New Primary master server--Pls comment!!

[Rgomes]

Hi All,

I am going to configure one primary master DNS server for an ISP. Pls comment on the below configuration of BIND 9.2.0, how it will react:

acl ournets { IP_range; };
acl bogusnets { IP_range; };
options {
...
...
allow-transfer { none; };
allow-query { ournets; };
allow-recursion { ournets; };
...
...
blackhole { bogusnets; };
};
zone "mydomain.com" {
type master;
file "db.mydomain.com";
allow-query { any; };
allow-transfer { IP_of_slave_server; };
};
.
.
.

Thanks in advance,
Richard

[Cheryl Griffin]

Here is how to assign points to those who have helped you in the past:
http://forums1.itrc.hp.com/service/forums/helptips.do?#28

[Rgomes]

Can I have some response now?

:)

TIA,
Richard

[Geoff Wild]

Looks okay - might want logging as well:

logging {

channel all_channel {
file "/var/named/named.log" versions 5 size 10; // keep 5 versions max 10 MB in size
print-category yes;
print-severity yes;
print-time yes;
};
category queries { all_channel; };
category update { all_channel; };
category security { all_channel; };
category default { all_channel; };

};


Do you need any incudes? like rndc key:

include "/etc/rndc.key";

Also for options add:

query-source address * port 53;
version "Noname DNS";
fetch-glue no;
max-cache-size 128M;

Rgds...Geoff

[Rgomes]

HI Geoff,

Thanks.

The option "query-source address * port 53", I read some doc on BIND and understood that this option may not work properly, so they advised to mention source address explicitly?? Although I am using this option to my other named server.

Another good point is logging, I am not sure for an ISP named service, how much syslog size would be sufficient??

one question, shall I apply my ACL to reverse zone also?

regards,
Richard

[Geoff Wild · Accepted solution]

I would keep the ACL on allzones.

As far as logging - start with 5 x 10MB - then go from there - if you need more, just increase it in the named.conf file and issue a: rndc reload

file "/var/named/named.log" versions 5 size 10; // keep 5 versions max 10 MB in size


As far as query source - yes, you can put the source address explicitly - I have mine at 53 because that was the only way I could get a NT DNS box to transfer (though I havn't tried lately to see if it will work explicitly now...)

Rgds...Geoff

[Rgomes]

Hi Geoff,

Thanks for sharing.

Best regards,
Richard