topic Re: New Primary master server--Pls comment!! in Operating System - HP-UX

New Primary master server--Pls comment!!

Rgomes — Tue, 11 May 2004 02:44:14 GMT

Hi All,

I am going to configure one primary master DNS server for an ISP. Pls comment on the below configuration of BIND 9.2.0, how it will react:

acl ournets { IP_range; };
acl bogusnets { IP_range; };
options {
...
...
allow-transfer { none; };
allow-query { ournets; };
allow-recursion { ournets; };
...
...
blackhole { bogusnets; };
};
zone "mydomain.com" {
type master;
file "db.mydomain.com";
allow-query { any; };
allow-transfer { IP_of_slave_server; };
};
.
.
.

Thanks in advance,
Richard

Re: New Primary master server--Pls comment!!

Cheryl Griffin — Tue, 11 May 2004 06:46:45 GMT

Here is how to assign points to those who have helped you in the past:
http://forums1.itrc.hp.com/service/forums/helptips.do?#28

Re: New Primary master server--Pls comment!!

Rgomes — Mon, 17 May 2004 13:46:10 GMT

Can I have some response now?

:)

TIA,
Richard

Re: New Primary master server--Pls comment!!

Geoff Wild — Mon, 17 May 2004 13:56:34 GMT

Looks okay - might want logging as well:

logging {

channel all_channel {
file "/var/named/named.log" versions 5 size 10; // keep 5 versions max 10 MB in size
print-category yes;
print-severity yes;
print-time yes;
};
category queries { all_channel; };
category update { all_channel; };
category security { all_channel; };
category default { all_channel; };

};

Do you need any incudes? like rndc key:

include "/etc/rndc.key";

Also for options add:

query-source address * port 53;
version "Noname DNS";
fetch-glue no;
max-cache-size 128M;

Rgds...Geoff

Re: New Primary master server--Pls comment!!

Rgomes — Mon, 17 May 2004 22:06:57 GMT

HI Geoff,

Thanks.

The option "query-source address * port 53", I read some doc on BIND and understood that this option may not work properly, so they advised to mention source address explicitly?? Although I am using this option to my other named server.

Another good point is logging, I am not sure for an ISP named service, how much syslog size would be sufficient??

one question, shall I apply my ACL to reverse zone also?

regards,
Richard

Re: New Primary master server--Pls comment!!

Geoff Wild — Tue, 18 May 2004 08:21:33 GMT

I would keep the ACL on allzones.

As far as logging - start with 5 x 10MB - then go from there - if you need more, just increase it in the named.conf file and issue a: rndc reload

file "/var/named/named.log" versions 5 size 10; // keep 5 versions max 10 MB in size

As far as query source - yes, you can put the source address explicitly - I have mine at 53 because that was the only way I could get a NT DNS box to transfer (though I havn't tried lately to see if it will work explicitly now...)

Rgds...Geoff

Re: New Primary master server--Pls comment!!

Rgomes — Tue, 18 May 2004 09:12:32 GMT

Hi Geoff,

Thanks for sharing.

Best regards,
Richard