Table of Contents
Advertisement
Section 14.5:Common Mistakes to Avoid
14.4.3 Security
BIND supports a number of different methods to protect the updating and transfer of zones, on both
master and slave nameservers:
•
DNSSEC — Short for DNS SECurity, this feature allows for zones to be cryptographically signed
with a zone key.
In this way, the information about a specific zone can be verified as coming from a nameserver
that has signed it with a particular private key, as long as the recipient has that nameserver's public
key.
BIND version 9 also supports the SIG(0) public/private key method of message authentication.
•
TSIG — Short for Transaction SIGnatures, a shared secret key exists on the master and slave
server, verifying that a transfer from master to slave is authorized.
This feature strengthens the standard IP address-based method of transfer authorization. An at-
tacker would not only need to have access to the IP address to transfer the zone, but they would
also need to know the secret key.
BIND version 9 also support TKEY, which is another shared secret key method of authorizing
zone transfers.
14.4.4 IP version 6
BIND version 9 can provide nameservice in IP version 6 (IPv6) environments, through the use of A6
zone records.
If your network environment includes both IPv4 and IPv6 hosts, you should use the lwresd light-
weight resolver daemon on your network clients. This daemon is essentially a very efficient, caching-
only nameserver, which understands the new A6 and DNAME records used with IPv6. See the lwresd
man page for more information.
14.5 Common Mistakes to Avoid
It is very common for beginners to make mistakes when editing BIND configuration files or run in to
initial difficulties using named. Be sure to avoid the following problems:
•
Make sure you increment the serial number when editing a zone file.
If the serial number is not incremented, your master nameserver may have the correct, new infor-
mation, but your slave nameservers will never be notified of the change or attempt to refresh their
data of that zone. After all, their serial number will match the one on the master nameserver, even
though their data for the zone is completely different than what is on the master.
•
Be careful to use ellipses and semi-colons correctly in the /etc/named.conf file.
243
Advertisement
Table of Contents
