What Are Ports and Why Forward Them? TCP/IP applications tell hosts apart via IP addresses: each computer or device on a TCP/IP
Chapter 6. Securing Domain Name Services (DNS)
6.3 Selecting a DNS Software Package
6.5.4 Installing djbdns
6.5.5.2 The tinydns-data format
The helper applications modify the data file, a text file that uses the tinydns-data format. This format is simple, compact, and easy to modify. Here are the lines created by the helper-application examples in the previous section: .hackenbush.com:192.193.194.195:a:259200 &hackenbush.com:200.201.202.203:a:259200 =hugo.hackenbush.com:192.193.194.200:86400 +another.hackenbush.com:192.193.194.200:86400 @mail.hackenbush.com:192.193.194.201:a::86400
Rather than using the helper applications, we could have created the lines with a text editor and used the default ttl values: .hackenbush.com:192.193.194.195:a &hackenbush.com:200.201.202.203:a =hugo.hackenbush.com:192.193.194.200 +another.hackenbush.com:192.193.194.200 @mail.hackenbush.com:192.193.194.201:a
If the primary name server was within our domain (at a.ns.hackenbush.com) but a secondary name server was at ns.flywheel.com, here’s how to specify it:
.hackenbush.com:192.193.194.195:a &hackenbush.com::ns.flywheel.com
If the primary name server was at ns.flywheel.com, here’s how to specify that: .hackenbush.com::ns.flywheel.com
A few characters perform a lot of work and avoid some common sources of error in BIND zone files: • Records starting with a dot (.) create an SOA record, an NS record, and an A record if an IP
address was specified.
• Records starting with an equals sign (=) create A and PTR records. 6.5.5.3 tinydns data reference
Each record (line) in a tinydns-data (formatted) file starts with an identifying character. Fields are separated by colons. Trailing fields and their colons may be omitted, and their default values will be used. Table 6-4 describes some fields common to many types of tinydns-data records.
Table 6-4. Common tinydns-data fields
Field Description Default
dom A domain name like hackenbush.com. None.
fqdn A fully qualified domain name like be used: *.fqdn means every name ending with .fqdn, unless a name has a hugo.hackenbush.com. A wild card can also
more specific record. None.
ip An IP address like 192.193.194.195. None.
ttl Time-to-live (number of seconds that the record’s data can be cached).
SOA: 2560 (42.6 minutes) NS: 259200 (3 days) MX, A, others: 86400 (1 day). ts
If ttl is missing or nonzero, the starting time for information in this line; if is zero, the end time. ts is specified as an external TAI64 timestamp, which is a 16-character, lowercase hex string with a resolution of one second. The hex value 4000000000000000 corresponds to ISO time 1970-01-01 00:00:00, the reference start time for Unix systems.
Empty, meaning the line is active. loc A location-identifier string, used to provide different answers to clients, depending on their locations; see the djbdns documentation for details. None.
The next table, Table 6-5, shows the correspondence between djbdns helper applications and equivalent lines in data; you can specify your data either way. Notice that the helper applications require IP addresses rather than names; if you wish to specify a name instead, you need to edit the data file.
Table 6-5. Helper-application syntax versus tinydns-data syntax
Helper application
syntax Data format Description
add-ns
dom ip .dom:ip:x:ttl:ts:loc
Specify a primary name server for domain dom. Create an SOA record for the domain and an NS record for the name server specified as x and/or ip. If x contains any dots, it is treated as a literal hostname; otherwise, it is interpreted as x.ns.dom. If ip is present, an A record is created.
Using add-ns generates the sequential values a, b, etc. for x. These correspond to a.ns.dom, b.ns.dom, etc. This default behavior generates in-bailiwick (intradomain) names for the name servers. Specifying a domain’s name server within the domain itself avoids a trip to the root name servers for resolution.
Add- childns
dom ip &dom:ip:x:ttl:ts:loc
Specify a domain’s secondary name server. Create only an NS record for the name server, specified as x and/or ip. If x contains any dots, it is treated as a literal hostname; otherwise, it is interpreted as x.ns.dom. If ip is present, an A record is
created.
Add-childns also generates a, b, etc. for x. Add-host
fqdn ip =fqdn:ip:ttl:ts
Specify a host: create an A record (fqdn
[Symbol_MonotypeSorts_217] ip) and a PTR record (reverse-ip.in-addr.arpa
[Symbol_MonotypeSorts_217] fqdn). Add-
alias
fqdn ip +fqdn:ip:ttl:ts
Specify an alias: create another A record (fqdn [Symbol_MonotypeSorts_217] ip).
Add-mx
fqdn ip @dom:ip:x:dist:ttl:ts
Specify a mail server: create an MX record. If x contains any dots, it is treated as a literal hostname; otherwise, it is interpreted as x.mx.dom. dist in distance and defaults to 0.
Add-mx also generates sequential hostnames of a, b, etc. for x. The less common record types shown in Table 6-6 have no helper applications.
Table 6-6. Less-common record types
Helper application
syntax Data format Description
(No helper) Zdom:fqdn:con:ser:ref:ret:exp:min:ttl:ts:loc
Create only an SOA record for dom, with contact con, serial number ser, refresh time ref, retry time ret, expire time exp, and minimum time min. (No helper) Chost2:fqdn:ttl:ts:loc Create a CNAME record for host2 to refer to host.
(No helper) ’fqdn:text:ttl:ts:loc
Create a TXT record for fqdn. text can contain octal escape codes (e.g., \F3D) to create non- ASCII values.
(No helper) ^fqdn:ip:ttl:ts:loc Create a PTR record for fqdn [Symbol_MonotypeSorts_217] ip.
(No helper) :fqdn:type:data:ttl:ts:loc
Create a record of type type (an integer between 1 and 65,535). Data bytes data may contain octal escapes.
After making changes to a datafile, type make. This runs the tinydns-data program to convert data to data.cdb. The conversion will only overwrite the existing database if the source data is consistent. tinydns will start serving the new data immediately.