yadifa DNS master with Hurricane Electric slaves
this explains in short terms how to setup a yadifa DNS server which is backed up by Hurricane Electrics free DNS service.
yadifa is availabla packaged for some distributions, with slackware you have to install it by compiling it from the script found on SlackBuilds.org.
at the time of writing, SBo is in freeze awaiting the release of Slackware 15. the version available for Slackware 14.2, 2.4.0 is a bit outdated. meanwhile the maintainer sergej has fixed the script for -current and i took the liberty to update this to 2.5.3 in my own repository of slackbuilds.
after you installed yadifa, you have to customize the config of
yadifa (the control program).
following are sanitized and commented versions of my configuration. yadifas reference manual is excellent, in doubt just look things up there!
this is the configuration of the nameserver daemon.
<main> allow-control yadifa-control keys-path /var/lib/yadifa/zones/keys data-path /var/lib/yadifa/zones log-path /var/log/yadifa pid-file /var/run/yadifa/yadifad.pid max-tcp-queries 100 tcp-query-min-rate 6000 answer-formerr-packets yes serverid ns.example.org # change to the FQDN of your nameserver user yadifa group yadifa statistics no statistics-max-period 60 version "000" </main> <acl> # limit access to control functionality to this key (defined further down and ip) yadifa-control key "controller-key";127.0.0.1;::1/128 # ACL to limit AXFR and IXFR to Hurricane Electric servers he-dns 220.127.116.11;2001:470:600::2/128 </acl> # key to secure access to the control functionality <key> name "controller-key" algorithm "hmac-md5" secret "longsecretstring" </key> <control> enabled true </control> # identification string of your nameserver, FQDN should suffice <nsid> ascii "ns.example.org" </nsid> <rrl> responses-per-second 5 errors-per-second 5 slip 10 log-only off ipv4-prefix-length 24 ipv6-prefix-length 56 enabled yes </rrl> # log to syslog, facility "local6" and include PID in logged messages <channels> syslog syslog local6,pid </channels> # just log everything <loggers> database info,warning,err,crit,alert,emerg syslog server info,warning,err,crit,alert,emerg syslog system info,warning,err,crit,alert,emerg syslog zone info,warning,err,crit,alert,emerg syslog </loggers> # zone to serve, this section can be included multiple times for different zones <zone> # domain name of the zone domain example.org # zone file file "masters/example.org.zone" # master or slave zone type "master" # allow transfers for this ACL allow-transfer he-dns # HE uses two different servers one for transfers (slave.dns.he.net), one # to receive notifications (ns1.he.net). this sets up the right target # for notifications and disables the default behavior to # send it to the servers allowed for transfers. # notify this server about changes notify 18.104.22.168 # disable notifications for servers in the transfer ACL notify-auto false </zone>
this is the configuration of the control-client-program
<yadifa-ctrl> server 127.0.0.1 tsig-key-name "controller-key" </yadifa-ctrl> <key> name "controller-key" algorithm "hmac-md5" secret "longsecretstring" </key>
now that the daemon configuration is in place, you can put the zone data
/var/lib/yadifa/zones/masters/example.org.zone. how to write a
zone file is left as excercise to the reader :^)
afterwards the daemon can be started (on slackware) with
/etc/rc.d/rc.yadifad start. don't forget to put it into
rc.local.shutdown to have it start/stop on system boot and shutdown.
Hurricane Electric setup
if you are a HE IPv6 certification holder or have a tunnelbroker account, you can also use HEs free DNS service.
before you can add replication to Hurricane Slectric servers, you have to setup a few things:
- add Hurricane Electric nameservers
ns.he.netto your domain at your registrar
- add the same nameservers as NS records in your zone file
if you've done this and changes have applied everywhere, log into the DNS service and choose "Add a new slave". in the following form insert your domain name and your nameserver as master. if you have further restricted transfers with a key, also insert that. after you click on "Add Slave!" a few sanity checks will be performed and your slave zone is added (it might take a few minutes for the initial transfer to happen).