Caching-only name servers are servers not authoritative for any domains except
0.0.127.in-addr.arpa, the localhost. A
caching-only name server can look up names inside and outside
your zone, as can
primary and
slave name servers. The difference is that when a
caching-only name server initially looks up a name within your zone, it ends up asking one
of the
primary or
slave names servers for your zone for the answer.
http://www.faqs.org/docs/securing/chap21sec164.html
The necessary files to setup a simple caching name server are:
-
named.conf
-
db.127.0.0
-
db.cache
-
named script
To configure the
/etc/named.conf file for a simple caching name server, use this for all servers that dont act as a
master or
slave
name server. Setting up
a simple caching server for local client machines will reduce the load
on the network's primary server. Many users on dialup connections may
use this configuration along with bind for such a purpose.
Create the
named.conf file,
touch /etc/named.conf and add the following lines to the file:
options {
directory "/var/named";
forwarders { 208.164.186.1; 208.164.186.2; };
forward only;
};
//
// a caching only nameserver config
zone "." in {
type hint;
file "db.cache";
};
zone "0.0.127.in-addr.arpa" in {
type master;
file "db.127.0.0";
};
|
-
In the forwarders line, 208.164.186.1 and 208.164.186.2 are the IP addresses of your Primary Master and Secondary Slave
DNS server. They can also be the IP addresses of your ISPs DNS server and another DNS server, respectively.
:
To improve the security of your BIND/DNS server you can stop it from even trying to contact an off-site server if their forwarder is down or doesn't respond. With the
forward only option set in your named.conf file, the name server doesn't try to contact other servers to find out information if the forwarder doesn't give
it an answer.
To configure the
/var/named/db.127.0.0 file for a simple caching name server,you can use this configuration for all machines on your network that don't act as a
master or
slave name server.
The
db.127.0.0 file covers the loopback network. Create the following files in
/var/named/,
touch /var/named/db.127.0.0 and
add the following lines in the file:
$TTL 345600
@ IN SOA localhost. root.localhost. (
00 ; Serial
86400 ; Refresh
7200 ; Retry
2592000 ; Expire
345600 ) ; Minimum
IN NS localhost.
1 IN PTR localhost.
|
Configure the
/var/named/db.cache file for a simple caching name server before starting your
DNS server. You must take a copy of
db.cache file
and copy this file to the
/var/named/ directory. The
db.cache tells your server where the servers for the
root zone are.
Use the following commands on another Unix computer in your organization to query a new
db.cache file for your
DNS Server or pick one from your
Red Hat Linux
CD-ROM source distribution:
[root@deep]# dig @.aroot-servers.net . ns > db.cache
|
Don't forget to copy the
db.cache file to the
/var/named/ directory on your server where you're installing
DNS server
after retrieving it over the Internet.
:
Internal addresses like 192.168.1/24 are not included in the DNS configuration files for security reasons. It is very important that DNS doesn't exist between hosts on the corporate network and external hosts.
Comments