From 3c960e83ab0dd0e2fb0b45813ac99e4bbb25a49d Mon Sep 17 00:00:00 2001 From: nicholasmanios Date: Wed, 18 Mar 2020 18:44:08 -0400 Subject: [PATCH] Added named.conf --- aries/bind/named.conf | 355 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 355 insertions(+) create mode 100644 aries/bind/named.conf diff --git a/aries/bind/named.conf b/aries/bind/named.conf new file mode 100644 index 0000000..ec469f9 --- /dev/null +++ b/aries/bind/named.conf @@ -0,0 +1,355 @@ +// $FreeBSD: branches/2018Q1/dns/bind911/files/named.conf.in 443609 2017-06-14 22:56:44Z mat $ +// +// Refer to the named.conf(5) and named(8) man pages, and the documentation +// in /usr/local/share/doc/bind for more details. +// +// If you are going to set up an authoritative server, make sure you +// understand the hairy details of how DNS works. Even with +// simple mistakes, you can break connectivity for affected parties, +// or cause huge amounts of useless Internet traffic. + +//include "/usr/local/etc/namedb/rndc.key"; + +// These are IPs that are trusted by the BIND9 server to make DNS changes? +acl "trusted" { + 127.0.0.1; + 192.168.0.1; + 192.168.0.0/24; +}; + +//controls { +// inet 127.0.0.1 allow { localhost; } keys { "rndc-key"; }; +//}; + +// stats for prometheus +statistics-channels { + inet 127.0.0.1 port 8053 allow { 127.0.0.1; }; +}; + +options { + // All file and path names are relative to the chroot directory, + // if any, and should be fully qualified. + directory "/usr/local/etc/namedb/working"; + pid-file "/var/run/named/pid"; + dump-file "/var/dump/named_dump.db"; + statistics-file "/var/stats/named.stats"; + +// dnssec + dnssec-enable yes; + dnssec-validation yes; + +// this will force local lookup for zone "secmayl.com" +response-policy { zone "secmayl.com"; }; + +// Disable zone transfers by default + allow-transfer { none; }; + +// Allow recursive queries by trusted ACLs only + recursion yes; + allow-recursion { trusted; }; + +// allow the local network to query DNS + allow-query { trusted; }; + +// If named is being used only as a local resolver, this is a safe default. +// For named to be accessible to the network, comment this option, specify +// the proper IP address, or delete this option. + listen-on port 53 { 127.0.0.1; 192.168.0.1; }; +// listen-on { 0.0.0.0; }; +// listen-on { 192.168.0.1; }; + +// listen-on port 53 { 192.168.0.1; }; + +// If you have IPv6 enabled on this system, uncomment this option for +// use as a local resolver. To give access to the network, specify +// an IPv6 address, or the keyword "any". +// listen-on-v6 { ::1; }; + +// adding this interface interval setting so that bind doesnt scan the interface every 1hr + interface-interval 0; + +// These zones are already covered by the empty zones listed below. +// If you remove the related empty zones below, comment these lines out. + disable-empty-zone "255.255.255.255.IN-ADDR.ARPA"; + disable-empty-zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA"; + disable-empty-zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA"; + +// If you've got a DNS server around at your upstream provider, enter +// its IP address here, and enable the line below. This will make you +// benefit from its cache, thus reduce overall DNS traffic in the Internet. + forwarders { + 84.200.69.80; //DNS.WATCH #1 + 84.200.70.40; //DNS.WATCH #2 + }; + +// If the 'forwarders' clause is not empty the default is to 'forward first' +// which will fall back to sending a query from your local server if the name +// servers in 'forwarders' do not have the answer. Alternatively you can +// force your name server to never initiate queries of its own by enabling the +// following line: +// forward only; + +// If you wish to have forwarding configured automatically based on +// the entries in /etc/resolv.conf, uncomment the following line and +// set named_auto_forward=yes in /etc/rc.conf. You can also enable +// named_auto_forward_only (the effect of which is described above). +// include "/usr/local/etc/namedb/auto_forward.conf"; + + /* + Modern versions of BIND use a random UDP port for each outgoing + query by default in order to dramatically reduce the possibility + of cache poisoning. All users are strongly encouraged to utilize + this feature, and to configure their firewalls to accommodate it. + + AS A LAST RESORT in order to get around a restrictive firewall + policy you can try enabling the option below. Use of this option + will significantly reduce your ability to withstand cache poisoning + attacks, and should be avoided if at all possible. + + Replace NNNNN in the example with a number between 49160 and 65530. + */ + // query-source address * port NNNNN; +}; + +// views for Split-Horizon DNS +/* +view "secmayl-view" { + match-clients { trusted; }; + + zone "secmayl.com" { + type master; + file "zones/db.secmayl.com"; + }; + + zone "168.192.in-addr.arpa" { + type master; + file "zones/db.192.168"; + }; +}; +*/ + +// If you enable a local name server, don't forget to enter 127.0.0.1 +// first in your /etc/resolv.conf so this server will be queried. +// Also, make sure to enable it in /etc/rc.conf. + +// secmayl.com zone +zone "secmayl.com" { + type master; + file "/usr/local/etc/namedb/zones/db.secmayl.com"; +// allow-transfer { 192.168.0.2; }; //transfer to secondary DNS (does not exist) +// allow-update { key "rndc-key"; }; +}; + +// secmayl.com reverse zone +zone "168.192.in-addr.arpa" { + type master; + file "/usr/local/etc/namedb/zones/db.192.168"; +// allow-transfer { 192.168.0.2; }; //transfer to secondary DNS (does not exist) +// allow-update { key "rndc-key"; }; +}; + +// manios.ca zone +zone "manios.ca" { + type master; + file "/usr/local/etc/namedb/zones/db.manios.ca"; +// allow-transfer { 192.168.0.2; }; //transfer to secondary DNS (does not exist) +// allow-update { key "rndc-key"; }; +}; + +// blocked zones (ads and such) +include "/usr/local/etc/namedb/sinkhole.conf"; + +// The traditional root hints mechanism. Use this, OR the slave zones below. +zone "." { type hint; file "/usr/local/etc/namedb/named.root"; }; + +/* Serving the following zones locally will prevent any queries + for these zones leaving your network and going to the root + name servers. This has two significant advantages: + 1. Faster local resolution for your users + 2. No spurious traffic will be sent from your network to the roots +*/ +// RFCs 1912, 5735 and 6303 (and BCP 32 for localhost) +zone "localhost" { type master; file "/usr/local/etc/namedb/master/localhost-forward.db"; }; +zone "127.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/localhost-reverse.db"; }; +zone "255.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; + +// RFC 1912-style zone for IPv6 localhost address (RFC 6303) +zone "0.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/localhost-reverse.db"; }; + +// "This" Network (RFCs 1912, 5735 and 6303) +zone "0.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; + +// Private Use Networks (RFCs 1918, 5735 and 6303) +zone "10.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "16.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "17.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "18.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "19.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "20.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "21.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "22.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "23.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "24.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "25.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "26.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "27.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "28.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "29.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "30.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "31.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +//zone "168.192.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; + +// Shared Address Space (RFC 6598) +zone "64.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "65.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "66.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "67.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "68.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "69.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "70.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "71.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "72.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "73.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "74.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "75.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "76.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "77.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "78.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "79.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "80.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "81.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "82.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "83.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "84.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "85.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "86.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "87.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "88.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "89.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "90.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "91.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "92.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "93.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "94.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "95.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "96.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "97.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "98.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "99.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "100.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "101.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "102.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "103.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "104.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "105.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "106.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "107.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "108.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "109.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "110.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "111.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "112.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "113.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "114.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "115.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "116.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "117.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "118.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "119.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "120.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "121.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "122.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "123.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "124.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "125.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "126.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "127.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; + +// Link-local/APIPA (RFCs 3927, 5735 and 6303) +zone "254.169.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; + +// IETF protocol assignments (RFCs 5735 and 5736) +zone "0.0.192.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; + +// TEST-NET-[1-3] for Documentation (RFCs 5735, 5737 and 6303) +zone "2.0.192.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "100.51.198.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "113.0.203.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; + +// IPv6 Example Range for Documentation (RFCs 3849 and 6303) +zone "8.b.d.0.1.0.0.2.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; + +// Router Benchmark Testing (RFCs 2544 and 5735) +zone "18.198.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "19.198.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; + +// IANA Reserved - Old Class E Space (RFC 5735) +zone "240.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "241.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "242.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "243.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "244.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "245.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "246.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "247.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "248.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "249.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "250.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "251.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "252.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "253.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "254.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; + +// IPv6 Unassigned Addresses (RFC 4291) +zone "1.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "3.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "4.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "5.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "6.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "7.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "8.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "9.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "a.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "b.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "c.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "d.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "e.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "0.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "1.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "2.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "3.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "4.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "5.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "6.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "7.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "8.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "9.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "a.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "b.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "0.e.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "1.e.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "2.e.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "3.e.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "4.e.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "5.e.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "6.e.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "7.e.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; + +// IPv6 ULA (RFCs 4193 and 6303) +zone "c.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "d.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; + +// IPv6 Link Local (RFCs 4291 and 6303) +zone "8.e.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "9.e.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "a.e.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "b.e.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; + +// IPv6 Deprecated Site-Local Addresses (RFCs 3879 and 6303) +zone "c.e.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "d.e.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "e.e.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; +zone "f.e.f.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; + +// IP6.INT is Deprecated (RFC 4159) +zone "ip6.int" { type master; file "/usr/local/etc/namedb/master/empty.db"; }; \ No newline at end of file