Red Hat Summit Red Hat SummitSuporteConsoleDesenvolvedoresComeçar um testeContato

4.7. BIND

There are several major changes in BIND configuration:
Default ACL configuration
In Red Hat Enterprise Linux 5, the default ACL configuration allowed queries and offered recursion for all hosts. By default in Red Hat Enterprise Linux 6, all hosts can make queries for authoritative data but only hosts from the local network can make recursive queries.
New allow-query-cache option
The allow-recursion option has been deprecated in favor of this option. It is used to control access to server caches, which include all non-authoritative data (like recursive lookups and root nameserver hints).
Chroot environment management
The bind-chroot-admin script, which was used to create symlinks from a non-chroot environment to a chroot environment, is deprecated and no longer exists. Instead, configuration can be managed directly in a non-chroot environment and init scripts automatically mount needed files to the chroot environment during named startup in the case that files are not already present in the chroot.
/var/named directory permissions
The /var/named directory is no longer writable. All zone files that need to be writable (such as dynamic DNS zones, DDNS) must be placed in the new writable directory: /var/named/dynamic.
dnssec [yes|no] option removed
The global dnssec [yes|no] options have been split into two new options: dnssec-enable and dnssec-validation. The dnssec-enable option enables DNSSEC support. The dnssec-validation option enables DNSSEC validation. Note that setting dnssec-enable to "no" on recursive server means that it cannot be used as a forwarder by another server that performs DNSSEC validation. Both options are set to yes by default.
controls statement not required
You no longer need to specify the controls statement in /etc/named.conf if you use the rndc management utility. The named service automatically allows control connections using the loopback device and both named and rndc use the same secret key generated during installation (located in /etc/rndc.key).
In a default installation, BIND is installed with DNSSEC validation enabled, and uses the ISC DLV register. This means all signed domains (such as gov., se., cz.), that have their key in the ISC DLV register, are cryptographically validated on the recursive server. If validation fails due to attempts at cache poisoning, then the end user will not be given this forged/spoofed data. DNSSEC deployment is fully supported in Red Hat Enterprise Linux 6. DNSSEC is an important step in making the Internet more secure for end users, and is widely implemented. As previously mentioned, DNSSEC validation is controlled with the dnssec-validation option in /etc/named.conf.
Voltar ao topo
Red Hat logoGithubredditYoutubeTwitter

Aprender

Experimente, compre e venda

Comunidades

Sobre a documentação da Red Hat

Ajudamos os usuários da Red Hat a inovar e atingir seus objetivos com nossos produtos e serviços com conteúdo em que podem confiar. Explore nossas atualizações recentes.

Tornando o open source mais inclusivo

A Red Hat está comprometida em substituir a linguagem problemática em nosso código, documentação e propriedades da web. Para mais detalhes veja o Blog da Red Hat.

Sobre a Red Hat

Fornecemos soluções robustas que facilitam o trabalho das empresas em plataformas e ambientes, desde o data center principal até a borda da rede.

Theme

© 2025 Red Hat