More about DNSBogus servers which give wrong information can be blocked or to make our server not to accept any information from them
server IP {bogus yes ;};
we can also create blackhole in dns where the server will not even acknowledge the other ip
blackhole {ips;};
version bind this can be used to make the details of dns version IE bind version safe from the outsider
version "INFORMATION ....";
chrooting the bindBy installing the bind-chroot the dns configuration file will be moved to space where only root and named group has permission to edit those files
Making DNS Zone sharing safewe could share a key between slave and master to make sure that update are send to only correct slaves.
This method in called TSIG transaction signature configuration
1.first start from client making the key
----->dnssec-keygen -a hmac-md5 -b 128 -n HOST virtual_key
----->cat Kvirtual_key.+157+56451.private
Private-key-format: v1.3
Algorithm: 157 (HMAC_MD5)
Key: yzkKqIIa4sUPXm+Oz7VNgg==
Bits: AAA=
Created: 20121022004959
Publish: 20121022004959
Activate: 20121022004959
**copy the key part and create a key file as follows
------->vim /etc/rndc.key
key "virtual_key"
{
algorithm HMAC-MD5;
secret "yzkKqIIa4sUPXm+Oz7VNgg==";
};
------->chgrp named /etc/rndc.key
**inside /etc/named.conf add
include "/etc/rndc.key" ;
server 192.168.100.1 {
keys { virtual_key ; };
};
**and
allow-transfer { key virtul_key ;};
this forces the client to use the key we generate..
Now copy the rndc.key file to server
change the group to named at server
and include the file to /etc/named.conf and give allow-transfer at needed zones to make it more secure
at server /etc/named.conf
include "/etc/rndc.key" ;
allow-transfer { key virtual_key ;};
----------------------------------------------------------------------
master configuration
----------------------------------------------------------------------
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
acl "example" { 192.168.122.0/24 ; 127/8 ; };
acl "virtual" { 192.168.100.0/24 ; 127/8 ; };
include "/etc/rndc.key" ;
options {
listen-on port 53 { 127.0.0.1; example ; virtual ;};
# listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; example; virtual; };
allow-transfer { key virtual_key ;};
recursion yes;
# dnssec-enable yes;
# dnssec-validation yes;
# dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
view mixed {
match-clients { 192.168.122.2; 192.168.100.1; };
zone "example.com" IN {
type master;
file "forward.zone";
allow-update { none; };
};
zone "122.168.192.in-addr.arpa" IN {
type master;
file "reverse.zone";
allow-update { none; };
};
zone "virtual.com" IN {
type master;
file "forwardvir.zone";
allow-update { none; };
};
zone "100.168.192.in-addr.arpa" IN {
type master;
file "reversevir.zone";
allow-update { none; };
};
};
view internal {
match-clients { example; };
zone "example.com" IN {
type master;
file "forward.zone";
allow-update { none; };
};
zone "122.168.192.in-addr.arpa" IN {
type master;
file "reverse.zone";
allow-update { none; };
};
};
view external {
match-clients { virtual; };
zone "virtual.com" IN {
type master;
file "forwardvir.zone";
allow-update {none; };
};
zone "100.168.192.in-addr.arpa" IN {
type master;
file "reversevir.zone";
allow-update {none ;};
};
};
#include "/etc/named.rfc1912.zones";
----------------------------------------------------------------------------
slave configuration
----------------------------------------------------------------------------
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
include "/etc/rndc.key" ;
server 192.168.100.1 {
keys { virtual_key ; };
};
options {
listen-on port 53 { 127.0.0.1; 192.168.100.0/24 ;};
# listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost;192.168.100.0/24; };
allow-transfer { key virtul_key ;};
recursion yes;
# dnssec-enable yes;
# dnssec-validation yes;
# dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
view external {
match-clients { 192.168.100.0/24; };
allow-transfer { key virtual_key ;};
zone "virtual.com" IN {
type slave;
file "slaves/forwardvir.zone";
masters {192.168.100.1 ; };
#allow-update {none;};
};
zone "100.168.192.in-addr.arpa" IN {
type slave;
file "slaves/reversevir.zone";
masters {192.168.100.1 ; };
#allow-update {none;};
};
};