Date: Tue, 2 Dec 2014 22:55:34 -0500 From: "John Von Essen" <john@quonix.net> To: <freebsd-hackers@freebsd.org> Subject: RE: Bind, DNS, and Denial of Service Message-ID: <005d01d00ead$00d56320$02802960$@quonix.net> In-Reply-To: <547E82CC.3040007@egr.msu.edu> References: <002e01d00e8c$1b7d6f40$52784dc0$@quonix.net> <381c25e1046453b9f7a5c94809e7d7fb@ultimatedns.net> <004e01d00ea0$6b7c7860$42756920$@quonix.net> <547E82CC.3040007@egr.msu.edu>
next in thread | previous in thread | raw e-mail | index | archive | help
The base bind99 port did not behave nicely even when I set named_program="/usr/local/sbin/named" because the port is built with a sysconfdir of /usr/local/etc which through everything out of whack. Even when I tried to override the startup scrip to explicitly pass -c /etc/namedb things were all weird. Rndc also didn't work because it kept looking in the wrong dir's, etc.,. So this is what I had to in order to get it to work cleanly on FreeBSD 9.3: 1. I edited the bind99 ports Makefile and set the sysconfdir to /etc/namedb instead of /usr/local/etc and I also set the BIND_ETC_DEST to /etc/namedb 2. I then re-did the make && make install 3. I still have to set named_program="/usr/local/sbin/named" in rc.conf That did it. Everything starts cleanly from /etc/rc.d/named, the RRL options now work, rndc works, etc,. I get the feeling that the bind99 port is setup to behave correctly in FreeBSD 10.X where the init script goes into /usr/local/etc/rc.d and the config goes into /usr/local/etc, but the problem is 9.3 is different, so you sort of have to tweak it like I did. -John -----Original Message----- From: owner-freebsd-hackers@freebsd.org [mailto:owner-freebsd-hackers@freebsd.org] On Behalf Of Adam McDougall Sent: Tuesday, December 02, 2014 10:26 PM To: freebsd-hackers@freebsd.org Subject: Re: Bind, DNS, and Denial of Service On 12/02/2014 21:25, John Von Essen wrote: > Thanks... Right now I have a FreeBSD 9.3 system, after a clean install I went in and built Bind99 from ports with the RRL option. You may want to consider bind910 which is 9.10 and newer. > > Question is how do I force /etc/rc.d/named to use the new bind9.9 that I built from ports and now resides in /usr/local/sbin? On FreeBSD 10+, /etc/rc.d/named is gone but the bind ports install a named script in /usr/local/etc/rc.d/. I'm doing this and all I need is named_enable="YES" in /etc/rc.conf. > > Do I just edit /etc/defaults/rc.conf and tell it to use /usr/local/sbin/named instead of /usr/sbin/named? Never edit /etc/defaults/*. Always edit the /etc/rc.conf equivalent (copy lines from /etc/defaults) or even /etc/rc.conf.local or files in /etc/rc.conf.d/. See the rc.conf manpage for more info. If you do use /etc/rc.d/named, you can edit these in your own rc.conf: named_program="/usr/sbin/named" # Path to named, if you want a different one. named_conf="/etc/namedb/named.conf" # Path to the configuration file > > I thought there might be a cleaner way to do this, just curious. > > -John > > -----Original Message----- > From: Chris H [mailto:bsd-lists@bsdforge.com] > Sent: Tuesday, December 02, 2014 9:18 PM > To: freebsd-hackers@freebsd.org; John Von Essen > Subject: Re: Bind, DNS, and Denial of Service > > On Tue, 2 Dec 2014 19:00:06 -0500 "John Von Essen" <john@quonix.net> > wrote > >> I figure this might be the best place to start this discussion. >> >> >> >> I've been using FreeBSD for ages for some core systems, one of those >> being Auth and public caching DNS. >> >> >> >> Lately I've been getting hit hard by reflective DDoS on DNS, so my >> old systems need some updating. >> >> >> >> Question is, what's the best/simplest solution moving forward? >> FreeBSD >> 9.3 or 10.1? Do I continue to use BIND with the rate-limiting >> feature, or go with something else? >> >> >> >> I will say, I tried to get a FreeBSD 10.1 instance running with BIND >> 10 - no luck, so I did BIND 9.9 with the RRL feature. It sort of >> worked, but was weird. I was getting a ton of weird responses on the >> server the moment I turned BIND on. >> >> >> >> Its been so long since I've worked on this stuff, my old 8.X machines >> have been running for years. >> >> >> >> I am open to using something else for the caching, but for the Auth I >> really want to stay with Bind. Its just really hard to implement BIND >> with RRL on newer freebsd distro's, I get the feeling that the >> FreeBSD folks want to move on from BIND. >> >> >> >> Any help would be appreciated. > > Hello, John. > > FWIW You might find dns/nsd a good fit. It's even possible to get it to output "Bind like" log messages. I've replaced the Bind on all, but one of our servers with it. In an effort to evaluate it for being a replacement. I'm finding it difficult to keep the last server still running the Bind going. > So I'll probably have to replace it with something soon. Just haven't > *yet* determined *what* other DNS to evaluate. I only ran into one > issue with it (NSD). It was NSD itself, and the reaction time is > extremely good (less than a week), and a new > (fixed) version was out. > > Anyway. Just thought I'd share my experience. In case it helps. > > --Chris > >> >> >> >> -John >> >> >> >> >> >> _______________________________________________ >> freebsd-hackers@freebsd.org mailing list >> http://lists.freebsd.org/mailman/listinfo/freebsd-hackers >> To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org" > > > _______________________________________________ > freebsd-hackers@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-hackers > To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org" > _______________________________________________ freebsd-hackers@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-hackers To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?005d01d00ead$00d56320$02802960$>