lbalhar / rpms / bind

Forked from rpms/bind 6 years ago
Clone
Adam Tkac 98dc342
/*
Adam Tkac 98dc342
 Sample named.conf BIND DNS server 'named' configuration file
Adam Tkac 98dc342
 for the Red Hat BIND distribution.
Adam Tkac 98dc342
Adam Tkac 98dc342
 See the BIND Administrator's Reference Manual (ARM) for details, in:
Adam Tkac 98dc342
   file:///usr/share/doc/bind-{version}/arm/Bv9ARM.html
Adam Tkac 98dc342
 Also see the BIND Configuration GUI : /usr/bin/system-config-bind and 
Adam Tkac 98dc342
 its manual.
Adam Tkac 98dc342
*/
Adam Tkac 98dc342
jvdias 053216a
options
jvdias 053216a
{
jvdias 053216a
	// Put files that named is allowed to write in the data/ directory:
Adam Tkac 98dc342
	directory 		"/var/named";		// "Working" directory
jvdias 053216a
	dump-file 		"data/cache_dump.db";
jvdias 053216a
        statistics-file 	"data/named_stats.txt";
jvdias 053216a
        memstatistics-file 	"data/named_mem_stats.txt";
0b15f32
	secroots-file		"data/named.secroots";
0b15f32
	recursing-file		"data/named.recursing";
jvdias 053216a
Adam Tkac 98dc342
Adam Tkac 98dc342
	/*
Adam Tkac 98dc342
	  Specify listenning interfaces. You can use list of addresses (';' is
Adam Tkac 98dc342
	  delimiter) or keywords "any"/"none"
Adam Tkac 98dc342
	*/
Adam Tkac 98dc342
	//listen-on port 53	{ any; };
Adam Tkac 98dc342
	listen-on port 53	{ 127.0.0.1; };
Adam Tkac 98dc342
Adam Tkac 98dc342
	//listen-on-v6 port 53	{ any; };
Adam Tkac 98dc342
	listen-on-v6 port 53	{ ::1; };
Adam Tkac 98dc342
Adam Tkac 98dc342
	/*
Adam Tkac 98dc342
	  Access restrictions
Adam Tkac 98dc342
Adam Tkac 98dc342
	  There are two important options:
Adam Tkac 98dc342
	    allow-query { argument; };
Adam Tkac 98dc342
	      - allow queries for authoritative data
Adam Tkac 98dc342
Adam Tkac 98dc342
	    allow-query-cache { argument; };
Adam Tkac 98dc342
	      - allow queries for non-authoritative data (mostly cached data)
Adam Tkac 98dc342
Adam Tkac 98dc342
	  You can use address, network address or keywords "any"/"localhost"/"none" as argument
Adam Tkac 98dc342
	  Examples:
Adam Tkac 98dc342
	    allow-query { localhost; 10.0.0.1; 192.168.1.0/8; };
Adam Tkac 98dc342
	    allow-query-cache { ::1; fe80::5c63:a8ff:fe2f:4526; 10.0.0.1; };
Adam Tkac 98dc342
	*/
Adam Tkac 98dc342
Adam Tkac 98dc342
	allow-query		{ localhost; };
Adam Tkac 98dc342
	allow-query-cache	{ localhost; };
Adam Tkac 98dc342
d0fda06
	/* Enable/disable recursion - recursion yes/no;
d0fda06
d0fda06
	 - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
d0fda06
	 - If you are building a RECURSIVE (caching) DNS server, you need to enable 
d0fda06
	   recursion. 
d0fda06
	 - If your recursive DNS server has a public IP address, you MUST enable access 
d0fda06
	   control to limit queries to your legitimate users. Failing to do so will
d0fda06
	   cause your server to become part of large scale DNS amplification 
d0fda06
	   attacks. Implementing BCP38 within your network would greatly
d0fda06
	   reduce such attack surface 
d0fda06
	 */
Adam Tkac 98dc342
	recursion yes;
Adam Tkac 98dc342
Adam Tkac 98dc342
	/* DNSSEC related options. See information about keys ("Trusted keys", bellow) */
Adam Tkac 98dc342
Adam Tkac 98dc342
	/* Enable serving of DNSSEC related data - enable on both authoritative
Adam Tkac 98dc342
 	   and recursive servers DNSSEC aware servers */
Adam Tkac 98dc342
	dnssec-enable yes;
Adam Tkac 98dc342
Adam Tkac 98dc342
	/* Enable DNSSEC validation on recursive servers */
Adam Tkac 98dc342
	dnssec-validation yes;
Adam Tkac 34adbeb
93a69bb
	/* In Fedora we use /run/named instead of default /var/run/named
93a69bb
	   so we have to configure paths properly. */
Adam Tkac 2043f0c
	pid-file "/run/named/named.pid";
93a69bb
	session-keyfile "/run/named/session.key";
ad6dbbd
ad6dbbd
	managed-keys-directory "/var/named/dynamic";
71f9fb4
71f9fb4
    /* In Fedora we use system-wide Crypto Policy */
71f9fb4
    /* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
71f9fb4
    include "/etc/crypto-policies/back-ends/bind.config";
jvdias 053216a
};
Adam Tkac 98dc342
jvdias 053216a
logging 
jvdias 053216a
{
jvdias 053216a
/*      If you want to enable debugging, eg. using the 'rndc trace' command,
jvdias 053216a
 *      named will try to write the 'named.run' file in the $directory (/var/named).
jvdias 053216a
 *      By default, SELinux policy does not allow named to modify the /var/named directory,
jvdias 053216a
 *      so put the default debug log file in data/ :
jvdias 053216a
 */
jvdias 053216a
        channel default_debug {
jvdias 053216a
                file "data/named.run";
jvdias 053216a
                severity dynamic;
0b15f32
        };
jvdias 053216a
};
Adam Tkac 98dc342
Adam Tkac 98dc342
/*
Adam Tkac 98dc342
 Views let a name server answer a DNS query differently depending on who is asking.
Adam Tkac 98dc342
Adam Tkac 98dc342
 By default, if named.conf contains no "view" clauses, all zones are in the 
Adam Tkac 98dc342
 "default" view, which matches all clients.
Adam Tkac 98dc342
Adam Tkac 98dc342
 Views are processed sequentially. The first match is used so the last view should
Adam Tkac 98dc342
 match "any" - it's fallback and the most restricted view.
Adam Tkac 98dc342
Adam Tkac 98dc342
 If named.conf contains any "view" clause, then all zones MUST be in a view.
Adam Tkac 98dc342
*/
Adam Tkac 98dc342
jvdias 053216a
view "localhost_resolver"
jvdias 053216a
{
jvdias 053216a
/* This view sets up named to be a localhost resolver ( caching only nameserver ).
jvdias 053216a
 * If all you want is a caching-only nameserver, then you need only define this view:
jvdias 053216a
 */
jvdias 053216a
	match-clients 		{ localhost; };
jvdias 053216a
	recursion yes;
Adam Tkac 98dc342
jvdias 053216a
	# all views must contain the root hints zone:
Adam Tkac 98dc342
	zone "." IN {
Adam Tkac 98dc342
	        type hint;
Adam Tkac 98dc342
	        file "/var/named/named.ca";
Adam Tkac 98dc342
	};
jvdias 053216a
jvdias 053216a
        /* these are zones that contain definitions for all the localhost
jvdias 053216a
         * names and addresses, as recommended in RFC1912 - these names should
Adam Tkac 95fd5e6
	 * not leak to the other nameservers:
jvdias 053216a
	 */
jvdias 053216a
	include "/etc/named.rfc1912.zones";
jvdias 053216a
};
jvdias 053216a
view "internal"
jvdias 053216a
{
jvdias 053216a
/* This view will contain zones you want to serve only to "internal" clients
jvdias 053216a
   that connect via your directly attached LAN interfaces - "localnets" .
jvdias 053216a
 */
jvdias fc31cdd
	match-clients		{ localnets; };
jvdias 053216a
	recursion yes;
jvdias 053216a
Adam Tkac 98dc342
	zone "." IN {
Adam Tkac 98dc342
	        type hint;
Adam Tkac 98dc342
	        file "/var/named/named.ca";
Adam Tkac 98dc342
	};
Adam Tkac 95fd5e6
Adam Tkac 95fd5e6
        /* these are zones that contain definitions for all the localhost
Adam Tkac 95fd5e6
         * names and addresses, as recommended in RFC1912 - these names should
Adam Tkac 95fd5e6
	 * not leak to the other nameservers:
Adam Tkac 95fd5e6
	 */
Adam Tkac 95fd5e6
	include "/etc/named.rfc1912.zones";
jvdias 053216a
 
jvdias 053216a
	// These are your "authoritative" internal zones, and would probably
jvdias 053216a
	// also be included in the "localhost_resolver" view above :
jvdias 053216a
Adam Tkac 98dc342
	/*
Adam Tkac 98dc342
	  NOTE for dynamic DNS zones and secondary zones:
Adam Tkac 98dc342
Adam Tkac 98dc342
	  DO NOT USE SAME FILES IN MULTIPLE VIEWS!
Adam Tkac 98dc342
Adam Tkac 98dc342
	  If you are using views and DDNS/secondary zones it is strongly
Adam Tkac 98dc342
	  recommended to read FAQ on ISC site (www.isc.org), section
Adam Tkac 98dc342
	  "Configuration and Setup Questions", questions
Adam Tkac 98dc342
	  "How do I share a dynamic zone between multiple views?" and
Adam Tkac 98dc342
	  "How can I make a server a slave for both an internal and an external
Adam Tkac 98dc342
	   view at the same time?"
Adam Tkac 98dc342
	*/
Adam Tkac 98dc342
jvdias 053216a
	zone "my.internal.zone" { 
jvdias 053216a
		type master;
jvdias 053216a
		file "my.internal.zone.db";
jvdias 053216a
	};
jvdias 053216a
	zone "my.slave.internal.zone" {
jvdias 053216a
		type slave;
jvdias 053216a
		file "slaves/my.slave.internal.zone.db";
jvdias 053216a
		masters { /* put master nameserver IPs here */ 127.0.0.1; } ;
jvdias 053216a
		// put slave zones in the slaves/ directory so named can update them
jvdias 053216a
	};	
jvdias 053216a
	zone "my.ddns.internal.zone" {
jvdias 053216a
		type master;
jvdias 053216a
		allow-update { key ddns_key; };
Adam Tkac 98dc342
		file "dynamic/my.ddns.internal.zone.db";
jvdias 053216a
		// put dynamically updateable zones in the slaves/ directory so named can update them
0b15f32
	};
jvdias 053216a
};
Adam Tkac 98dc342
jvdias 053216a
key ddns_key
jvdias 053216a
{
jvdias 053216a
	algorithm hmac-md5;
Adam Tkac 40b0044
	secret "use /usr/sbin/dnssec-keygen to generate TSIG keys";
jvdias 053216a
};
Adam Tkac 98dc342
Adam Tkac 98dc342
view "external"
jvdias 053216a
{
jvdias 053216a
/* This view will contain zones you want to serve only to "external" clients
Adam Tkac 95fd5e6
 * that have addresses that are not match any above view:
jvdias 053216a
 */
Adam Tkac 95fd5e6
	match-clients		{ any; };
jvdias 053216a
Adam Tkac 98dc342
	zone "." IN {
Adam Tkac 98dc342
	        type hint;
Adam Tkac 98dc342
	        file "/var/named/named.ca";
Adam Tkac 98dc342
	};
Adam Tkac 98dc342
jvdias 053216a
	recursion no;
jvdias 053216a
	// you'd probably want to deny recursion to external clients, so you don't
jvdias 053216a
        // end up providing free DNS service to all takers
jvdias 053216a
jvdias 053216a
	// These are your "authoritative" external zones, and would probably
jvdias 053216a
        // contain entries for just your web and mail servers:
jvdias 053216a
jvdias 053216a
	zone "my.external.zone" { 
jvdias 053216a
		type master;
jvdias 053216a
		file "my.external.zone.db";
jvdias 053216a
	};
jvdias 053216a
};
Adam Tkac 98dc342
Adam Tkac 98dc342
/* Trusted keys
Adam Tkac 98dc342
Adam Tkac 98dc342
  This statement contains DNSSEC keys. If you want DNSSEC aware resolver you
Adam Tkac 98dc342
  have to configure at least one trusted key.
Adam Tkac 98dc342
Adam Tkac 98dc342
  Note that no key written below is valid. Especially root key because root zone
Adam Tkac 98dc342
  is not signed yet.
Adam Tkac 98dc342
*/
Adam Tkac 98dc342
/*
Adam Tkac 98dc342
trusted-keys {
Adam Tkac 98dc342
// Root Key
Adam Tkac 98dc342
"." 257 3 3 "BNY4wrWM1nCfJ+CXd0rVXyYmobt7sEEfK3clRbGaTwSJxrGkxJWoZu6I7PzJu/
Adam Tkac 98dc342
             E9gx4UC1zGAHlXKdE4zYIpRhaBKnvcC2U9mZhkdUpd1Vso/HAdjNe8LmMlnzY3
Adam Tkac 98dc342
             zy2Xy4klWOADTPzSv9eamj8V18PHGjBLaVtYvk/ln5ZApjYghf+6fElrmLkdaz
Adam Tkac 98dc342
             MQ2OCnACR817DF4BBa7UR/beDHyp5iWTXWSi6XmoJLbG9Scqc7l70KDqlvXR3M
Adam Tkac 98dc342
             /lUUVRbkeg1IPJSidmK3ZyCllh4XSKbje/45SKucHgnwU5jefMtq66gKodQj+M
Adam Tkac 98dc342
             iA21AfUVe7u99WzTLzY3qlxDhxYQQ20FQ97S+LKUTpQcq27R7AT3/V5hRQxScI
Adam Tkac 98dc342
             Nqwcz4jYqZD2fQdgxbcDTClU0CRBdiieyLMNzXG3";
Adam Tkac 98dc342
Adam Tkac 98dc342
// Key for forward zone
Adam Tkac 98dc342
example.com. 257 3 5 "AwEAAaxPMcR2x0HbQV4WeZB6oEDX+r0QM65KbhTjrW1ZaARmPhEZZe
Adam Tkac 98dc342
                      3Y9ifgEuq7vZ/zGZUdEGNWy+JZzus0lUptwgjGwhUS1558Hb4JKUbb
Adam Tkac 98dc342
                      OTcM8pwXlj0EiX3oDFVmjHO444gLkBO UKUf/mC7HvfwYH/Be22GnC
Adam Tkac 98dc342
                      lrinKJp1Og4ywzO9WglMk7jbfW33gUKvirTHr25GL7STQUzBb5Usxt
Adam Tkac 98dc342
                      8lgnyTUHs1t3JwCY5hKZ6CqFxmAVZP20igTixin/1LcrgX/KMEGd/b
Adam Tkac 98dc342
                      iuvF4qJCyduieHukuY3H4XMAcR+xia2 nIUPvm/oyWR8BW/hWdzOvn
Adam Tkac 98dc342
                      SCThlHf3xiYleDbt/o1OTQ09A0=";
Adam Tkac 98dc342
Adam Tkac 98dc342
// Key for reverse zone.
Adam Tkac 98dc342
2.0.192.IN-ADDRPA.NET. 257 3 5 "AQOnS4xn/IgOUpBPJ3bogzwcxOdNax071L18QqZnQQQA
Adam Tkac 98dc342
                                VVr+iLhGTnNGp3HoWQLUIzKrJVZ3zggy3WwNT6kZo6c0
Adam Tkac 98dc342
                                tszYqbtvchmgQC8CzKojM/W16i6MG/ea fGU3siaOdS0
Adam Tkac 98dc342
                                yOI6BgPsw+YZdzlYMaIJGf4M4dyoKIhzdZyQ2bYQrjyQ
Adam Tkac 98dc342
                                4LB0lC7aOnsMyYKHHYeRv PxjIQXmdqgOJGq+vsevG06
Adam Tkac 98dc342
                                zW+1xgYJh9rCIfnm1GX/KMgxLPG2vXTD/RnLX+D3T3UL
Adam Tkac 98dc342
                                7HJYHJhAZD5L59VvjSPsZJHeDCUyWYrvPZesZDIRvhDD
Adam Tkac 98dc342
                                52SKvbheeTJUm6EhkzytNN2SN96QRk8j/iI8ib";
Adam Tkac 98dc342
};
Adam Tkac 98dc342
*/