1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
|
include "/etc/rndc.key";
controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { mykey; };
};
logging {
channel "default" {
syslog local1;
severity info;
};
category "default" { "default"; };
};
acl "trusted_networks" {
127.0.0.1;
212.85.158.144/28;
# used for various virtual machines
192.168.0.0/16;
10.0.0.0/8;
172.16.0.0/12;
};
// Enable statistics at http://127.0.0.1:5380/
statistics-channels {
inet 127.0.0.1 port 5380 allow { 127.0.0.1; };
};
options {
version "";
directory "/var/named";
dump-file "/var/tmp/named_dump.db";
<% if scope.function_versioncmp([lsbdistrelease, '3']) < 0 -%>
pid-file "/var/run/named.pid";
<% end -%>
statistics-file "/var/tmp/named.stats";
zone-statistics yes;
// datasize 256M;
coresize 100M;
// fetch-glue no;
// recursion no;
// recursive-clients 10000;
auth-nxdomain yes;
query-source address * port *;
listen-on port 53 { any; };
cleaning-interval 120;
transfers-in 20;
transfers-per-ns 2;
lame-ttl 0;
max-ncache-ttl 10800;
// forwarders { first_public_nameserver_ip; second_public_nameserver_ip; };
// allow-update { none; };
// allow-transfer { any; };
// Prevent DoS attacks by generating bogus zone transfer
// requests. This will result in slower updates to the
// slave servers (e.g. they will await the poll interval
// before checking for updates).
notify no;
// notify explicit;
// also-notify { secondary_name_server };
// Generate more efficient zone transfers. This will place
// multiple DNS records in a DNS message, instead of one per
// DNS message.
transfer-format many-answers;
// Set the maximum zone transfer time to something more
// reasonable. In this case, we state that any zone transfer
// that takes longer than 60 minutes is unlikely to ever
// complete. WARNING: If you have very large zone files,
// adjust this to fit your requirements.
max-transfer-time-in 60;
// We have no dynamic interfaces, so BIND shouldn't need to
// poll for interface state {UP|DOWN}.
interface-interval 0;
// Uncoment these to enable IPv6 connections support
// IPv4 will still work
// listen-on { none; };
// listen-on-v6 { any; };
// allow-query { trusted_networks; };
allow-transfer {"none";};
allow-recursion { trusted_networks; };
// Deny anything from the bogon networks as
// detailed in the "bogon" ACL.
// blackhole { bogon; };
};
zone "." IN {
type hint;
file "named.ca";
};
zone "localdomain" IN {
type master;
<% if scope.function_versioncmp([lsbdistrelease, '3']) >= 0 -%>
file "named.localhost";
<% else -%>
file "master/localdomain.zone";
<% end -%>
allow-update { none; };
};
zone "localhost" IN {
type master;
<% if scope.function_versioncmp([lsbdistrelease, '3']) >= 0 -%>
file "named.localhost";
<% else -%>
file "master/localhost.zone";
<% end -%>
allow-update { none; };
};
<% if scope.function_versioncmp([lsbdistrelease, '3']) >= 0 -%>
zone "1.0.0.127.in-addr.arpa" IN {
<% else -%>
zone "0.0.127.in-addr.arpa" IN {
<% end -%>
type master;
<% if scope.function_versioncmp([lsbdistrelease, '3']) >= 0 -%>
file "named.loopback";
<% else -%>
file "reverse/named.local";
<% end -%>
allow-update { none; };
};
<% if scope.function_versioncmp([lsbdistrelease, '3']) >= 0 -%>
zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
<% else -%>
zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
<% end -%>
type master;
<% if scope.function_versioncmp([lsbdistrelease, '3']) >= 0 -%>
file "named.loopback";
<% else -%>
file "reverse/named.ip6.local";
<% end -%>
allow-update { none; };
};
<% if scope.function_versioncmp([lsbdistrelease, '3']) < 0 -%>
zone "255.in-addr.arpa" IN {
type master;
file "reverse/named.broadcast";
allow-update { none; };
};
<% end -%>
zone "0.in-addr.arpa" IN {
type master;
<% if scope.function_versioncmp([lsbdistrelease, '3']) >= 0 -%>
file "named.empty";
<% else -%>
file "reverse/named.zero";
<% end -%>
allow-update { none; };
};
|
