- 追加された行はこの色です。
- 削除された行はこの色です。
[[FrontPage]]
[[BIND9 20121215]]
----
#contents
----
*OS同梱のbindをportsのものに入れ替える [#a598d102]
2013-03-14 08:19:57
http://www.yomaigoto.jp/archives/437
root@ns1:/root # named -v
BIND 9.8.3-P4
ports から最新のBIND をインストールする。このとき、make のオプションに "WITH_REPLACE_BASE=yes" を加えると、BASE の BIND を ports のものと完全に置き換えることが出来るが、これはお勧めしない。~
なぜなら、freebsd-update を実行する度に BASE の BIND に戻そうとするから。BASE と ports と両方インストールしておき、rc.conf で named のパスを指定することで使い分ける方法を採る。
root@ns1:/root # portinstall dns/bind99
オプションはデフォルトのまま
#ref(bind99_option.png)
*************************************************************************
* _ _____ _____ _____ _ _ _____ ___ ___ _ _ *
* / \|_ _|_ _| ____| \ | |_ _|_ _/ _ \| \ | | *
* / _ \ | | | | | _| | \| | | | | | | | | \| | *
* / ___ \| | | | | |___| |\ | | | | | |_| | |\ | *
* /_/ \_\_| |_| |_____|_| \_| |_| |___\___/|_| \_| *
* *
* If you are running BIND 9 in a chroot environment, make *
* sure that there is a /dev/random device in the chroot. *
* *
* BIND 9 also requires configuration of rndc, including a *
* "secret" key. The easiest, and most secure way to configure *
* rndc is to run 'rndc-confgen -a' to generate the proper conf *
* file, with a new random key, and appropriate file permissions. *
* *
* The /etc/rc.d/named script in the base will do both for you. *
* *
*************************************************************************
===> Compressing manual pages for bind99-9.9.2.1
===> Registering installation for bind99-9.9.2.1
===> SECURITY REPORT:
This port has installed the following files which may act as network
servers and may therefore pose a remote security risk to the system.
/usr/local/sbin/named-journalprint
/usr/local/sbin/named
/usr/local/sbin/rndc-confgen
/usr/local/sbin/dnssec-verify
/usr/local/sbin/ddns-confgen
/usr/local/sbin/dnssec-dsfromkey
/usr/local/bin/host
/usr/local/sbin/nsec3hash
/usr/local/sbin/dnssec-signzone
/usr/local/bin/nsupdate
/usr/local/sbin/rndc
/usr/local/sbin/lwresd
/usr/local/bin/dig
/usr/local/sbin/dnssec-revoke
/usr/local/sbin/dnssec-keygen
/usr/local/sbin/named-checkzone
/usr/local/sbin/dnssec-keyfromlabel
/usr/local/sbin/named-checkconf
/usr/local/bin/nslookup
/usr/local/sbin/dnssec-settime
If there are vulnerabilities in these programs there may be a security
risk to the system. FreeBSD makes no guarantee about the security of
ports included in the Ports Collection. Please type 'make deinstall'
to deinstall the port if this is a concern.
For more information, and contact details about the security
status of this software, see the following webpage:
https://www.isc.org/software/bind
===> Cleaning for bind99-9.9.2.1
rndc.key を再生成する。
http://linux.kororo.jp/cont/server/bind_src.php
# /usr/local/sbin/rndc-confgen -a -b 512 -k rndckey
上記コマンドを実行したら、/etc/namedb/rndc.key というファイルが作成(上書き)されている.~
このとき、/usr/local/etc/rndc.key が /etc/namedb/rndc.key のシンボリックリンクとして作成される。~
続いて、/etc/rc.conf に以下の一文を追加。
[/etc/rc.conf]
named_program="/usr/local/sbin/named"
しかる後に、BIND を再起動。明示的に停止した上で起動させる。
# ps ax | grep named
877 ?? Ss 0:02.21 /usr/sbin/syslogd -l /var/run/log -l /var/named/var/run/log -
2033 ?? Is 1:54.54 /usr/sbin/named -t /var/named -u bind
98231 0 S+ 0:00.00 grep named
# kill 2033
# /usr/local/sbin/named -t /var/named -u bind
# ps ax | grep named
877 ?? Ss 0:02.38 /usr/sbin/syslogd -l /var/run/log -l /var/named/var/run/log -
98235 ?? Ss 0:10.87 /usr/local/sbin/named -t /var/named -u bind
6680 0 S+ 0:00.00 grep named
なぜか起動時にSYSLOGにエラーを吐く。
syslog抜粋：
Nov 19 20:57:07 atom named[98235]: Warning: view local-zone: 'empty-zones-ena
ble/disable-empty-zone' not set: disabling RFC 1918 empty zones
Nov 19 20:57:07 atom named[98235]: command channel listening on 127.0.0.1#953
Nov 19 20:57:07 atom named[98235]: managed-keys-zone ./IN/local-zone: loading
from master file 77705e291908193a368e1a63ec464c83c5519736a0faa4bc753d76fc79750
a68.mkeys failed: file not found
Nov 19 20:57:07 atom named[98235]: managed-keys-zone ./IN/external: loading fr
om master file 3c4623849a49a53911c4a3e48d8cead8a1858960bccdea7a1b978d73ec2f06d
7.mkeys failed: file not found
実用上は特に影響はないが、これを回避するには managed-keys.bind という名の空ファイルを作ってやればよい。
# touch /etc/namedb/working/managed-keys.bind
ちなみに、現時点のバージョン
# named -v
BIND 9.8.1-P1
![[PukiWiki]](image/pukiwiki.png "[PukiWiki]")
