From 7f68cb5ba2db2271f07417faac263cf08cba50a2 Mon Sep 17 00:00:00 2001
From: Antoine Ginies <aginies@mandriva.com>
Date: Mon, 14 May 2007 13:55:01 +0000
Subject: fix Bind chroot problem, and use a new named.conf needed for
 bind9.2.x (thx tv report)

---
 dns_wizard/Bind.pm | 141 ++++++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 118 insertions(+), 23 deletions(-)

diff --git a/dns_wizard/Bind.pm b/dns_wizard/Bind.pm
index a736a064..66e15102 100644
--- a/dns_wizard/Bind.pm
+++ b/dns_wizard/Bind.pm
@@ -379,10 +379,11 @@ EOF
 # create named.conf file
 sub crea_named_common {
     output($WDIR . "/named.conf", <<EOF);
-key mykey {
-    algorithm hmac-md5;
-    secret "$DNSKEY";
-};
+// (oe) Loosely based on the document below and from production server configurations.
+// http://www.cymru.com/Documents/secure-bind-template.html
+
+// secret must be the same as in /etc/rndc.conf
+include "/etc/rndc.key";
 
 controls {
     inet 127.0.0.1 port 953
@@ -390,30 +391,123 @@ controls {
 };
 
 options {
-    directory "$NAMED_DIR";
-    pid-file "$NAMED_DIR/named.pid";
-    version "Wizard drake";
-    allow-query { any; };
-    allow-transfer { any; };
+    version "";
+    directory "/var/named";
+    dump-file "/var/tmp/named_dump.db";
+    pid-file "/var/run/named.pid";
+    statistics-file "/var/tmp/named.stats";
+    zone-statistics yes;
+//    datasize 256M;
+    coresize 100M; 
+//    fetch-glue no;
+//    recursion no;
+//    recursive-clients 10000;
+    auth-nxdomain yes;
+    query-source address * port *;
+    listen-on port 53 { any; };
+    cleaning-interval 120;
+    transfers-in 20;
+    transfers-per-ns 2;
+    lame-ttl 0;
+    max-ncache-ttl 10800;
+
+//    forwarders { first_public_nameserver_ip; second_public_nameserver_ip; };
 EOF
-
     !$o->{var}{IPOFFORWARDER} or append_to_file($WDIR . "/named.conf", "\tforwarders { $o->{var}{IPOFFORWARDER}; };\n");
     append_to_file($WDIR . "/named.conf", <<EOF);
+
+//    allow-update { none; };
+//    allow-transfer { any; };
+// Prevent DoS attacks by generating bogus zone transfer 
+// requests.  This will result in slower updates to the 
+// slave servers (e.g. they will await the poll interval 
+// before checking for updates). 
+    notify no; 
+//    notify explicit; 
+//    also-notify { secondary_name_server };
+
+// Generate more efficient zone transfers.  This will place 
+// multiple DNS records in a DNS message, instead of one per 
+// DNS message. 
+    transfer-format many-answers; 
+
+// Set the maximum zone transfer time to something more 
+// reasonable.  In this case, we state that any zone transfer 
+// that takes longer than 60 minutes is unlikely to ever 
+// complete.  WARNING:  If you have very large zone files, 
+// adjust this to fit your requirements. 
+    max-transfer-time-in 60; 
+
+// We have no dynamic interfaces, so BIND shouldn't need to 
+// poll for interface state {UP|DOWN}. 
+    interface-interval 0; 
+
+// Uncoment these to enable IPv6 connections support
+// IPv4 will still work
+//      listen-on { none; };
+//      listen-on-v6 { any; };
+
+    allow-query { any; };
+    allow-recursion { any; };
+
+// Deny anything from the bogon networks as
+// detailed in the "bogon" ACL.
+//    blackhole { bogon; };
 };
 
-zone "localhost" {
-    type master;
-    file "zone/db.localhost";
+// workaround stupid stuff... (OE: Wed 17 Sep 2003)
+zone "ac" { type delegation-only; };
+zone "cc" { type delegation-only; };
+zone "com" { type delegation-only; };
+zone "cx" { type delegation-only; };
+zone "lv" { type delegation-only; };
+zone "museum" { type delegation-only; };
+zone "net" { type delegation-only; };
+zone "nu" { type delegation-only; };
+zone "ph" { type delegation-only; };
+zone "sh" { type delegation-only; };
+zone "tm" { type delegation-only; };
+zone "ws" { type delegation-only; };
+
+zone "." IN {
+        type hint;
+        file "named.ca";
 };
 
-zone "0.0.127.in-addr.arpa" {
-    type master;
-    file "zone/db.127.0.0.1";
+zone "localdomain" IN {
+        type master;
+        file "master/localdomain.zone";
+        allow-update { none; };
+};
+
+zone "localhost" IN {
+        type master;
+        file "master/localhost.zone";
+        allow-update { none; };
+};
+
+zone "0.0.127.in-addr.arpa" IN {
+        type master;
+        file "reverse/named.local";
+        allow-update { none; };
+};
+
+zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
+        type master;
+        file "reverse/named.ip6.local";
+        allow-update { none; };
+};
+
+zone "255.in-addr.arpa" IN {
+        type master;
+        file "reverse/named.broadcast";
+        allow-update { none; };
 };
 
-zone "." {
-    type hint;
-    file "zone/root.hints";
+zone "0.in-addr.arpa" IN {
+        type master;
+        file "reverse/named.zero";
+        allow-update { none; };
 };
 
 EOF
@@ -618,8 +712,8 @@ sub save_old_config {
   mkdir_p($REP_SAVE . '/dns');
   system("cp -avf $ZONE_DIR/* $REP_SAVE/dns/");
 #  cp_af($_, "$REP_SAVE/dns/$_" . '-' . $DATE . '.sauv') foreach glob_($ZONE_DIR . "/*");
-  if (-e "/etc/named.conf") {
-    cp_af("/etc/named.conf", "$REP_SAVE/dns/named.conf-$DATE");
+  if (-e "$BIND_CHROOT/etc/named.conf") {
+    cp_af("$BIND_CHROOT/etc/named.conf", "$REP_SAVE/dns/named.conf-$DATE");
   }
 }
 # end save old config
@@ -666,8 +760,9 @@ sub check_config {
 # copy file correct place
 sub copy_good {
   mkdir_p($ZONE_DIR);
-  cp_af($WDIR . '/named.conf', '/etc/named.conf');
-  cp_af($WDIR . '/rndc.conf', '/etc/rndc.conf');
+  mkdir_p("$BIND_CHROOT/etc");
+  cp_af($WDIR . '/named.conf', "$BIND_CHROOT/etc/named.conf");
+  cp_af($WDIR . '/rndc.conf', "$BIND_CHROOT/etc/rndc.conf");
   cp_af($WDIR . '/hosts', '/etc/hosts');
   cp_af($WDIR . '/resolv.conf', '/etc/resolv.conf');
   cp_af($WDIR . '/root.hints', $ZONE_DIR . '/');
-- 
cgit v1.2.1