MidnightBSD: The BSD For Everyone

BIND (named) Set up

Intro

This is a quick guide to setting up an authoritative name server. It's based loosely on this guide for FreeBSD, but has some additional information. https://blog.andreev.it/?p=4096 The original guide does cover GoDaddy configuration of DS records well.

Installation

Select a version of BIND from packages or ports. In this example, we will install BIND 9.12

mport install bind912

The configuration files will live in /usr/local/etc/namedb/

Next we need to create a RNDC key. This is used to manage BIND from the command line via rndc utility.

rndc-confgen -a

Fix the permissions on the file it just created

cd /usr/local/etc/namedb
chown root:bind rndc.key
chmod 640 rndc.key

Next we need to enable BIND on system startup

sysrc named_enable="YES"

Now you can start it if you want to verify it's working so far.

service named start

Verify it worked with no errors by doing this:

tail /var/log/messages

Optional: if you want to control the slave servers with rndc also, they must have the same rndc key. Copy it over and edit this on the slave BIND config where XXX.XXX.XXX.XXX is an ip address of the master. This has to be before the options directive.

include "/usr/local/etc/namedb/rndc.key";
controls {
inet 127.0.0.1 allow { localhost; } keys { "rndc-key"; };
inet XXX.XXX.XXX.XXX allow { XXX.XXX.XXX.XXX; } keys { "rndc-key"; };
};

On the master and slave, you need to fix the listen directives to use the ip addresses. Use your own IP addresses rather than the ones listed here.

Now restart BIND on both master and slaves

service named restart

You can optionally use rndc to manage them.

rndc reload
rndc status

rndc -s XXX.XXX.XXX.XXX reload

Check your firewall rules. You need TCP and UDP 53 open for DNS and if you are using rndc remotely port 953 open for all the slaves and master between each other.

If you were going to set up a recursive name server, you would use recursion yes. This is a BAD IDEA for an authoritative name server to do.

Now you need to set up the master to allow zone transfers from the slaves. Put this below the listen-on directive.

allow-transfer { localhost; XXX.XXX.XXX.XXX; };
notify yes;

You can either use the dynamic directory or master directory to store zone files. This depends on your use case what makes sense.

zone "midnightbsd.org" {
type master;
file /usr/local/etc/namedb/dynamic/midnightbsd.org";
};

Next you will create the zone file listed above.

$TTL 604800
@ IN SOA ns1.midnightbsd.org. admin.midnightbsd.org. (
2018101901; Serial 3H
Refresh 15M;
Retry 2W;
Expiry 1D ); Minimum
 
; name servers - NS records
        IN      NS      ns1.midnightbsd.org.
        IN      NS      ns2.midnightbsd.org.
 
; name servers - A records
ns1.midnightbsd.org.       IN      A       XXX.XXX.XXX.XXX
ns1.midnightbsd.org.       IN      A       XXX.XXX.XXX.XXX
 
; other servers - A records
www.midnightbsd.org.       IN      A       XXX.XXX.XXX.XXX