Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] bind 9.2.2-P1 w/ delegation-only and chrooting in devel and test

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Robin Cook <rcook AT wyrms.net>
  • To: Seth Woolley <seth AT tautology.org>
  • Cc: Source Mage - Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] bind 9.2.2-P1 w/ delegation-only and chrooting in devel and test
  • Date: Fri, 19 Sep 2003 07:15:17 -0500

How does this effect DNS servers, if at all, that serve two different IP
address for a DNS name depending on where the request came from (ie
private IP addresses and public IP addresses)?

CuZnDragon
Robin Cook

On Fri, 2003-09-19 at 05:51, Seth Woolley wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Please test it. To prevent DOS attacks on /etc/ I had it move the config
> and the chroot dir over to /var/chroot/bind which has a symlink
> from /etc/bind. there's a symlink from /etc/bind/etc/bind back to / so
> that chrooting doesn't require a modification to the config (just remove
> the -t /etc/bind from the init script to make it not chroot).
>
> There's a new config layout, too. master and slave zones have their own
> directories and config files (mkzones.sh is a tool to create the
> zones.conf and szones.conf files which are included in named.conf), and
> make sure to put your options in options.conf. That allows us to change
> around defaults easily with just an update and makes my scripting easier.
> Hope nobody minds, I like it this way better.
>
> And it grabs the root zone if it can connect to internic for
> use in with the delegation-only. It also generates the named.root from
> dig . ns automatically if it can do that. It automatically backs up your
> config (I hope) and puts it into the new chroot directory as well... but
> it's still in test for your testing pleasure. The slave zone it creates
> can be copied to another copy of smgl bind in one easy step to have a
> slave setup. localhost.rev is auto-generated as well if it doesn't exist.
>
> All TLDs are set to delegation-only by default, to prevent the dozen or so
> CC and G TLDs from using wildcard results to siphon off typo hits:
>
> http://isc.org/products/BIND/delegation-only.html
>
> All future BIND releases will contain the patch from the sound of it. No
> need to null route their IP anymore or use the hosts file:
>
> route add 64.94.110.11 reject
> (or I think:, /etc/hosts:64.94.110.11 0.0.0.0)
>
> zone ".com" { type: delegation-only; };
>
> $ host lfkjdslfjlsfajsfl.com 4.2.2.1
> lfkjdslfjlsfajsfl.com A 64.94.110.11
> $ host lfkjdslfjlsfajsfl.com 65.102.47.193
> lfkjdslfjlsfajsfl.com does not exist at ns0.positivism.org, try again
>
> works like a charm, but to be honest, you need to make a list to be
> complete:
>
> # modified from some url I don't remember... original used curl and ipget
> and printed out the returned IP
> for dom in `wget -O - --passive ftp://ftp.internic.net/domain/root.zone.gz
> 2> /dev/null | gunzip -c | grep NS | awk '{print $1}' | uniq | egrep
> "^[^\.]*\.$"`; do
> host "*.$dom" > /dev/null 2> /dev/null && echo zone '"'$dom'"' '{
> type delegation-only; };'
> done
>
> zone "MUSEUM." { type delegation-only; };
> zone "AC." { type delegation-only; };
> zone "BZ." { type delegation-only; };
> zone "CN." { type delegation-only; };
> zone "COM." { type delegation-only; };
> zone "CX." { type delegation-only; };
> zone "MP." { type delegation-only; };
> zone "NET." { type delegation-only; };
> zone "NU." { type delegation-only; };
> zone "PH." { type delegation-only; };
> zone "PW." { type delegation-only; };
> zone "SH." { type delegation-only; };
> zone "TD." { type delegation-only; };
> zone "TK." { type delegation-only; };
> zone "TM." { type delegation-only; };
> zone "TW." { type delegation-only; };
> zone "WS." { type delegation-only; };
> zone "CC." { type delegation-only; };
>
> Seth
> - --
> Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
> Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
> Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.2 (FreeBSD)
>
> iD8DBQE/at/R7fQ833vqzH0RAkWCAKDOiHq+g2zYCJXn62PHfhH1/igP8QCgnetB
> sbYeF3f9s+oZ0r2r0ICp4/0=
> =xzYo
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss
>





Archive powered by MHonArc 2.6.24.

Top of Page