August 13, 2002, 12:00 AM — At the beginning of this trip down DJBDNS lane, I tagged a challenge at
the end of the message. Unlike my previous [1] challenge, this one had
almost no response, probably because it was lost in obscurity at the
bottom of the email. I'm re-issuing it again this week, and you'll find
it at the end of this article.
Welcome to the home stretch, my last [2] ITworld article on installing
DJBDNS. I'll cover two things here. First, I'll show you how to 'import'
your existing BIND zones into tinydns data format so you don't need to
convert those files by hand. Lastly, I'll show you how to start up the
axfrdns server, which will allow DNS secondaries running BIND to mirror
your DNS zones.
Import Your Existing BIND Zones
First, both of these require another piece of DJB software, ucspi-tcp
(Unix Client Server Program Interface). Run the following to install it:
$ mkdir /tmp/src
$ cd /tmp/src
$ wget http://cr.yp.to/ucspi-tcp/ucspi-tcp-0.88.tar.gz
$ tar xzvf ucspi-tcp-0.88.tar.gz
$ cd ucspi-tcp-0.88
$ make
# make setup check
This installs a bunch of different TCP client and server programs in
/usr/local/bin, though we'll only be using two of them: tcpserver and
tcpclient.
So, let's see how we can snag our existing BIND zone files. I'll assume
we want to get the 'example.dom' domain. First, make sure that BIND
allows you to perform DNS transfers for our IP address. Assuming you are
doing this on the same machine, localhost should be allowed in
/etc/named.conf:
allow-transfer { 127.0.0.1; };
If you don't have an allow-transfer directive, then create one like the
one above. Test to verify that you can do a transfer using 'host':
$ host -l example.dom
example.dom SOA example.dom. hostmaster.example.dom 10 3600 180
25920 8640
example.dom name server ns1.example.dom
example.dom name server ns2.example.dom
www.example.dom has address 192.168.1.1
...
If you don't get a listing, then check your logs and make sure that
localhost is allowed to perform a transfer. If all's well, then do the
following:
# cd /etc/tinydns/root
# tcpclient -v 127.0.0.1 53 axfr-get example.dom example.dom.zone
tmpfile
This connects to the local BIND server, snags a copy of the zone, and
saves in the proper format as example.dom.zone in the local directory.
You can do this for all the domains that you support, it's that easy.
Once you've got all the zones saved, you can edit them if you want to
make them more tinydns-ish, for example deleting the TTLs, converting Z
and & lines to .domain lines instead, etc.... However, even if you leave
them as is, they'll work exactly as before. All that's left to do is
merge these files into the data file:
# cat *.zone > data
# make
/usr/local/bin/tinydns-data
That's it. You've just taken all your BIND data and turned it into
tinydns data format. Kill off BIND, tell tinydns to listen on the old IP
address (192.168.1.1 for example), and restart tinydns:
# killall named
# echo 192.168.1.1 > /etc/tinydns/env/IP
# svc -d /etc/tinydns
# svc -u /etc/tinydns
You are BIND free. Isn't that a great feeling! Of course, since we're
not using BIND, there are a few BIND-specific niceties we're missing
* The ability to mirror other BIND servers' data
* The ability for secondary BIND servers to mirror our data
Start Up the axfrdns
The 'official' way to send and receive zone updates for DJBDNS is to
simply rsync /etc/tinydns/root/data from one host to another. This is
great if you are in control of all your DNS servers, but doesn't work if
you rely on third party BIND name servers as well. However, you can use
the axfrdns program to allow BIND servers to mirror your domains.
axfrdns was installed as part of DJBDNS already, but we still need to
configure it. axfrdns only listens on TCP port 53 and, since tinydns
only listens on UDP port 53, you can have axfrdns run on the same IP as
tinydns. Let's assume that's 192.168.1.1 for this example:
# axfrdns-conf axfrdns dnslog /etc/axfrdns /etc/tinydns 192.168.1.1
Those arguments, from left to right, are the user id for axfrdns, userid
for logging, the new axfrdns directory, the location of your existing
tinydns directory, and the IP to listen on. axfrdns looks at the very
same data.cdb file that tinydns uses, so it's always in sync. Let's
start up axfrdns with:
# cd /etc/axfrdns
# make
tcprules tcp.cdb tcp.tmp < tcp
# ln -s /etc/axfrdns /service
In about five seconds axfrdns will be started by svscan. By default,
axfrdns will reject any requests for a zone transfer. This is good,
because it keeps the bad guys from easily getting a list of all your
machines names and IPs. The access restrictions are located in the file
/etc/axfrdns/tcp.
