BIND-9.20.27

#### Beyond Linux® From Scratch (systemd Edition) - Version r13.1-84

### Chapter 20. Major Servers

- Prev

  Apache-2.4.68

- Next

  Kea 3.2.0 DHCP Server

- Up
- Home

# BIND-9.20.27

## Introduction to BIND

The BIND package provides a DNS server and client utilities. If you are only interested in the utilities, refer to the BIND Utilities-9.20.27.

### Note

Development versions of BLFS may not build or run some packages properly if LFS or dependencies have been updated since the most recent stable versions of the books.

### Package Information

- Download (HTTP): https://ftp.isc.org/isc/bind9/9.20.27/bind-9.20.27.tar.xz

- Download MD5 sum: 0a05c630261429e9da8b012314507b05

- Download size: 5.6 MB

- Estimated disk space required: 157 MB (23 MB installed)

- Estimated build time: 0.4 SBU (with parallelism=4; about 8 minutes somewhat processor independent, to run the complete test suite)

### BIND Dependencies

#### Required

liburcu-0.15.6 and libuv-1.52.1

#### Recommended

json-c-0.19, libcap-2.78 with PAM, and nghttp2-1.70.0

#### Optional

cURL-8.22.0, libidn2-2.3.8, libxml2-2.15.4, lmdb-1.0.1, MIT Kerberos V5-1.22.2, pytest-9.1.1, sphinx-9.1.0 (required to build documentation), cmocka, geoip, jemalloc, w3m

#### Optional (to run the test suite)

Net-DNS-1.57, cryptography, dnspython, h2, hypothesis, and pytest-xdist

Editor Notes: https://wiki.linuxfromscratch.org/blfs/wiki/bind

## Installation of BIND

If you plan to run the tests, a virtual python environment should be set up, so that configure finds the Python binary from that environment. This is needed since this binary is then hardcoded into the test framework:

    python3 -m venv --system-site-packages testenv &&
    source testenv/bin/activate

Install BIND by running the following commands:

    ./configure --prefix=/usr           \
                --sysconfdir=/etc       \
                --localstatedir=/var    \
                --mandir=/usr/share/man \
                --disable-static        &&
    make

Issue the following commands to run the complete suite of tests. First, as the `root` user, set up some test interfaces:

### Note

If IPv6 is not enabled in the kernel, there will be several error messages: "RTNETLINK answers: Operation not permitted". These messages do not affect the tests.

    bin/tests/system/ifconfig.sh up

The test suite may indicate some skipped tests depending on what configuration options are used. Some tests are marked “UNTESTED” or do even fail if Net-DNS-1.57 is not installed. The tests require the cryptography, dnspython, h2, hypothesis, and pytest-xdist Python modules, which are not in BLFS. Those modules are installed in the virtual environment created earlier prior to running the tests. To run the tests, as an unprivileged user, execute:

    pip3 install cryptography \
                 dnspython    \
                 h2           \
                 hypothesis   \
                 pytest-xdist &&
    make -k check             &&
    deactivate

Again as `root`, clean up the test interfaces:

    bin/tests/system/ifconfig.sh down

Finally, install the package as the `root` user:

    make install

## Command Explanations

`--sysconfdir=/etc`: This parameter forces BIND to look for configuration files in `/etc` instead of `/usr/etc`.

`--with-libidn2`: This parameter enables the IDNA2008 (Internationalized Domain Names in Applications) support.

`--enable-fetchlimit`: Use this option if you want to be able to limit the rate of recursive client queries. This may be useful on servers which receive a large number of queries.

`--disable-doh`: Use this option if you do not have nghttp2-1.70.0 installed and do not need support for DNS over HTTPS.

`--disable-static`: This switch prevents installation of static versions of the libraries.

`--system-site-packages`: Allow the Python3 venv module to access the system-installed `/usr/lib/python3.14/site-packages` directory.

## Configuring BIND

### Config files

`named.conf`, `root.hints`, `127.0.0`, `rndc.conf`, and `resolv.conf`

### Configuration Information

BIND will be configured to run in a chroot jail as an unprivileged user (`named`). This configuration is more secure in that a DNS compromise can only affect a few files in the `named` user's `HOME` directory.

Create the unprivileged user and group `named`:

    groupadd -g 20 named &&
    useradd -c "BIND Owner" -g named -s /bin/false -u 20 named

Set up some files, directories and devices needed by BIND:

    install -d -m770 -o named -g named /srv/named &&
    cd       /srv/named &&
    mkdir -p dev etc/named/{slave,pz} usr/lib/engines var/run/named &&
    mknod /srv/named/dev/null c 1 3 &&
    mknod /srv/named/dev/urandom c 1 9 &&
    chmod 666 /srv/named/dev/{null,urandom} &&
    cp /etc/localtime etc

The `rndc.conf` file contains information for controlling named operations with the rndc utility. Generate a key for use in the `named.conf` and `rndc.conf` with the rndc-confgen command:

    rndc-confgen -a -b 512 -t /srv/named

Create the `named.conf` file from which named will read the location of zone files, root name servers and secure DNS keys:

    cat >> /srv/named/etc/named.conf << "EOF"
    options {
        directory "/etc/named";
        pid-file "/var/run/named.pid";
        statistics-file "/var/run/named.stats";

    };
    zone "." {
        type hint;
        file "root.hints";
    };
    zone "0.0.127.in-addr.arpa" {
        type master;
        file "pz/127.0.0";
    };

    // Bind 9 now logs by default through syslog (except debug).
    // These are the default logging rules.

    logging {
        category default { default_syslog; default_debug; };
        category unmatched { null; };

      channel default_syslog {
          syslog daemon;                      // send to syslog's daemon
                                              // facility
          severity info;                      // only send priority info
                                              // and higher
      };

      channel default_debug {
          file "named.run";                   // write to named.run in
                                              // the working directory
                                              // Note: stderr is used instead
                                              // of "named.run"
                                              // if the server is started
                                              // with the '-f' option.
          severity dynamic;                   // log at the server's
                                              // current debug level
      };

      channel default_stderr {
          stderr;                             // writes to stderr
          severity info;                      // only send priority info
                                              // and higher
      };

      channel null {
          null;                               // toss anything sent to
                                              // this channel
      };
    };
    EOF

Create a zone file with the following contents:

    cat > /srv/named/etc/named/pz/127.0.0 << "EOF"
    $TTL 3D
    @      IN      SOA     ns.local.domain. hostmaster.local.domain. (
                            1       ; Serial
                            8H      ; Refresh
                            2H      ; Retry
                            4W      ; Expire
                            1D)     ; Minimum TTL
                    NS      ns.local.domain.
    1               PTR     localhost.
    EOF

Create the `root.hints` file with the following commands:

### Note

Caution must be used to ensure there are no leading spaces in this file.

    cat > /srv/named/etc/named/root.hints << "EOF"
    .                       6D  IN      NS      A.ROOT-SERVERS.NET.
    .                       6D  IN      NS      B.ROOT-SERVERS.NET.
    .                       6D  IN      NS      C.ROOT-SERVERS.NET.
    .                       6D  IN      NS      D.ROOT-SERVERS.NET.
    .                       6D  IN      NS      E.ROOT-SERVERS.NET.
    .                       6D  IN      NS      F.ROOT-SERVERS.NET.
    .                       6D  IN      NS      G.ROOT-SERVERS.NET.
    .                       6D  IN      NS      H.ROOT-SERVERS.NET.
    .                       6D  IN      NS      I.ROOT-SERVERS.NET.
    .                       6D  IN      NS      J.ROOT-SERVERS.NET.
    .                       6D  IN      NS      K.ROOT-SERVERS.NET.
    .                       6D  IN      NS      L.ROOT-SERVERS.NET.
    .                       6D  IN      NS      M.ROOT-SERVERS.NET.
    A.ROOT-SERVERS.NET.     6D  IN      A       198.41.0.4
    A.ROOT-SERVERS.NET.     6D  IN      AAAA    2001:503:ba3e::2:30
    B.ROOT-SERVERS.NET.     6D  IN      A       170.247.170.2
    B.ROOT-SERVERS.NET.     6D  IN      AAAA    2801:1b8:10::b
    C.ROOT-SERVERS.NET.     6D  IN      A       192.33.4.12
    C.ROOT-SERVERS.NET.     6D  IN      AAAA    2001:500:2::c
    D.ROOT-SERVERS.NET.     6D  IN      A       199.7.91.13
    D.ROOT-SERVERS.NET.     6D  IN      AAAA    2001:500:2d::d
    E.ROOT-SERVERS.NET.     6D  IN      A       192.203.230.10
    E.ROOT-SERVERS.NET.     6D  IN      AAAA    2001:500:a8::e
    F.ROOT-SERVERS.NET.     6D  IN      A       192.5.5.241
    F.ROOT-SERVERS.NET.     6D  IN      AAAA    2001:500:2f::f
    G.ROOT-SERVERS.NET.     6D  IN      A       192.112.36.4
    G.ROOT-SERVERS.NET.     6D  IN      AAAA    2001:500:12::d0d
    H.ROOT-SERVERS.NET.     6D  IN      A       198.97.190.53
    H.ROOT-SERVERS.NET.     6D  IN      AAAA    2001:500:1::53
    I.ROOT-SERVERS.NET.     6D  IN      A       192.36.148.17
    I.ROOT-SERVERS.NET.     6D  IN      AAAA    2001:7fe::53
    J.ROOT-SERVERS.NET.     6D  IN      A       192.58.128.30
    J.ROOT-SERVERS.NET.     6D  IN      AAAA    2001:503:c27::2:30
    K.ROOT-SERVERS.NET.     6D  IN      A       193.0.14.129
    K.ROOT-SERVERS.NET.     6D  IN      AAAA    2001:7fd::1
    L.ROOT-SERVERS.NET.     6D  IN      A       199.7.83.42
    L.ROOT-SERVERS.NET.     6D  IN      AAAA    2001:500:9f::42
    M.ROOT-SERVERS.NET.     6D  IN      A       202.12.27.33
    M.ROOT-SERVERS.NET.     6D  IN      AAAA    2001:dc3::35
    EOF

The `root.hints` file is a list of root name servers. This file must be updated periodically with the dig utility. A current copy of root.hints can be obtained from https://www.internic.net/domain/named.root. For details, consult the "BIND 9 Administrator Reference Manual".

Create or modify `resolv.conf` to use the new name server with the following commands:

### Note

Replace `<yourdomain.com>` with your own valid domain name.

    cp /etc/resolv.conf /etc/resolv.conf.bak &&
    cat > /etc/resolv.conf << "EOF"
    search <yourdomain.com>
    nameserver 127.0.0.1
    EOF

Set permissions on the chroot jail with the following command:

    chown -R named:named /srv/named

### Systemd Unit

To start the DNS server at boot, install the `named.service` unit included in the blfs-systemd-units-20251204 package:

    make install-named

Now start BIND with the following command:

    systemctl start named

### Testing BIND

Test out the new BIND 9 installation. First query the local host address with dig:

    dig -x 127.0.0.1

Now try an external name lookup, taking note of the speed difference in repeated lookups due to the caching. Run the dig command twice on the same address:

    dig www.linuxfromscratch.org &&
    dig www.linuxfromscratch.org

You can see almost instantaneous results with the named caching lookups. Consult the BIND Administrator Reference Manual (see below) for further configuration options.

## Administrator Reference Manual (ARM)

The ARM documentation (do not confuse with the processor architecture) is included in the source package. The documentation is in .rst format which means that it can be converted in human readable formats if sphinx-9.1.0 is installed.

When BIND is set up, especially if it is going to be operating in a real live scenario, it is highly recommended to consult the ARM documentation. ISC provides an updated set of excellent documentation along with every release so it can be easily viewed and/or downloaded – so there is no excuse to not read the docs. The formats ISC provides are epub and html at https://downloads.isc.org/isc/bind9/9.20.27/doc/arm/.

## Contents

Installed Programs: arpaname, ddns-confgen, delv, dig, dnssec-cds, dnssec-dsfromkey, dnssec-importkey, dnssec-keyfromlabel, dnssec-keygen, dnssec-ksr, dnssec-revoke, dnssec-settime, dnssec-signzone, dnssec-verify, host, mdig, named, named-checkconf, named-checkzone, named-compilezone, named-journalprint, named-nzd2nzf, named-rrchecker, nsec3hash, nslookup, nsupdate, rndc, rndc-confgen, and tsig-keygen (symlink)
Installed Libraries: libdns.so, libisc.so, libisccc.so, libisccfg.so, and libns.so
Installed Directories: /usr/include/{dns,dst,irs,isc,isccc,isccfg,ns}, /usr/lib/bind, and /srv/named

### Short Descriptions

arpaname | translates IP addresses to the corresponding ARPA names
ddns-confgen | generates a key for use by nsupdate and named
delv | is a new debugging tool that is a successor to dig
dig | interrogates DNS servers
dnssec-cds | changes DS records for a child zone based on CDS/CDNSKEY
dnssec-dsfromkey | outputs the Delegation Signer (DS) resource record (RR)
dnssec-importkey | reads a public DNSKEY record and generates a pair of .key/.private files
dnssec-keyfromlabel | gets keys with the given label from a cryptography hardware device and builds key files for DNSSEC
dnssec-keymgr | ensures correct DNSKEY coverage based on a defined policy
dnssec-ksr | creates signed key response (SKR) files for offline KSK setups
dnssec-revoke | sets the REVOKED bit on a DNSSEC key
dnssec-settime | sets the key timing metadata for a DNSSEC key
dnssec-signzone | generates signed versions of zone files
dnssec-verify | verifies that a zone is fully signed for each algorithm found in the DNSKEY RRset for the zone, and that the NSEC / NSEC3 chains are complete
host | is a utility for DNS lookups
mdig | is a version of dig that allows multiple queries at once
named | is the name server daemon
named-checkconf | checks the syntax of `named.conf` files
named-checkzone | checks zone file validity
named-compilezone | is similar to named-checkzone, but it always dumps the zone contents to a specified file in a specified format
named-journalprint | prints the zone journal in human-readable form
named-rrchecker | reads an individual DNS resource record from standard input and checks if it is syntactically correct
named-nzd2nzf | converts an NZD database to NZF text format
nsec3hash | generates an NSEC3 hash based on a set of NSEC3 parameters
nslookup | is a program used to query Internet domain nameservers
nsupdate | is used to submit DNS update requests
rndc | controls the operation of BIND
rndc-confgen | generates `rndc.conf` files
tsig-keygen | is a symlink to ddns-confgen

- Prev

  Apache-2.4.68

- Next

  Kea 3.2.0 DHCP Server

- Up
- Home