Linux restart dns client

Как запустить или перезапустить BIND DNS сервис (Named)

Эту инструкцию я делаю как шпаргалку для себя на тему как запустить DNS-сервис BIND (он же Named), перезапустить или остановить его при необходимости. Надеюсь, что она сможет пригодиться и ещё кому-то.
BIND (Berkeley Internet Name Domain) — это открытая и очень популярная реализация DNS-сервера, которая обеспечивает выполнение преобразования DNS-имени в IP-адрес и наоборот. Она по праву считается самой первой системой ДНС и на сегодняшний день так же не теряет актуальность.

Для того, чтобы выполнять манипуляции с сервисом БИНД, необходимо зайти в систему с правами суперпользователя root. Вводим следующие команды:

Запуск DNS сервера Named

Эти базовые команды позволяют запустить сервис BIND из терминала Linux:

Остановка сервиса Named

Основные команды позволяют запустить сервис BIND из терминала Linux:

Как перезапустить BIND

Для того, чтобы перезагрузить Named и перезапустить сервис — выполните в консоли следующие команды:

Для того, чтобы посмотреть текущий статус работы DNS-сервера БИНД можно использовать такие команды:

Итак, мы с Вами рассмотрели самые основные команды для управления DNS-сервером Bind.

Источник

Linux: Start / Stop / Restart BIND DNS Server

Tutorial details
Difficulty level	Easy
Root privileges	Yes
Requirements	service command
Est. reading time	N/A

[a] service service-name command. [b] /etc/init.d/service-name script command. [c] rndc command – Name server control utility.

CentOS / RHEL / Fedora Linux

Type the following command to start BIND server:
# service named start
Type the following command to stop BIND server:
# service named stop
Type the following command to restart BIND server:
# service named restart
Type the following command to reload BIND server to reload zone file or config file changes:
# service named reload
Type the following command to see the current status of BIND server:
# service named status
You can also use the following syntax too:

Debian / Ubuntu Linux

Type the following command to start BIND server:
# service bind9 start
Type the following command to stop BIND server:
# service bind9 stop
Type the following command to restart BIND server:
# service bind9 restart
Type the following command to reload BIND server to reload zone file or config file changes:
# service bind9 reload
Type the following command to see the current status of BIND server:
# service bind9 status
Sample outputs:

Fig.01: BIND 9 Service In Action

A note about rncd command

This is an optional command and you are recommended to use the above commands only. From the rndc man page:

rndc controls the operation of a name server. It supersedes the ndc utility that was provided in old BIND releases. If rndc is invoked with no command line options or arguments, it prints a short summary of the supported commands and the available options and their arguments. rndc communicates with the name server over a TCP connection, sending commands authenticated with digital signatures. In the current versions of rndc and named, the only supported authentication algorithm is HMAC-MD5, which uses a shared secret on each end of the connection. This provides TSIG-style authentication for the command request and the name server’s response. All commands sent over the channel must be signed by a key_id known to the server. rndc reads a configuration file to determine how to contact the name server and decide what algorithm and key it should use.

• No ads and tracking
• In-depth guides for developers and sysadmins at Opensourceflare✨
• Join my Patreon to support independent content creators and start reading latest guides:
  • How to set up Redis sentinel cluster on Ubuntu or Debian Linux
  • How To Set Up SSH Keys With YubiKey as two-factor authentication (U2F/FIDO2)
  • How to set up Mariadb Galera cluster on Ubuntu or Debian Linux
  • A podman tutorial for beginners – part I (run Linux containers without Docker and in daemonless mode)
  • How to protect Linux against rogue USB devices using USBGuard

Join Patreon ➔

Please note that rndc does not yet support all the commands of the BIND 8 ndc utility:

1. status – Display status of the server.
2. stop – Save pending updates to master files and stop the server.
3. restart – Restart the server.
4. reload – Reload configuration file and zones.

To see status, enter:
# rndc status
Sample outputs:

To reload the server, enter:
# rndc reload
To see all options just type rncd:
# rndc
Sample outputs:

Источник

Domain Name Service (DNS)

Domain Name Service (DNS) is an Internet service that maps IP addresses and fully qualified domain names (FQDN) to one another. In this way, DNS alleviates the need to remember IP addresses. Computers that run DNS are called name servers. Ubuntu ships with BIND (Berkley Internet Naming Daemon), the most common program used for maintaining a name server on Linux.

Installation

At a terminal prompt, enter the following command to install dns:

A very useful package for testing and troubleshooting DNS issues is the dnsutils package. Very often these tools will be installed already, but to check and/or install dnsutils enter the following:

Configuration

There are many ways to configure BIND9. Some of the most common configurations are a caching nameserver, primary server, and secondary server.

When configured as a caching nameserver BIND9 will find the answer to name queries and remember the answer when the domain is queried again.

As a primary server, BIND9 reads the data for a zone from a file on its host and is authoritative for that zone.

As a secondary server, BIND9 gets the zone data from another nameserver that is authoritative for the zone.

Overview

The DNS configuration files are stored in the /etc/bind directory. The primary configuration file is /etc/bind/named.conf , which in the layout provided by the package just includes these files.

• /etc/bind/named.conf.options : global DNS options
• /etc/bind/named.conf.local : for your zones
• /etc/bind/named.conf.default-zones : default zones such as localhost, its reverse, and the root hints

The root nameservers used to be described in the file /etc/bind/db.root . This is now provided instead by the /usr/share/dns/root.hints file shipped with the dns-root-data package, and is referenced in the named.conf.default-zones configuration file above.

It is possible to configure the same server to be a caching name server, primary, and secondary: it all depends on the zones it is serving. A server can be the Start of Authority (SOA) for one zone, while providing secondary service for another zone. All the while providing caching services for hosts on the local LAN.

Caching Nameserver

The default configuration acts as a caching server. Simply uncomment and edit /etc/bind/named.conf.options to set the IP addresses of your ISP’s DNS servers:

Replace 1.2.3.4 and 5.6.7.8 with the IP Addresses of actual nameservers.

To enable the new configuration, restart the DNS server. From a terminal prompt:

See dig for information on testing a caching DNS server.

Primary Server

In this section BIND9 will be configured as the Primary server for the domain example.com . Simply replace example.com with your FQDN (Fully Qualified Domain Name).

Forward Zone File

To add a DNS zone to BIND9, turning BIND9 into a Primary server, first edit /etc/bind/named.conf.local :

If bind will be receiving automatic updates to the file as with DDNS, then use /var/lib/bind/db.example.com rather than /etc/bind/db.example.com both here and in the copy command below.

Now use an existing zone file as a template to create the /etc/bind/db.example.com file:

Edit the new zone file /etc/bind/db.example.com and change localhost. to the FQDN of your server, leaving the additional . at the end. Change 127.0.0.1 to the nameserver’s IP Address and root.localhost to a valid email address, but with a . instead of the usual @ symbol, again leaving the . at the end. Change the comment to indicate the domain that this file is for.

Create an A record for the base domain, example.com . Also, create an A record for ns.example.com , the name server in this example:

You must increment the Serial Number every time you make changes to the zone file. If you make multiple changes before restarting BIND9, simply increment the Serial once.

Now, you can add DNS records to the bottom of the zone file. See Common Record Types for details.

Many admins like to use the last date edited as the serial of a zone, such as 2020012100 which is yyyymmddss (where ss is the Serial Number)

Once you have made changes to the zone file BIND9 needs to be restarted for the changes to take effect:

Reverse Zone File

Now that the zone is setup and resolving names to IP Addresses, a Reverse zone needs to be added to allows DNS to resolve an address to a name.

Edit /etc/bind/named.conf.local and add the following:

Replace 1.168.192 with the first three octets of whatever network you are using. Also, name the zone file /etc/bind/db.192 appropriately. It should match the first octet of your network.

Now create the /etc/bind/db.192 file:

Next edit /etc/bind/db.192 changing the same options as /etc/bind/db.example.com :

The Serial Number in the Reverse zone needs to be incremented on each change as well. For each A record you configure in /etc/bind/db.example.com , that is for a different address, you need to create a PTR record in /etc/bind/db.192 .

After creating the reverse zone file restart BIND9:

Secondary Server

Once a Primary Server has been configured a Secondary Server is highly recommended in order to maintain the availability of the domain should the Primary become unavailable.

First, on the Primary server, the zone transfer needs to be allowed. Add the allow-transfer option to the example Forward and Reverse zone definitions in /etc/bind/named.conf.local :

Replace 192.168.1.11 with the IP Address of your Secondary nameserver.

Restart BIND9 on the Primary server:

Next, on the Secondary server, install the bind9 package the same way as on the Primary. Then edit the /etc/bind/named.conf.local and add the following declarations for the Forward and Reverse zones:

Replace 192.168.1.10 with the IP Address of your Primary nameserver.

Restart BIND9 on the Secondary server:

In /var/log/syslog you should see something similar to the following (some lines have been split to fit the format of this document):

Note: A zone is only transferred if the Serial Number on the Primary is larger than the one on the Secondary. If you want to have your Primary DNS notifying other Secondary DNS Servers of zone changes, you can add also-notify < ipaddress; >; to /etc/bind/named.conf.local as shown in the example below:

The default directory for non-authoritative zone files is /var/cache/bind/ . This directory is also configured in AppArmor to allow the named daemon to write to it. For more information on AppArmor see Security — AppArmor.

Troubleshooting

This section covers diagnosing problems with DNS and BIND9 configurations.

Testing

resolv.conf

The first step in testing BIND9 is to add the nameserver’s IP Address to a hosts resolver. The Primary nameserver should be configured as well as another host to double check things. Refer to DNS client configuration for details on adding nameserver addresses to your network clients. In the end your nameserver line in /etc/resolv.conf should be pointing at 127.0.0.53 and you should have a search parameter for your domain. Something like this:

To check which DNS server your local resolver is using, run:

You should also add the IP Address of the Secondary nameserver to your client configuration in case the Primary becomes unavailable.

If you installed the dnsutils package you can test your setup using the DNS lookup utility dig:

After installing BIND9 use dig against the loopback interface to make sure it is listening on port 53. From a terminal prompt:

You should see lines similar to the following in the command output:

If you have configured BIND9 as a Caching nameserver “dig” an outside domain to check the query time:

Note the query time toward the end of the command output:

After a second dig there should be improvement:

Now to demonstrate how applications make use of DNS to resolve a host name use the ping utility to send an ICMP echo request:

This tests if the nameserver can resolve the name ns.example.com to an IP Address. The command output should resemble:

named-checkzone

A great way to test your zone files is by using the named-checkzone utility installed with the bind9 package. This utility allows you to make sure the configuration is correct before restarting BIND9 and making the changes live.

To test our example Forward zone file enter the following from a command prompt:

If everything is configured correctly you should see output similar to:

Similarly, to test the Reverse zone file enter the following:

The output should be similar to:

The Serial Number of your zone file will probably be different.

Quick temporary query logging

With the rndc tool, you can quickly turn query logging on and off, without restarting the service or changing the configuration file.

To turn query logging on, run:

Likewise, to turn it off, run:

The logs will be sent to syslog and will show up in /var/log/syslog by default:

The amount of logs generated by enabling querylog could be huge!

Logging

BIND9 has a wide variety of logging configuration options available, but the two main ones are channel and category, which configure where logs go, and what information gets logged, respectively.

If no logging options are configured the default configuration is:

Let’s instead configure BIND9 to send debug messages related to DNS queries to a separate file.

We need to configure a channel to specify which file to send the messages to, and a category. In this example, the category will log all queries. Edit /etc/bind/named.conf.local and add the following:

The debug option can be set from 1 to 3. If a level isn’t specified, level 1 is the default.

Since the named daemon runs as the bind user the /var/log/named directory must be created and the ownership changed:

Now restart BIND9 for the changes to take effect:

You should see the file /var/log/named/query.log fill with query information. This is a simple example of the BIND9 logging options. For coverage of advanced options see More Information.

References

Common Record Types

This section covers some of the most common DNS record types.

A record: This record maps an IP Address to a hostname.

CNAME record: Used to create an alias to an existing A record. You cannot create a CNAME record pointing to another CNAME record.

MX record: Used to define where email should be sent to. Must point to an A record, not a CNAME .

NS record: Used to define which servers serve copies of a zone. It must point to an A record, not a CNAME . This is where Primary and Secondary servers are defined.

More Information

DNS and BIND is a popular book now in it’s fifth edition. There is now also a DNS and BIND on IPv6 book.

A great place to ask for BIND9 assistance, and get involved with the Ubuntu Server community, is the #ubuntu-server IRC channel on freenode.

Источник