adw0rd.
RUEN
← All posts
·5 min read

FreeBSD. Setting Up Your Own DNS Server with Bind9

BindDNSFreeBSD

bind9

Hi, today we’ll set up our own name server to map domain names to IP addresses. For this, we’ll need at least one dedicated server with FreeBSD installed.

Installing Bind9

Before installing, don’t forget to update the ports.


# cd /usr/ports/dns/bind9
# make install clean
# rehash

Now let’s add BIND to /etc/rc.conf so it starts automatically


named_enable="YES"
named_uid="bind"
named_chrootdir=""
named_flags="-s"

And reboot the server


# reboot

Configuring Bind9

Open named.conf for editing


# ee /etc/namedb/named.conf

And insert the following directives:



options {
        directory       "/etc/namedb";
        pid-file        "/var/run/named/pid";
        dump-file       "/var/dump/named_dump.db";
        statistics-file "/var/stats/named.stats";

        // Изменяем название, ниже расскажу зачем
        version "adw0rd dns";

        // Добавляем локальные "ip-адреса dns-серверов" вашего провайдера
        // их можно посмотреть в /etc/resolv.conf (директива "nameserver") или через утилиту nslookup
        forwarders {
                82.146.59.250;
        };

}

Restart BIND:


# /etc/rc.d/named restart

The rndc Utility

Go to the named directory:


# cd /etc/namedb/

And check whether you have a file called “rndc.key”. If you do, you can skip this step; if not, you’ll need to generate it:


# rndc-confgen

It will output something like this:


# Start of rndc.conf
key "rndc-key" {
        algorithm hmac-md5;
        secret "NrDcqVcbML1XI0ZLmRrmaQ==";
};

options {
        default-key "rndc-key";
        default-server 127.0.0.1;
        default-port 953;
};

To save the key directly to a file without copying its contents, run it with the flag

rndc-confgen -a

Create the file “/etc/namedb/rndc.key” and paste this data into it:


key "rndc-key" {
        algorithm hmac-md5;
        secret "NrDcqVcbML1XI0ZLmRrmaQ==";
};

Now it’s time to add our first domain, which will act as the “master name server,” so that other domains can use it later.

Setting Up Our Own Master Server (ns1)

First, we need to add a domain entry to named.conf. Add it at the end of the file:


zone "adw0rd.ru" {
        type master;
        file "master/adw0rd.ru";
};

Now use the “make-localhost” utility to create your first master file. After that, you can simply copy any master file and modify it for other domains.

Sometimes this file isn’t included in the standard distribution; you can download it here. You might also find PROTO.localhost.rev and PROTO.localhost-v6.rev useful.

Run make-localhost, but don’t forget to give it execute permissions!


# cd /etc/namedb/
# chmod u+x make-localhost
# ./make-localhost

Now let’s copy localhost.rev and use it to create our own master file:


# cd /etc/namedb/master/
# cp localhost.rev adw0rd.ru

And edit it to look like this:


$TTL    3600
$ORIGIN ru.

adw0rd                      IN SOA  ns1.adw0rd.ru. root.adw0rd.ru. (
                                2009082601   ; serial number
                                43200        ; refresh
                                3600         ; retry
                                604800       ; expire
                                3600       ) ; minimum TTL

$ORIGIN adw0rd.ru.

; первым будет наш ns1.adw0rd.ru
@                     NS       ns1

; второй будет бесплатный сервис ns2.trifle.net, о нем расскажу дальше
@                     NS       ns2.trifle.net.

@                       A       82.146.63.195
localhost               A       127.0.0.1

ns1                     A       82.146.63.195
ns2                     A       195.24.128.164

www                     A       82.146.63.195
ww                      CNAME   www

Don’t forget the “serial number”: it needs to be updated with every change. For example, if you’re editing on August 26, 2009, it should be 2009082601. If you edit it multiple times a day, increment the last two digits of the serial number by one (2009082602, 2009082617, and so on, up to 99). And if you’re editing on August 27, 2009, use 2009082701, and so on.

Now let’s check the configuration using the named-checkconf utility. If everything is fine, it won’t return anything; otherwise, it will output an error log.


# named-checkconf

After that, run “rndc reload”:


# rndc reload

Restart BIND:


# /etc/rc.d/named restart

Setting Up a Slave Server (ns2)

To use your own domain name servers, you need at least two name servers, so we need to set up a second one too. But where do we get another server? Actually, we don’t have to: we can just use free services. Here’s a short list of services that offer this:

Let’s walk through an example using “ns2.trifle.net”. Go to http://ns2.trifle.net, then sign up and log in.

Now let’s add our domain “adw0rd.ru” and associate it with the IP address 82.146.63.195

ns2\_trifle\_net

That’s it, done!

Checking That It Works

First, let’s find out whether ns1 returns data for our domain:


dig @ns1.adw0rd.ru adw0rd.ru

If it outputs something like this:


; <<>> DiG 9.3.4-P1 <<>> @ns1.adw0rd.ru adw0rd.ru
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 3703
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;adw0rd.ru.                       IN      A

;; AUTHORITY SECTION:
ru.                     1814    IN      SOA     ns.ripn.net. hostmaster.ripn.net. 4015239 7200 900 2592000 3600

;; Query time: 10 msec
;; SERVER: 82.146.63.195#53(82.146.63.195)
;; WHEN: Wed Aug 26 12:15:12 2009
;; MSG SIZE  rcvd: 83

then things aren’t looking good. Take a look at your master file; you’ve messed up somewhere… or you haven’t restarted the named server.

But if you get this, everything is fine:


; <<>> DiG 9.3.4-P1 <<>> @ns1.adw0rd.ru adw0rd.ru
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22582
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;adw0rd.ru.                     IN      A

;; ANSWER SECTION:
adw0rd.ru.              3600    IN      A       82.146.63.195

;; AUTHORITY SECTION:
adw0rd.ru.              3600    IN      NS      ns1.adw0rd.ru.
adw0rd.ru.              3600    IN      NS      ns2.trifle.net.

;; ADDITIONAL SECTION:
ns1.adw0rd.ru.         3600    IN      A       82.146.63.195
ns2.trifle.net.         166787  IN      A       195.24.128.164

;; Query time: 3 msec
;; SERVER: 82.146.63.195#53(82.146.63.195)
;; WHEN: Wed Aug 26 12:16:14 2009
;; MSG SIZE  rcvd: 129

Now you can enter your own DNS servers at your registrar, something like this:


ns1.adw0rd.ru 82.146.63.195
ns2.trifle.net

The address “82.146.63.195” is needed here for the domain to be delegated correctly, since your domain isn’t associated with it yet… ;)

For other domains, such as “blgo.ru”, this is enough


ns1.adw0rd.ru
ns2.trifle.net

How Do You Find Out the DNS Server Software Version?

Remember how I set the “version” directive in “named.conf” and said I’d explain why later… It’s to keep wannabe hackers from finding out your BIND version. Once they do, they can do some very amusing things. Google the subject and you’ll find out all about it.

Run the command


# dig @ns1.adw0rd.ru version.bind chaos txt

and you’ll see the BIND version…

P.S.

Well, I think that’s everything. Ask questions, point out any details I haven’t covered, and I’ll help however I can!

Comments are closed. Read the original discussion in Russian →