Responses can be authoritative, coming from an authoritative server, or not, coming from a caching server. They can also be truncated, which means that not all of the information available from the server fit in the 512 byte limit.
Resource records can be A or address records, providing the IP address of an FQDN; NS records, which describe name servers to go to for more information; PTR or "pointer" records, which provide the FQDN associated with an IP address; or CNAME records, which provide "canonical names", or aliases. Responses also provide a time for which the data is to be trusted. If a domain name does not exist, the response is NXDOMAIN: non-existant domain.
Primary and secondary servers can also be caching servers for zones for which they are not authoritative.
For instance, if the local domain is "lab265" and the search domains are "rwc.uc.edu" and "uc.edu", the lookup of "mickey.mouse" would involve queries for:
Note that a search for "mickey.mouse." would only involve the first lookup.
The use of search domains is discouraged, since it can result in excessive waits for DNS lookups.
97.122.137.129.in-addr.arpaYou can also perform this query using "dig -x 129.137.122.97".
mount -wo remount /
cd /usr/src
tar -xzf bind-9.3.2.tar.gz
cd bind-9.3.2
sed -i -e '247a #undef SO_BSDCOMPAT\n' lib/isc/unix/socket.c
(./configure --prefix=/usr --sysconfdir=/etc --enable-threads --with-libtool) 2>&1 | tee -a ../bind.out
(make) 2>&1 | tee -a ../bind.out
bin/tests/system/ifconfig.sh up
(make check) 2>&1 | tee -a ../bind.out
bin/tests/system/ifconfig.sh down
grep "R:PASS" ../bind.out | wc -l # should return 144
(make install) 2>&1 | tee -a ../bind.out
chmod 755 /usr/lib/{lib{bind9,isc{,cc,cfg},lwres,dns}.so.*.?.?}
cd doc
install -d -m755 /usr/share/doc/bind-9.3.2/{arm,draft,misc,rfc}
install -m644 arm/*.html /usr/share/doc/bind-9.3.2/arm
install -m644 draft/*.txt /usr/share/doc/bind-9.3.2/draft
install -m644 rfc/* /usr/share/doc/bind-9.3.2/rfc
install -m644 misc/{dnssec,ipv6,migrat*,options,rfc-compliance,roadmap,sdb} /usr/share/doc/bind-9.3.2/misc
groupadd -g 20 named
useradd -c "BIND Owner" -g named -s /bin/false -u 20 named
install -d -m770 -o named -g named /srv/named
cd /srv/named
mkdir -p dev etc/namedb/slave var/run
mknod /srv/named/dev/null c 1 3
mknod /srv/named/dev/random c 1 8
chmod 666 /srv/named/dev/{null,random}
mkdir /srv/named/etc/namedb/pz
cp /etc/localtime /srv/named/etc
rndc-confgen -b 512 | grep -m 1 "secret" | cut -d '"' -f 2 #"
cat > /etc/rndc.conf << "EOF"
key rndc_key {
algorithm "hmac-md5";
secret
"< Insert secret from rndc-confgen's output here >";
};
options {
default-server localhost;
default-key rndc_key;
};
EOF
chown -R named.named /srv/named
cd /sources/blfs-bootscripts-20060624
make install-bind
cd
mount -ro remount /
This installation method installs named in a "chroot jail" located in /srv/named. The directories
and files installed in /srv/named permit named to be run with /srv/named as its root directory.
This means that if named is compromised, the hacker has no access to any other directory or file
on the system.
Some browsers will create lab265 as "lab265.htm". If this happens, rename it.Edit named.conf to insert the rndc key into the line
secret "< Insert secret from rndc-confgen's output here >";
"dig @(host) AXFR lab265" can be used to test access through TCP. Until we reconfigure named, this can only be done from the instructor's PC.
©2007, Kenneth R. Koehler. All Rights Reserved. This document may be freely reproduced provided that this copyright notice is included.
Please send comments or suggestions to the author.