Commit Graph

64 Commits

Author SHA1 Message Date
Doug Barton
e45bba92cb Update the example named.conf file to answer locally for the newly
released IPv4 documentation ranges (http://tools.ietf.org/html/rfc5737)
and catch up to the IPv6 documentation range and domain names that 5737
also references.
2010-01-18 18:37:47 +00:00
Doug Barton
0fcd844921 The named process needs to have a "working directory" that it can
write to. This is specified in "options { directory }" in named.conf.
So, create /etc/namedb/working with appropriate permissions, and
update the entry in named.conf to match.

In addition to specifying the working directory, file and path names
in named.conf can be specified relative to the directory listed.
However, since that directory is now different from /etc/namedb
(where the configuration, zone, rndc.*, and other files are located)
further update named.conf to specify all file names with fully
qualified paths. Also update the comment about file and path names
so users know this should be done for all file/path names in the file.

This change will eliminate the 'working directory is not writable'
messages at boot time without sacrificing security. It will also
allow for features in newer versions of BIND (9.7+) to work as
designed.
2009-12-15 05:14:39 +00:00
Doug Barton
1d0185c436 Update to the December 12, 2008 version of this file. The one
substantive change is to add the IPv6 address of L. The other
changes are all CAPS LOCK related.
2009-12-11 01:06:04 +00:00
Doug Barton
94d77159ae 1. New feature; option to have the script loop until a specified hostname
(localhost by default) can be successfully looked up. Off by default.
2. New feature: option to create a forwarder configuration file based on
the contents of /etc/resolv.conf. This allows you to utilize a local
resolver for better performance, less network traffic, custom zones, etc.
while still relying on the benefits of your local network resolver.
Off by default.
3. Add named-checkconf into the startup routine. This will prevent named
from trying to start in a situation where it would not be possible to do
so.
2009-05-16 20:55:28 +00:00
Doug Barton
919dbc2969 Strongly discourage the use of the query-source option, and explain why.
Give a better example if a user absolutely must use this option, and
suggest they pick something from the ephemeral port range rather than
port 53. This means that the example will not work if it is merely
uncommented, but this will hopefully encourage users to read the comment.
2008-07-12 10:00:36 +00:00
Doug Barton
4a4e965247 From the 4 February 2008 update:
IPv6 addresses for 6 of the root name servers!
2008-02-07 06:28:02 +00:00
Doug Barton
d207e3a35c Remove from the default empty zone list zones that, unlike the others,
could theoretically be allocated one day.
2008-01-11 22:41:21 +00:00
Doug Barton
8003dd03de Update to the 1 November 2007 version of this file. The change
is to the address of l.root-servers.net, which is moving to a
new /24 in order to enable anycast routing down the road.
2007-11-02 22:37:15 +00:00
Doug Barton
f183dbca4f 1. Remove root name servers from the list of possible masters in the
commented out example who have either not responded, or specifically
asked not to participate because they do not view AXFR as "a production
service."

2. Add f.root-servers.net to the example after confirmation from
Paul Vixie.

3. Add a warning to the commented out "root zone slave" example to the
effect that it requires more attention than a hints file, and provides
more benefit to larger sites than individual hosts.

4. Correct a typo copied from RFC 2544 which was corrected in a later
errata, and confirmed in RFC 3330. Update the comment to reflect that
RFC 3330 got it right and to avoid confusion down the road. 3330 also
contains a reference back to 2544 for anyone interested in pursuing the
history. [1]

PR:             conf/115573 [1]
Submitted by:   Oliver Fromme <olli@secnetix.de> [1]

Approved by:	re (kensmith)
2007-08-17 04:37:02 +00:00
Doug Barton
1c24b5458d 1. Move the disable-empty-zone stuff down below the first 25 lines so
that the listen-on stuff floats up to the first "page" of text. This
makes it very obvious what's going on so that someone trying to enable
a server for use on a network can easily see how to do that.

2. Change the default behavior back to using a hint zone for the root.

3. Leave the root slave zone config as a commented out example.

4. Remove the B and F root servers from the example at the request of
their operators.

Requested by:	he-who-must-not-be-named [1]
Requested by:	many [2]

Approved by:	re (rwatson)
2007-08-02 09:18:53 +00:00
Doug Barton
e56dafe630 Drop the default zones that are now covered by the new zones that
were added in the last revision.
2007-06-18 06:29:45 +00:00
Doug Barton
1de57a4c76 Bring our default named configuration more in line with current
best practices:

1. The old way of generating the localhost zones was not optimal both
because they did not exist by default, and because they were not really
aligned with BCP. There is no need to have the dynamic data that the
make-localhost script generated, and good reasons to do this more
"by the book."

2. In named.conf
	a. Clean up white space
	b. Add/clarify a few comments
	c. Slave zones from the root servers instead of using a hints
	file. This has several advantages, as described in the comments.
	d. Significantly revamp the default zones, including the
	forward localhost zone, and the reverse zones for IPv4 and IPv6
	loopback addresses. There are extensive comments describing what
	is included and why. Interested readers should take the time to
	review the RFCs mentioned in the comments. There is also relevant
	information about the motivations for hosting these zones in the
	"work in progress" Internet-Draft,
	http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
	or its successor.
	It's also worth noting that a significant number of these
	empty zones are already included by default in the named binary
	without any user configuration.
	e. Because we're including a lot of examples of both local
	forward zones and slave zones in the default configuration,
	eliminate some of those examples.

3. Add new localhost-{forward|reverse} zone files, and an "empty" zone
to support the changes in 2.d. above. The empty zone file isn't really
empty in order to avoid a warning from BIND about a zone file that
doesn't contain any A or AAAA records.
2007-06-18 05:58:23 +00:00
Doug Barton
bc998fd6f4 Add a namedb/master directory for the zone files I'm about to add,
and switch to the more "normal" way of installing files for the
namedb directory so that we can pick up the new subdir.
2007-06-18 05:44:38 +00:00
Doug Barton
9e8bc8bf11 In accordance with my intentions announced (and not objected to)
on -arch, and RFC 4159 (http://www.rfc-editor.org/rfc/rfc4159.txt)
which officially deprecates all usage of IP6.INT, remove the
reference to that zone from the example named.conf file.
2005-09-05 13:42:22 +00:00
Doug Barton
259b67a528 Scot pointed out that the dynamic zone example didn't seem to "flow"
with the rest of the examples, so after discussion with him and gshapiro,
re-sort the examples, and add more comments to make things very obvious.

Also, divide the examples between example.{com|net|org} to make things
even more obvious, and use the same RFC 1918 block for all examples.

Pointed out by:	Scot W. Hetzel <hetzels@westbend.net>
2005-01-22 21:34:10 +00:00
Ruslan Ermilov
e653b48c80 Start the dreaded NOFOO -> NO_FOO conversion.
OK'ed by:	core
2004-12-21 08:47:35 +00:00
Gregory Neil Shapiro
37a4b79385 Create a separate directory for dynamic zones which is owned by the bind
user (for creation of the zone journal file).  This is separate from the
master/ directory for security.  Give an example dynamic zone in the
sample named.conf.

Approved by:	dougb
Noticed by:	Eivind Olsen <eivind at aminor.no>
MFC after:	1 week
2004-11-04 05:24:29 +00:00
Ruslan Ermilov
a35d88931c For variables that are only checked with defined(), don't provide
any fake value.
2004-10-24 15:33:08 +00:00
Doug Barton
83b3de9f56 1. Update the documentation references, and the warning about setting up
authoritative servers.

2. Add an IPv4 listen-on option for 127.0.0.1, which is appropriate
for the default use as a local resolver.

3. Add a commented out listen-on-v6 option.
2004-09-30 09:57:36 +00:00
Doug Barton
e963331b47 Add a statistics-file directive 2004-09-29 03:49:35 +00:00
Doug Barton
81f7fbc732 Fix some of the more egregious problems with this file:
1. Update text about later BINDs using a pseudo-random, unpriviliged
query port for UDP by default.

2. We are now running in a sandbox by default, with a dedicated dump
directory, so remove the stale comment.

3. The topology configuration is not for the faint of heart, so
remove the commented example.

4. Tighten up some language a bit.

5. s/secondary/slave/

6. No need for the example about a bind-owned directory for slave zones.

7. Change domain.com to example.com in the example, per RFC 2606.

8. Update the path for slave zones in the example.
	- Thanks to Scot Hetzel <swhetzel@gmail.com>

There is more work to do here, but this is an improvement.
2004-09-28 21:22:09 +00:00
Doug Barton
8f1bb3891d Create a named chroot directory structure in /var/named, and use it
by default when named is enabled. Also, improve our default directory
layout by creating /var/named/etc/namedb/{master|slave} directories,
and use the former for the generated localhost* files.

Rather than using pax to copy device entries, mount devfs in the
chroot directory.

There may be some corner cases where things need to be adjusted,
but overall this structure has been well tested on a production
network, and should serve the needs of the vast majority of users.

UPDATING has instructions on how to do the conversion for those
with existing configurations.
2004-09-28 09:46:00 +00:00
Jens Schweikhardt
d8beb0fd3b Removed whitespace at BOF, EOL & EOF. 2004-06-06 11:46:29 +00:00
Doug Barton
b849739c70 Latest version of this file from InterNIC. This version updates the IP
address of b.root-servers.net, and various comments.
2004-01-29 16:24:30 +00:00
Giorgos Keramidas
d38c8c5622 Misc grammar, typo and wording fixes of comments.
PR:		docs/41034
Submitted by:	Chris Pepper <pepper@rockefeller.edu>
2003-02-07 20:58:38 +00:00
Hajimu UMEMOTO
3cea219898 compliance with RFC3152.
PR:		standards/45557
Submitted by:	Matthew Seaman <m.seaman@infracaninophile.co.uk>
Approved by:	re
2002-11-26 07:55:44 +00:00
Doug Barton
a0c161c4e4 Import the latest hints file from Internic. The most important change
is that J has moved, however I'm sure you'll all be very disappointed
to hear that you can no longer retrieve this file via gopher.
2002-11-06 09:21:39 +00:00
Hajimu UMEMOTO
232b0e36b5 Install PROTO.localhost-v6.rev.
Reported by:	Scott Allendorf <scott-allendorf@uiowa.edu>
Forgot by:	me (ume)
2002-02-06 04:46:07 +00:00
Bruce Evans
f52150f696 Added this makefile. This is not attached to the build yet. I often
install parts of /etc manually and it helps to have a makefile for
each subdir even if the main makefile doesn't invoke it.
2002-01-30 09:27:03 +00:00
Hajimu UMEMOTO
fc50a44458 Do not taint ::/124 for localhost reverse table. 2002-01-22 17:22:41 +00:00
Crist J. Clark
cb46a4618b The named.conf file should refer to named.conf(5) in addition to
named(8) in the comments.

PR:		32459
Submitted by:	"Gary W. Swearingen" <swear@blarg.net>
MFC after:	2 days
2001-12-03 08:05:52 +00:00
Jun Kuriyama
6d9e09d7d0 Invoke named with privilege of bind:bind.
Change pidfile location to /var/run/named/pid.
2001-08-23 13:34:45 +00:00
Sheldon Hearn
24c3179f4e Replace old-style "chown foo.bar" with orthodox "chown foo:bar". 2001-05-28 13:43:26 +00:00
Ben Smithurst
2300f00f4c FreeBSD doesn't run named in a sandbox by default, so change a comment so it
doesn't imply we do.
2001-01-16 20:57:18 +00:00
Robert Watson
9766e32c01 o Add a PATH statement to the beginning of make-localhost, making it
work right when the administrator has modified their runtime environment
  in a manner not anticipated by our script.

Requested by:	Tom Maher <tardis@ece.cmu.edu>
2000-11-29 19:19:06 +00:00
Hajimu UMEMOTO
2150dfdae0 Add reverse lookup entry for ::1
Suggested by:	itojun
2000-07-07 17:20:23 +00:00
Peter Wemm
d62b57c22f Sigh. RFC2038 and bind 8.2.2 have a slight variation of interpretation
of the SOA 'minimum' field.  Now it's necessary to define $TTL seperately
to shut it up.  Bind does reasonable things by default but it's annoying
still.

PR:		15834
Submitted by:	Daniel Lewart <d-lewart@uiuc.edu>
2000-01-10 15:31:40 +00:00
Peter Wemm
6cabfb3832 Add/adjust some $FreeBSD$ tags.
Noted by:	Doug <Doug@gorean.org>
1999-09-13 17:09:08 +00:00
Peter Wemm
9b7a44a60e $Id$ -> $FreeBSD$ 1999-08-27 23:37:10 +00:00
Matthew Dillon
35fb56f97e Add (commented out) directive and note regarding dumpfile location
when running in a sandbox.

Submitted by:	Ben Smithurst <ben@scientia.demon.co.uk>
1998-12-23 06:06:13 +00:00
Matthew Dillon
cc6fef08db Since we do not pre-create /etc/namedb/s, add additional documentation
to the comments in named.conf to describe to the user how to create it.
    (named.conf does not use /etc/namedb/s by default anyway so us not
    pre-created it in the mtree does not hurt us terribly).
1998-12-02 19:59:24 +00:00
Matthew Dillon
128272b8c5 Reviewed by: freebsd-current, freebsd-security
Adjust rc.conf to run named in sandbox, adjust mtree to add /etc/namedb/s
    subdirectory (user bind, group bind) to hold secondaries, adjust
    comments in named.conf to reflect new secondary scheme.  (Note that
    core read-only zone files are left owned by root, increasing security even
    more).
1998-12-01 21:36:33 +00:00
Brian Somers
965066d630 Add Id keyword 1998-09-13 23:11:13 +00:00
Peter Wemm
19ca863a42 Delete some large chunks of trailing whitespace since it was making some
lines longer than 80 columns.
1998-05-11 11:26:28 +00:00
Andrey A. Chernov
0888581f49 Add new named configuration template and remove old template 1998-05-07 23:42:33 +00:00
Masafumi Max NAKANE
7f65d26404 Bring in the latest (08/22/1997) version from the Internic. 1997-08-24 08:17:02 +00:00
Bill Fenner
4d4f8bc429 Make "make-localhost" Y2K safe by using "date +%Y" instead of "date +%y"
to pick the serial number.

PR:		misc/3465
Submitted by:	sjr1@flash.net (Stephen J. Roznowski)
1997-08-11 04:06:49 +00:00
Eivind Eklund
5a4f3da5c2 Upgrade to latest version of named.root (from InterNIC).
PR:		conf/3642

Submitted by:	Josh Gilliam <soil@quick.net> (Well, suggestion.  Root file
from InterNIC)
1997-05-22 01:20:54 +00:00
Joerg Wunsch
2e8c2f7d8e Add some blurb about how to setup a secondary nameserver.
Reviewed by:	-hackers
1997-05-08 15:23:28 +00:00
Andrey A. Chernov
6ca11646fa Increase Retry interval from 300 to 900 to shut named warning that
(300 < 900) maintainance interval
1997-05-01 21:02:37 +00:00