1. Install packages :
yum install bind bind-chroot bind-libs bind-utils caching-nameserver
2. Configure RNDC :
cd /var/named/chroot/etc
rndc-confgen > rndc.key
chown root:named rndc.key
Edit rndc.key so it looks like this :
key "rndckey" {
algorithm hmac-md5;
secret "SGsvd1dF+mv+yU4ywCCkkg==";
};
You DON’T NEED anything else in the file (you must remove some option lines!)
A symlink in /etc exists and points to the rndc.key file we’ve just created, named expects that file there in order to be able to authenticate against rndc.
3. Configure /var/named/chroot/etc/named.conf
// we include the rndckey (copy-paste from rndc.key created earlier)
key "rndckey" {
algorithm hmac-md5;
secret "SGsvd1dF+mv+yU4ywCCkkg==";
};
// we assume our server has the IP 192.168.254.207 serving the 192.168.10.0/24 subnet
controls {
inet 127.0.0.1 allow { 127.0.0.1; } keys { "rndckey"; };
inet 192.168.10.10 allow { 192.168.10.0/24; } keys { "rndckey"; };
};
options {
directory "/var/named";
pid-file "/var/run/named/named.pid";
recursion yes;
allow-recursion {
127.0.0.1;
192.168.10.0/24;
};
// these are the opendns servers (optional)
forwarders {
208.67.222.222;
208.67.220.220;
};
listen-on {
127.0.0.1;
192.168.10.10;
};
/*
* If there is a firewall between you and nameservers you want
* to talk to, you might need to uncomment the query-source
* directive below. Previous versions of BIND always asked
* questions using port 53, but BIND 8.1 uses an unprivileged
* port by default.
*/
query-source address * port 53;
// so people can't try to guess what version you're running
version "REFUSED";
allow-query {
127.0.0.1;
192.168.10.0/24;
};
};
server 192.168.10.10 {
keys { rndckey; };
};
zone "." IN {
type hint;
file "named.ca";
};
// forward zone
zone "example.com" IN {
type master;
file "data/example.zone";
allow-update { none; };
// we assume we have a slave dns server with the IP 192.168.10.11
allow-transfer { 192.168.10.11; };
};
// reverse zone
zone "10.168.192.in-addr.arpa" IN {
type master;
file "data/192.168.10.zone";
allow-update { none; };
allow-transfer { 192.168.10.11; };
};
4. Our first zone
Let’s say I own the domain example.com
We create our first zone under /var/named/chroot/var/named/data/example.zone
Here’s an example :
$ttl 38400
example.com. IN SOA ns.example.com. admin.example.com. (
2007020400 ; Serial
10800 ; Refresh after 3 hours
3600 ; Retry after 1 hour
604800 ; Expire after 1 week
86400 ) ; Minimum TTL of 1 day
example.com. IN NS ns.example.com.
example.com. IN MX 1 mx.example.com.
example.com. IN MX 5 mx2.example.com.
www.example.com. IN A 192.168.10.5
ns.example.com. IN A 192.168.10.10
mx.example.com. IN A 192.168.10.20
mx2.example.com. IN A 192.168.10.21
mail.example.com. IN CNAME mx.example.com.
Here’s the corresponding reverse zone under /var/named/chroot/var/named/data/192.168.10.zone :
$TTL 86400
10.168.192.in-addr.arpa. IN SOA ns.example.com. admin.example.com. (
2007032000
10800
900
604800
3600 )
10.168.192.in-addr.arpa. IN NS ns.example.com.
20.10.168.192.in-addr.arpa. IN PTR mx.example.com.
5.10.168.192.in-addr.arpa. IN PTR www.example.com.
5. Start the service and make sure it’ll start at boot
service named start
chkconfig named on
Make sure it’s running:
# rndc status
number of zones: 1
debug level: 0
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is OFF
recursive clients: 0/1000
tcp clients: 0/100
server is up and running
6. Query
# nslookup mx.example.com. 127.0.0.1
Server: 127.0.0.1
Address: 127.0.0.1#53
Name: mx.example.com
Address: 192.168.10.20
# nslookup www.google.com. 127.0.0.1
Server: 127.0.0.1
Address: 127.0.0.1#53
Non-authoritative answer:
www.google.com canonical name = www.l.google.com.
Name: www.l.google.com
Address: 216.239.59.99
Name: www.l.google.com
Address: 216.239.59.103
Name: www.l.google.com
Address: 216.239.59.104
Name: www.l.google.com
Address: 216.239.59.147
7. /etc/resolv.conf
If the query made on the previous point is working, you can set up /etc/resolv.conf on the server.
It should look like this :
search example.com
nameserver 127.0.0.1
