Starinux Auteur : Jean-Yves Bossard FICHE TECHNIQUE Linux Tutoriel Cache DNS avec Bind 9 TUTORIEL Starinux de création d'un cache DNS avec Bind 9 La distribution utilisée pour ce tutoriel est une Debian SID. 1. Configuration du fichier /etc/bind/named.conf Dans le fichier /etc/bind/named.conf doit figurer l'entrée suivante : zone "127.in-addr.arpa" { type master file "/etc/bind/db.127" zone "0.in-addr.arpa" { type master file "/etc/bind/db.0" include "/etc/bind/named.conf.options" 2. Configuration du fichier /etc/bind/named.conf.options Dans le fichier /etc/bind/named.conf.options doit figurer l'entrée suivante options { directory "/var/cache/bind" // If there is a firewall between you and nameservers you want // to talk to, you might need to uncomment the query-source // directive below. Previous versions of BIND always asked // questions using port 53, but BIND 8.1 and later use an unprivileged // port by default. // query-source address * port 53 // If your ISP provided one or more IP addresses for stable // nameservers, you probably want to use them as forwarders. 1
// Uncomment the following block, and insert the addresses replacing // the all-0's placeholder. forwarders { 80.10.246.130 #Si vous etes abonne chez Wanadoo 80.10.246.3 auth-nxdomain no # conform to RFC1035 3. Dans le répertoire /var/cache/bind doivent figurer les fichiers de zone suivants /var/cache/bind/db.127 /var/cache/bind/db.root 3.1 Fichier /var/cache/bind/db.127 --------------------------------------------- BIND reverse data file for local loopback interface $TTL 604800 @ IN SOA localhost. root.localhost. ( 1 Serial 604800 Refresh 86400 Retry 2419200 Expire 604800 ) Negative Cache TTL @ IN NS localhost. 1.0.0 IN PTR localhost. 3.2 Fichier /var/cache/bind/db.root <<>> DiG 9.2.3 <<>> ns. @a.root-servers.net. Got answer: ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18944 flags: qr aa rd QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 13 QUESTION SECTION:. IN NS. 518400 IN NS A.ROOT-SERVERS.NET. 2
. 518400 IN NS B.ROOT-SERVERS.NET.. 518400 IN NS C.ROOT-SERVERS.NET.. 518400 IN NS D.ROOT-SERVERS.NET.. 518400 IN NS E.ROOT-SERVERS.NET.. 518400 IN NS F.ROOT-SERVERS.NET.. 518400 IN NS G.ROOT-SERVERS.NET.. 518400 IN NS H.ROOT-SERVERS.NET.. 518400 IN NS I.ROOT-SERVERS.NET.. 518400 IN NS J.ROOT-SERVERS.NET.. 518400 IN NS K.ROOT-SERVERS.NET.. 518400 IN NS L.ROOT-SERVERS.NET.. 518400 IN NS M.ROOT-SERVERS.NET. ADDITIONAL SECTION: A.ROOT-SERVERS.NET. 3600000 IN A 198.41.0.4 B.ROOT-SERVERS.NET. 3600000 IN A 192.228.79.201 C.ROOT-SERVERS.NET. 3600000 IN A 192.33.4.12 D.ROOT-SERVERS.NET. 3600000 IN A 128.8.10.90 E.ROOT-SERVERS.NET. 3600000 IN A 192.203.230.10 F.ROOT-SERVERS.NET. 3600000 IN A 192.5.5.241 G.ROOT-SERVERS.NET. 3600000 IN A 192.112.36.4 H.ROOT-SERVERS.NET. 3600000 IN A 128.63.2.53 I.ROOT-SERVERS.NET. 3600000 IN A 192.36.148.17 J.ROOT-SERVERS.NET. 3600000 IN A 192.58.128.30 K.ROOT-SERVERS.NET. 3600000 IN A 193.0.14.129 L.ROOT-SERVERS.NET. 3600000 IN A 198.32.64.12 M.ROOT-SERVERS.NET. 3600000 IN A 202.12.27.33 4. Modifier le fichier /etc/resolv.conf ou /etc/ppp/resolv.conf nameserver 127.0.0.1 searchname mon.domain.net 5. Relancer Bind9 /etc/init.d/bind9 restart 3
6. Tester que le cache DNS fonctionne Lancer la commande suivante pour voir si en local cela fonctionne : dig @mon.adresse.ip.perso mon.domain.net Exemple : dig @82.127.3.18 jybserver.homelinux.net Le résultat de la commande doit être : jyb@jybserver:/etc/bind$ dig @82.127.3.18 jybserver.homelinux.net <<>> DiG 9.2.4rc7 <<>> @82.127.3.18 jybserver.homelinux.net Got answer: ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49991 flags: qr rd ra QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 0 QUESTION SECTION: jybserver.homelinux.net. IN A jybserver.homelinux.net. 10786 IN A 82.127.3.18 AUTHORITY SECTION:. 51882 IN NS D.ROOT-SERVERS.net.. 51882 IN NS E.ROOT-SERVERS.net.. 51882 IN NS F.ROOT-SERVERS.net.. 51882 IN NS G.ROOT-SERVERS.net.. 51882 IN NS H.ROOT-SERVERS.net.. 51882 IN NS I.ROOT-SERVERS.net.. 51882 IN NS J.ROOT-SERVERS.net.. 51882 IN NS K.ROOT-SERVERS.net.. 51882 IN NS L.ROOT-SERVERS.net.. 51882 IN NS M.ROOT-SERVERS.net.. 51882 IN NS A.ROOT-SERVERS.net.. 51882 IN NS B.ROOT-SERVERS.net.. 51882 IN NS C.ROOT-SERVERS.net. Query time: 2 msec SERVER: 82.127.3.18#53(82.127.3.18) WHEN: Wed Dec 8 00:24:28 2004 MSG SIZE rcvd: 265 Lancer la commande suivante pour vérifier que le cache DNS fonctionne bien dig www.free.fr Le résultat de la commande doit être : -------------------------------------------------------------- 4
jyb@jybserver:/etc/bind$ dig www.free.fr <<>> DiG 9.2.4rc7 <<>> www.free.fr Got answer: ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39570 flags: qr rd ra QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 0 QUESTION SECTION: www.free.fr. IN A www.free.fr. 79425 IN A 213.228.0.42 AUTHORITY SECTION:. 51729 IN NS K.ROOT-SERVERS.NET.. 51729 IN NS L.ROOT-SERVERS.NET.. 51729 IN NS M.ROOT-SERVERS.NET.. 51729 IN NS A.ROOT-SERVERS.NET.. 51729 IN NS B.ROOT-SERVERS.NET.. 51729 IN NS C.ROOT-SERVERS.NET.. 51729 IN NS D.ROOT-SERVERS.NET.. 51729 IN NS E.ROOT-SERVERS.NET.. 51729 IN NS F.ROOT-SERVERS.NET.. 51729 IN NS G.ROOT-SERVERS.NET.. 51729 IN NS H.ROOT-SERVERS.NET.. 51729 IN NS I.ROOT-SERVERS.NET.. 51729 IN NS J.ROOT-SERVERS.NET. Query time: 1 msec SERVER: 127.0.0.1#53(127.0.0.1) WHEN: Wed Dec 8 00:27:01 2004 MSG SIZE rcvd: 256 ----------------------------------------------------------------- 5