DNSを「きちんと」設定しよう

Transcription

1 DNS WIDE Project DNS DAY - Internet Week 2002

2 BIND DNS 2

3

4 DNS DNS(Domain Name System) named(bind), tinydns(djbdns), MicrosoftDNS(Windows), etc DNS 4

5 2 (1) IP ftp.example.jp % dig example.jp ns ;; ANSWER SECTION: example.jp. 1D IN NS ns0.example.jp. example.jp. 1D IN NS ns1.example.jp. ;; ADDITIONAL SECTION: ns0.example.jp. 1D IN A ns1.example.jp. 1D IN A DNS 5

6 2 (2) IP? IP ? /etc/resolv.conf nameserver DHCP DNS 6

7 BIND named Windows DNS BIND BIND Windows? djbdns tinydns dnscache DNS 7

8 BIND (Windows?)?? resolv.conf? DNS 8

9 BIND9 DOS DNS 9

10 Cache Poisoning example.gr.jp example.jp NS ns.example.jp ns.example.jp A ;; AUTHORITY SECTION: 1D IN NS ns.example.jp. ;; ADDITIONAL SECTION: ns.example.jp. 1D IN A BIND DNS 10

11 BIND

12 TIPS DNS and BIND djbdns DNS 12

13 BIND named.conf recursion no; fetch-glue no; BIND9 no options {... recursion no; fetch-glue no;... } ; zone "example.jp" { type master ; hint (zone. ) zone file "example.jp.zone" ; } ; DNS 13

14 BIND recursion yes; hint options {... recursion yes; allow-query { /8 ; };... }; zone "." { type hint; file "named.root"; }; zone " IN-ADDR.ARPA" { type master; file "localhost.rev"; }; allow-query (localhost) ::1 DNS 14

15 1 (1/3) named 2 BIND9 v6 1 listen-on-v6 {any;}; (?) /etc/named.conf options {... recursion no; fetch-glue no; listen-on { ; } ;... } ; listen-on IP /etc/resolv.conf nameserver DNS 15

16 1 (2/3) /etc/cache.conf named c /etc/cache.conf options {... pid-file "/var/run/cache-named.pid" ; listen-on { ; } ;... }; controls { unix "/var/run/cache-ndc" perm 0600 owner 0 group 0; } ; DNS 16

17 1 (3/3) dump-file, memstatistics-file, statistics-file 2 named (BIND8 ) dump-file "cache_dump.db" ; memstatistics-file "cache.memstats" ; statistics-file "cache.stats" ; DNS 17

18 example.jp ns ;;flags ;; flags: qr aa rd; ;; flags: qr aa rd ra; recursion yes ; < > < > DNS 18

19 1 named zone "." { type hint; file "named.root" ; }; zone " IN-ADDR.ARPA" { type master ; file "localhost.rev" ; }; zone "example.jp" { type master ; file "example.jp.zone" ; allow-query { any; }; }; options {... allow-query { localhost ; /8 ; } ;... }; DNS 19

20 Private Address Space - RFC /8, /12, /16 IPv4 Link-Local Address Dynamic Configuration of IPv4 Link-Local Addresses draft-ietf-zeroconf-ipv4-linklocal-07.txt /16 ISP! DNS 20

21 named.conf zone "10.in-addr.arpa" { type master; file "dummy.zone"; }; zone " in-addr.arpa" { type master; file "dummy.zone"; }; zone " in-addr.arpa" { type master; file "dummy.zone"; }; zone " in-addr.arpa" { type master; file "dummy.zone"; }; zone " in-addr.arpa" { type master; file "dummy.zone"; }; dummy.zone SOA NS $TTL IN SOA ns.example.jp. root.example.jp. ( 1 1H 15M 1W 1D ) IN NS ns.example.jp. DNS 21

22 BIND (1/2) options zone allow-transfer zone xxx.zone {... allow-transfer { x.x.x.x ; y.y.y.y ; }; }; BIND8 fork named u bind... bind named named DNS 22

23 BIND (2/2) chroot named named named t <chroot > Rob s DNS Data Page Secure BIND Template djbdns chroot DNS 23

24 acl IDS acl IDS DNS 24

25 SOA NS CNAME MX CNAME MX IP CNAME? NS RR DNS 25

26

27 ! DNS 27

28 ! DNS 28

29 ISP ns.provider.dom ns.example.jp WWW DNS 29

30 ! (or ) ns.example.jp ns.provider.dom IP? DNS 30

31 ( ) DNS 31

32 DNS 32