{"id":5551,"date":"2014-10-22T15:09:18","date_gmt":"2014-10-22T07:09:18","guid":{"rendered":"https:\/\/webhostinggeeks.com\/howto\/?p=5551"},"modified":"2023-04-28T09:47:26","modified_gmt":"2023-04-28T09:47:26","slug":"bind-dns-server-in-chroot-jail-on-centos-7","status":"publish","type":"post","link":"https:\/\/webhostinggeeks.com\/howto\/bind-dns-server-in-chroot-jail-on-centos-7\/","title":{"rendered":"How to Setup Bind DNS Server in Chroot Jail on CentOS 7"},"content":{"rendered":"

\"bind<\/p>\n

BIND (Berkeley Internet Name Daemon) also known as NAMED is the most widely used linux dns server in the internet.<\/p>\n

This tutorial will explain how we can setup BIND DNS in a chroot jail in CentOS 7, the process is simply unable to see any part of the filesystem outside the jail. For example, in this post, i will configure BIND dns to run chrooted to the directory \/var\/named\/chroot\/.<\/p>\n

Well, to BIND dns, the contents of this directory will appear to be \/, the root directory. A \u201cjail\u201d is a software mechanism for limiting the ability of a process to access resources outside a very limited area, and it\u2019s purposely to enhance the security.<\/p>\n

Unlike with earlier versions of BIND, you typically will not need to compile named statically nor install shared libraries under the new root.<\/p>\n

Chroot Environment initialization script will mount the above configuration files using the mount –bind command, so that you can manage the configuration outside this environment. There is no need to copy anything into the \/var\/named\/chroot\/ directory because it is mounted automatically. This simplifies maintenance since you do not need to take any special care of BIND configuration files if it is run in a chroot environment. You can organize everything as you would with BIND not running in a chroot environment.<\/p>\n

Chrooted Bind DNS server was by default configured to \/var\/named\/chroot. You may follow this complete steps to implement Bind Chroot DNS Server on CentOS 7 virtual private server (VPS).<\/p>\n

Setup Bind DNS Server in Chroot Jail on CentOS 7<\/h3>\n

1. Install Bind Chroot DNS server :<\/p>\n

# yum install bind-chroot -y\n<\/pre>\n
2. To enable the named-chroot service, first check if the named service is running by issuing the following command:<\/p>\n
\n# systemctl status named\n<\/pre>\n
If it is running, it must be disabled.
\nTo disable named, issue the following commands as root:<\/p>\n
\n# systemctl stop named\n<\/pre>\n
\n# systemctl disable named\n<\/pre>\n
3. Initialize the \/var\/named\/chroot environment by running:<\/p>\n
# \/usr\/libexec\/setup-named-chroot.sh \/var\/named\/chroot on\n# systemctl stop named\n# systemctl disable named\n# systemctl start named-chroot\n# systemctl enable named-chroot\nln -s '\/usr\/lib\/systemd\/system\/named-chroot.service' '\/etc\/systemd\/system\/multi-user.target.wants\/named-chroot.service'\n<\/pre>\n
The following directories are automatically mounted into the \/var\/named\/chroot\/ directory if the corresponding mount point directories underneath \/var\/named\/chroot\/ are empty:<\/p>\n
Verify Chroot Environment :<\/p>\n
\n# ll \/var\/named\/chroot\/etc\ntotal 28\n-rw-r--r-- 1 root root   372 Dec  1 23:04 localtime\ndrwxr-x--- 2 root named 4096 Nov 22 01:28 named\n-rw-r----- 1 root named 1705 Mar 22  2016 named.conf\n-rw-r--r-- 1 root named 2389 Nov 22 01:28 named.iscdlv.key\n-rw-r----- 1 root named  931 Jun 21  2007 named.rfc1912.zones\n-rw-r--r-- 1 root named  487 Jul 19  2010 named.root.key\ndrwxr-x--- 3 root named 4096 Jan  4 22:12 pki\n<\/pre>\n
\n# ll \/var\/named\/chroot\/var\/named\ntotal 32\ndrwxr-x--- 7 root  named 4096 Jan  4 22:12 chroot\ndrwxrwx--- 2 named named 4096 Nov 22 01:28 data\ndrwxrwx--- 2 named named 4096 Nov 22 01:28 dynamic\n-rw-r----- 1 root  named 2076 Jan 28  2013 named.ca\n-rw-r----- 1 root  named  152 Dec 15  2009 named.empty\n-rw-r----- 1 root  named  152 Jun 21  2007 named.localhost\n-rw-r----- 1 root  named  168 Dec 15  2009 named.loopback\ndrwxrwx--- 2 named named 4096 Nov 22 01:28 slaves\n<\/pre>\n
4. Create bind dns related files into chrooted directory :<\/p>\n
# touch \/var\/named\/chroot\/var\/named\/data\/cache_dump.db\n# touch \/var\/named\/chroot\/var\/named\/data\/named_stats.txt\n# touch \/var\/named\/chroot\/var\/named\/data\/named_mem_stats.txt\n# touch \/var\/named\/chroot\/var\/named\/data\/named.run\n# mkdir \/var\/named\/chroot\/var\/named\/dynamic\n# touch \/var\/named\/chroot\/var\/named\/dynamic\/managed-keys.bind\n<\/pre>\n
5. Bind lock file should be writeable, therefore set the permission to make it writable as below :<\/p>\n
# chmod -R 777 \/var\/named\/chroot\/var\/named\/data\n# chmod -R 777 \/var\/named\/chroot\/var\/named\/dynamic\n<\/pre>\n
6. Copy \/etc\/named.conf chrooted bind config folder :<\/p>\n
# cp -p \/etc\/named.conf \/var\/named\/chroot\/etc\/named.conf\n<\/pre>\n
7.Configure main bind configuration in \/etc\/named.conf. Append the example.local zone information to the file :<\/p>\n
# vi \/var\/named\/chroot\/etc\/named.conf\n<\/pre>\n
Create forward and reverse zone into named.conf:<\/p>\n
..\n..\nzone \"example.local\" {\n    type master;\n    file \"example.local.zone\";\n};\n\nzone \"0.168.192.in-addr.arpa\" IN {\n        type master;\n        file \"192.168.0.zone\";\n};\n..\n..\n<\/pre>\n
Full named.conf configuration :<\/p>\n
\/\/\n\/\/ named.conf\n\/\/\n\/\/ Provided by Red Hat bind package to configure the ISC BIND named(8) DNS\n\/\/ server as a caching only nameserver (as a localhost DNS resolver only).\n\/\/\n\/\/ See \/usr\/share\/doc\/bind*\/sample\/ for example named configuration files.\n\/\/\n\noptions {\n        listen-on port 53 { any; };<\/strong>\n        listen-on-v6 port 53 { ::1; };\n        directory       \"\/var\/named\";\n        dump-file       \"\/var\/named\/data\/cache_dump.db\";\n        statistics-file \"\/var\/named\/data\/named_stats.txt\";\n        memstatistics-file \"\/var\/named\/data\/named_mem_stats.txt\";\n        allow-query     { any; };<\/strong>\n\n        \/*\n         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.\n         - If you are building a RECURSIVE (caching) DNS server, you need to enable\n           recursion.\n         - If your recursive DNS server has a public IP address, you MUST enable access\n           control to limit queries to your legitimate users. Failing to do so will\n           cause your server to become part of large scale DNS amplification\n           attacks. Implementing BCP38 within your network would greatly\n           reduce such attack surface\n        *\/\n        recursion yes;\n\n        dnssec-enable yes;\n        dnssec-validation yes;\n        dnssec-lookaside auto;\n\n        \/* Path to ISC DLV key *\/\n        bindkeys-file \"\/etc\/named.iscdlv.key\";\n\n        managed-keys-directory \"\/var\/named\/dynamic\";\n\n        pid-file \"\/run\/named\/named.pid\";\n        session-keyfile \"\/run\/named\/session.key\";\n};\n\nlogging {\n        channel default_debug {\n                file \"data\/named.run\";\n                severity dynamic;\n        };\n};\n\nzone \".\" IN {\n        type hint;\n        file \"named.ca\";\n};\n\nzone \"example.local\" {\n    type master;\n    file \"example.local.zone\";\n};\n\nzone \"0.168.192.in-addr.arpa\" IN {\n        type master;\n        file \"192.168.0.zone\";\n};<\/strong>\n\ninclude \"\/etc\/named.rfc1912.zones\";\ninclude \"\/etc\/named.root.key\";\n<\/pre>\n
8. Create Forward and Reverse zone files for domain example.local.<\/p>\n
a) Create Forward Zone :<\/p>\n
# vi \/var\/named\/chroot\/var\/named\/example.local.zone\n<\/pre>\n
Add the following and save :<\/p>\n
;\n;       Addresses and other host information.\n;\n$TTL 86400\n@       IN      SOA     example.local. hostmaster.example.local. (\n                               2014101901      ; Serial\n                               43200      ; Refresh\n                               3600       ; Retry\n                               3600000    ; Expire\n                               2592000 )  ; Minimum\n\n;       Define the nameservers and the mail servers\n\n               IN      NS      ns1.example.local.\n               IN      NS      ns2.example.local.\n               IN      A       192.168.0.70\n               IN      MX      10 mx.example.local.\n\ncentos7          IN      A       192.168.0.70\nmx               IN      A       192.168.0.50\nns1              IN      A       192.168.0.70\nns2              IN      A       192.168.0.80\n<\/pre>\n
b) Create Reverse Zone :<\/p>\n
# vi \/var\/named\/chroot\/var\/named\/192.168.0.zone\n<\/pre>\n
;\n;       Addresses and other host information.\n;\n$TTL 86400\n@       IN      SOA     example.local. hostmaster.example.local. (\n                               2014101901      ; Serial\n                               43200      ; Refresh\n                               3600       ; Retry\n                               3600000    ; Expire\n                               2592000 )  ; Minimum\n\n0.168.192.in-addr.arpa. IN      NS      centos7.example.local.\n\n70.0.168.192.in-addr.arpa. IN PTR mx.example.local.\n70.0.168.192.in-addr.arpa. IN PTR ns1.example.local.\n80.0.168.192.in-addr.arpa. IN PTR ns2.example.local.\n<\/pre>\n
Bind dns related articles<\/h4>\n