Book review - DNSSEC Mastery

For the past few days, I've spent most of my reading time with a new book titled DNSSEC Mastery. The author of the book is Michael W. Lucas, again (from my not too long ago book review blog post, Absolute OpenBSD 2nd Edition). He's now one of my favorite tech book author, upgraded from "favorite blog author". The "upgrade" was done after reading another of his new book published by No Starch Press, Absolute OpenBSD 2nd Edition. This review is the result of my reading of DNSSEC Mastery. It may not be the whole truth, but at least this is what I've understand from it.

Here it goes:

FreeBSD - How to reduce TIME_WAIT connections

Routinely, I did a "netstat -an" on a FreeBSD box, a DNS server. The screen then shower with hundreds of "TIME_WAIT" connections. Seems like some malware infected clients are querying the server and causes the terminated TCP socket waiting to be shutdown, but not fast enough, to be efficient. Fortunately, the numbers of TIME_WAIT sockets accumulated are insignificant.

In order to reduce the number of socket waiting, tune the system value :

BIND - Error "loading from master file managed-keys.bind failed: file not found"

Platform :
FreeBSD

Error message :
Every time restarting the BIND DNS server, the log file will have this entry :

general: error: managed-keys-zone ./IN: loading from master file managed-keys.bind failed: file not found

BIND DNS continue to work though.

Solution :
Create a empty file in /var/named/etc/namedb, name "managed-keys.bind":

touch /var/named/etc/namedb/managed-keys.bind

Why :
The file "managed-keys.bind" is used for managing keys in DNSSEC. By default, BIND is looking for it. Even though you might not be using this feature, creating the file in empty will make the error message go away.


Sayonara !!!

BIND - name server error "the working directory is not writable"

Recently, there has been a few incident on vulnerabilities of DNS server being exploited. Fortunately, Bind have release patches soon enough for the rest of us to start covering up the loop holes.

After an upgrade or installations of ISC Bind DNS server 9.6 on a FreeBSD box, we will need to stop and start "named" service. As usual, running the below command will restart it :

/etc/rc.d/named stop
/etc/rc.d/named start

During the restart of the service, a few lines of text pops up saying that the permission of some directories in "/var/named" was altered. By default, the named files will need to be owner and group of "bind" in order for it to run properly. But the script in "/etc/rc.d/named" seems to change some directories ownership to "root" and group ownership to "wheel". This actually causes some errors reported in the log file :

Sep  3 02:44:26 nameserver named[9999]: the working directory is not writable

Naturally, we would issued the command :

chown -R bind:bind /var/name/etc

to fix the permission problem. But after another restart of "named" service using the command :

/etc/rc.d/named restart

the permission revert back to "root" and "wheel". This causes problem when the DNS server transfer zone files from the Master DNS server. The "named" service would not be able to write the latest zone info into the file in the directories "/var/named", then it would create some temporary files.

After some investigation, it seems like the ownership define in "/etc/mtree/BIND.chroot.dist" was set in this way. We will need to redefine the ownership of the directories so that it stop changing the directories ownership back to "root" whenever the "named" service is started so that "named" service owner, "bind" user, which runs the DNS server will be able to write the zones files in "/var/named".

DNS - how to add, create, edit and verify BIND DNS SRV resource record (RR) type

ISC BIND DNS SRV resource record type is rarely needed on a open source world, at least not as frequent as A, NS, MX, CNAME PTR and TXT resource record. After creating it in BIND DNS as the sample format below :

BIND error "permission denied"

Problem :
Error found in log file,

general: error: dumping master file: master/tmp-cFRWfFf7ah: open: permission denied

while doing a "rndc", "/etc/rc.d/named restart" or "/etc/init.d/named restart".


Solution :