1. Install Bind in a folder as you like :
# ./configure --prefix=/usr/local/dns/Bind-9.6.1-P1/
# make && make install
2. It’s not a good idea to run Bind as root so create another username and group for this purpose :
# useradd –c NameServer –s /bin/false named
* named is the username I chose
3. Create a couple of folders for our Chroot Jail as I show below :
/chroot +—named
+—dev
+—etc
| +—namedb
| +—slave
+—var
+—run
4. Change all files and folders permission to 700 and select “named” as owner and group unless Chroot ( you may need Chroot folder for other purpose ) :
# chmod 700 named
# chown named:named named
5. Go to the Bind installation folder --> sbin and follow below commands :
# rndc-confgen –a ( that makes a default rndc.key )
# rndc-confgen
6. Open rndc.key and replace the key with secret that I showed below in green and copy all of them to named.conf in /chroot/named/etc/namedb folder.
key "rndc-key" {
algorithm hmac-md5;
secret "m2gKdMpZbyG49C9v+uXM6Q==";
};
controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { "rndc-key"; };
};
7. We need at least 2 necessary files and a symbolic link :
- named.conf
- a zone file that specified in named.conf or other included file
- a symbolic link for named.conf in /etc/namedb
8. Create 2 device in /chroot/named/dev folder :
# mknod /chroot/named/dev/null c 1 3
# mknod /chroot/named/dev/random c 1 8
# chmod 666 /chroot/named/dev/{null,random}
9. Now it’s ok to run named like something like this :
# /usr/local/dns/Bind-9.6.1-P1/named –4 –c /etc/namedb/named.conf –t \ /chroot/named –u named
* You can put the above command and also rndc ( if you like ) to a file in /etc/init.d folder and run it as a service.
* You have to specify the PID file path in named.conf or options that included if you don’t want the Bind create an extra folder in chroot/named folder.
e.g.
options {
directory "/etc/namedb";
version "[If you have a legitimate reason for requesting this info, please contact ]";
listen-on-v6 { none; };
pid-file "/var/run/named/named.pid";
};
