bind best practices from day 1 · © 2015 isc the question § what would you do if dropped into an...
TRANSCRIPT
![Page 1: BIND Best Practices from Day 1 · © 2015 ISC The Question § What would you do if dropped into an existing organization to run their DNS?](https://reader033.vdocuments.us/reader033/viewer/2022042011/5e723ef4b9bfd90cdb1671f5/html5/thumbnails/1.jpg)
© 2015 ISC
BIND Best Practices from Day 1
05 October 2016
![Page 2: BIND Best Practices from Day 1 · © 2015 ISC The Question § What would you do if dropped into an existing organization to run their DNS?](https://reader033.vdocuments.us/reader033/viewer/2022042011/5e723ef4b9bfd90cdb1671f5/html5/thumbnails/2.jpg)
© 2015 ISC
Logistics
§ Webinar is scheduled for 1 hour § This session will be recorded and posted
at http://www.isc.org/webinars § Participants are muted to improve audio
quality for everyone. § We want questions! Please enter into the
WebEx Q&A tab – The presenter may defer some questions until the
end of the presentation
![Page 3: BIND Best Practices from Day 1 · © 2015 ISC The Question § What would you do if dropped into an existing organization to run their DNS?](https://reader033.vdocuments.us/reader033/viewer/2022042011/5e723ef4b9bfd90cdb1671f5/html5/thumbnails/3.jpg)
© 2015 ISC
Presenters Eddy Winstead
ISC Senior Sales Engineer
![Page 4: BIND Best Practices from Day 1 · © 2015 ISC The Question § What would you do if dropped into an existing organization to run their DNS?](https://reader033.vdocuments.us/reader033/viewer/2022042011/5e723ef4b9bfd90cdb1671f5/html5/thumbnails/4.jpg)
© 2015 ISC
The Question
§ What would you do if dropped into an existing organization to run their DNS?
![Page 5: BIND Best Practices from Day 1 · © 2015 ISC The Question § What would you do if dropped into an existing organization to run their DNS?](https://reader033.vdocuments.us/reader033/viewer/2022042011/5e723ef4b9bfd90cdb1671f5/html5/thumbnails/5.jpg)
© 2015 ISC
First action, Recon!
§ Actually, first action is freak out!
§ 2nd action is caffeine, then deep breath and recon:
Any network or infrastructure diagrams available?
![Page 6: BIND Best Practices from Day 1 · © 2015 ISC The Question § What would you do if dropped into an existing organization to run their DNS?](https://reader033.vdocuments.us/reader033/viewer/2022042011/5e723ef4b9bfd90cdb1671f5/html5/thumbnails/6.jpg)
© 2015 ISC
diagrams
![Page 7: BIND Best Practices from Day 1 · © 2015 ISC The Question § What would you do if dropped into an existing organization to run their DNS?](https://reader033.vdocuments.us/reader033/viewer/2022042011/5e723ef4b9bfd90cdb1671f5/html5/thumbnails/7.jpg)
© 2015 ISC
Pick a nameserver, login!
§ Running a current version of BIND? named –V
§ OS? § How is named started on this box?
Does this match the version currently running?
§ Is there a nanny script in use?
![Page 8: BIND Best Practices from Day 1 · © 2015 ISC The Question § What would you do if dropped into an existing organization to run their DNS?](https://reader033.vdocuments.us/reader033/viewer/2022042011/5e723ef4b9bfd90cdb1671f5/html5/thumbnails/8.jpg)
© 2015 ISC
named -V % named -V BIND 9.8.4-P2 built with '--prefix=/usr' '--infodir=/usr/share/info' '--mandir=/usr/share/man' '--enable-threads' '--enable-getifaddrs' '--disable-linux-caps' '--with-openssl=/usr' '--with-randomdev=/dev/random' '--without-idn' '--without-libxml2' using OpenSSL version: OpenSSL 0.9.8zd-freebsd 8 Jan 2015
![Page 9: BIND Best Practices from Day 1 · © 2015 ISC The Question § What would you do if dropped into an existing organization to run their DNS?](https://reader033.vdocuments.us/reader033/viewer/2022042011/5e723ef4b9bfd90cdb1671f5/html5/thumbnails/9.jpg)
© 2015 ISC
On to named.conf
§ Do the global options make sense? § Basic security check:
– TSIG secured zone transfers? – allow-transfer? – allow-query (is this an open resolver?)
![Page 10: BIND Best Practices from Day 1 · © 2015 ISC The Question § What would you do if dropped into an existing organization to run their DNS?](https://reader033.vdocuments.us/reader033/viewer/2022042011/5e723ef4b9bfd90cdb1671f5/html5/thumbnails/10.jpg)
© 2015 ISC
Global options options { directory "/etc/namedb/"; dnssec-enable yes; dnssec-validation yes; allow-recursion { none; }; allow-query { any; }; allow-transfer { none; }; notify no; key-directory "/etc/namedb/keys"; max-journal-size 32k; zone-statistics yes; listen-on { 192.168.53.251; }; listen-on-v6 { 2001:db8:100::251; }; notify-source 192.168.53.251; notify-source-v6 2001:db8:100::251;};
![Page 11: BIND Best Practices from Day 1 · © 2015 ISC The Question § What would you do if dropped into an existing organization to run their DNS?](https://reader033.vdocuments.us/reader033/viewer/2022042011/5e723ef4b9bfd90cdb1671f5/html5/thumbnails/11.jpg)
© 2015 ISC
zone stanzas
zone "example.com" IN { file "example.com-zone"; type slave; masters { 192.168.53.4; 192.168.53.8; }; notify no;};
![Page 12: BIND Best Practices from Day 1 · © 2015 ISC The Question § What would you do if dropped into an existing organization to run their DNS?](https://reader033.vdocuments.us/reader033/viewer/2022042011/5e723ef4b9bfd90cdb1671f5/html5/thumbnails/12.jpg)
© 2015 ISC
logging
§ Is the logging stanza sane and actually occurring?
§ Check the config as well as the
actual logs.
§ Have a look at the system logs
![Page 13: BIND Best Practices from Day 1 · © 2015 ISC The Question § What would you do if dropped into an existing organization to run their DNS?](https://reader033.vdocuments.us/reader033/viewer/2022042011/5e723ef4b9bfd90cdb1671f5/html5/thumbnails/13.jpg)
© 2015 ISC
logging stanza
logging { channel query_log { file "logs/query.log" versions 5 size 1M; severity info; print-time yes; }; category queries { query_log; };};
![Page 14: BIND Best Practices from Day 1 · © 2015 ISC The Question § What would you do if dropped into an existing organization to run their DNS?](https://reader033.vdocuments.us/reader033/viewer/2022042011/5e723ef4b9bfd90cdb1671f5/html5/thumbnails/14.jpg)
© 2015 ISC
named-checkconf is your friend
$ named-checkconf –z zone ./IN: loaded serial 121 (DNSSEC signed)zone test.dnslab.org/IN: loaded serial 50 (DNSSEC signed)
![Page 15: BIND Best Practices from Day 1 · © 2015 ISC The Question § What would you do if dropped into an existing organization to run their DNS?](https://reader033.vdocuments.us/reader033/viewer/2022042011/5e723ef4b9bfd90cdb1671f5/html5/thumbnails/15.jpg)
© 2015 ISC
rndc
§ Is rndc configured? § If not, ‘rndc-confgen –a’
§ rndc status
§ rndc notify zone § rndc retransfer zone
![Page 16: BIND Best Practices from Day 1 · © 2015 ISC The Question § What would you do if dropped into an existing organization to run their DNS?](https://reader033.vdocuments.us/reader033/viewer/2022042011/5e723ef4b9bfd90cdb1671f5/html5/thumbnails/16.jpg)
© 2015 ISC
Recon Repeat
§ Repeat the prior Recon for all known nameservers!
§ If diagrams were available, check to see if configs match stated functionality.
![Page 17: BIND Best Practices from Day 1 · © 2015 ISC The Question § What would you do if dropped into an existing organization to run their DNS?](https://reader033.vdocuments.us/reader033/viewer/2022042011/5e723ef4b9bfd90cdb1671f5/html5/thumbnails/17.jpg)
© 2015 ISC
Authoritative specific
§ Use external tools to check service:
– DNSViz
– dnscheck.iis.se
– ednscomp.isc.org (firewall check)
![Page 18: BIND Best Practices from Day 1 · © 2015 ISC The Question § What would you do if dropped into an existing organization to run their DNS?](https://reader033.vdocuments.us/reader033/viewer/2022042011/5e723ef4b9bfd90cdb1671f5/html5/thumbnails/18.jpg)
© 2015 ISC
Recursive specific
§ Perform queries against these servers via dig dig @192.168.53.53 www.example.com.
§ Are they answering appropriately?
§ Are they refusing appropriately?
![Page 19: BIND Best Practices from Day 1 · © 2015 ISC The Question § What would you do if dropped into an existing organization to run their DNS?](https://reader033.vdocuments.us/reader033/viewer/2022042011/5e723ef4b9bfd90cdb1671f5/html5/thumbnails/19.jpg)
© 2015 ISC
Actions for Day 2
§ Meet with the following teams:
– Provisioning: how fast for new servers? – Operations: how’s life? – Security: about those firewalls… – Monitoring: alerting on?, peak traffic? – Architecture: future plans? – Management: support?
![Page 20: BIND Best Practices from Day 1 · © 2015 ISC The Question § What would you do if dropped into an existing organization to run their DNS?](https://reader033.vdocuments.us/reader033/viewer/2022042011/5e723ef4b9bfd90cdb1671f5/html5/thumbnails/20.jpg)
© 2015 ISC
Questions
?