Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] bind 9.2.2-P1 w/ delegation-only and chrooting in devel and test

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Robin Cook <rcook AT wyrms.net>
  • To: Seth Woolley <seth AT tautology.org>
  • Cc: Source Mage - Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] bind 9.2.2-P1 w/ delegation-only and chrooting in devel and test
  • Date: Fri, 19 Sep 2003 21:55:15 -0500

I already have a named.conf that does this. I just wanted to make sure
I wouldn't have to rewrite the whole thing or loose it.

I dislike when they break up a config file and then have the extra files
added back in with include statements. Though I don't think it will
break things with this, when they started doing this with apache it
started breaking a lot of other extras that didn't know how to handle
the include statement.

Breaking up of a config file is not always good.

CuZnDragon
Robin Cook

On Fri, 2003-09-19 at 10:17, Seth Woolley wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> The mkzones.sh script isn't that smart, but there's nothing that says you
> have to use the script. Just use a view and define them both inside the
> zones.conf file:
>
> http://www.csd.uwo.ca/staff/magi/doc/bind9/Bv9ARM.ch06.html#AEN3035
>
> Seth
>
> On Fri, 19 Sep 2003, Robin Cook wrote:
>
> > How does this effect DNS servers, if at all, that serve two different IP
> > address for a DNS name depending on where the request came from (ie
> > private IP addresses and public IP addresses)?
> >
> > CuZnDragon
> > Robin Cook
> >
> > On Fri, 2003-09-19 at 05:51, Seth Woolley wrote:
> > > -----BEGIN PGP SIGNED MESSAGE-----
> > > Hash: SHA1
> > >
> > > Please test it. To prevent DOS attacks on /etc/ I had it move the
> > > config
> > > and the chroot dir over to /var/chroot/bind which has a symlink
> > > from /etc/bind. there's a symlink from /etc/bind/etc/bind back to / so
> > > that chrooting doesn't require a modification to the config (just remove
> > > the -t /etc/bind from the init script to make it not chroot).
> > >
> > > There's a new config layout, too. master and slave zones have their own
> > > directories and config files (mkzones.sh is a tool to create the
> > > zones.conf and szones.conf files which are included in named.conf), and
> > > make sure to put your options in options.conf. That allows us to change
> > > around defaults easily with just an update and makes my scripting
> > > easier.
> > > Hope nobody minds, I like it this way better.
> > >
> > > And it grabs the root zone if it can connect to internic for
> > > use in with the delegation-only. It also generates the named.root from
> > > dig . ns automatically if it can do that. It automatically backs up
> > > your
> > > config (I hope) and puts it into the new chroot directory as well...
> > > but
> > > it's still in test for your testing pleasure. The slave zone it creates
> > > can be copied to another copy of smgl bind in one easy step to have a
> > > slave setup. localhost.rev is auto-generated as well if it doesn't
> > > exist.
> > >
> > > All TLDs are set to delegation-only by default, to prevent the dozen or
> > > so
> > > CC and G TLDs from using wildcard results to siphon off typo hits:
> > >
> > > http://isc.org/products/BIND/delegation-only.html
> > >
> > > All future BIND releases will contain the patch from the sound of it.
> > > No
> > > need to null route their IP anymore or use the hosts file:
> > >
> > > route add 64.94.110.11 reject
> > > (or I think:, /etc/hosts:64.94.110.11 0.0.0.0)
> > >
> > > zone ".com" { type: delegation-only; };
> > >
> > > $ host lfkjdslfjlsfajsfl.com 4.2.2.1
> > > lfkjdslfjlsfajsfl.com A 64.94.110.11
> > > $ host lfkjdslfjlsfajsfl.com 65.102.47.193
> > > lfkjdslfjlsfajsfl.com does not exist at ns0.positivism.org, try again
> > >
> > > works like a charm, but to be honest, you need to make a list to be
> > > complete:
> > >
> > > # modified from some url I don't remember... original used curl and
> > > ipget and printed out the returned IP
> > > for dom in `wget -O - --passive
> > > ftp://ftp.internic.net/domain/root.zone.gz 2> /dev/null | gunzip -c |
> > > grep NS | awk '{print $1}' | uniq | egrep "^[^\.]*\.$"`; do
> > > host "*.$dom" > /dev/null 2> /dev/null && echo zone '"'$dom'"'
> > > '{ type delegation-only; };'
> > > done
> > >
> > > zone "MUSEUM." { type delegation-only; };
> > > zone "AC." { type delegation-only; };
> > > zone "BZ." { type delegation-only; };
> > > zone "CN." { type delegation-only; };
> > > zone "COM." { type delegation-only; };
> > > zone "CX." { type delegation-only; };
> > > zone "MP." { type delegation-only; };
> > > zone "NET." { type delegation-only; };
> > > zone "NU." { type delegation-only; };
> > > zone "PH." { type delegation-only; };
> > > zone "PW." { type delegation-only; };
> > > zone "SH." { type delegation-only; };
> > > zone "TD." { type delegation-only; };
> > > zone "TK." { type delegation-only; };
> > > zone "TM." { type delegation-only; };
> > > zone "TW." { type delegation-only; };
> > > zone "WS." { type delegation-only; };
> > > zone "CC." { type delegation-only; };
> > >
> > > Seth
> > > - --
> > > Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
> > > Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
> > > Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
> > > -----BEGIN PGP SIGNATURE-----
> > > Version: GnuPG v1.2.2 (FreeBSD)
> > >
> > > iD8DBQE/at/R7fQ833vqzH0RAkWCAKDOiHq+g2zYCJXn62PHfhH1/igP8QCgnetB
> > > sbYeF3f9s+oZ0r2r0ICp4/0=
> > > =xzYo
> > > -----END PGP SIGNATURE-----
> > >
> > > _______________________________________________
> > > SM-Discuss mailing list
> > > SM-Discuss AT lists.ibiblio.org
> > > http://lists.ibiblio.org/mailman/listinfo/sm-discuss
> > >
> >
> >
>
> - --
> Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
> Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
> Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.2 (FreeBSD)
>
> iD8DBQE/ax4E7fQ833vqzH0RAsBHAJ4329NoOIRBOoRKEPAJqjrQY8jwaQCfc9JR
> ZJrOquKzeUugbE6PYE5mzP0=
> =000W
> -----END PGP SIGNATURE-----
>
>





Archive powered by MHonArc 2.6.24.

Top of Page