Public SourceMage Discussion List

[Seth Woolley <seth AT tautology.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

The mkzones.sh script isn't that smart, but there's nothing that says you
have to use the script.  Just use a view and define them both inside the
zones.conf file:

http://www.csd.uwo.ca/staff/magi/doc/bind9/Bv9ARM.ch06.html#AEN3035

Seth

On Fri, 19 Sep 2003, Robin Cook wrote:

> How does this effect DNS servers, if at all, that serve two different IP
> address for a DNS name depending on where the request came from (ie
> private IP addresses and public IP addresses)?
>
> CuZnDragon
> Robin Cook
>
> On Fri, 2003-09-19 at 05:51, Seth Woolley wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > Please test it.  To prevent DOS attacks on /etc/ I had it move the config
> > and the chroot dir over to /var/chroot/bind which has a symlink
> > from /etc/bind.  there's a symlink from /etc/bind/etc/bind back to / so
> > that chrooting doesn't require a modification to the config (just remove
> > the -t /etc/bind from the init script to make it not chroot).
> >
> > There's a new config layout, too.  master and slave zones have their own
> > directories and config files (mkzones.sh is a tool to create the
> > zones.conf and szones.conf files which are included in named.conf), and
> > make sure to put your options in options.conf. That allows us to change
> > around defaults easily with just an update and makes my scripting easier.
> > Hope nobody minds, I like it this way better.
> >
> > And it grabs the root zone if it can connect to internic for
> > use in with the delegation-only.  It also generates the named.root from
> > dig . ns automatically if it can do that.  It automatically backs up your
> > config (I hope) and puts it into the new chroot directory as well...  but
> > it's still in test for your testing pleasure.  The slave zone it creates
> > can be copied to another copy of smgl bind in one easy step to have a
> > slave setup.  localhost.rev is auto-generated as well if it doesn't exist.
> >
> > All TLDs are set to delegation-only by default, to prevent the dozen or so
> > CC and G TLDs from using wildcard results to siphon off typo hits:
> >
> > http://isc.org/products/BIND/delegation-only.html
> >
> > All future BIND releases will contain the patch from the sound of it.  No
> > need to null route their IP anymore or use the hosts file:
> >
> > route add 64.94.110.11 reject
> > (or I think:, /etc/hosts:64.94.110.11 0.0.0.0)
> >
> > zone ".com" { type: delegation-only; };
> >
> > $ host lfkjdslfjlsfajsfl.com 4.2.2.1
> > lfkjdslfjlsfajsfl.com   A       64.94.110.11
> > $ host lfkjdslfjlsfajsfl.com 65.102.47.193
> > lfkjdslfjlsfajsfl.com does not exist at ns0.positivism.org, try again
> >
> > works like a charm, but to be honest, you need to make a list to be 
> > complete:
> >
> > # modified from some url I don't remember... original used curl and ipget 
> > and printed out the returned IP
> > for dom in `wget -O - --passive 
> > ftp://ftp.internic.net/domain/root.zone.gz 2> /dev/null | gunzip -c | 
> > grep NS | awk '{print $1}' | uniq | egrep "^[^\.]*\.$"`; do
> >         host "*.$dom" > /dev/null 2> /dev/null && echo zone '"'$dom'"' '{ 
> > type delegation-only; };'
> > done
> >
> > zone "MUSEUM." { type delegation-only; };
> > zone "AC." { type delegation-only; };
> > zone "BZ." { type delegation-only; };
> > zone "CN." { type delegation-only; };
> > zone "COM." { type delegation-only; };
> > zone "CX." { type delegation-only; };
> > zone "MP." { type delegation-only; };
> > zone "NET." { type delegation-only; };
> > zone "NU." { type delegation-only; };
> > zone "PH." { type delegation-only; };
> > zone "PW." { type delegation-only; };
> > zone "SH." { type delegation-only; };
> > zone "TD." { type delegation-only; };
> > zone "TK." { type delegation-only; };
> > zone "TM." { type delegation-only; };
> > zone "TW." { type delegation-only; };
> > zone "WS." { type delegation-only; };
> > zone "CC." { type delegation-only; };
> >
> > Seth
> > - --
> > Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
> > Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
> > Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.2.2 (FreeBSD)
> >
> > iD8DBQE/at/R7fQ833vqzH0RAkWCAKDOiHq+g2zYCJXn62PHfhH1/igP8QCgnetB
> > sbYeF3f9s+oZ0r2r0ICp4/0=
> > =xzYo
> > -----END PGP SIGNATURE-----
> >
> > _______________________________________________
> > SM-Discuss mailing list
> > SM-Discuss AT lists.ibiblio.org
> > http://lists.ibiblio.org/mailman/listinfo/sm-discuss
> >
>
>

- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (FreeBSD)

iD8DBQE/ax4E7fQ833vqzH0RAsBHAJ4329NoOIRBOoRKEPAJqjrQY8jwaQCfc9JR
ZJrOquKzeUugbE6PYE5mzP0=
=000W
-----END PGP SIGNATURE-----