LDP
/
old-www
1
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity
old-www/LDP/LG/issue90/tag/1.html

258 lines
9.3 KiB
HTML
Raw Permalink Blame History

<!--startcut ==============================================-->
<!-- *** BEGIN HTML header *** -->
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML><HEAD>
<META NAME="generator" CONTENT="lgazmail v1.4G.f">
<TITLE>The Answer Gang 90: Re: Hidden master DNS</TITLE>
</HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#0000FF" VLINK="#0000AF"
ALINK="#FF0000">
<!-- *** END HTML header *** -->
<!--endcut ==============================================-->
<!--endcut ==============================================-->
<!-- *** BEGIN navbar *** -->
<!-- *** END navbar *** -->
<!--endcut ============================================================-->
<!-- begin 1 -->
<H3 align="left"><img src="../../gx/dennis/qbubble.gif"
height="50" width="60" alt="(?) " border="0"
>Re: Hidden master DNS</H3>
<p><strong>From Mike Orr
</strong></p>
<p align="right"><strong>Answered By Dan Wilder
</p>
<P><STRONG><IMG SRC="../../gx/dennis/qbub.gif" ALT="(?)"
HEIGHT="28" WIDTH="50" BORDER="0"
>
How do you do the hidden master trick for DNS? In my case, my computer
is the real master and my friend runs two secondaries. However, the
registrar lists only his servers. Is that all that's needed to make
his secondary appear to be the master from the public's
perspective, or do I have to do something else too?
</STRONG></P>
<blockQuote><IMG SRC="../../gx/dennis/bbub.gif" ALT="(!)"
HEIGHT="28" WIDTH="50" BORDER="0"
> [Dan]
First bear in mind that "master" and "slave", a relationship
between servers, has nothing whatever to do with "primary"
and "secondary", an arbitrary ordering of servers on a list
your registrar maintains for you. Many sysadmins confuse the
two, partly because similar terms are sometimes used, and
much grief results.
</blockQuote>
<blockQuote>
1) List any servers you think will serve your domain with your
registrar, in any order you please.
</blockQuote>
<blockQuote>
2) Set up any relationship you want between your DNS servers.
The master/slave relationship is established (when using BIND)
in the named.conf stanzas. For the master:
</blockQuote>
<blockquote><pre>zone "mydomain.com" {
type master;
file "mydomain.com";
};
</pre></blockquote>
<blockQuote>
and put the "mydomain.com" zone file where the server expects
to find it.
</blockQuote>
<blockQuote>
For a slave:
</blockQuote>
<blockquote><pre>zone "mydomain.com" {
type slave;
masters { xxx.xxx.xxx.xxx; };
file "mydomain.com";
};
</pre></blockquote>
<blockQuote>
the slave will download mydomain.com from the master.
</blockQuote>
<blockQuote>
About "hidden":
</blockQuote>
<blockQuote><BLOCKQuote>
You don't have to list the actual master server at all. It is
sufficient that the listed servers know the IP address of the
actual master. The registrar doesn't need this information.
Then it's a "hidden master".
</BLOCKQuote></blockQuote>
<blockQuote>
Somewhat related to this is so-called "split DNS". Use this when
you have a firewalled network containing hosts known internally
as a part of your domain, but which are not visible outside.
</blockQuote>
<blockQuote>
Set up a master DNS server inside and point all your hosts at it.
In the "options" section:
</blockQuote>
<blockquote><pre>options {
...
notify no;
allow-transfer { none; };
forward only;
forwarders {
xxx.xxx.xxx.xxx;
xxx.xxx.xxx.xxx;
xxx.xxx.xxx.xxx;
};
};
</pre></blockquote>
<blockQuote>
which turns off notification to anybody, allows nobody to
get a copy of locally maintained zone files, and specifies
a few nameservers, typically those of your ISP, as the
places to query for domains the server doesn't consider
itself definitive for.
</blockQuote>
<blockQuote>
Then, for your own domain, a stanza that says:
</blockQuote>
<blockquote><pre>zone "mydomain.com." IN {
type master;
file "mydomain.com";
};
</pre></blockquote>
<blockQuote>
and the "mydomain.com" zone file contains records for
internal hosts, <EM>plus</EM> all external hosts listed in the
mydomain.com zone file in the outside nameserver.
</blockQuote>
<P><STRONG><IMG SRC="../../gx/dennis/qbub.gif" ALT="(?)"
HEIGHT="28" WIDTH="50" BORDER="0"
>
All my domains are "master" in my <TT>/etc/bind/bind.conf.</TT> My friend has
who-knows-what settings to download my information to his secondary
servers. I'm not sure whether the records appear as "master" or "slave"
on his server. I want his first secondary server (the one listed first
at the registrar) to appear authoritative to the public, so that the
public won't be querying my server. Does he have to do anything else?
I asked him, but he said he thought hidden master was something I set at
my end.
</STRONG></P>
<blockQuote><IMG SRC="../../gx/dennis/bbub.gif" ALT="(!)"
HEIGHT="28" WIDTH="50" BORDER="0"
> [Dan]
Nope.
</blockQuote>
<blockQuote>
"Hidden" is set at the registrar. That is, you don't register your
server. That makes it hidden.
</blockQuote>
<blockQuote>
Your server has to consider itself "master" but that's already set up.
</blockQuote>
<blockQuote>
If you want your hidden master to actually control anything, your
friend has to set the stanza for your domain in his named.conf file
to "slave" with the ip of your machine in the "masters" keyword
in the stanza. That's what makes your server a "master".
</blockQuote>
<blockQuote>
Or else he has to set his stanza to "master", and you have to
send him a copy of your zone file every time you change it, and he
has to put it in place. But then your machine isn't a "hidden master".
</blockQuote>
<blockQuote>
If the transfer happens on a timely basis, nobody outside cares how the
zone file gets to his machine. If he'll cooperate it saves work
on your part and on his.
</blockQuote>
<P><STRONG><IMG SRC="../../gx/dennis/qbub.gif" ALT="(?)"
HEIGHT="28" WIDTH="50" BORDER="0"
>
He's already set up to automatically pull the data from my server; that
was set up years ago. I guess that means he's a "slave". But I thought
"secondary" was the term for that, and that his record would tell the
public to go to my server for the authoritative source, but I guess
that's not the case.
</STRONG></P>
<blockQuote><IMG SRC="../../gx/dennis/bbub.gif" ALT="(!)"
HEIGHT="28" WIDTH="50" BORDER="0"
> [Dan]
No. That's the confusion due to similar terms being used in the
same context for different things, that I've been fighting off and
on about with slightly underqualified sysadmins who don't realize
the extent of their underqualification, for years.
</blockQuote>
<blockQuote>
"Primary" and "Secondary" should be used to denote a matter of
public record, the nameservers listed with a registrar for
a domain. They should never be used to denote the private
relationship between servers, of which the registrar knows
nothing.
</blockQuote>
<blockQuote>
"Master" and "Slave" should be used to denote a privately
arranged relationship between servers configured to furnish
DNS information about a particular domain. This has nothing
to do with the matter of public record mentioned previously.
</blockQuote>
<!-- end 1 -->
<!-- *** BEGIN copyright *** -->
<hr>
<CENTER><SMALL><STRONG>
<h5>
<br>Copyright &copy; 2003
<br>Copying license <A HREF="">http://www.linuxgazette.com/copying.html</A>
<BR>Published in Issue 90 of <i>Linux Gazette</i>, May 2003</H5>
</STRONG></SMALL></CENTER>
<!-- *** END copyright *** -->
<SMALL><CENTER><H6 ALIGN="center">HTML script maintained by
<A HREF="mailto:star@starshine.org">Heather Stern</a> of
Starshine Technical Services,
<A HREF="http://www.starshine.org/">http://www.starshine.org/</A>
</H6></SMALL></CENTER>
<HR>
<!--startcut ======================================================= -->
<P> <hr>
<!-- begin tagnav ::::::::::::::::::::::::::::::::::::::::::::::::::-->
<p align="center">
<table width="100%" border="0"><tr>
<td align="right" valign="center"
><IMG ALT="" SRC="../../gx/navbar/left.jpg"
WIDTH="14" HEIGHT="45" BORDER="0" ALIGN="middle" border="0"
><A HREF="../index.html"
><IMG SRC="../../gx/navbar/toc.jpg" align="middle"
ALT="[ Table Of Contents ]" border="0"></A
><A HREF="../lg_answer.html"
><IMG SRC="../../gx/dennis/answertoc.jpg" align="middle"
ALT="[ Answer Guy Current Index ]" border="0"></A></td>
<td align="center" valign="center"><A HREF="../lg_answer.html#greeting"><img align="middle"
src="../../gx/dennis/smily.gif" alt="greetings" border="0"></A> &nbsp;
<A HREF="../../tag/bios.html">Meet&nbsp;the&nbsp;Gang</A> &nbsp;
<A HREF="1.html">1</A> &nbsp;
<A HREF="2.html">2</A>
</td>
<td align="left" valign="center"><A HREF="../../tag/kb.html"
><IMG SRC="../../gx/dennis/answerpast.jpg" align="middle"
ALT="[ Index of Past Answers ]" border="0"></A
><IMG ALT="" SRC="../../gx/navbar/right.jpg" align="middle"
WIDTH="14" HEIGHT="45" BORDER="0"></td></tr></table>
</p>
<!-- end tagnav ::::::::::::::::::::::::::::::::::::::::::::::::::::-->
<!--endcut ========================================================= -->
<P> <hr>
<!--startcut ======================================================= -->
<CENTER>
<!-- *** BEGIN navbar *** -->
<!-- *** END navbar *** -->
</CENTER>
</p>
<!--endcut ========================================================= -->
<!--startcut ======================================================= -->
</BODY></HTML>
<!--endcut ========================================================= -->
Reference in New Issue View Git Blame Copy Permalink