summaryrefslogtreecommitdiffstats
path: root/contrib/bind/bin/named/named.conf
blob: d423b343df2c2146ea69dc99105a6a39fe2abe74 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
/*
 * This is a worthless, nonrunnable example of a named.conf file that has
 * every conceivable syntax element in use.  We use it to test the parser.
 * It could also be used as a conceptual template for users of new features.
 */

/*
 * C-style comments are OK
 */

// So are C++-style comments

# So are shell-style comments

// watch out for ";" -- it's important!

options {
	directory ".";			// use current directory
	named-xfer "/usr/libexec/named-xfer";	// _PATH_XFER
	dump-file "named_dump.db";  	// _PATH_DUMPFILE
	pid-file "/var/run/named.pid";  // _PATH_PIDFILE
	statistics-file "named.stats";  // _PATH_STATS
	memstatistics-file "named.memstats";	// _PATH_MEMSTATS
	check-names master fail;
	check-names slave warn;
	check-names response ignore;
	host-statistics no;
	deallocate-on-exit no;		// Painstakingly deallocate all
					// objects when exiting instead of
					// letting the OS clean up for us.
					// Useful a memory leak is suspected.
					// Final statistics are written to the
					// memstatistics-file.
	datasize default;
	stacksize default;
	coresize default;
	files unlimited;
	recursion yes;
	fetch-glue yes;
	fake-iquery no;
	notify yes;			// send NOTIFY messages.  You can set
					// notify on a zone-by-zone
					// basis in the "zone" statement
					// see (below)
	max-serial-queries 4;		// number of parallel SOA queries
					// we can have outstanding for master
					// zone change testing purposes
	auth-nxdomain yes;		// always set AA on NXDOMAIN.
					// don't set this to 'no' unless
					// you know what you're doing -- older
					// servers won't like it.
	multiple-cnames no;		// if yes, then a name my have more
					// than one CNAME RR.  This use
					// is non-standard and is not
					// recommended, but it is available
					// because previous releases supported
					// it and it was used by large sites
					// for load balancing.
	allow-query { any; };
	allow-transfer { any; };
	transfers-in 10;		// DEFAULT_XFERS_RUNNING, cannot be
					// set > than MAX_XFERS_RUNNING (20)
	transfers-per-ns 2;		// DEFAULT_XFERS_PER_NS
	transfers-out 0;		// not implemented
	max-transfer-time-in 120;	// MAX_XFER_TIME; the default number
					// of minutes an inbound zone transfer
					// may run.  May be set on a per-zone
					// basis.
	/*
	 * The "transfer-format" option specifies the way outbound zone
	 * transfers (i.e. from us to them) are formatted.  Two values are
	 * allowed:
	 *
	 *	one-answer		Each RR gets its own DNS message.
	 *				This format is not very efficient,
	 *				but is widely understood.  All
	 *				versions of BIND prior to 8.1 generate
	 *				this format for outbound zone 
	 *				and require it on inbound transfers.
	 *
	 *	many-answers		As many RRs as will fit are put into
	 *				each DNS message.  This format is
	 *				the most efficient, but is only known
	 *				to work with BIND 8.  Patches to
	 *				BIND 4.9.5 named-xfer that enable it
	 *				to understand 'many-answers' will be
	 *				available.
	 *
	 * If you are going to be doing zone transfers to older servers, you
	 * shouldn't use 'many-answers'.  'transfer-format' may also be set
	 * on a host-by-host basis using the 'server' statement (see below).
	 */
	transfer-format one-answer;
	query-source address * port *;
	/*
	 * The "forward" option is only meaningful if you've defined
	 * forwarders.  "first" gives the normal BIND
	 * forwarding behavior, i.e. ask the forwarders first, and if that
	 * doesn't work then do the full lookup.  You can also say
	 * "forward only;" which is what used to be specified with
	 * "slave" or "options forward-only".  "only" will never attempt
	 * a full lookup; only the forwarders will be used.
	 */
	forward first;
	forwarders { };			// default is no forwarders
	/*
	 * Here's a forwarders example that isn't trivial
	 */
	/*
	forwarders {
		1.2.3.4;
		5.6.7.8;
	};
	*/
	topology { localhost; localnets; };	// prefer local nameservers
	/*
	 * Here's a more complicated topology example; it's commented out
	 * because only one topology block is allowed.
	 *
	topology {
		10/8;			// prefer network 10.0.0.0
					// netmask 255.0.0.0 most
		!1.2.3/24;		// don't like 1.2.3.0 netmask
					// 255.255.255.0 at all
		{ 1.2/16; 3/8; };	// like 1.2.0.0 netmask 255.255.0.0
					// and 3.0.0.0 netmask 255.0.0.0
					// equally well, but less than 10/8
	};
	*/

	listen-on port 53 { any; };	// listen for queries on port 53 on
					// any interface on the system
					// (i.e. all interfaces).  The
					// "port 53" is optional; if you
					// don't specify a port, port 53
					// is assumed.
	/*
	 * Multiple listen-on statements are allowed.  Here's a more
	 * complicated example:
	 */
	/*
	listen-on { 5.6.7.8; };		// listen on port 53 on interface
					// 5.6.7.8
	listen-on port 1234 {		// listen on port 1234 on any
		!1.2.3.4;		// interface on network 1.2.3
		1.2.3/24;		// netmask 255.255.255.0, except for
	};				// interface 1.2.3.4.
	*/

	/*
	 * Interval Timers
	 */
	cleaning-interval 60;		// clean the cache of expired RRs
					// every 'cleaning-interval' minutes
	interface-interval 60;		// scan for new or deleted interfaces
					// every 'interface-interval' minutes
	statistics-interval 60;		// log statistics every 
					// 'statistics-interval' minutes
	/*
	 * IXFR options
     */
    maintain-ixfr-base no;   // If yes, keep transaction log file for IXFR
    max-ixfr-log-size 20;	 // Not implemented, maximum size the 
	                         // IXFR transaction log file to grow
};

/*
 * Control listeners, for "ndc".  Every nameserver needs at least one.
 */
controls {
	inet * port 52 allow { any; };			// a bad idea
	unix "/var/run/ndc" perm 0600 owner 0 group 0;	// the default
};

zone "master.demo.zone" {
	type master;			// what used to be called "primary" 
	file "master.demo.zone";
	check-names fail;
	allow-update { none; };
	allow-transfer { any; };
	allow-query { any; };
	// notify yes;			// send NOTIFY messages for this
					// zone?  The global option is used
					// if "notify" is not specified
					// here.
	also-notify { };		// don't notify any nameservers other
					// than those on the NS list for this
					// zone
};

zone "slave.demo.zone" {
	type slave;			// what used to be called "secondary" 
	file "slave.demo.zone";
	ixfr-base  "slave.demo.zone.ixfr";  // File name for IXFR transaction log file
	masters {
		1.2.3.4;		// where to zone transfer from
		5.6.7.8;
	};
	transfer-source 10.0.0.53;	// fixes multihoming problems
	check-names warn;
	allow-update { none; };
	allow-transfer { any; };
	allow-query { any; };
	max-transfer-time-in 120;	// if not set, global option is used.
	also-notify { };		// don't notify any nameservers other
					// than those on the NS list for this
					// zone
};

zone "stub.demo.zone" {
	type stub;			// stub zones are like slave zones,
					// except that only the NS records
					// are transferred.
	file "stub.demo.zone";
	masters {
		1.2.3.4;		// where to zone transfer from
		5.6.7.8;
	};
	check-names warn;
	allow-update { none; };
	allow-transfer { any; };
	allow-query { any; };
	max-transfer-time-in 120;	// if not set, global option is used.
};

zone "." {
	type hint;			// used to be specified w/ "cache"
	file "cache.db";	
	pubkey 257 255 1 "AQP2fHpZ4VMpKo/jc9Fod821uyfY5p8j5h/Am0V/KpBTMZjdXmp9QJe6yFRoIIzkaNCgTIftASdpXGgCwFB2j2KXP/rick6gvEer5VcDEkLR5Q==";
};

trusted-keys {                          
	. 257 255 1 "AQP2fHpZ4VMpKo/jc9Fod821uyfY5p8j5h/Am0V/KpBTMZjdXmp9QJe6yFRoIIzkaNCgTIftASdpXGgCwFB2j2KXP/rick6gvEer5VcDEkLR5Q==";
};       


acl can_query { !1.2.3/24; any; };	// network 1.2.3.0 mask 255.255.255.0
					// is disallowed; rest are OK
acl can_axfr { 1.2.3.4; can_query; };	// host 1.2.3.4 and any host allowed
					// by can_query are OK

zone "non-default-acl.demo.zone" {
	type master;
	file "foo";
	allow-query { can_query; };
	allow-transfer { can_axfr; };
	allow-update {
		1.2.3.4;
		5.6.7.8;
	};
};

key sample_key {			// for TSIG
	algorithm hmac-md5;		// hmac-md5 is the supported algorithm
	secret "abcdefgh";		// base 64 encoded secret
};

key key2 {
	algorithm hmac-md5;
	secret "87654321";
};

acl key_acl { key sample_key; };	// a request signed with sample_key

server 1.2.3.4 {
	bogus no;			// if yes, we won't query or listen
					// to this server
	transfer-format one-answer;	// set transfer format for this
					// server (see the description of
					// 'transfer-format' above)
					// if not specified, the global option
					// will be used
	transfers 0;			// not implemented
	keys { sample_key; key2; };	// for TSIG; sign requests to this
					// server with this key
	support-ixfr yes;      // for IXFR supported by server
					// if yes, the listed server talks IXFR 
};

logging {
	/*
	 * All log output goes to one or more "channels"; you can make as
	 * many of them as you want.
	 */

	channel syslog_errors {		// this channel will send errors or
		syslog user;		// or worse to syslog (user facility)
		severity error;
	};

	/*
	 * Channels have a severity level.  Messages at severity levels 
	 * greater than or equal to the channel's level will be logged on
	 * the channel.  In order of decreasing severity, the levels are:
	 *
	 * 	critical		a fatal error
	 *	error
	 *	warning			
	 *	notice			a normal, but significant event
	 *	info			an informational message
	 *	debug 1			the least detailed debugging info
	 *	...
	 *	debug 99		the most detailed debugging info
	 */

	/*
	 * Here are the built-in channels:
	 *
	 * 	channel default_syslog {
	 *		syslog daemon;
	 *		severity info;
	 *	};
	 *
	 *	channel default_debug {
	 *		file "named.run";	// note: stderr is used instead
	 *					// of "named.run" if the server
	 *					// is started with the "-f"
	 *					// option.
	 *		severity dynamic;	// this means log debugging
	 *					// at whatever debugging level
	 *					// the server is at, and don't
	 *					// log anything if not
	 *					// debugging.
	 *	};
	 *
	 *	channel null {			// this is the bit bucket;
	 *		file "/dev/null";	// any logging to this channel
	 *					// is discarded.
	 *	};
	 *
	 *	channel default_stderr {	// writes to stderr
	 *		file "<stderr>";	// this is illustrative only;
	 *					// there's currently no way
	 *					// of saying "stderr" in the
	 *					// configuration language.
	 *					// i.e. don't try this at home.
	 *		severity info;
	 *	};
	 *
	 *	default_stderr only works before the server daemonizes (i.e.
	 *	during initial startup) or when it is running in foreground
	 *	mode (-f command line option).
	 */

	/*
	 * There are many categories, so you can send the logs
	 * you want to see wherever you want, without seeing logs you
	 * don't want.  Right now the categories are
	 *
	 *	default			the catch-all.  many things still
	 *				aren't classified into categories, and
	 *				they all end up here.  also, if you
	 *				don't specify any channels for a
	 *				category, the default category is used
	 *				instead.
	 *	config			high-level configuration file
	 *				processing
	 *	parser			low-level configuration file processing
	 *	queries			what used to be called "query logging"
	 *	lame-servers		messages like "Lame server on ..."
	 *	statistics
	 *	panic			if the server has to shut itself
	 *				down due to an internal problem, it
	 *				logs the problem here (as well as
	 *				in the problem's native category)
	 *	update			dynamic update
	 *	ncache			negative caching
	 *	xfer-in			zone transfers we're receiving
	 *	xfer-out		zone transfers we're sending
	 *	db			all database operations
	 *	eventlib		debugging info from the event system
	 *				(see below)
	 *	packet			dumps of packets received and sent
	 *				(see below)
	 *	notify			the NOTIFY protocol
	 *	cname			messages like "XX points to a CNAME"
	 *	security		approved/unapproved requests
	 *	os			operating system problems
	 *	insist			consistency check failures
	 *	maintenance		periodic maintenance
	 *	load			zone loading
	 *	response-checks		messages like
	 *				"Malformed response ..."
	 *				"wrong ans. name ..."
	 *				"unrelated additional info ..."
	 *				"invalid RR type ..."
	 *				"bad referral ..."
	 */

	category parser {
		syslog_errors;		// you can log to as many channels
		default_syslog;		// as you want
	};

	category lame-servers { null; };	// don't log these at all

	channel moderate_debug {			
		severity debug 3;		// level 3 debugging to file
		file "foo";			// foo
		print-time yes;			// timestamp log entries
		print-category yes;		// print category name
		print-severity yes;		// print severity level
		/*
		 * Note that debugging must have been turned on either
		 * on the command line or with a signal to get debugging
		 * output (non-debugging output will still be written to
		 * this channel).
		 */
	};

	/*
	 * If you don't want to see "zone XXXX loaded" messages but do
	 * want to see any problems, you could do the following.
	 */
	channel no_info_messages {
		syslog;
		severity notice;
	};

	category load { no_info_messages; };

	/*
	 * You can also define category "default"; it gets used when no
	 * "category" statement has been given for a category.
	 */
	category default {
		default_syslog;
		moderate_debug;
	};

	/*
	 * If you don't define category default yourself, the default
	 * default category will be used.  It is
	 *
	 * 	category default { default_syslog; default_debug; };
	 */

	/*
	 * If you don't define category panic yourself, the default
	 * panic category will be used.  It is
	 *
	 * 	category panic { default_syslog; default_stderr; };
	 */

	/*
	 * Two categories, 'packet' and 'eventlib', are special.  Only one
	 * channel may be assigned to each of them, and it must be a
	 * file channel.  If you don't define them  yourself, they default to
	 *
 	 *	category eventlib { default_debug; };
	 *
	 *	category packet { default_debug; };
	 */
};

include "filename";			// can't do within a statement
OpenPOWER on IntegriCloud