Basic DNS Configuration at Innodata

DNS Configuration at Innodata

Packages

bind-libs-9.3.6-16.P1.el5

bind-sdb-9.3.6-16.P1.el5

bind-chroot-9.3.6-16.P1.el5

bind-utils-9.3.6-16.P1.el5

ypbind-1.19-12.el5

bind-libbind-devel-9.3.6-16.P1.el5

bind-devel-9.3.6-16.P1.el5

bind-9.3.6-16.P1.el5

Configuration

DNS infra overview:

Master DNS: nwjdns30.innodata-isogen.com

Note: ndadns30.innodata-isogen.com is master of innodata.co.in and mnldns30.innodata.com.ph is master of innodata.com.ph domain.

Named.conf

//
// named.caching-nameserver.conf
//
// Provided by Red Hat caching-nameserver package to configure the
// ISC BIND named(8) DNS server as a caching only nameserver
// (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// DO NOT EDIT THIS FILE - use system-config-bind or an editor
// to create named.conf - edits to this file will be lost on
// caching-nameserver package upgrade.
//
acl dmz-servers {
10.105.1.35;
10.105.1.36;
10.125.1.35;
10.125.1.36;
10.155.1.35;
};
acl global-servers {
69.74.164.143;
115.85.0.230;
121.97.80.133;
203.55.173.35;
203.55.173.36;
};
//acl blacklist {
// 144.160.0.0/16;
//};
include "/etc/secure.key";
options {
listen-on port 53 { 127.0.0.1; 10.155.1.35; 69.74.164.142; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
// Those options should be used carefully because they disable port
// randomization
// query-source port 53;
// query-source-v6 port 53;
allow-query { any; };
allow-query-cache { localhost; localnets; };
allow-notify { 69.74.164.142; };
// blackhole { blacklist; };
hostname none;
//dnssec-enable yes;
version "SECURED";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
#key "nwjdns30.innodata-isogen.com" {
#
# algorithm hmac-md5;
# secret "QexjhAJSXKF0s2DeXYqzh7LHOKeKpz6SskUu/YfFj+E=";
#};
#server 203.34.246.35 {
#
# keys {
# nwjdns30.innodata-isogen.com;
# };
#};
view internal_resolver {
match-clients { localhost; localnets; 10.150.0.8; 10.150.0.9; };
recursion yes;
include "/etc/internalview.zone";
};
view external_resolver {
match-clients { !localhost; !localnets; any; };
recursion no;
include "/etc/externalview.zone";
};

Dns views

Dns views is enabled to perform separate query for external and internal client,example of exter and internal view below

External: /etc/externalview.zone

Internal: /etc/internalview.zone

TSIG key configuration

/var/named/chroot/etc/secure.key

Now the zone files will be transferred to those servers only who is having this secure key.