DNS(BIND) Server Configuration.ppt

DNS(BIND) Server Configuration By 林逸祥(Yi-Hsiang Lin) 2002/1/8 @CISCC OUTLINE Hardware requirements Named startup Configuration files Example Hardware requirements BIND is a memory hog. New features of BIND9 also CPU intensive(most notably DNSSEC & IPv6) BIND 9 is multithreaded and can make full use of multiprocessor systems. Watch the size of named process to determine if a name server has enough memory PID USERNAME THR PRI NICE SIZE RES STATE TIME CPU COMMAND 17399 root 6 59 0 12M 12M sleep 17:21 0.30% named Named startup Started at boot time, runs continuously Use a command-line interface:ndc or rndc(BIND 9)ndc commandwhich command can be start, stop, restart, reload, status Should be started before syslogd Do not use inetd to manage named Configuration files(1/2) /etc/named.conf (in BIND 8 and 9) Comments: /* */ , // , # Each statement begins with a keyword An address match list can include:IP/IP with netmask/acl name/key/!E.g. { ! 1.2.3.13; 1.2.3.24; }; { 140.113/16; 127.0.0.1; };PS. “first match” algorithm Configuration files(2/2)Statement types in named.conf The include statement include “path”; Put different portion of the configuration in separate files The path is relative Protect cryptographic keys not world-readable The options statement(1/4) options { option; option; … }; BIND 8 had 30 /BIND 9 has over 50 The options statement(2/4) version “string”; [real version of server] directory “path”; [where server started] notify yes | no; [yes] also-notify svrs_ips; [empty] recursion yes | no; [yes] allow-recursion { add_list }; [all hosts] The options statement(3/4) check-names { master|slave|response action}valid name? letters, numbers, dashes,no longer than 64c per componect, total 256cdefault:master: fail-log and reject bad namesslave: warn-log bad names, but continue processingresponse: ignore-do not checking transfer-format one-answer | many-answers; The options statement(4/4) listen-on port