Setting Up BIND 9.3 on FreeBSD 5.3

Today I moved my local name resolution duties from a FreeBSD 4.x system to a FreeBSD 5.3 system. I found the FreeBSD Handbook sparse reading, but this article gave a few more pointers. Here's what I ended up doing.

The first step is to recognize that /etc/namedb is a symlink:

janney:/home/richard$ ls -al /etc/namedb
lrwxrwxrwx  1 root  wheel  23 Nov  8 09:14 /etc/namedb -> ../var/named/etc/namedb

This supports the new default of running BIND in a jail.

Next I created the localhost-v6.rev and localhost.rev files in /var/named/etc/namedb/master. 

janney:/home/richard$ cd /var/named/etc/namedb/
janney:/var/named/etc/namedb$ sudo sh make-localhost

I altered the serial numbers by adding '01' to the end to allow 99 edits per day. (Using the default '20050109' yields one edit per day, if you want your serial number to be related to the day you change it. This is totally optional but I find it helpful.)

janney:/var/named/etc/namedb/master$ cat localhost.rev 
;       From: @(#)localhost.rev 5.1 (Berkeley) 6/30/90
; $FreeBSD: src/etc/namedb/PROTO.localhost.rev,v 1.6 2000/01/10 15:31:40 peter Exp $
;
; This file is automatically edited by the `make-localhost' script in
; the /etc/namedb directory.
;

$TTL    3600

@       IN      SOA     janney.taosecurity.com. root.janney.taosecurity.com.  (
                                2005010901      ; Serial
                                3600    ; Refresh
                                900     ; Retry
                                3600000 ; Expire
                                3600 )  ; Minimum
        IN      NS      janney.taosecurity.com.
1       IN      PTR     localhost.taosecurity.com.

Next I ran rndc-confgen to create a key which authorizes me to administer the BIND server. Notice that rndc replaces ndc for controlling BIND.

janney:/home/richard$ sudo rndc-confgen -a
wrote key file "/etc/namedb/rndc.key"
janney:/home/richard$ sudo cat /etc/namedb/rndc.key
key "rndc-key" {
        algorithm hmac-md5;
        secret "OBSCURED";
};

I then added that information plus a control statement to /var/named/etc/namedb/named.conf:

controls {
  inet 127.0.0.1 allow { localhost; } keys { rndc-key; };
};

key "rndc-key" {
        algorithm hmac-md5;
        secret "OBSCURED";
};

I found I had a file /etc/rndc.conf that had a matching key:

options {
        default-server  localhost;
        default-key     "rndc-key";
};

server localhost {
        key     "rndc-key";
};

key "rndc-key" {
        algorithm hmac-md5;
        secret "OBSCURED";
};

With this infrastructure in place, I essentially copied my old zone configuration files into /var/named/etc/namedb. I made sure to update all of the serial numbers on files with changes. Once done I used the new rc scripts to restart named:

janney:/etc/namedb$ sudo /etc/rc.d/named restart
Stopping named.
Starting named.

I checked to see if I could query BIND's status as a user, but then had to use sudo because they rndc.key file was not readable for users:

janney:/etc/namedb$ rndc status
rndc: error: none:0: open: /etc/namedb/rndc.key: permission denied
rndc: could not load rndc configuration
janney:/etc/namedb$ sudo rndc status
number of zones: 7
debug level: 0
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is OFF
recursive clients: 0/1000
tcp clients: 0/100
server is up and running

Everything seems to be working. My /etc/rc.conf file has these DNS-related entries:

named_enable="YES"
named_chrootdir="/var/named"
named_chroot_autoupdate="YES"

Comments

Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more