Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 237)

Chapter 17. Berkeley Internet Name Domain (BIND) 237

• TSIG — Short for Transaction SIGnatures, a shared secret key exists on the master and slave server,

verifying that a transfer from master to slave is authorized.

This feature strengthens the standard IP address-based method of transfer authorization. An attacker

would not only need to have access to the IP address to transfer the zone, but they would also need

to know the secret key.

BIND version 9 also support TKEY, which is another shared secret key method of authorizing zone

transfers.

17.4.4. IP version 6

BIND version 9 can provide nameservice in IP version 6 (IPv6) environments, through the use of A6

zone records.

If your network environment includes both IPv4 and IPv6 hosts, you should use the lwresd

lightweight resolver daemon on your network clients. This daemon is essentially a very efﬁcient,

caching-only nameserver, which understands the new A6 and DNAME records used with IPv6. See the

lwresd man page for more information.

17.5. Common Mistakes to Avoid

It is very common for beginners to make mistakes when editing BIND conﬁguration ﬁles or run in to

initial difﬁculties using named. Be sure to avoid the following problems:

• Make sure you increment the serial number when editing a zone ﬁle.

If the serial number is not incremented, your master nameserver may have the correct, new infor-

mation, but your slave nameservers will never be notiﬁed of the change or attempt to refresh their

data of that zone.

• Be careful to use ellipses and semi-colons correctly in the /etc/named.conf ﬁle.

An omitted semi-colon or unclosed ellipse section will cause named to refuse to start.

• Remember to place dots (.) in zone ﬁles after all FQDNs and omit them on hostnames.

The dot denotes a fully qualiﬁed domain name. If the dot is omitted, then named will place the

name of the zone or the $ORIGIN value after the name to complete it.

• If you are having problems with your ﬁrewall blocking connections from your named to other

nameservers, you should manually tell named to use port 53 for upstream queries.

BIND version 9 uses random ports above 1024 query other nameservers to resolve names, just

like other DNS clients do, connecting to the remote nameserver’s port 53. Some ﬁrewalls, however,

expect nameservers to communicate with each other with both systems using port 53. You can place

the following line in the options statement to force named to send queries from port 53:

query-source address * port 53;

17.6. Additional Resources

The following sources of information will provide additional resources regarding BIND.

1 2 ... 232 233 234 235 236 237 238 239 240 241 242 ... 281 282

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 237