8f1bb3891d
by default when named is enabled. Also, improve our default directory
layout by creating /var/named/etc/namedb/{master|slave} directories,
and use the former for the generated localhost* files.
Rather than using pax to copy device entries, mount devfs in the
chroot directory.
There may be some corner cases where things need to be adjusted,
but overall this structure has been well tested on a production
network, and should serve the needs of the vast majority of users.
UPDATING has instructions on how to do the conversion for those
with existing configurations.
127 lines
3.4 KiB
Plaintext
127 lines
3.4 KiB
Plaintext
// $FreeBSD$
|
|
//
|
|
// Refer to the named.conf(5) and named(8) man pages for details. If
|
|
// you are ever going to set up a primary server, make sure you
|
|
// understand the hairy details of how DNS works. Even with
|
|
// simple mistakes, you can break connectivity for affected parties,
|
|
// or cause huge amounts of useless Internet traffic.
|
|
|
|
options {
|
|
directory "/etc/namedb";
|
|
pid-file "/var/run/named/pid";
|
|
dump-file "/var/dump/named_dump.db";
|
|
|
|
// In addition to the "forwarders" clause, you can force your name
|
|
// server to never initiate queries of its own, but always ask its
|
|
// forwarders only, by enabling the following line:
|
|
//
|
|
// forward only;
|
|
|
|
// If you've got a DNS server around at your upstream provider, enter
|
|
// its IP address here, and enable the line below. This will make you
|
|
// benefit from its cache, thus reduce overall DNS traffic in the Internet.
|
|
/*
|
|
forwarders {
|
|
127.0.0.1;
|
|
};
|
|
*/
|
|
/*
|
|
* If there is a firewall between you and nameservers you want
|
|
* to talk to, you might need to uncomment the query-source
|
|
* directive below. Previous versions of BIND always asked
|
|
* questions using port 53, but BIND 8.1 uses an unprivileged
|
|
* port by default.
|
|
*/
|
|
// query-source address * port 53;
|
|
|
|
/*
|
|
* If running in a sandbox, you may have to specify a different
|
|
* location for the dumpfile.
|
|
*/
|
|
// dump-file "s/named_dump.db";
|
|
};
|
|
|
|
// Note: the following will be supported in a future release.
|
|
/*
|
|
host { any; } {
|
|
topology {
|
|
127.0.0.0/8;
|
|
};
|
|
};
|
|
*/
|
|
|
|
// Setting up secondaries is way easier and a rough example for this
|
|
// is provided below.
|
|
//
|
|
// If you enable a local name server, don't forget to enter 127.0.0.1
|
|
// first in your /etc/resolv.conf so this server will be queried.
|
|
// Also, make sure to enable it in /etc/rc.conf.
|
|
|
|
zone "." {
|
|
type hint;
|
|
file "named.root";
|
|
};
|
|
|
|
zone "0.0.127.IN-ADDR.ARPA" {
|
|
type master;
|
|
file "master/localhost.rev";
|
|
};
|
|
|
|
// RFC 3152
|
|
zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA" {
|
|
type master;
|
|
file "master/localhost-v6.rev";
|
|
};
|
|
|
|
// RFC 1886 -- deprecated
|
|
zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.INT" {
|
|
type master;
|
|
file "master/localhost-v6.rev";
|
|
};
|
|
|
|
// NB: Do not use the IP addresses below, they are faked, and only
|
|
// serve demonstration/documentation purposes!
|
|
//
|
|
// Example secondary config entries. It can be convenient to become
|
|
// a secondary at least for the zone your own domain is in. Ask
|
|
// your network administrator for the IP address of the responsible
|
|
// primary.
|
|
//
|
|
// Never forget to include the reverse lookup (IN-ADDR.ARPA) zone!
|
|
// (This is named after the first bytes of the IP address, in reverse
|
|
// order, with ".IN-ADDR.ARPA" appended.)
|
|
//
|
|
// Before starting to set up a primary zone, make sure you fully
|
|
// understand how DNS and BIND works. There are sometimes
|
|
// non-obvious pitfalls. Setting up a secondary is simpler.
|
|
//
|
|
// NB: Don't blindly enable the examples below. :-) Use actual names
|
|
// and addresses instead.
|
|
//
|
|
// NOTE!!! FreeBSD can run bind in a sandbox (see named_flags in rc.conf).
|
|
// The directory containing the secondary zones must be write accessible
|
|
// to bind. The following sequence is suggested:
|
|
//
|
|
// mkdir /etc/namedb/s
|
|
// chown bind:bind /etc/namedb/s
|
|
// chmod 750 /etc/namedb/s
|
|
|
|
/*
|
|
zone "domain.com" {
|
|
type slave;
|
|
file "s/domain.com.bak";
|
|
masters {
|
|
192.168.1.1;
|
|
};
|
|
};
|
|
|
|
zone "0.168.192.in-addr.arpa" {
|
|
type slave;
|
|
file "s/0.168.192.in-addr.arpa.bak";
|
|
masters {
|
|
192.168.1.1;
|
|
};
|
|
};
|
|
*/
|
|
|