• No results found

The tinydns-data format

In document Building Secure Servers with Linux pdf (Page 129-131)

What Are Ports and Why Forward Them? TCP/IP applications tell hosts apart via IP addresses: each computer or device on a TCP/IP

Chapter 6. Securing Domain Name Services (DNS)

6.3 Selecting a DNS Software Package

6.5.4 Installing djbdns

6.5.5.2 The tinydns-data format

The helper applications modify the data file, a text file that uses the tinydns-data format. This format is simple, compact, and easy to modify. Here are the lines created by the helper-application examples in the previous section: .hackenbush.com:192.193.194.195:a:259200 &hackenbush.com:200.201.202.203:a:259200 =hugo.hackenbush.com:192.193.194.200:86400 +another.hackenbush.com:192.193.194.200:86400 @mail.hackenbush.com:192.193.194.201:a::86400

Rather than using the helper applications, we could have created the lines with a text editor and used the default ttl values: .hackenbush.com:192.193.194.195:a &hackenbush.com:200.201.202.203:a =hugo.hackenbush.com:192.193.194.200 +another.hackenbush.com:192.193.194.200 @mail.hackenbush.com:192.193.194.201:a

If the primary name server was within our domain (at a.ns.hackenbush.com) but a secondary name server was at ns.flywheel.com, here’s how to specify it:

.hackenbush.com:192.193.194.195:a &hackenbush.com::ns.flywheel.com

If the primary name server was at ns.flywheel.com, here’s how to specify that: .hackenbush.com::ns.flywheel.com

A few characters perform a lot of work and avoid some common sources of error in BIND zone files: • Records starting with a dot (.) create an SOA record, an NS record, and an A record if an IP

address was specified.

• Records starting with an equals sign (=) create A and PTR records. 6.5.5.3 tinydns data reference

Each record (line) in a tinydns-data (formatted) file starts with an identifying character. Fields are separated by colons. Trailing fields and their colons may be omitted, and their default values will be used. Table 6-4 describes some fields common to many types of tinydns-data records.

Table 6-4. Common tinydns-data fields

Field Description Default

dom A domain name like hackenbush.com. None.

fqdn A fully qualified domain name like be used: *.fqdn means every name ending with .fqdn, unless a name has a hugo.hackenbush.com. A wild card can also

more specific record. None.

ip An IP address like 192.193.194.195. None.

ttl Time-to-live (number of seconds that the record’s data can be cached).

SOA: 2560 (42.6 minutes) NS: 259200 (3 days) MX, A, others: 86400 (1 day). ts

If ttl is missing or nonzero, the starting time for information in this line; if is zero, the end time. ts is specified as an external TAI64 timestamp, which is a 16-character, lowercase hex string with a resolution of one second. The hex value 4000000000000000 corresponds to ISO time 1970-01-01 00:00:00, the reference start time for Unix systems.

Empty, meaning the line is active. loc A location-identifier string, used to provide different answers to clients, depending on their locations; see the djbdns documentation for details. None.

The next table, Table 6-5, shows the correspondence between djbdns helper applications and equivalent lines in data; you can specify your data either way. Notice that the helper applications require IP addresses rather than names; if you wish to specify a name instead, you need to edit the data file.

Table 6-5. Helper-application syntax versus tinydns-data syntax

Helper application

syntax Data format Description

add-ns

dom ip .dom:ip:x:ttl:ts:loc

Specify a primary name server for domain dom. Create an SOA record for the domain and an NS record for the name server specified as x and/or ip. If x contains any dots, it is treated as a literal hostname; otherwise, it is interpreted as x.ns.dom. If ip is present, an A record is created.

Using add-ns generates the sequential values a, b, etc. for x. These correspond to a.ns.dom, b.ns.dom, etc. This default behavior generates in-bailiwick (intradomain) names for the name servers. Specifying a domain’s name server within the domain itself avoids a trip to the root name servers for resolution.

Add- childns

dom ip &dom:ip:x:ttl:ts:loc

Specify a domain’s secondary name server. Create only an NS record for the name server, specified as x and/or ip. If x contains any dots, it is treated as a literal hostname; otherwise, it is interpreted as x.ns.dom. If ip is present, an A record is

created.

Add-childns also generates a, b, etc. for x. Add-host

fqdn ip =fqdn:ip:ttl:ts

Specify a host: create an A record (fqdn

[Symbol_MonotypeSorts_217] ip) and a PTR record (reverse-ip.in-addr.arpa

[Symbol_MonotypeSorts_217] fqdn). Add-

alias

fqdn ip +fqdn:ip:ttl:ts

Specify an alias: create another A record (fqdn [Symbol_MonotypeSorts_217] ip).

Add-mx

fqdn ip @dom:ip:x:dist:ttl:ts

Specify a mail server: create an MX record. If x contains any dots, it is treated as a literal hostname; otherwise, it is interpreted as x.mx.dom. dist in distance and defaults to 0.

Add-mx also generates sequential hostnames of a, b, etc. for x. The less common record types shown in Table 6-6 have no helper applications.

Table 6-6. Less-common record types

Helper application

syntax Data format Description

(No helper) Zdom:fqdn:con:ser:ref:ret:exp:min:ttl:ts:loc

Create only an SOA record for dom, with contact con, serial number ser, refresh time ref, retry time ret, expire time exp, and minimum time min. (No helper) Chost2:fqdn:ttl:ts:loc Create a CNAME record for host2 to refer to host.

(No helper) ’fqdn:text:ttl:ts:loc

Create a TXT record for fqdn. text can contain octal escape codes (e.g., \F3D) to create non- ASCII values.

(No helper) ^fqdn:ip:ttl:ts:loc Create a PTR record for fqdn [Symbol_MonotypeSorts_217] ip.

(No helper) :fqdn:type:data:ttl:ts:loc

Create a record of type type (an integer between 1 and 65,535). Data bytes data may contain octal escapes.

After making changes to a datafile, type make. This runs the tinydns-data program to convert data to data.cdb. The conversion will only overwrite the existing database if the source data is consistent. tinydns will start serving the new data immediately.

In document Building Secure Servers with Linux pdf (Page 129-131)