bind9 f&q_PHP tutorial

This article is translated from an article on the BIND main website: http://www.isc.org/products/BIND/FAQ.html. It should be said that these problems are very typical and can provide considerable help to BIND 9 users in their daily maintenance and management.

1. Why does the -u parameter not work when I use the bind program compiled with the --enable-threads option on Linux 2.2.x?
Answer: Linux threads do not fully implement the Posix thread (pthreads) standard. In particular, setuid() can only work on the current thread, not the entire process. Because of this limitation, BIND 9 on Linux cannot use setuid() like it can on other supported system platforms. Setuid() cannot be called before the thread is created, because the server can only start listening to the reserved port after the thread is started.
For 2.2.18 or 2.3.99-pre3 and newer kernels, availability can still be maintained after calling setuid(). This allows BIND 9 to call setuid() earlier while maintaining the ability to bind to reserved ports. This is a special treatment for Linux.
On the 2.2 kernel, BIND 9 does give up many root privileges, so this will be more secure than root processes that do not give up privileges.
If Linux threads are already working normally, this restriction will no longer exist.
Users can use the --disable-threads option (this is the default option) to compile BIND9, which will generate a non-threaded version. Users can use the -u option.

2. Why is the warning message "no TTL specified - using SOA MINTTL instead" given in the named log?
Answer: Your zone file does not comply with the RFC1035 standard. You can use two methods to solve this problem:
1) Add a line defining TTL at the beginning of the zone file, for example: $TTL 86400
2) Include the TTL field in the first record of the zone file , for example: example.com. 86400 IN SOA ns hostmaster

3. Why do I see 5 (or more) named copies on Linux?
Answer: Each Linux thread will also be displayed like a process under ps. Generally, the number of running threads is n+4, where n represents the number of CPUs. Note that the amount of memory used does not follow the principle of accumulation; if each process uses 10M of memory, then all threads will only use a total of 10M of memory.

4. Why do I still get "permission denied" error logs when accessing configuration files or zone files even if I run BIND 9 as root on a Linux system?
A: On Linux, BIND 9 gives up most of the root permissions when it starts, including the permission to open files owned by other users. Therefore, if the server is running as root, the configuration files and zone files should also be owned by root.

5. Why do I get an error message similar to "dns_zone_load: zone foo/IN: loading master file bar: ran out of space"?
A: This is usually caused by a missing quote in the TXT record. Check that all TXT records contain complete quotes.

6. How can I generate a usable core file from multi-threaded named on Linux?
A: If the Linux kernel is 2.4.7 or newer, multi-threaded core export (dump) is available (that is, the correct threads will be exported). Otherwise, if you are using a 2.2 kernel, you need to apply the kernel patch in contrib/linux/coredump-patch and recompile the kernel. This patch enables multi-threaded programs to export the correct threads.

7. How can I restrict others from querying my server version?
Answer: Place the "version" option in the "options" section of named.conf, and set its value to a version different from the version you actually use. Note: Doing this will not prevent attacks, but may hinder others' attempts to diagnose problems with your server, and it may also become a sign for others to identify your server.

8. How can I restrict that only remote users can query the server version?
Answer: When the internal view that holds version information is last matched, the following view statement will intercept the query. The caveat in the answer to the previous question applies here as well.
view "chaos" chaos {
match-clients { ; };
allow-query { none; };
zone "." {
type hint;
file "/ dev/null"; // or any empty file
};
};

9. What does "no source of entropy found" or "could not open entropy source foo" mean?
A: Servers require a source of entropy to perform specific operations, usually related to DNSSEC. These information tips have no source of information entropy. On systems with /dev/random or similar devices, they are used by default. Information sources can also be defined through the random-device option in named.conf.

10. I installed BIND 9 and restarted named, but it is still BIND 8. Why is this?
Answer: BIND 9 is installed under /usr/local by default. BIND 8 is usually installed under /usr. Check if the correct named is running.

11. I try to use TSIG to verify dynamic updates or zone transfers. I'm sure the key settings are correct, but the server still refuses TSIG, why?
Answer: This may be an issue with the clock being inaccurate. Check whether the client's clock and the server's clock are synchronized (e.g. using ntp).

12. I tried to compile BIND 9, but "make" failed because some files could not be found. Why?
A: Using parallel or distributed "make" to compile BIND 9 is not supported and will not work. If you do use one of them, it is recommended that you use regular make or gmake instead.

13. I have a BIND 9 master server and a BIND 8.2.3 slave server, and the master server recorded something similar to "notify to 10.0.0.1#53 failed: unexpected end of input" error message. What's wrong?
A: This error message is caused by a known bug in BIND 8.2.3, which has been fixed in BIND 8.2.4. You can ignore it completely - notify is working normally regardless of the error message.

14. I keep getting the following log information. Why?
Dec 4 23:47:59 client 10.0.0.1#1355: updating zone example.com/IN: update failed: RRset exists (value dependent) prerequisite not satisfied (NXRRSET)
Answer: DNS updater allows updates Request a test to confirm that specific conditions are met before an update is made. The above information indicates that the conditions are not met and the update cannot continue. See doc/rfc/rfc2136.txt for more information on prerequisites.

15. I keep getting the following log information. Why?
Jun 21 12:00:00.000 client 10.0.0.1#1234: update denied
Answer: Someone is trying to use the RFC2136 dynamic update protocol to update your DNS data. Windows 2000 machines have the habit of sending dynamic update requests to the DNS server without prior configuration. If the update request is coming from a Windows 2000 machine, see to learn how to turn it off.

16. I saw the following log information. Why?
couldnt open pid file /var/run/named.pid: Permission denied
Answer: It is very likely that you are running named as a non-root user, and the user does not have write permissions for /var/run. The usual fix is ​​to create the /var/run/named directory owned by named user and set the pid file to "/var/run/named/named.pid", or set the pid file to "named.pid", which will The file is placed in the directory specified by the directory option (in this case, the directory must be writable by named user).

17. When I execute "dig . ns", many A records about the root server are lost. Why?
A: This is normal and nothing serious. There are some confusing side effects in the way BIND 9 implements RFC 2181's trust ranking and in BIND 9's efforts to prevent glue from entering answers.
When BIND 9 first starts and initializes its buffers, it receives root server addresses as additional data in the root server's authoritative response, and these records are eligible for inclusion in the response as additional data. It then receives a subset of the root server addresses as additional data in the root server's non-authoritative (recommended) response. This results in these addresses now being considered non-authoritative (relevant) data and they are not suitable for inclusion in responses.
Servers do always have a complete set of root server addresses as buffers, they just may not include all of them as additional data, depending on whether they last received a response or related data. You can usually find these addresses using an explicit query such as "dig a.root-servers.net A".

18. The zone transfer from the BIND 9 master server to the Windows 2000 slave server failed. Why?
A: This may be due to a bug in the Windows 2000 DNS server. On Windows machines, DNS messages larger than 16K cannot be processed correctly. This can be solved by setting the option "transfer-format one-answer;". You can also check to see if your zone contains embedded spaces or other special characters, such as "John2Doe3s2Computer", as these names are also known to cause Windows 2000 slave servers to incorrectly reject zones.

19. Why is my zone file not reloaded when I execute "rndc reload" or SIGHUP?
A: You can update the zone file by editing the zone file and rebooting the server, or you can do it through dynamic update, but you cannot use both methods at the same time. If you have used the "allow-update" option for a zone to activate dynamic updates, you can no longer manually edit the zone file, and the server will no longer attempt to reload the zone file.

20. I can query the domain name server on the domain name server, but I cannot find it from other machines. Why?
A: This is usually the result of a firewall configuration that blocks queries and/or responses.

21. How can I make the server serve as a slave server for both internal and external views? When I try to do this, two views on the slave server transfer the same view on the master server.
Answer: You should set multiple IP addresses for the master server and slave server. For example:
Main server: 10.0.1.1 (internal), 10.0.1.2 (external, IP alias)
internal:
match-clients { !10.0.1.2; !10.0.1.4; 10.0.1/24; };
notify-source 10.0.1.1;
transfer-source 10.0.1.1;
query-source address 10.0.1.1;
external:
match-clients { any; };
recursion no; // dont offer recursion to the world
notify-source 10.0.1.2;
transfer-source 10.0.1.2;
query-source address 10.0.1.2;
Slave server: 10.0.1.3 (internal), 10.0.1.4 (external, IP alias)
inte