![[PukiWiki]](image/pukiwiki.png "[PukiWiki]")
2013-03-14 08:19:57
http://www.yomaigoto.jp/archives/437
root@ns1:/root # named -v BIND 9.8.3-P4
ports から最新のBIND をインストールする。このとき、make のオプションに "WITH_REPLACE_BASE=yes" を加えると、BASE の BIND を ports のものと完全に置き換えることが出来るが、これはお勧めしない。
なぜなら、freebsd-update を実行する度に BASE の BIND に戻そうとするから。BASE と ports と両方インストールしておき、rc.conf で named のパスを指定することで使い分ける方法を採る。
root@ns1:/root # portinstall dns/bind99
オプションはデフォルトのまま
*************************************************************************
* _ _____ _____ _____ _ _ _____ ___ ___ _ _ *
* / \|_ _|_ _| ____| \ | |_ _|_ _/ _ \| \ | | *
* / _ \ | | | | | _| | \| | | | | | | | | \| | *
* / ___ \| | | | | |___| |\ | | | | | |_| | |\ | *
* /_/ \_\_| |_| |_____|_| \_| |_| |___\___/|_| \_| *
* *
* If you are running BIND 9 in a chroot environment, make *
* sure that there is a /dev/random device in the chroot. *
* *
* BIND 9 also requires configuration of rndc, including a *
* "secret" key. The easiest, and most secure way to configure *
* rndc is to run 'rndc-confgen -a' to generate the proper conf *
* file, with a new random key, and appropriate file permissions. *
* *
* The /etc/rc.d/named script in the base will do both for you. *
* *
*************************************************************************
===> Compressing manual pages for bind99-9.9.2.1
===> Registering installation for bind99-9.9.2.1
===> SECURITY REPORT:
This port has installed the following files which may act as network
servers and may therefore pose a remote security risk to the system.
/usr/local/sbin/named-journalprint
/usr/local/sbin/named
/usr/local/sbin/rndc-confgen
/usr/local/sbin/dnssec-verify
/usr/local/sbin/ddns-confgen
/usr/local/sbin/dnssec-dsfromkey
/usr/local/bin/host
/usr/local/sbin/nsec3hash
/usr/local/sbin/dnssec-signzone
/usr/local/bin/nsupdate
/usr/local/sbin/rndc
/usr/local/sbin/lwresd
/usr/local/bin/dig
/usr/local/sbin/dnssec-revoke
/usr/local/sbin/dnssec-keygen
/usr/local/sbin/named-checkzone
/usr/local/sbin/dnssec-keyfromlabel
/usr/local/sbin/named-checkconf
/usr/local/bin/nslookup
/usr/local/sbin/dnssec-settime
If there are vulnerabilities in these programs there may be a security
risk to the system. FreeBSD makes no guarantee about the security of
ports included in the Ports Collection. Please type 'make deinstall'
to deinstall the port if this is a concern.
For more information, and contact details about the security
status of this software, see the following webpage:
https://www.isc.org/software/bind
===> Cleaning for bind99-9.9.2.1
rndc.key を再生成する。 http://linux.kororo.jp/cont/server/bind_src.php
# /usr/local/sbin/rndc-confgen -a -b 512 -k rndckey
上記コマンドを実行したら、/etc/namedb/rndc.key というファイルが作成(上書き)されている.
続いて、/etc/rc.conf に以下の一文を追加。
[/etc/rc.conf] named_program="/usr/local/sbin/named"
# /usr/local/sbin/named -t /var/named -u bind # ps ax | grep named 877 ?? Ss 0:02.38 /usr/sbin/syslogd -l /var/run/log -l /var/named/var/run/log - 98235 ?? Ss 0:10.87 /usr/local/sbin/named -t /var/named -u bind 6680 0 S+ 0:00.00 grep named
Mar 14 10:44:06 ns1 named[825]: starting BIND 9.9.2-P1 -t /var/named -u bind Mar 14 10:44:06 ns1 named[825]: ---------------------------------------------------- Mar 14 10:44:06 ns1 named[825]: BIND 9 is maintained by Internet Systems Consortium, Mar 14 10:44:06 ns1 named[825]: Inc. (ISC), a non-profit 501(c)(3) public-benefit Mar 14 10:44:06 ns1 named[825]: corporation. Support and training for BIND 9 are Mar 14 10:44:06 ns1 named[825]: available at https://www.isc.org/support Mar 14 10:44:06 ns1 named[825]: ---------------------------------------------------- Mar 14 10:44:07 ns1 named[825]: command channel listening on 127.0.0.1#953 Mar 14 10:44:07 ns1 named[825]: the working directory is not writable Mar 14 10:46:36 ns1 named[825]: the working directory is not writable Mar 14 10:46:36 ns1 named[825]: all zones loaded Mar 14 10:46:36 ns1 named[825]: running Mar 14 11:00:48 ns1 named[825]: the working directory is not writable Mar 14 11:00:49 ns1 named[825]: all zones loaded Mar 14 11:00:49 ns1 named[825]: running
http://d.hatena.ne.jp/tama0905/20110729/1311934233
/etc/mtree/BIND.chroot.distの「/set type=dir uname=root gname=wheel mode=0755」をuname=bindへ修正すると、エラーが出なくなりましたし、ディレクトリ所有者もbindになりました。
http://www.geocities.jp/yasasikukaitou/rndc2.html
root@ns1:/root # named -v BIND 9.8.3-P4
と、OSバンドルバージョンが表示される。
root@ns1:/root # rndc status
だと、portsで入れたバージョンが表示される。
WARNING: key file (/etc/namedb/rndc.key) exists, but using default configuration file (/etc/namedb/rndc.conf) version: 9.9.2-P1 CPUs found: 1 worker threads: 1 UDP listeners per interface: 1 number of zones: 39 debug level: 0 xfers running: 0 xfers deferred: 0 soa queries in progress: 0 query logging is OFF recursive clients: 0/0/1000 tcp clients: 0/100 server is up and running
https://lists.isc.org/pipermail/bind-users/2010-October/081444.html
root@ns1:/root # rndc reload WARNING: key file (/etc/namedb/rndc.key) exists, but using default configuration file (/etc/namedb/rndc.conf) server reload successful
というWARNINGをいただきますた。
mv /var/named/etc/namedb/rndc.conf /var/named/etc/namedb/rndc.conf_stop
で、消えました。
参考URL BIND 9 のエラー対策(2)
Apr 4 11:02:44 theseus kernel: Apr 4 11:02:44 theseus named[1013]: creating IPv4 interface fxp0 failed; interface ignored Apr 4 11:02:44 theseus kernel: Apr 4 11:02:44 theseus named[1013]: could not listen on UDP socket: permission denied
これが起こってて、エラーが延々でていた。(ーー;)
reboot すると/var/log/messages にbindを二回起動した記録があり、原因を探っていたところ、なんと、/etc/rc.d/に
-r-xr-xr-x 1 root wheel 293 Mar 30 13:12 msgs -r-xr-xr-x 1 root wheel 7569 Mar 30 13:12 named -r-xr-xr-x 1 root wheel 3569 Mar 30 13:12 named-dist -r-xr-xr-x 1 root wheel 780 Mar 30 13:12 natd -r-xr-xr-x 1 root wheel 3891 Mar 30 13:12 netif
ってな具合に、念のためにとリネーム保存していたnamed-distがありました。
これを削除して、一見落着。
Apr 5 11:38:10 theseus named[937]: error (unexpected RCODE REFUSED) resolving 'ns1.oar.net/A/IN': 210.141.108.226#53 Apr 5 11:38:10 theseus named[937]: error (unexpected RCODE REFUSED) resolving 'ns1.oar.net/AAAA/IN': 210.141.108.226#53
named.ca に記載したホストのIPが有効でないという結果
# dig . ns @128.63.2.53 > /etc/namedb/named.ca
Total access 11174：本日 2：昨日 0
