RE: [sentinix-list] RE: BIND

Here are the solutions...

my own bone-headed-ness...

First, the slow response from the server was because I was submitting an
incomplete query, I forgot my networking 101 basics.  I was omitting the
trailing dot on queries for zones the server was hosting
For example I was sending "nslookup host.mydomain.com" when I should have
been sending "nslookup host.mydomain.com."

Second: the init script, I'm accustomed to gentoo and other distros where you
end up with an init script for most if not all packages; example
/etc/init.d/named

I found the commented out section to start BIND in /etc/init.d/rc.inet2
You have 2 choices:
<snip>
# # Start the BIND name server daemon:
#
# # Option number one:  Start the NAMED/BIND name server as root.
# # Note that BIND has a somewhat spotty history in terms of security,
# # but they recommend running it as root, and if you don't, not all
# # the features (especially when attached to a dynamic IP such as
# # through PPP) will necessary work correctly).
# if [ -x /usr/sbin/named ]; then
#   echo "Starting BIND:  /usr/sbin/named"
#   /usr/sbin/named
# fi
# # Done starting the BIND server using option #1.
#
# # Start the BIND name server daemon:
# # Option number two:  Start the NAMED/BIND name server as user daemon.
# # This is another way to start BIND for the more paranoid.  By starting it
as
# # user daemon, if there does turn out to be a vulnerability, the attacker
can
# # at best gain user deamon access to your machine, which is a considerably
# # better situation than if they gain root access.  Note that for this
option
# # to work at all, you'll need to change the ownership of the directory
# # /var/named to daemon like this:  chown -R daemon /var/named
# # If you don't have this directory, you'll have to make it first.
# # It may also be necessary to do this:  chown -R daemon /var/run/named
# # Also, for the *really* paranoid, you can read this document for
# # instructions on running BIND in a "chroot jail":
# #   /usr/doc/Linux-HOWTOs/Chroot-BIND-HOWTO
if [ -x /usr/sbin/named ]; then
  echo "Starting BIND:  /usr/sbin/named -u daemon"
  /usr/sbin/named -u daemon
fi
# # Done starting the BIND server using option #2.
</snip>

I went with option 2; this server is in my DMZ and is running named for my
Internet zone and watching my web servers, etc.
Note: you'll also have to chown the directories for the pid file and zone
files, for security sake call out the pid file in your named.conf file and
put it in it's own directory.

Hope this helps others.

Travis Albrecht

-----Original Message-----
From: sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org
[mailto:sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org] On Behalf Of Arabela
Sent: Friday, April 09, 2004 7:26 PM
To: The SENTINIX Mailing List
Subject: Re: [sentinix-list] RE: BIND

Hy, Travis
    however, maybe others are interested too. please, tell us how you've done
if isn]t a problem for you

                thx in advance, Arabela


----- Original Message -----
From: "Travis Albrecht" <[email protected]>
To: "The SENTINIX Mailing List" <[email protected]>
Sent: Friday, April 09, 2004 6:26 PM
Subject: [sentinix-list] RE: BIND


> Nevermind, I figured it all out
>
>
> -----Original Message-----
> From: Travis Albrecht
> Sent: Wednesday, April 07, 2004 11:24 AM
> To: 'The SENTINIX Mailing List'
> Subject: BIND
>
> I'm looking for advice if anyone has configured BIND on their Sentinix
> server.
> I set up BIND as a secondary and seem to be having performance issues,
also
> the init script is missing...?
> I created the conf file (copied from another Linux server on my DMZ,
changed
> options as necessary) then ran rndc-confgen It starts up and runs without
> error, however from the client side it takes 3 or more seconds for a
> response, other servers on the same segment don't have this issue.
> Could this be because the NIC is promiscuous?
> Looking for help/experience...
> Thanks,
> Travis Albrecht
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix
>
>
> ---
> avast! Antivirus: Inbound message clean.
> Virus Database (VPS): 0404-6, 2004/04/09
> Tested on: 4/10/2004 3:17:24 AM
> avast! is copyright (c) 2000-2003 ALWIL Software.
> http://www.avast.com
>
>
>



---
avast! Antivirus: Outbound message clean.
Virus Database (VPS): 0404-6, 2004/04/09
Tested on: 4/10/2004 3:26:20 AM
avast! is copyright (c) 2000-2003 ALWIL Software.
http://www.avast.com



_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix