We will explore rndc, which is a new tool with BIND 9 that takes the place of ndc in BIND 8. First we need to create a key using dnssec-keygen: [root@srv-3 /root]# dnssec-keygen -a hmac-md5 -b 256 -n user rndc Krndc.+157+34404 [root@srv-3 /root]# ls Krndc.+157+34404.key Krndc.+157+34404.private [root@srv-3 /root]# cat *.private Private-key-format: v1.2 Algorithm: 157 (HMAC_MD5) […]
Using rndc to Administer BIND
BIND Administration with Webmin
We will use Webmin to automate updates of forward and reverse zones. Webmin will automatically update both, as well as restart your services and increment your serial number. Webmin is much more than just a DNS tool. It can be used to administer many services. Since Webmin is Open Source, released under the BSD license, […]
DNS/BIND TTL Settings During Domain Migrations
There are two different default DNS/BIND TTL settings you need to switch when moving domains to a different IP address. One is the negative caching setting in the SOA record, and the other is the default ttl at the top of the file ($ttl).. If you have different TTL settings for your indidual record, you […]
Logging With BIND 9
We talked in this article about setting the TTLs for DNS records in BIND for the purposes of moving a website, or, more specifically, changing the IP address of an authoritative DNS server. In this article, we will show you how to turn up the logging and output the results to a file. Again, this […]
Restricting Recursive Lookups with BIND 8/9
When you allow recursive lookups, you open yourself up to various security risks and performance issues, so you should only allow recursion when needed. Recursive lookups are lookups for domains you are not authoritative for. That is, if you are authoritative for mycompany.com, and you don’t allow recursion, then if somebody queries your server for […]
Example Domain for Documentation
If you need to put a domain name in documentation, example.net, example.com, and example.org are reserved for this purpose as defined in this RFC. This will prevent an inadvertently run script from causing trouble, as well as avoiding an association with a seemingly arbitrary host.
Replace Aging BIND on Virtual Dedicated Host – Part 1 – Compile BIND 9.5.0-P2
>1< | 2 | 3 We were checking out the various servers that we administer and noticed that one of our hosts is not up to the latest version of BIND. Yum update wasn’t giving us joy, so we grabbed the latest version of BIND: # wget http://ftp.isc.org/isc/bind9/9.5.0-P2/bind-9.5.0-P2.tar.gz –07:10:17– http://ftp.isc.org/isc/bind9/9.5.0-P2/bind-9.5.0-P2.tar.gz Resolving ftp.isc.org… 204.152.184.110, 2001:4f8:0:2::18 Connecting […]
Replace Aging BIND on Virtual Dedicated Host – Part 2 – Rip Out Old RPMs
1 | >2< | 3 We are ripping out the old RPMs. Let’s figure out what RPMs they are: # rpm -qa | grep bind bind-9.3.4-8.P1.fc6 bind-libs-9.3.4-8.P1.fc6 Let’s start removing them: # rpm -e bind-libs-9.3.4-8.P1.fc6 error: Failed dependencies: libbind9.so.0 is needed by (installed) bind-9.3.4-8.P1.fc6.i386 libdns.so.22 is needed by (installed) bind-9.3.4-8.P1.fc6.i386 libisc.so.11 is needed by (installed) […]
Replace Aging BIND on Virtual Dedicated Host – Part 3 – Modify SysV Init Scripts and PID Home
1 | 2 | >3< We need a directory for the PID, and put it in /var/run/named: # mkdir /var/run/named # ls -ld /var/run/named drwxr-xr-x 2 root root 4096 Aug 3 07:58 /var/run/named # chown named /var/run/named # chgrp named /var/run/named # ls -ld /var/run/named drwxr-xr-x 2 named named 4096 Aug 3 07:58 /var/run/named # […]
Verifying and Setting Recursion with DiG and BIND
There is another flurry of interest in DNS cache poisoning. The first thing that you should do is turn off recursion if you don’t need it. One way to determine this is with DiG: $ dig -v DiG 9.5.0-P2 $ Verizon operates a well known server that does recursive lookups: $ dig @4.2.2.3 example.com ; […]
Troubleshooting RAS with Device and PPP logs
Two files can be used to troubleshoot RAS problems: device.log and ppp.log. These files need to be enabled in the registry. For device.log, set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Parameters\Logging to 1. (default is 0) This will show you the communication between the server and the modem. For ppp.log, set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\Logging to 1. (default is 0) This will help you […]
LDAP / Palm OS integration
One problem we’ve always had here at NetAdminTools is the management of our various contacts databases. For the most part we use our Palm OS databases. The problem is that it is difficult to synchronize between various Palm OS databases. An even more nasty problem is that it is quite difficult under Linux to synchronize […]
Some Useful RFCs
HTTP: RFC 2068 POP3: RFC 1725 SMTP: RFC 821 FTP: RFC 959
Installing Network Probe
Network Probe is a free network monitor and protocol analyzer that runs on Windows NT/2K/XP, Linux, FreeBSD, Solaris (Intel), and Mac OS X. We downloaded the Linux version by filling out the form here. The form wasn’t too intrusive, and the email with the download information came back quickly. We used version 0.4 for this […]
Setting Up Network Load Balancing on Windows 2000 Advanced Server
Network load balancing is a service that comes with Windows 2000 Advanced Server (not plain old Windows 2000). In this article we will set up Network Load Balancing on a cluster of two systems and test via the telnet service. The Network Load Balancing service is unlike other popular load balancing schemes like Red Hat […]
Using the WLBS CLI tool to Control Network Load Balancing on Windows 2000 Advanced Server
In order to use the WLBS CLI, you need to enable remote control: The WLBS CLI lives as wlbs.exe in system32. Query the cluster: C:\>wlbs query 10.50.100.10 /passw WLBS Cluster Control Utility V2.3. (c) 1997-99 Microsoft Corporation Password: Accessing cluster ‘10.50.100.10’ (10.50.100.40): Host 7 (10.50.100.17) reported: converged Host 1 (10.50.100.11) reported: converged as DEFAULT Host […]
Initial MRTG Configuration
MRTG is a monitoring tool for traffic loads on network-links. It will create HTML pages with visual representation of both the current and historical load on the device. The server we will use for this article is the Gentoo box we built in this article. With Gentoo, we simply run emerge and a bunch of […]
Creating a PPP Connection to a Cisco Aux Port
In this article, we set up MRTG to monitor an old Cisco 1720 router. Now, it is nice to have *two* interfaces on a lab router so that you can route between two physical interfaces. We tried adding a second FastEthernet module instead of the T1 module we have, but the firmware was too old. […]
Using the Ping -f Option to Test for Lost Packets
There is a cool option on some versions of ping. With the -f option, a dot is printed for each ping sent, and a backspace is printed when a ping is received. This gives you an instant visualization of the lost packets. Hit ctrl-c to end the task, and you will then see the latency […]
AreWeDown Trace/Latency Tool
We wrote up a tool that will generate a latency and trace report based on your IP address. Note that this is the IP address that the web server detects your client has. First it pings your IP address with 50 pings or 5 seconds worth of pings, whatever is the most restrictive. If 50 […]
