| 192 |
- |
1 |
//
|
|
|
2 |
// named.conf
|
|
|
3 |
//
|
|
|
4 |
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
|
|
|
5 |
// server as a caching only nameserver (as a localhost DNS resolver only).
|
|
|
6 |
//
|
|
|
7 |
// See /usr/share/doc/bind*/sample/ for example named configuration files.
|
|
|
8 |
//
|
|
|
9 |
|
|
|
10 |
options {
|
|
|
11 |
//listen-on port 53 { 127.0.0.1; };
|
|
|
12 |
//listen-on-v6 port 53 { ::1; };
|
|
|
13 |
directory "/var/named";
|
|
|
14 |
dump-file "/var/named/data/cache_dump.db";
|
|
|
15 |
statistics-file "/var/named/data/named_stats.txt";
|
|
|
16 |
memstatistics-file "/var/named/data/named_mem_stats.txt";
|
|
|
17 |
secroots-file "/var/named/data/named.secroots";
|
|
|
18 |
recursing-file "/var/named/data/named.recursing";
|
|
|
19 |
allow-query { localhost; 10.192.25.0/24; };
|
|
|
20 |
querylog yes;
|
|
|
21 |
|
|
|
22 |
/*
|
|
|
23 |
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
|
|
|
24 |
- If you are building a RECURSIVE (caching) DNS server, you need to enable
|
|
|
25 |
recursion.
|
|
|
26 |
- If your recursive DNS server has a public IP address, you MUST enable access
|
|
|
27 |
control to limit queries to your legitimate users. Failing to do so will
|
|
|
28 |
cause your server to become part of large scale DNS amplification
|
|
|
29 |
attacks. Implementing BCP38 within your network would greatly
|
|
|
30 |
reduce such attack surface
|
|
|
31 |
*/
|
|
|
32 |
recursion yes;
|
|
|
33 |
|
|
|
34 |
dnssec-enable yes;
|
|
|
35 |
dnssec-validation yes;
|
|
|
36 |
|
|
|
37 |
managed-keys-directory "/var/named/dynamic";
|
|
|
38 |
|
|
|
39 |
pid-file "/run/named/named.pid";
|
|
|
40 |
session-keyfile "/run/named/session.key";
|
|
|
41 |
|
|
|
42 |
/* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
|
|
|
43 |
include "/etc/crypto-policies/back-ends/bind.config";
|
|
|
44 |
};
|
|
|
45 |
|
|
|
46 |
logging {
|
|
|
47 |
channel default_debug {
|
|
|
48 |
file "data/named.run";
|
|
|
49 |
severity dynamic;
|
|
|
50 |
};
|
|
|
51 |
};
|
|
|
52 |
|
|
|
53 |
zone "." IN {
|
|
|
54 |
type hint;
|
|
|
55 |
file "named.ca";
|
|
|
56 |
};
|
|
|
57 |
|
|
|
58 |
include "/etc/named.rfc1912.zones";
|
|
|
59 |
include "/etc/named.root.key";
|
|
|
60 |
|