diff options
author | dougb <dougb@FreeBSD.org> | 2005-12-29 04:22:58 +0000 |
---|---|---|
committer | dougb <dougb@FreeBSD.org> | 2005-12-29 04:22:58 +0000 |
commit | 13e6e55147add29e8d7701891f70aefeb3d74645 (patch) | |
tree | 570b6e4f35462e81147786cc2f272d28fac7f470 /contrib/bind9/FAQ.xml | |
parent | 9123af99f7956e2383e5b9c4d39e84bea89915fe (diff) | |
download | FreeBSD-src-13e6e55147add29e8d7701891f70aefeb3d74645.zip FreeBSD-src-13e6e55147add29e8d7701891f70aefeb3d74645.tar.gz |
Vendor import of BIND 9.3.2
Diffstat (limited to 'contrib/bind9/FAQ.xml')
-rw-r--r-- | contrib/bind9/FAQ.xml | 1007 |
1 files changed, 1007 insertions, 0 deletions
diff --git a/contrib/bind9/FAQ.xml b/contrib/bind9/FAQ.xml new file mode 100644 index 0000000..963cd0a --- /dev/null +++ b/contrib/bind9/FAQ.xml @@ -0,0 +1,1007 @@ +<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" + "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" []> +<!-- + - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") + - Copyright (C) 2000-2003 Internet Software Consortium. + - + - Permission to use, copy, modify, and distribute this software for any + - purpose with or without fee is hereby granted, provided that the above + - copyright notice and this permission notice appear in all copies. + - + - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + - PERFORMANCE OF THIS SOFTWARE. +--> + +<!-- $Id: FAQ.xml,v 1.4.6.3 2005/11/02 22:53:51 marka Exp $ --> + +<article class="faq"> + <title>Frequently Asked Questions about BIND 9</title> + <qandaset defaultlabel='qanda'> + <qandaentry> + <question> + <para> + Why doesn't -u work on Linux 2.2.x when I build with + --enable-threads? + </para> + </question> + <answer> + <para> + Linux threads do not fully implement the Posix threads + (pthreads) standard. In particular, setuid() operates only + on the current thread, not the full process. Because of + this limitation, BIND 9 cannot use setuid() on Linux as it + can on all other supported platforms. setuid() cannot be + called before creating threads, since the server does not + start listening on reserved ports until after threads have + started. + </para> + <para> + In the 2.2.18 or 2.3.99-pre3 and newer kernels, the ability + to preserve capabilities across a setuid() call is present. + This allows BIND 9 to call setuid() early, while retaining + the ability to bind reserved ports. This is a Linux-specific + hack. + </para> + <para> + On a 2.2 kernel, BIND 9 does drop many root privileges, so + it should be less of a security risk than a root process + that has not dropped privileges. + </para> + <para> + If Linux threads ever work correctly, this restriction will + go away. + </para> + <para> + Configuring BIND9 with the --disable-threads option (the + default) causes a non-threaded version to be built, which + will allow -u to be used. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + Why does named log the warning message <quote>no TTL specified - + using SOA MINTTL instead</quote>? + </para> + </question> + <answer> + <para> + Your zone file is illegal according to RFC1035. It must either + have a line like: + </para> + <informalexample> + <programlisting> +$TTL 86400</programlisting> + </informalexample> + <para> + at the beginning, or the first record in it must have a TTL field, + like the "84600" in this example: + </para> + <informalexample> + <programlisting> +example.com. 86400 IN SOA ns hostmaster ( 1 3600 1800 1814400 3600 )</programlisting> + </informalexample> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + Why do I see 5 (or more) copies of named on Linux? + </para> + </question> + <answer> + <para> + Linux threads each show up as a process under ps. The + approximate number of threads running is n+4, where n is + the number of CPUs. Note that the amount of memory used + is not cumulative; if each process is using 10M of memory, + only a total of 10M is used. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + Why does BIND 9 log <quote>permission denied</quote> errors accessing + its configuration files or zones on my Linux system even + though it is running as root? + </para> + </question> + <answer> + <para> + On Linux, BIND 9 drops most of its root privileges on + startup. This including the privilege to open files owned + by other users. Therefore, if the server is running as + root, the configuration files and zone files should also + be owned by root. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + Why do I get errors like <quote>dns_zone_load: zone foo/IN: loading + master file bar: ran out of space</quote>? + </para> + </question> + <answer> + <para> + This is often caused by TXT records with missing close + quotes. Check that all TXT records containing quoted strings + have both open and close quotes. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + How do I produce a usable core file from a multithreaded + named on Linux? + </para> + </question> + <answer> + <para> + If the Linux kernel is 2.4.7 or newer, multithreaded core + dumps are usable (that is, the correct thread is dumped). + Otherwise, if using a 2.2 kernel, apply the kernel patch + found in contrib/linux/coredump-patch and rebuild the kernel. + This patch will cause multithreaded programs to dump the + correct thread. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + How do I restrict people from looking up the server version? + </para> + </question> + <answer> + <para> + Put a "version" option containing something other than the + real version in the "options" section of named.conf. Note + doing this will not prevent attacks and may impede people + trying to diagnose problems with your server. Also it is + possible to "fingerprint" nameservers to determine their + version. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + How do I restrict only remote users from looking up the + server version? + </para> + </question> + <answer> + <para> + The following view statement will intercept lookups as the + internal view that holds the version information will be + matched last. The caveats of the previous answer still + apply, of course. + </para> + <informalexample> + <programlisting> +view "chaos" chaos { + match-clients { <those to be refused>; }; + allow-query { none; }; + zone "." { + type hint; + file "/dev/null"; // or any empty file + }; +};</programlisting> + </informalexample> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + What do <quote>no source of entropy found</quote> or <quote>could not + open entropy source foo</quote> mean? + </para> + </question> + <answer> + <para> + The server requires a source of entropy to perform certain + operations, mostly DNSSEC related. These messages indicate + that you have no source of entropy. On systems with + /dev/random or an equivalent, it is used by default. A + source of entropy can also be defined using the random-device + option in named.conf. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + I installed BIND 9 and restarted named, but it's still BIND 8. Why? + </para> + </question> + <answer> + <para> + BIND 9 is installed under /usr/local by default. BIND 8 + is often installed under /usr. Check that the correct named + is running. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + I'm trying to use TSIG to authenticate dynamic updates or + zone transfers. I'm sure I have the keys set up correctly, + but the server is rejecting the TSIG. Why? + </para> + </question> + <answer> + <para> + This may be a clock skew problem. Check that the the clocks + on the client and server are properly synchronised (e.g., + using ntp). + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + I'm trying to compile BIND 9, and "make" is failing due to + files not being found. Why? + </para> + </question> + <answer> + <para> + Using a parallel or distributed "make" to build BIND 9 is + not supported, and doesn't work. If you are using one of + these, use normal make or gmake instead. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + I have a BIND 9 master and a BIND 8.2.3 slave, and the + master is logging error messages like <quote>notify to 10.0.0.1#53 + failed: unexpected end of input</quote>. What's wrong? + </para> + </question> + <answer> + <para> + This error message is caused by a known bug in BIND 8.2.3 + and is fixed in BIND 8.2.4. It can be safely ignored - the + notify has been acted on by the slave despite the error + message. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + I keep getting log messages like the following. Why? + </para> + <para> + Dec 4 23:47:59 client 10.0.0.1#1355: updating zone + 'example.com/IN': update failed: 'RRset exists (value + dependent)' prerequisite not satisfied (NXRRSET) + </para> + </question> + <answer> + <para> + DNS updates allow the update request to test to see if + certain conditions are met prior to proceeding with the + update. The message above is saying that conditions were + not met and the update is not proceeding. See doc/rfc/rfc2136.txt + for more details on prerequisites. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + I keep getting log messages like the following. Why? + </para> + <para> + Jun 21 12:00:00.000 client 10.0.0.1#1234: update denied + </para> + </question> + <answer> + <para> + Someone is trying to update your DNS data using the RFC2136 + Dynamic Update protocol. Windows 2000 machines have a habit + of sending dynamic update requests to DNS servers without + being specifically configured to do so. If the update + requests are coming from a Windows 2000 machine, see + <ulink + url="http://support.microsoft.com/support/kb/articles/q246/8/04.asp"> + http://support.microsoft.com/support/kb/articles/q246/8/04.asp + </ulink> + for information about how to turn them off. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + I see a log message like the following. Why? + </para> + <para> + couldn't open pid file '/var/run/named.pid': Permission denied + </para> + </question> + <answer> + <para> + You are most likely running named as a non-root user, and + that user does not have permission to write in /var/run. + The common ways of fixing this are to create a /var/run/named + directory owned by the named user and set pid-file to + "/var/run/named/named.pid", or set pid-file to "named.pid", + which will put the file in the directory specified by the + directory option (which, in this case, must be writable by + the named user). + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + When I do a "dig . ns", many of the A records for the root + servers are missing. Why? + </para> + </question> + <answer> + <para> + This is normal and harmless. It is a somewhat confusing + side effect of the way BIND 9 does RFC2181 trust ranking + and of the efforts BIND 9 makes to avoid promoting glue + into answers. + </para> + <para> + When BIND 9 first starts up and primes its cache, it receives + the root server addresses as additional data in an authoritative + response from a root server, and these records are eligible + for inclusion as additional data in responses. Subsequently + it receives a subset of the root server addresses as + additional data in a non-authoritative (referral) response + from a root server. This causes the addresses to now be + considered non-authoritative (glue) data, which is not + eligible for inclusion in responses. + </para> + <para> + The server does have a complete set of root server addresses + cached at all times, it just may not include all of them + as additional data, depending on whether they were last + received as answers or as glue. You can always look up the + addresses with explicit queries like "dig a.root-servers.net A". + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + Zone transfers from my BIND 9 master to my Windows 2000 + slave fail. Why? + </para> + </question> + <answer> + <para> + This may be caused by a bug in the Windows 2000 DNS server + where DNS messages larger than 16K are not handled properly. + This can be worked around by setting the option "transfer-format + one-answer;". Also check whether your zone contains domain + names with embedded spaces or other special characters, + like "John\032Doe\213s\032Computer", since such names have + been known to cause Windows 2000 slaves to incorrectly + reject the zone. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + Why don't my zones reload when I do an "rndc reload" or SIGHUP? + </para> + </question> + <answer> + <para> + A zone can be updated either by editing zone files and + reloading the server or by dynamic update, but not both. + If you have enabled dynamic update for a zone using the + "allow-update" option, you are not supposed to edit the + zone file by hand, and the server will not attempt to reload + it. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + I can query the nameserver from the nameserver but not from other + machines. Why? + </para> + </question> + <answer> + <para> + This is usually the result of the firewall configuration stopping + the queries and / or the replies. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + How can I make a server a slave for both an internal and + an external view at the same time? When I tried, both views + on the slave were transferred from the same view on the master. + </para> + </question> + <answer> + <para> + You will need to give the master and slave multiple IP + addresses and use those to make sure you reach the correct + view on the other machine. + </para> + <informalexample> + <programlisting> +Master: 10.0.1.1 (internal), 10.0.1.2 (external, IP alias) + internal: + match-clients { !10.0.1.2; !10.0.1.4; 10.0.1/24; }; + notify-source 10.0.1.1; + transfer-source 10.0.1.1; + query-source address 10.0.1.1; + external: + match-clients { any; }; + recursion no; // don't offer recursion to the world + notify-source 10.0.1.2; + transfer-source 10.0.1.2; + query-source address 10.0.1.2; + +Slave: 10.0.1.3 (internal), 10.0.1.4 (external, IP alias) + internal: + match-clients { !10.0.1.2; !10.0.1.4; 10.0.1/24; }; + notify-source 10.0.1.3; + transfer-source 10.0.1.3; + query-source address 10.0.1.3; + external: + match-clients { any; }; + recursion no; // don't offer recursion to the world + notify-source 10.0.1.4; + transfer-source 10.0.1.4; + query-source address 10.0.1.4;</programlisting> + </informalexample> + <para> + You put the external address on the alias so that all the other + dns clients on these boxes see the internal view by default. + </para> + </answer> + <answer> + <para> + BIND 9.3 and later: Use TSIG to select the appropriate view. + </para> + <informalexample> + <programlisting> +Master 10.0.1.1: + key "external" { + algorithm hmac-md5; + secret "xxxxxxxx"; + }; + view "internal" { + match-clients { !key external; 10.0.1/24; }; + ... + }; + view "external" { + match-clients { key external; any; }; + server 10.0.0.2 { keys external; }; + recursion no; + ... + }; + +Slave 10.0.1.2: + key "external" { + algorithm hmac-md5; + secret "xxxxxxxx"; + }; + view "internal" { + match-clients { !key external; 10.0.1/24; }; + ... + }; + view "external" { + match-clients { key external; any; }; + server 10.0.0.1 { keys external; }; + recursion no; + ... + };</programlisting> + </informalexample> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + I have FreeBSD 4.x and "rndc-confgen -a" just sits there. + </para> + </question> + <answer> + <para> + /dev/random is not configured. Use rndcontrol(8) to tell + the kernel to use certain interrupts as a source of random + events. You can make this permanent by setting rand_irqs + in /etc/rc.conf. + </para> + <informalexample> + <programlisting> +/etc/rc.conf +rand_irqs="3 14 15"</programlisting> + </informalexample> + <para> + See also + <ulink url="http://people.freebsd.org/~dougb/randomness.html"> + http://people.freebsd.org/~dougb/randomness.html + </ulink> + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + Why is named listening on UDP port other than 53? + </para> + </question> + <answer> + <para> + Named uses a system selected port to make queries of other + nameservers. This behaviour can be overridden by using + query-source to lock down the port and/or address. See + also notify-source and transfer-source. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + I get error messages like <quote>multiple RRs of singleton type</quote> + and <quote>CNAME and other data</quote> when transferring a zone. What + does this mean? + </para> + </question> + <answer> + <para> + These indicate a malformed master zone. You can identify + the exact records involved by transferring the zone using + dig then running named-checkzone on it. + </para> + <informalexample> + <programlisting> +dig axfr example.com @master-server > tmp +named-checkzone example.com tmp</programlisting> + </informalexample> + <para> + A CNAME record cannot exist with the same name as another record + except for the DNSSEC records which prove its existance (NSEC). + </para> + <para> + RFC 1034, Section 3.6.2: <quote>If a CNAME RR is present at a node, + no other data should be present; this ensures that the data for a + canonical name and its aliases cannot be different. This rule also + insures that a cached CNAME can be used without checking with an + authoritative server for other RR types.</quote> + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + I get error messages like <quote>named.conf:99: unexpected end + of input</quote> where 99 is the last line of named.conf. + </para> + </question> + <answer> + <para> + Some text editors (notepad and wordpad) fail to put a line + title indication (e.g. CR/LF) on the last line of a + text file. This can be fixed by "adding" a blank line to + the end of the file. Named expects to see EOF immediately + after EOL and treats text files where this is not met as + truncated. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + I get warning messages like <quote>zone example.com/IN: refresh: + failure trying master 1.2.3.4#53: timed out</quote>. + </para> + </question> + <answer> + <para> + Check that you can make UDP queries from the slave to the master + </para> + <informalexample> + <programlisting> +dig +norec example.com soa @1.2.3.4</programlisting> + </informalexample> + <para> + You could be generating queries faster than the slave can + cope with. Lower the serial query rate. + </para> + <informalexample> + <programlisting> +serial-query-rate 5; // default 20</programlisting> + </informalexample> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + How do I share a dynamic zone between multiple views? + </para> + </question> + <answer> + <para> + You choose one view to be master and the second a slave and + transfer the zone between views. + </para> + <informalexample> + <programlisting> +Master 10.0.1.1: + key "external" { + algorithm hmac-md5; + secret "xxxxxxxx"; + }; + + key "mykey" { + algorithm hmac-md5; + secret "yyyyyyyy"; + }; + + view "internal" { + match-clients { !external; 10.0.1/24; }; + server 10.0.1.1 { + /* Deliver notify messages to external view. */ + keys { external; }; + }; + zone "example.com" { + type master; + file "internal/example.db"; + allow-update { key mykey; }; + notify-also { 10.0.1.1; }; + }; + }; + + view "external" { + match-clients { external; any; }; + zone "example.com" { + type slave; + file "external/example.db"; + masters { 10.0.1.1; }; + transfer-source { 10.0.1.1; }; + // allow-update-forwarding { any; }; + // allow-notify { ... }; + }; + };</programlisting> + </informalexample> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + I get a error message like <quote>zone wireless.ietf56.ietf.org/IN: + loading master file primaries/wireless.ietf56.ietf.org: no + owner</quote>. + </para> + </question> + <answer> + <para> + This error is produced when a line in the master file + contains leading white space (tab/space) but the is no + current record owner name to inherit the name from. Usually + this is the result of putting white space before a comment. + Forgeting the "@" for the SOA record or indenting the master + file. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + Why are my logs in GMT (UTC). + </para> + </question> + <answer> + <para> + You are running chrooted (-t) and have not supplied local timzone + information in the chroot area. + </para> + <simplelist> + <member>FreeBSD: /etc/localtime</member> + <member>Solaris: /etc/TIMEZONE and /usr/share/lib/zoneinfo</member> + <member>OSF: /etc/zoneinfo/localtime</member> + </simplelist> + <para> + See also tzset(3) and zic(8). + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + I get the error message <quote>named: capset failed: Operation + not permitted</quote> when starting named. + </para> + </question> + <answer> + <para> + The capability module, part of "Linux Security Modules/LSM", + has not been loaded into the kernel. See insmod(8). + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + I get <quote>rndc: connect failed: connection refused</quote> when + I try to run rndc. + </para> + </question> + <answer> + <para> + This is usually a configuration error. + </para> + <para> + First ensure that named is running and no errors are being + reported at startup (/var/log/messages or equivalent). + Running "named -g <usual arguments>" from a title + can help at this point. + </para> + <para> + Secondly ensure that named is configured to use rndc either + by "rndc-confgen -a", rndc-confgen or manually. The + Administrators Reference manual has details on how to do + this. + </para> + <para> + Old versions of rndc-confgen used localhost rather than + 127.0.0.1 in /etc/rndc.conf for the default server. Update + /etc/rndc.conf if necessary so that the default server + listed in /etc/rndc.conf matches the addresses used in + named.conf. "localhost" has two address (127.0.0.1 and + ::1). + </para> + <para> + If you use "rndc-confgen -a" and named is running with -t or -u + ensure that /etc/rndc.conf has the correct ownership and that + a copy is in the chroot area. You can do this by re-running + "rndc-confgen -a" with appropriate -t and -u arguments. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + I don't get RRSIG's returned when I use "dig +dnssec". + </para> + </question> + <answer> + <para> + You need to ensure DNSSEC is enabled (dnssec-enable yes;). + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + I get <quote>Error 1067</quote> when starting named under Windows. + </para> + </question> + <answer> + <para> + This is the service manager saying that named exited. You + need to examine the Application log in the EventViewer to + find out why. + </para> + <para> + Common causes are that you failed to create "named.conf" + (usually "C:\windows\dns\etc\named.conf") or failed to + specify the directory in named.conf. + </para> + <informalexample> + <programlisting> +options { + Directory "C:\windows\dns\etc"; +};</programlisting> + </informalexample> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + I get <quote>transfer of 'example.net/IN' from 192.168.4.12#53: + failed while receiving responses: permission denied</quote> error + messages. + </para> + </question> + <answer> + <para> + These indicate a filesystem permission error preventing + named creating / renaming the temporary file. These will + usually also have other associated error messages like + </para> + <informalexample> + <programlisting> +"dumping master file: sl/tmp-XXXX5il3sQ: open: permission denied"</programlisting> + </informalexample> + <para> + Named needs write permission on the directory containing + the file. Named writes the new cache file to a temporary + file then renames it to the name specified in named.conf + to ensure that the contents are always complete. This is + to prevent named loading a partial zone in the event of + power failure or similar interrupting the write of the + master file. + </para> + <para> + Note file names are relative to the directory specified in + options and any chroot directory ([<chroot + dir>/][<options dir>]). + </para> + <informalexample> + <para> + If named is invoked as "named -t /chroot/DNS" with + the following named.conf then "/chroot/DNS/var/named/sl" + needs to be writable by the user named is running as. + </para> + <programlisting> +options { + directory "/var/named"; +}; + +zone "example.net" { + type slave; + file "sl/example.net"; + masters { 192.168.4.12; }; +};</programlisting> + </informalexample> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + How do I intergrate BIND 9 and Solaris SMF + </para> + </question> + <answer> + <para> + Sun has a blog entry describing how to do this. + </para> + <para> + <ulink + url="http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris"> + http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris + </ulink> + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + Can a NS record refer to a CNAME. + </para> + </question> + <answer> + <para> + No. The rules for glue (copies of the *address* records + in the parent zones) and additional section processing do + not allow it to work. + </para> + <para> + You would have to add both the CNAME and address records + (A/AAAA) as glue to the parent zone and have CNAMEs be + followed when doing additional section processing to make + it work. No namesever implementation supports either of + these requirements. + </para> + </answer> + </qandaentry> + + <qandaentry> + <question> + <para> + What does <quote>RFC 1918 response from Internet for + 0.0.0.10.IN-ADDR.ARPA</quote> mean? + </para> + </question> + <answer> + <para> + If the IN-ADDR.ARPA name covered refers to a internal address + space you are using then you have failed to follow RFC 1918 + usage rules and are leaking queries to the Internet. You + should establish your own zones for these addresses to prevent + you quering the Internet's name servers for these addresses. + Please see <ulink url="http://as112.net/">http://as112.net/</ulink> + for details of the problems you are causing and the counter + measures that have had to be deployed. + </para> + <para> + If you are not using these private addresses then a client + has queried for them. You can just ignore the messages, + get the offending client to stop sending you these messages + as they are most probably leaking them or setup your own zones + empty zones to serve answers to these queries. + </para> + <informalexample> + <programlisting> +zone "10.IN-ADDR.ARPA" { + type master; + file "empty"; +}; + +zone "16.172.IN-ADDR.ARPA" { + type master; + file "empty"; +}; + +... + +zone "31.172.IN-ADDR.ARPA" { + type master; + file "empty"; +}; + +zone "168.192.IN-ADDR.ARPA" { + type master; + file "empty"; +}; + +empty: +@ 10800 IN SOA <name-of-server>. <contact-email>. ( + 1 3600 1200 604800 10800 ) +@ 10800 IN NS <name-of-server>.</programlisting> + </informalexample> + <note> + Future versions of named are likely to do this automatically. + </note> + </answer> + </qandaentry> + + </qandaset> +</article> |