 . 37 4.11.2.1 Configuring BIND 9 for Linux . 37 4.11.2.2 Configuring BIND 9 for Solaris . 38 4.11.3 PKCS #11 Tools . 38 4.11.4 Using the HSM . 38 4.11.5 Specifying the engine on the command line . 39 4.11.6 Running named with automatic zone re-signing . 40 4.12 IPv6 Support in BIND 9 . 40 4.12.1 Address Lookups Using AAAA Records . 41 4.12.2 Address to Name Lookups Using Nibble Format . 41 5 The BIND 9 Lightweight Resolver 43 5.1 The Lightweight Resolver Library . 43 5.2 Running a Resolver Daemon . 43 6 BIND 9 Configuration Reference 45 6.1 Configuration File Elements . 45 6.1.1 Address Match Lists . 46 6.1.1.1 Syntax . 46 6.1.1.2 Definition and Usage . 47 6.1.2 Comment Syntax . 47 6.1.2.1 Syntax . 47 6.1.2.2 Definition and Usage . 48 6.2 Configuration File Grammar . ..
Details
-
File Typepdf
-
Upload Time-
-
Content LanguagesEnglish
-
Upload UserAnonymous/Not logged-in
-
File Pages174 Page
-
File Size-