From 169631ac4c2e4ae6e6deb081dbf46694c1b520da Mon Sep 17 00:00:00 2001 From: David Blacka Date: Sat, 2 Dec 2023 17:06:45 -0500 Subject: [PATCH] update README.md, add named-compilezone wrapper --- README.md | 36 ++++++++++++++++++++++-------------- run_named-compilezone.sh | 4 ++++ 2 files changed, 26 insertions(+), 14 deletions(-) create mode 100755 run_named-compilezone.sh diff --git a/README.md b/README.md index 0c108d2..af41ddf 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ -# zeke.ecotroph.net DNS service +# `zeke.ecotroph.net` DNS service -This repo and directory consists of the revamped DNS service for zeke.ecotroph.net. The goals of this service are: +This repo and directory consists of the revamped DNS service for `zeke.ecotroph.net`. The goals of this service are: 1. Host the primary zones we want. 2. DNSSEC-sign those primary zones, if desired. @@ -8,41 +8,41 @@ This repo and directory consists of the revamped DNS service for zeke.ecotroph.n ## Overview -In the past, we just ran the version of BIND that came with our distribution (at this moment, that is CentOS 7, which translates to bind 9.11.) This new configuration runs a very recent version of BIND 9 via a docker image produced by ISC themselves. We are starting with 9.18.12. +In the past, we just ran the version of BIND that came with our distribution (at this moment, that is CentOS 7, which translates to bind 9.11.) This new configuration runs a very recent version of BIND 9 via a docker image produced by ISC themselves. We started with 9.18.12 and now are up to 9.18.20. This docker image imposes a few requirements: * Internally, the image runs `named` as the `bind` user (104:105). Since we bind-mount directories, we do need those directories owned by whatever internal UID it is using. * We need some way to ensure that our container is run on system reboots, etc. Here we chose to use `systemd` to do this, although that is not ideal. * Presumably the normal way to do logging for a docker container is to use the standard journal service, although this image is set up to bind-mount `/var/log`. On the other hand, the standard command uses the `-g` flag, which is "debug" mode, and causes all of the logs to go to stderr. -* We do want named to stay in the foreground here. Fortunately, there have always been command line options that do this (`-g` and `-f`). Thus, in order to log to `/var/log`, we supply a different command: `/usr/sbin/named -f -4 -u bind`. This will run in the forground, only do IPv4 (zeke does not yet have IPv6 connectivity), and run as the internal `bind` user. +* We do want named to stay in the foreground here. Fortunately, there have always been command line options that do this (`-g` and `-f`). Thus, in order to log to `/var/log`, we supply a different command: `/usr/sbin/named -f -4 -u bind`. This will run in the foreground, only do IPv4 (`zeke` does not yet have IPv6 connectivity), and run as the internal `bind` user. ## Source -I have this in a local git repository on zeke, however we can see it here: . +I have this in a local git repository on `zeke`, however we can see it here: . ## Design We have in this repo: * named configurations. I've broken this up into sections (options, keys, logging, primary, secondary, etc.), which all just get included in the primary named.conf. It isn't tricky. -* "keys". Well, mostly TSIG keys. Those are are but are encrypted with `git-crypt`. With a key that is ... somewhere. I've saved it in my password manager, but it can be extracted from the current checkout in `/etc/bind` with `cd /etc/bind; git-crypt export-key /tmp/docker_bind_crypto.key`. `git-crypt` doesn't seem to come via RPM and yum, but I build the code and installed it into /usr/local/bin on zeke. +* "keys". Well, mostly TSIG keys. Those are encrypted with `git-crypt`. With a key that is ... somewhere. I've saved it in my password manager, but it can be extracted from the current checkout in `/etc/bind` with `cd /etc/bind; git-crypt export-key /tmp/docker_bind_crypto.key`. `git-crypt` doesn't seem to come via RPM and yum, but I built it and installed it into `/usr/local/bin` on `zeke`. * zone files. I have all of the zone files we started with, although currently the configuration does not load all of them. * A script to launch the container (`run_bind_container.sh`). -* A script to use as the internal "command" (`cfg/run.sh`) -- it isn't config, but we need to bind-mount it. I could possibly be moved to `cache`. -* A helper script to run `rndc` that just runs that inside the container itself (via a docker exec). You would need to be in the `docker` group to run it. Another helper script to run `named-checkconf`. -* A helper script to prepare zeke to run this container and properly work, in case we want to do this install again (`setup.sh`). +* A script to use as the internal "command" (`cfg/run.sh`) -- it isn't config, but we need to bind-mount it. It could possibly be moved to `cache`. +* A helper script to run `rndc` that just runs that inside the container itself (via a docker exec). You would need to be in the `docker` group to run it. Another few helper scripts to run other command line tools: `named-checkconf`, `named-compilezone`. +* A helper script to prepare `zeke` to run this container and properly work, in case we want to do this install again (`setup.sh`). ## Installation 1. Clone this repo to `/etc/bind` (clone in `/etc` -- we want the working copy to *be* `/etc/bind`.) -2. Create a user to match the internal user (uid 104): `useradd -u 104 -g 105 -M --no-log-init bind` +2. Create a user to match the internal user (`uid 104`): `useradd -u 104 -g 105 -M --no-log-init bind` 3. Change the ownership of everything under `/etc/bind` to the `bind` user and group: `chown -R 104:105 /etc/bind`. -3. Copy the supplied systemd unit file to `/etc/systemd/system`, and `systemctl enable docker.bind.service`, then `systemctl start docker.bind.service`. +4. Copy the supplied `systemd` unit file to `/etc/systemd/system`, and `systemctl enable docker.bind.service`, then `systemctl start docker.bind.service`. ## Zone Changes -All of our zone files are now in this git repo, so we can just make changes and commit them, assuming you have write access to the local repo, that is. The `bind` user should be able to do it, though. Once you've changed your zone, you *could* bounce the service via systemctl, or we could use `rndc`. I've made a little script that will do this with `docker exec`, `/etc/bind/run_rndc.sh`. Thus: +All of our zone files are now in this git repo, so we can just make changes and commit them, assuming you have write access to the local repo, that is. The `bind` user should be able to do it, though. Once you've changed your zone, you *could* bounce the service via `systemctl`, or we could use `rndc`. I've made a little script that will do this with `docker exec`, `/etc/bind/run_rndc.sh`. Thus: ```bash sudo -u bind -s @@ -58,9 +58,17 @@ cd .. More modern BIND releases have changed the configuration for this. Note *how* your zone is signed is based on a `dnssec-policy` block (I've put those in `cfg/named.dnssec.conf`). Then, in your zone, you add: -``` +```conf dnssec-policy "default_alg13"; inline-signing yes; ``` -in your zone block. After restarting/reconfiguring BIND, it will create a .signed and .signed.jnl file, and start serving a DNSSEC signed version of the zone. It will then take care of resigning activities, key rollovers etc. +in your zone block. After restarting/reconfiguring BIND, it will create a `.signed` and `.signed.jnl` file, and start serving a DNSSEC signed version of the zone. It will then take care of resigning activities, key rollovers etc. + +### Zone Files + +We can find the zone files on `zeke` in `/etc/bind/zones`, although note that your zone may be in BIND's *raw* format. If you want to see the contents, you can use `named-compilezone` for that (either using a version inside the container or not): + +```bash +named-compilezone -f raw -F text -o - blacka.com /etc/bind/zones/blacka.com.signed +``` diff --git a/run_named-compilezone.sh b/run_named-compilezone.sh new file mode 100755 index 0000000..dae654f --- /dev/null +++ b/run_named-compilezone.sh @@ -0,0 +1,4 @@ +#! /bin/bash +[ -x "$(which docker 2>/dev/null)" ] && DOCKER=docker +[ -x "$(which podman 2>/dev/null)" ] && DOCKER=podman +$DOCKER exec bind9 named-compilezone "$@"