Sébastien Wains » CentOS 4 : chroot DNS with BIND

[...] Howto available for CentOS 5 : http://www.wains.be/index.php/2007/12/13/centos-5-chroot-dns-with-bind/ [...]

amri

just found this error ..

rndc: connect failed: 127.0.0.1#953: connection refused

amri

sorry if this was a spam post ..

but i’ve managed to start the named service after chages some lines ..

[code]
server 192.168.254.207 {
keys { rndckey; };
};
[/code]

to

[code]
server 127.0.0.1 {
keys { rndckey; };
};
[/code]

but currently it can’t nslookup to other domain .. will try find the solution .. i gr8 to achive this far ..

thank you so much for this gr8 how to

regards

bstaggs

Greetings,

I have a fresh install of CentOS 5.1 and I don’t beleive that named.conf is generated by default as it was in version 4.x. I don’t want the GUI stuff so I can’t run system-config-bind. What gives? Did they change something or what am I missing?

Thanks,

bstaggs

gaurav

sir, i need named.conf file always i get the problem to download it provide me a named.conf file so that i can complete dns server

Praveen V

It got resolved. It was a firewall issue at the Data center.

Thanks & Regards,
Praveen V

Praveen V

Thank you very much for the info.

Thanks & Regards,
Praveen V

Altria

Thanks Sebastian!

I found the problem which was in the named.conf file; a incorrect spelling on the zone.

thanks again!
Altria

alaisa22

logs are fine, here is my config file for named.conf

# Start of rndc.conf
key “rndckey” {
algorithm hmac-md5;
secret “y+fRznLdzSffmyZzNG0ZKQ==”;
};

controls {
inet 127.0.0.1 allow { 127.0.0.1; } keys { “rndckey”; };
inet 192.168.121.19 allow ( 192.168.254.0/24; } keys { “rndckey”; };
};

options {
directory “/var/named”;
pid-file “/var/run/named/named.pid”;

recursion yes;

allow-recursion {
127.0.0.1;
192.168.254.0/24;
};

listen-on {
127.0.0.1;
192.168.121.19;
};

query-source address * port 53;

allow-query {
127.0.0.1;
192.168.254.0/24;
};
};

server 192.168.121.19 {
keys { rndckey; };
};

zone “onin.be” IN {
type master;
file “cd /var/named/chroot/var/named/data/onin.be.zone”;
allow-update { none; };
allow-transfer { 192.168.121.19; };
};

Here are my confgi file for my zone located at /var/named/chroot/var/named/data/onin.be.zone

$ttl 38400
onin.be. IN SOA ns.onin.be. admin.onin.be. (
2007020800 ; Serial
10800 ; Refresh after 3 hours
3600 ; Retry after 1 hour
604800 ; Expire after 1 week
86400 ) ; Minimum TTL of 1 day

onin.be. IN NS ns.onin.be.

onin.be. IN MX 1 mx.onin.be.
onin.be. IN MS 5 mx2.onin.be.

ns.onin.be. IN A 192.168.120.22
mx.onin.be. IN A 192.168.121.19
mx2.onin.be. IN A 192.168.121.19
mail.onin.be. IN CNAME mx.onin.be.

Thanks!

Emir

Hi Sebastien,

I want to host website name “komentari.info” on VPS i rented and I I’m having problems with named conf that is how I ran to your tutorial. I’ve been provided with nameservers ips and hostnames for them so hostname for first nameserver is NS149210.RAPIDVPS.NET and it corresponds to 208.84.149.210 and hostname for secondary nameserver is NS15135.RAPIDVPS.NET and it corresponds to this ip 208.84.151.35 . I’ve installed all packages you showed above in this tut. I’ve been over this and many other tutorials over and over again and I can’t figure out the problem what am I doing wrong.

Here is my /etc/named.conf it was linked from /var/named/chroot/etc/named.conf with ln -s :
====================================================================
// we include the rndckey (copy-paste from rndc.key created earlier)
key “rndckey” {
algorithm hmac-md5;
secret “HPET6WPJ7gPbry3AqnmqLrh8auV0IVgqyDoTC8nuy1BB5NKx40Q5aUXI2pav”;
};

// we assume our server has the IP 192.168.254.207 serving the 192.168.254.0/24 subnet
controls {
inet 127.0.0.1 allow { 127.0.0.1; } keys { “rndckey”; };
inet 192.168.254.207 allow { 192.168.254.0/24; } keys { “rndckey”; };
};

options {
directory “/var/named”;
pid-file “/var/run/named/named.pid”;

recursion yes;

allow-recursion {
127.0.0.1;
192.168.254.0/24;
};

listen-on {
127.0.0.1;
192.168.254.207;
};

/*
* If there is a firewall between you and nameservers you want
* to talk to, you might need to uncomment the query-source
* directive below. Previous versions of BIND always asked
* questions using port 53, but BIND 8.1 uses an unprivileged
* port by default.
*/
query-source address * port 53;

// so people can’t try to guess what version you’re running
version “REFUSED”;

allow-query {
127.0.0.1;
192.168.254.0/24;
};
};

server 192.168.254.207 {
keys { rndckey; };
};
zone “.” IN {
type hint;
file “named.ca”;
};

view “internal”
{

// we assume we have a slave dns server with the IP 192.168.254.101
zone “komentari.info” IN {
type master;
file “/var/named/komentari.info.zone”;
};
};

view “external”
{
zone “komentari.info” IN {
type master;
file “/var/named/komentari.info.zone”;
};
};
==================================================================
Here is content of /var/named/komentari.info.zone

==================================================================
$TTL 14400
@ 86400 IN SOA NS149210.RAPIDVPS.NET. hexteam.gmail.com. (
2008170717 ; serial, todays date+todays
86400 ; refresh, seconds
7200 ; retry, seconds
3600000 ; expire, seconds
86400 ) ; minimum, seconds

komentari.info. 86400 IN NS ns149210.rapidvps.net.
komentari.info. 86400 IN NS ns15135.rapidvps.net.

komentari.info. IN A 208.84.149.210

localhost.komentari.info. IN A 127.0.0.1

komentari.info. IN MX 0 komentari.info.

mail IN CNAME komentari.info.
www IN CNAME komentari.info.
ftp IN CNAME komentari.info.
====================================================================
Can you figure out where am I making mistake, why can’t I get ping reply from “ping komentari.info” ? Thank you very good tutorial

Azra

Emireeeeeeeeeeeeeee radiiiiil:)

Adam

In my opinion, bind-chroot should be installed after you configure everything. It will save you time and misconfiguration errors.

Clay

This has been very helpful.

I think I have it almost working but dns is not resolving on my second computer connected to the server.

I have copied everything from your page, customized it for my iprange ex.

test.be I replaced with claymoss.ca, that is registered to me and with any luck someday I will have a page hosted.

anyways I digress,

when I nslookup on the server I get

[root@S010600104b22f14b etc]# nslookup http://www.google.ca 127.0.0.1
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
http://www.google.ca canonical name = http://www.google.com.
ext….

and on the vista computer I get

server: unknown
address: 172.17.10.1 *my internal server ip

unknown can’t find http://www.google.com: queary refused

selinux and iptables are disabled so there should be no firewall issue.

What did I miss?

Clay

Got it, thanks

Tony

Very cool, needed this today as my older centos 4.x settings not working on 5.x servers.
Now to update my wiki
tux

Ruben Ortiz

Hi Sebastien, great tutorial once again

I have one doubt, if we create one slave zone, named reload the “domain.zone” (or whatever) automatically with data of its master dns?

Thanks!

Tuan

Hi Sebastien, it’s great tutorial. So I want ask some question for Bind DNS, would you help me to know. Thank.
File config: named.conf
nano /etc/named.conf
options {
directory “/var/named”;
query-source port 53;
};
zone “testcms.com” {
type master;
file “testcms.com.db”;
};

And I create file: testcms.com.db
$TTL 2d ; zone TTL default = 2 days or 172800 seconds//I don’t know why TTL = 2days.
$ORIGIN testcms.com.
@ IN SOA testcms.com. hostmaster.testcms.com. (
2008051200 ; serial number (change when you modify DNS)
1d12h ; refresh = 1 day 12 hours
15M ; update retry = 15 minutes
3W12h ; expiry = 3 weeks + 12 hours
2h20M ) ; minimum = 2 hours + 20 minutes
//all of this: serial number for what? expiry = I mean it’s expiry in our server…Can you explain for me, thanks a lots, I’m newbie in jobs, and not well linux system..:)

IN NS testcms.com.

IN A 210.245.110.135
www IN A 210.245.110.135
ftp IN A 210.245.110.149

In slaver server:
I’ve changed: type slaver and use master to {210.245.110.135}

I’ve done with this. When nslookup, it’s OK. But How can I create slaver “sync” with master server. When create zone on master server, I want it’ll be in slaver server, too.
Thank you

errornous

here my named.conf
———————-
options {
directory “/etc”;
pid-file “/var/run/named/named.pid”;
};

zone “.” {
type hint;
file “/etc/db.cache”;
};

zone “name.org.my” {
type master;
file “/var/named/name.org.my.hosts”;
};
key rndc-key {
algorithm hmac-md5;
secret “MOh/VWrBda4l3qP0dVvakQ==”;
};
controls {
inet 127.0.0.1 port 953 allow { 127.0.0.1; } keys { rndc-key; };
};

and here my zone.hosts file
—————————-
$ttl 38400
name.org.my. IN SOA ns1.name.org.my. server.name.org.my. (
2
6H
1H
5D
20M )
name.org.my. IN A 60.51.xxx.xxx
http://www.name.org.my. IN CNAME name.org.my.
ns1.name.org.my. IN A 60.51.xxx.xxx
ns2.name.org.my. IN A 60.52.xxx.xxx
name.org.my. IN NS ns1.name.org.my.
name.org.my. IN NS ns2.name.org.my.
name.org.my. IN MX 1 name.org.my.

and here my /etc/resolv.conf
—————————-
search named.org.my
nameserver 127.0.0.1

my problem is, when i browse from out outside, it can resolve the domain name, but when i browse using my internal network to access the server it went to my router. anythin problem with my local loopback?
here my setting

eth0
ip : 192.168.1.10
sub: 255.255.255.0
gateway : 192.168.1.1

eth1
ip : 90.0.0.1
sub : 255.255.255.0

errornous

sorry..this maybe a bit noob..1st time setup..is his corry..coz it seems wont work
my network is using 90.0.0.x ip.

controls {
inet 127.0.0.1 port 953 allow { 127.0.0.1; } keys { rndc-key; };
inet 90.0.0.1 allow { 90.0.0.0/24; } keys { rndc-key; };
};

Stefan

Hello Sébastien.
First of all sorry for my bad english and tnx for your HOWTO.

All is working fine exept one thing… if i try to lookup my server from outside it retern me query is denyed.
Where I made a mistake?

Tnx for your help.

Stefan

Done. All is working fine.

Thanks a lot.

Can you tell me where I am wrong, pls. Here is my .zone file all is working exept 4-th level domain name (123.voip.weblog.ro and 456.voip.weblog.ro). When I tried to check it, it returns me the err – NXDOMAIN. Why?

$ttl 3600
webog.ro. IN SOA ns1.weblog.ro. admin.weblog.ro. (
2002032116 ; Serial
10800 ; Refresh after 3 hours
3600 ; Retry after 1 hour
604800 ; Expire after 1 week
86400 ; Minimum TTL of 1 day
)
weblog.ro. IN NS ns1.weblog.ro.
weblog.ro. IN MX 10 mx.weblog.ro.

ns1.weblog.ro. IN A 87.248.169.122
mx.weblog.ro. IN A 87.248.169.122

http://www.weblog.ro. IN A 87.248.169.122
http://ftp.weblog.ro. IN A 87.248.169.122

123.voip.weblog.ro. IN A 99.333.333.236
456.voip.weblog.ro. IN A 87.248.169.122

mail.weblog.ro. IN CNAME mx.weblog.ro.

I has made the same conf in win 2003 and all is working fine.
Where I am wrong?

Tnx.

errornous

Hello Sébastien.

options {
directory “/etc”;
pid-file “/var/run/named/named.pid”;
};

zone “.” {
type hint;
file “/etc/db.cache”;
};

zone “tbs.org.my” {
type master;
file “/var/named/tbs.org.my.hosts”;
};
key rndc-key {
algorithm hmac-md5;
secret “2WsmJ0BF6esZcqrSzTwkkg==”;
};
controls {
inet 127.0.0.1 port 953 allow { 127.0.0.1; } keys { rndc-key; };
inet 192.168.1.10 allow { 192.168.1.0/24; } keys { rndc-key; };
inet 90.0.0.1 allow { 90.0.0.0/24; } keys { rndc-key; };
};

my eth0 id internet, and my eth1 os for LAN.
what wrong with my named..still cant get to my server through LAN. from outside seems ok..can find my domain,

DNS error in named.conf file

Hello Sebastian,
here is my named.conf file as a static link to named.conf -> /var/named/chroot/etc/named.conf.

// we include the rndckey (copy-paste from rndc.key created earlier)
key “rndckey” {
algorithm hmac-md5;
secret “SGsvd1dF+mv+yU4ywCCkkg==”;
};

// we assume our server has the IP 192.168.254.207 serving the 192.168.254.0/24 subnet
controls {
inet 127.0.0.1 allow { 127.0.0.1; } keys { “rndckey”; };
inet 10.0.0.1 allow { 10.0.0.0/24; } keys { “rndckey”; };
};

options {
directory “/etc”;
pid-file “/var/run/named/named.pid”;

recursion yes;

allow-recursion {
127.0.0.1;
10.0.0.0/24;
};

// these are the opendns servers (optional)
forwarders {
// 208.67.220.220;
194.228.41.113;
};

listen-on {
127.0.0.1;
10.0.0.1;
};

/*
* If there is a firewall between you and nameservers you want
* to talk to, you might need to uncomment the query-source
* directive below. Previous versions of BIND always asked
* questions using port 53, but BIND 8.1 uses an unprivileged
* port by default.
*/
// query-source address * port 53;

// so people can’t try to guess what version you’re running
version “REFUSED”;
allow-query {
127.0.0.1;
10.0.0.0/24;
};
};

server 10.0.0.1 {
keys { rndckey; };
};

zone “.” IN {
type hint;
file “named.ca”;
};

// we assume we have a slave dns server with the IP 192.168.254.101
zone “home.solutia.cz” IN {
type master;
file “/zone/home.solutia.cz.zone”;
allow-update { none; };
// allow-transfer { 192.168.254.101; };
};

When I start “service named start” I got this message:

Error in named configuration:
zone home.solutia.cz/IN: loading master file /zone/home.solutia.cz.zone: file not found
_default/home.solutia.cz/IN: file not found
[FAILED]
I can’t find where named.conf got in the path “_default” and I think this is a reason why my DNS could not start.

Many thanks in advance for your response.

Martin

Guido

The problem with:
# rndc status
rndc: connection to remote host closed
This may indicate that the remote server is using an older version of
the command protocol, this host is not authorized to connect,
or the key is invalid.

I think the problem is in bind-chroot and the used rndckey:
rndc use /etc/rndc.conf
bind-chroot use what is in /var/named/chroot/etc/named.conf and not the
/var/named/chroot/etc/rndc.key
please check the step:
2. Configure RNDC :
on your good HOWTO.

Thank you.

RAF

Hi Sebastien

i ve configured a local DNS it work in the centos machine but when i make nslookup from another machine from the lan it doesnt work ive desactivated the firewall and no result but it ping the 192.168.1.18 the centos machine

here is my named.conf file
controls {
inet 127.0.0.1 allow { 127.0.0.1; } ;
inet 192.168.1.18 allow { 192.168.1.0/24; } ;
};
options {
directory “/var/named”;
dump-file “/var/named/data/cache_dump.db”;
statistics-file “/var/named/data/named_stats.txt”;
/*
* If there is a firewall between you and nameservers you want
* to talk to, you might need to uncomment the query-source
* directive below. Previous versions of BIND always asked
* questions using port 53, but BIND 8.1 uses an unprivileged
* port by default.
*/
query-source address * port 53;
listen-on { 127.0.0.1; 192.168.1.1; };
allow-query { 127.0.0.1; 192.168.1.0/24; };

};

zone “.” IN {
type hint;
file “named.ca”;
};

zone “example.com” IN {
type master;
file “data/master-example.com”;
allow-update { none; };
};

zone “1.168.192.in-addr.arpa” IN {
type master;
file “data/reverse-192.168.1″;
allow-update { none; };
};

the /etc/resolf.conf
search example.com
nameserver 127.0.0.1

and here is the nslookup from the machine:

[root@example etc]# nslookup example.com
Server: 127.0.0.1
Address: 127.0.0.1#53

Name: example.com
Address: 192.168.1.18
also the dig request
[root@example etc]# dig http://www.example.com

; <> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5 <> http://www.example.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<nslookup http://www.example.com
DNS request timed out.
timeout was 2 seconds.
Serveurà:Unknown
address:192.168.1.18

RAF

opcode: QUERY, status: NOERROR, id: 8732
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;www.example.com. IN A

;; ANSWER SECTION:
http://www.example.com. 86400 IN CNAME galaxy.example.com.
galaxy.example.com. 86400 IN A 192.168.1.18

;; AUTHORITY SECTION:
example.com. 86400 IN NS galaxy.example.com.

;; Query time: 5 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Nov 24 15:46:05 2009
;; MSG SIZE rcvd: 84

The machine is hosted an VMware worksatation
The 1st zone file
;
; Zone File for “example.com” – Internal Use ONLY
;
$TTL 1D
@ IN SOA galaxy.example.com. sysadmin.example.com. (
10 ; Serial
8H ; Refresh
2H ; Retry
4W ; Expire
1D ) ; Minimum
;
IN NS galaxy ; Name Server for the domain
IN MX 10 galaxy ; Mail Exchange
;
example.com. IN A 192.168.1.18 ; IP address for the domain ‘example.com’
galaxy IN A 192.168.1.18 ; IP address for ‘galaxy’
www IN CNAME galaxy ; ‘galaxy’ is also known as www
ftp IN CNAME galaxy ; ‘galaxy’ is also known as ftp
;
wkstn1 IN A 192.168.1.201 ; MANUAL IP address entry for ‘wkstn1′
wkstn2 IN A 192.168.1.202 ; MANUAL IP address entry for ‘wkstn2′

the reverse zone file
;
; Reverse File for network “192.168.1.0/24″ – Internal ONLY
;
$TTL 1D
@ IN SOA galaxy.example.com. sysadmin.example.com. (
10 ; Serial
8H ; Refresh
2H ; Retry
4W ; Expire
1D ) ; Minimum
;
IN NS galaxy.example.com.
18 IN PTR galaxy.example.com.
;
201 IN PTR wkstn1.example.com. ; MANUAL entry for ‘wkstn1′ reverse delegation
202 IN PTR wkstn2.example.com. ; MANUAL entry for ‘wkstn2′ reverse delegation

the nslookup from another machine in the lan (an xp machine)
C:\Users\Raf>nslookup http://www.example.com
DNS request timed out.
timeout was 2 seconds.
Serveurà:Unknown
address:192.168.1.18

RAF

Sorry but it doesn’t create /var/log/named.log file

[root@example log]# ls
acpid conman.old maillog rpmpkgs vbox
anaconda.log cron maillog.1 rpmpkgs.1 wtmp
anaconda.syslog cron.1 mailman sa xferlog
anaconda.xlog cups messages samba xferlog.1
audit dmesg messages.1 scrollkeeper.log Xorg.0.log
boot.log faillog munin secure Xorg.0.log.old
boot.log.1 gdm mysqld.log secure.1 yum.log
btmp httpd pm spooler
codendi lastlog ppp spooler.1
conman mail prelink tallylog

RAF

i ve done it but nothing (with all permission to the file) the file is empty
maybe i have somthing wrong in the named.conf file
controls {
inet 127.0.0.1 allow { 127.0.0.1; } ;
inet 192.168.1.18 allow { 192.168.1.0/24; } ;
};
logging {
category “default” { “debug”; };
category “general” { “debug”; };
category “queries” { “debug”; };
channel “debug” {
file “/var/log/named.log” versions 2 size 50m;
severity debug 1;
print-time yes;
print-category yes;
};
};
options {
directory “/var/named”;
dump-file “/var/named/data/cache_dump.db”;
statistics-file “/var/named/data/named_stats.txt”;
/*
* If there is a firewall between you and nameservers you want
* to talk to, you might need to uncomment the query-source
* directive below. Previous versions of BIND always asked
* questions using port 53, but BIND 8.1 uses an unprivileged
* port by default.
*/
query-source address * port 53;
listen-on { 127.0.0.1; 192.168.1.18; };
allow-query { 127.0.0.1; 192.168.1.0/24; };

forward first;
forwarders { 193.95.66.10; 193.95.66.11; };
};

zone “.” IN {
type hint;
file “named.ca”;
};

zone “example.com” IN {
type master;
file “data/master-example.com”;
allow-update { none; };
};

zone “1.168.192.in-addr.arpa” IN {
type master;
file “data/reverse-192.168.1″;
allow-update { none; };
};

tpatel

OS CentOS 5.4

rndc status
rndc: connection to remote host closed
This may indicate that the remote server is using an older version of
the command protocol, this host is not authorized to connect,
or the key is invalid.

how to resolve this error?

tpatel

Hi TuanNguyen

key in rndc.conf, rndc.key and named.conf are same,
any solutions..?

tech guy

Thanks for your solution and great explanation. Can you please suggest what is the best web application to manage DNS records?

tech guy

I’m doing it with Webmin too as of the moment. Thanks again Sébastien. I really appreciate sharing your knowledge.

Eugene

you see, when i modified named.conf like below then it started so it is definitely that change root failed
zone “unicreate.ru” IN {
type master;
file “/var/named/chroot/var/named/data/unicreate.ru.zone”;
allow-update { none; };
// we assume we have a slave dns server with the IP 192.168.254.101
allow-transfer { 192.168.1.11; };
};

// reverse zone
zone “1.168.192.in-addr.arpa” IN {
type master;
file “/var/named/chroot/var/named/data/192.168.1.zone”;
allow-update { none; };
allow-transfer { 192.168.1.11; };
};

Tuan Nguyen

Hi Eugene,

I think you should check data file of BIND service, is it locate on this folder “/var/named/chroot/var/named/data/”. You check again BIND config, because “named.conf” is locate on /etc/named.conf.
Check again or send info “named.conf”

rhodz

i’m running a Centos 5.5, i have a llitle problem with the tutorial… as i follow the steps on it i just found out that i dont have /var/named/chroot/etc/named.conf

do i have to create that file in case?
thanks by the way for this tutorial…

great job.

ph

first, sorry for my english.

i already setup DNS server using BIND in centos 5.4 for intranet access with domain “something.intra.net”. At the same time, all client in local network must have access to Internet. So, i configure directive “forwarders” in “named.conf” file with my ISP DNS server ip address. But now i have problem, when our client in intranet access my local domain “http://something.intra.net”, access will automatically redirect to search engine in internet to search my local domain. Now, i confuse how to resolve this.

Any idea, how i can restrict or protect query to my local domain “something.intra.net” not forward to dns server in internet? so, our local dns server can resolve correctly for our local domain. thanks.

ph

finally resolved thanks … i made some typo )