![[PukiWiki]](image/pukiwiki.png "[PukiWiki]")
DNSの入れ替えを企むので、もう一度BND9のおさらい
#portinstall dns/bind9
portでBIND9をインストールすると、もともと有った/etc/namedb -> /var/named/etc/namedb へのリンクが無くなる場合がります。
オプション指定で、もともとのBINDを入れ替えることにする。
いきなりエラー！？
make: don't know how to make /usr/ports/dns/bind9/work/.build_done.bind9._usr_local. Stop
*** Error code 2
Stop in /usr/ports/dns/bind9.
** Command failed [exit code 1]: /usr/bin/script -qa /tmp/portinstall20100217-64536-10phvg0-0 env make
** Fix the problem and try again.
** Listing the failed packages (-:ignored / *:skipped / !:failed)
! dns/bind9 (unknown build error)
やりなお～し
flora# cd /usr/ports/dns/bind9 flora# make install ===> Found saved configuration for bind9-9.3.6.1.1 => bind-9.3.6-P1.tar.gz doesn't seem to exist in /usr/ports/distfiles/. => Attempting to fetch from ftp://ftp.isc.org/isc/bind9/9.3.6-P1/. bind-9.3.6-P1.tar.gz 5% of 5583 kB 6085 Bps 14m45s
*************************************************************************
* _ _____ _____ _____ _ _ _____ ___ ___ _ _ *
* / \|_ _|_ _| ____| \ | |_ _|_ _/ _ \| \ | | *
* / _ \ | | | | | _| | \| | | | | | | | | \| | *
* / ___ \| | | | | |___| |\ | | | | | |_| | |\ | *
* /_/ \_\_| |_| |_____|_| \_| |_| |___\___/|_| \_| *
* *
* If you are running BIND 9 in a chroot environment, make *
* sure that there is a /dev/random device in the chroot. *
* *
* BIND 9 also requires configuration of rndc, including a *
* "secret" key. The easiest, and most secure way to configure *
* rndc is to run 'rndc-confgen -a' to generate the proper conf *
* file, with a new random key, and appropriate file permissions. *
* *
* The /etc/rc.d/named script in the base will do both for you. *
* *
*************************************************************************
* *
* Please note: BIND 9.3.6 has been classified as "End of Life" *
* as of 1 December 2008 by the ISC. The port will be supported *
* through the lifetime of the RELENG_6 branch, currently *
* scheduled to be supported through 30 November 2010. *
* *
*************************************************************************
===> Compressing manual pages for bind9-base-9.3.6.1.1
===> Registering installation for bind9-base-9.3.6.1.1
===> SECURITY REPORT:
This port has installed the following files which may act as network
servers and may therefore pose a remote security risk to the system.
/usr/sbin/rndc-confgen
/usr/sbin/named-checkconf
/usr/sbin/dnssec-keygen
/usr/sbin/rndc
/usr/sbin/lwresd
/usr/bin/nsupdate
/usr/bin/dig
/usr/sbin/named
/usr/bin/host
/usr/sbin/dnssec-signzone
/usr/bin/nslookup
/usr/sbin/named-checkzone
If there are vulnerabilities in these programs there may be a security
risk to the system. FreeBSD makes no guarantee about the security of
ports included in the Ports Collection. Please type 'make deinstall'
to deinstall the port if this is a concern.
For more information, and contact details about the security
status of this software, see the following webpage:
https://www.isc.org/software/bind
でアップグレード完了。でも、936は本年までの寿命？なんだとか・・・・
既にBindは稼働中なので、以下は、
# cd /etc/namedb/ # rndc-confgen -a wrote key file "/etc/namedb/rndc.key" # cat /etc/namedb/rndc.key > /etc/namedb/rndc.conf
設定済みで、keyは作り直し
Feb 17 07:50:24 flora named[621]: starting BIND 9.3.6-P1 -t /var/named -u bind Feb 17 07:50:24 flora named[621]: using up to 4096 sockets Feb 17 07:50:24 flora named[621]: loading configuration from '/etc/namedb/named.conf' Feb 17 07:50:24 flora named[621]: /etc/namedb/named.conf:37: unknown option 'key' Feb 17 07:50:24 flora kernel: Feb 17 07:50:24 flora named[621]: /etc/namedb/named.conf:37: unknown option 'key' Feb 17 07:50:24 flora named[621]: loading configuration: failure Feb 17 07:50:24 flora kernel: Feb 17 07:50:24 flora named[621]: loading configuration: failure Feb 17 07:50:24 flora named[621]: exiting (due to fatal error) Feb 17 07:50:24 flora kernel: Feb 17 07:50:24 flora named[621]: exiting (due to fatal error)
仰せの通りファイルを編集してreboot
Feb 17 08:05:33 flora named[619]: starting BIND 9.3.6-P1 -t /var/named -u bind Feb 17 08:05:33 flora named[619]: using up to 4096 sockets Feb 17 08:05:33 flora named[619]: loading configuration from '/etc/namedb/named.conf' Feb 17 08:05:34 flora named[619]: max open files (3405) is smaller than max sockets (4096) Feb 17 08:05:34 flora named[619]: using default UDP/IPv4 port range: [49152, 65535] Feb 17 08:05:34 flora named[619]: using default UDP/IPv6 port range: [49152, 65535] Feb 17 08:05:34 flora named[619]: listening on IPv4 interface em0, 218.44.228.148#53 Feb 17 08:05:34 flora named[619]: listening on IPv4 interface lo0, 127.0.0.1#53 Feb 17 08:05:34 flora named[619]: command channel listening on 127.0.0.1#953 Feb 17 08:05:34 flora named[619]: the working directory is not writable Feb 17 08:05:34 flora kernel: Feb 17 08:05:34 flora named[619]: the working directory is not writable Feb 17 08:05:34 flora named[619]: zone 0.0.127.in-addr.arpa/IN: loaded serial 2002040405 Feb 17 08:05:34 flora named[619]: zone 144.228.44.218.in-addr.arpa/IN: loaded serial 2007030700 Feb 17 08:05:34 flora named[619]: zone kuji-clinic.info/IN: loaded serial 2007030701 Feb 17 08:05:34 flora named[619]: zone thousand-winds.jp/IN: loaded serial 2010021700 Feb 17 08:05:34 flora named[619]: zone localhost/IN: loaded serial 2002040402 Feb 17 08:05:34 flora named[619]: running Feb 17 08:05:34 flora named[619]: zone 144.228.44.218.in-addr.arpa/IN: sending notifies (serial 2007030700) Feb 17 08:05:34 flora named[619]: zone kuji-clinic.info/IN: sending notifies (serial 2007030701) Feb 17 08:05:34 flora named[619]: zone thousand-winds.jp/IN: sending notifies (serial 2010021700) Feb 17 08:05:34 flora kernel: Setting date via ntp. Feb 17 08:05:34 flora named[619]: host unreachable resolving 'pns.ocn.ad.jp/AAAA/IN': 2001:dc2::1#53 Feb 17 08:05:34 flora named[619]: host unreachable resolving 'ddns1.interlink.or.jp/A/IN': 2001:240::53#53 Feb 17 08:05:34 flora named[619]: host unreachable resolving 'ddns1.interlink.or.jp/AAAA/IN': 2001:240::53#53
# mv /etc/namedb/named.conf /etc/namedb/named.conf.org # rndc-confgen -a wrote key file "/etc/namedb/rndc.key" # cat /etc/namedb/rndc.key > /etc/namedb/rndc.conf # cat /etc/namedb/rndc.key >> /etc/namedb/named.conf 書き加える？ # rm /etc/namedb/rndc.key してない
# vi /etc/namedb/rndc.conf
key "rndc-key" {
algorithm hmac-md5;
secret "xxxxxxxxxxxxxxxxxxxxxxxx";
};
↓すでにあるオプション行に追加
options {
default-key "rndc-key";
default-server 127.0.0.1;
default-port 953;
};
Server 127.0.0.1 {
key "rndc-key";
};
# chmod 400 /etc/namedb/rndc.conf # chmod 600 /etc/namedb/named.conf # chown bind:wheel /etc/namedb/named.conf
# vi /etc/namedb/named.conf
key "rndc-key" {
algorithm hmac-md5;
secret "xxxxxxxxxxxxxxxxxxxxxxxx";
};
↓最終行に下記を記入
controls {
inet 127.0.0.1 port 953 allow { 127.0.0.1; } keys { "rndc-key"; };
};
options {
version "unknown";
directory "/etc/namedb";
pid-file "/var/run/named/pid";
dump-file "/var/dump/named_dump.db";
statistics-file "/var/stats/named.stats";
listen-on-v6 { none; };
listen-on { localhost; localnets; };
allow-query { localhost; localnets; };
allow-recursion { localhost; localnets; };
allow-transfer { localhost; localnets; };
forwarders { xxx.xxx.xxx.xx1; xxx.xxx.xxx.xx2; };
};
view "internal"{
match-clients { localnets; };
recursion yes;
zone "." IN {
type hint;
file "named.ca";
};
zone "0.0.127.in-addr.arpa" {
type master;
file "0.0.127.in-addr.arpa";
};
zone "3.168.192.in-addr.arpa" {
type master;
file "3.168.192.in-addr.arpa";
};
zone "freebsd.orz" {
type master;
file "freebsd.orz.local";
};
};
※黄色い部分は環境に合わせて変更してください。
※xxx.xxx.xxx.xx1 はプロバイダのプライマリDNSサーバーのIPアドレスです。
※xxx.xxx.xxx.xx2 はプロバイダのセカンダリDNSサーバーのIPアドレスです。
# vi /etc/namedb/named.conf
↓最終行に下記を記入
view "external"{
match-clients { any; };
recursion no;
zone "freebsd.orz" {
type master;
file "freebsd.orz.zone";
allow-transfer { yyy.yyy.yyy.yyy; };
};
};
※黄色い部分は環境に合わせて変更してください
※yyy.yyy.yyy.yyy はセカンダリDNSサーバーのIPアドレスです。
# vi /etc/namedb/0.0.127.in-addr.arpa
↓下記を記入 $TTL 86400 @ IN SOA ns1.freebsd.orz. root.freebsd.orz. ( 2007052900 ;Serial 28800 ;Refresh 7200 ;Retry 604800 ;Expire 86400 ;Minimum ) IN NS ns1.freebsd.orz. 1 IN PTR localhost.
※黄色い部分は環境に合わせて変更してください。
# vi /etc/namedb/freebsd.orz.local
↓下記を記入 $TTL 86400 @ IN SOA ns1.freebsd.orz. root.freebsd.orz. ( 2007052900 ;Serial 28800 ;Refresh 7200 ;Retry 604800 ;Expire 86400 ;Minimum ) IN NS ns1.freebsd.orz. IN MX 10 mail.freebsd.orz. @ IN A 192.168.3.10 * IN A 192.168.3.10 mail IN A 192.168.3.10
# vi /etc/namedb/3.168.192.in-addr.arpa
↓下記を記入
$TTL 86400 @ IN SOA ns1.freebsd.orz. root.freebsd.orz. ( 2007052900 ;Serial 28800 ;Refresh 7200 ;Retry 604800 ;Expire 86400 ;Minimum ) IN NS freebsd.orz. 10 IN PTR freebsd.orz.
# vi /etc/namedb/freebsd.orz.zone
↓下記を記入
$TTL 86400 @ IN SOA ns1.freebsd.orz. root.freebsd.orz. ( 2007052900 ;Serial 28800 ;Refresh 7200 ;Retry 604800 ;Expire 86400 ;Minimum ) IN NS ns1.freebsd.orz. IN MX 10 mail.freebsd.orz. @ IN A zzz.zzz.zzz.zzz * IN A zzz.zzz.zzz.zzz mail IN A zzz.zzz.zzz.zzz freebsd.orz. IN TXT "v=spf1 a mx ~all"
# dig . ns @128.63.2.53 > /etc/namedb/named.ca
# echo 'nameserver 127.0.0.1' > /etc/resolv.conf
# vi /etc/rc.conf
named_enable="YES" ←追加(named起動)
# /etc/rc.d/named start
Oct 8 07:05:37 vaio_ns1 kernel: Oct 8 07:05:37 vaio_ns1 named[1075]: isc_log_open '/var/log/named/named.log' failed: file not found vaio_ns1# touch /var/log/named/update.log touch: /var/log/named/update.log: No such file or directory vaio_ns1# touch /var/log/named/update.log touch: /var/log/named/update.log: No such file or directory vaio_ns1# mkdir /var/log/named vaio_ns1# chown bind:bind /var/log/named
http://hazyinfo.net/wiki/index.php?FreeBSD%2FBIND9
http://www.kishiro.com/FreeBSD/bind.html
http://freebsd.server-manual.com/bind.html
https://www.dns-oarc.net/oarc/services/dnsentropy
2010-02-17 (水) 10:05:13
bind.png 534件
[詳細]
BIND9_Conf.gif 302件
[詳細]
BIND9_Conf.bmp 293件
[詳細]
Bind_Port.gif 291件
[詳細]
