4.7. BIND
There are several major changes in BIND configuration:
- Default ACL configuration
- In Red Hat Enterprise Linux 5, the default ACL configuration allowed queries and offered recursion for all hosts. By default in Red Hat Enterprise Linux 6, all hosts can make queries for authoritative data but only hosts from the local network can make recursive queries.
- New
allow-query-cacheoption - The
allow-recursionoption has been deprecated in favor of this option. It is used to control access to server caches, which include all non-authoritative data (like recursive lookups and root nameserver hints). - Chroot environment management
- The
bind-chroot-adminscript, which was used to create symlinks from a non-chroot environment to a chroot environment, is deprecated and no longer exists. Instead, configuration can be managed directly in a non-chroot environment and init scripts automatically mount needed files to the chroot environment duringnamedstartup in the case that files are not already present in the chroot. /var/nameddirectory permissions- The
/var/nameddirectory is no longer writable. All zone files that need to be writable (such as dynamic DNS zones, DDNS) must be placed in the new writable directory:/var/named/dynamic. dnssec [yes|no]option removed- The global
dnssec [yes|no]options have been split into two new options:dnssec-enableanddnssec-validation. Thednssec-enableoption enables DNSSEC support. Thednssec-validationoption enables DNSSEC validation. Note that settingdnssec-enableto "no" on recursive server means that it cannot be used as a forwarder by another server that performs DNSSEC validation. Both options are set to yes by default. controlsstatement not required- You no longer need to specify the
controlsstatement in/etc/named.confif you use therndcmanagement utility. Thenamedservice automatically allows control connections using the loopback device and bothnamedandrndcuse the same secret key generated during installation (located in/etc/rndc.key).
In a default installation, BIND is installed with DNSSEC validation enabled, and uses the ISC DLV register. This means all signed domains (such as gov., se., cz.), that have their key in the ISC DLV register, are cryptographically validated on the recursive server. If validation fails due to attempts at cache poisoning, then the end user will not be given this forged/spoofed data. DNSSEC deployment is fully supported in Red Hat Enterprise Linux 6. DNSSEC is an important step in making the Internet more secure for end users, and is widely implemented. As previously mentioned, DNSSEC validation is controlled with the
dnssec-validation option in /etc/named.conf.
