From 42463f754f01d38e2e78fab5e9f53a85d17dab4d Mon Sep 17 00:00:00 2001 From: root Date: Fri, 9 Nov 2018 12:43:42 +0100 Subject: [PATCH] committing changes in /etc after apt run Package changes: +bind9 1:9.11.3+dfsg-1ubuntu1.2 amd64 +bind9utils 1:9.11.3+dfsg-1ubuntu1.2 amd64 +python3-ply 3.11-1 all --- .etckeeper | 31 ++++ apparmor.d/local/usr.sbin.named | 0 apparmor.d/usr.sbin.named | 70 +++++++++ bind/bind.keys | 50 ++++++ bind/db.0 | 12 ++ bind/db.127 | 13 ++ bind/db.255 | 12 ++ bind/db.empty | 14 ++ bind/db.local | 14 ++ bind/db.root | 90 +++++++++++ bind/named.conf | 11 ++ bind/named.conf.default-zones | 30 ++++ bind/named.conf.local | 8 + bind/named.conf.options | 26 ++++ bind/rndc.key | 4 + bind/zones.rfc1918 | 20 +++ default/bind9 | 6 + group | 1 + group- | 2 +- gshadow | 1 + gshadow- | 2 +- init.d/bind9 | 145 ++++++++++++++++++ insserv.conf.d/bind9 | 1 + network/if-down.d/bind9 | 15 ++ network/if-up.d/bind9 | 15 ++ passwd | 1 + passwd- | 1 + ppp/ip-down.d/bind9 | 15 ++ ppp/ip-up.d/bind9 | 15 ++ rc0.d/K01bind9 | 1 + rc1.d/K01bind9 | 1 + rc2.d/S01bind9 | 1 + rc3.d/S01bind9 | 1 + rc4.d/S01bind9 | 1 + rc5.d/S01bind9 | 1 + rc6.d/K01bind9 | 1 + shadow | 1 + shadow- | 1 + .../multi-user.target.wants/bind9.service | 1 + ufw/applications.d/bind9 | 5 + 40 files changed, 638 insertions(+), 2 deletions(-) create mode 100644 apparmor.d/local/usr.sbin.named create mode 100644 apparmor.d/usr.sbin.named create mode 100644 bind/bind.keys create mode 100644 bind/db.0 create mode 100644 bind/db.127 create mode 100644 bind/db.255 create mode 100644 bind/db.empty create mode 100644 bind/db.local create mode 100644 bind/db.root create mode 100644 bind/named.conf create mode 100644 bind/named.conf.default-zones create mode 100644 bind/named.conf.local create mode 100644 bind/named.conf.options create mode 100644 bind/rndc.key create mode 100644 bind/zones.rfc1918 create mode 100644 default/bind9 create mode 100755 init.d/bind9 create mode 100644 insserv.conf.d/bind9 create mode 100755 network/if-down.d/bind9 create mode 100755 network/if-up.d/bind9 create mode 100755 ppp/ip-down.d/bind9 create mode 100755 ppp/ip-up.d/bind9 create mode 120000 rc0.d/K01bind9 create mode 120000 rc1.d/K01bind9 create mode 120000 rc2.d/S01bind9 create mode 120000 rc3.d/S01bind9 create mode 120000 rc4.d/S01bind9 create mode 120000 rc5.d/S01bind9 create mode 120000 rc6.d/K01bind9 create mode 120000 systemd/system/multi-user.target.wants/bind9.service create mode 100644 ufw/applications.d/bind9 diff --git a/.etckeeper b/.etckeeper index 81ed76177..18c9147e1 100755 --- a/.etckeeper +++ b/.etckeeper @@ -382,6 +382,7 @@ maybe chmod 0644 'apparmor.d/local/README' maybe chmod 0644 'apparmor.d/local/sbin.dhclient' maybe chmod 0644 'apparmor.d/local/usr.bin.man' maybe chmod 0644 'apparmor.d/local/usr.sbin.mysqld' +maybe chmod 0644 'apparmor.d/local/usr.sbin.named' maybe chmod 0644 'apparmor.d/local/usr.sbin.rsyslogd' maybe chmod 0644 'apparmor.d/local/usr.sbin.tcpdump' maybe chmod 0644 'apparmor.d/sbin.dhclient' @@ -406,6 +407,7 @@ maybe chmod 0755 'apparmor.d/tunables/xdg-user-dirs.d' maybe chmod 0644 'apparmor.d/tunables/xdg-user-dirs.d/site.local' maybe chmod 0644 'apparmor.d/usr.bin.man' maybe chmod 0644 'apparmor.d/usr.sbin.mysqld' +maybe chmod 0644 'apparmor.d/usr.sbin.named' maybe chmod 0644 'apparmor.d/usr.sbin.rsyslogd' maybe chmod 0644 'apparmor.d/usr.sbin.tcpdump' maybe chmod 0755 'apparmor/init' @@ -437,6 +439,27 @@ maybe chmod 0755 'bash_completion.d' maybe chmod 0644 'bash_completion.d/fail2ban' maybe chmod 0644 'bash_completion.d/git-prompt' maybe chmod 0644 'bash_completion.d/grub' +maybe chgrp 'bind' 'bind' +maybe chmod 2755 'bind' +maybe chmod 0644 'bind/bind.keys' +maybe chmod 0644 'bind/db.0' +maybe chmod 0644 'bind/db.127' +maybe chmod 0644 'bind/db.255' +maybe chmod 0644 'bind/db.empty' +maybe chmod 0644 'bind/db.local' +maybe chmod 0644 'bind/db.root' +maybe chgrp 'bind' 'bind/named.conf' +maybe chmod 0644 'bind/named.conf' +maybe chgrp 'bind' 'bind/named.conf.default-zones' +maybe chmod 0644 'bind/named.conf.default-zones' +maybe chgrp 'bind' 'bind/named.conf.local' +maybe chmod 0644 'bind/named.conf.local' +maybe chgrp 'bind' 'bind/named.conf.options' +maybe chmod 0644 'bind/named.conf.options' +maybe chown 'bind' 'bind/rndc.key' +maybe chgrp 'bind' 'bind/rndc.key' +maybe chmod 0640 'bind/rndc.key' +maybe chmod 0644 'bind/zones.rfc1918' maybe chmod 0644 'bindresvport.blacklist' maybe chmod 0755 'binfmt.d' maybe chmod 0755 'ca-certificates' @@ -536,6 +559,7 @@ maybe chmod 0644 'default/amavisd-milter' maybe chmod 0644 'default/amavisd-snmp-subagent' maybe chmod 0644 'default/amd64-microcode' maybe chmod 0644 'default/apache-htcacheclean' +maybe chmod 0644 'default/bind9' maybe chmod 0644 'default/bsdmainutils' maybe chmod 0644 'default/console-setup' maybe chmod 0644 'default/crda' @@ -903,6 +927,7 @@ maybe chmod 0755 'init.d/amavisd-snmp-subagent' maybe chmod 0755 'init.d/apache-htcacheclean' maybe chmod 0755 'init.d/apache2' maybe chmod 0755 'init.d/apparmor' +maybe chmod 0755 'init.d/bind9' maybe chmod 0755 'init.d/console-setup.sh' maybe chmod 0755 'init.d/cron' maybe chmod 0755 'init.d/dbus' @@ -950,6 +975,7 @@ maybe chmod 0755 'initramfs-tools/scripts/panic' maybe chmod 0644 'initramfs-tools/update-initramfs.conf' maybe chmod 0644 'inputrc' maybe chmod 0755 'insserv.conf.d' +maybe chmod 0644 'insserv.conf.d/bind9' maybe chmod 0644 'insserv.conf.d/postfix' maybe chmod 0755 'iproute2' maybe chmod 0644 'iproute2/bpf_pinning' @@ -1256,8 +1282,10 @@ maybe chmod 0755 'netplan' maybe chmod 0644 'netplan/01-netcfg.yaml' maybe chmod 0755 'network' maybe chmod 0755 'network/if-down.d' +maybe chmod 0755 'network/if-down.d/bind9' maybe chmod 0755 'network/if-down.d/postfix' maybe chmod 0755 'network/if-up.d' +maybe chmod 0755 'network/if-up.d/bind9' maybe chmod 0755 'network/if-up.d/openssh-server' maybe chmod 0755 'network/if-up.d/postfix' maybe chmod 0644 'network/interfaces' @@ -1396,8 +1424,10 @@ maybe chmod 0644 'postfix/without_ptr' maybe chmod 0644 'postfix/without_ptr.db' maybe chmod 0755 'ppp' maybe chmod 0755 'ppp/ip-down.d' +maybe chmod 0755 'ppp/ip-down.d/bind9' maybe chmod 0755 'ppp/ip-down.d/postfix' maybe chmod 0755 'ppp/ip-up.d' +maybe chmod 0755 'ppp/ip-up.d/bind9' maybe chmod 0755 'ppp/ip-up.d/postfix' maybe chmod 0644 'profile' maybe chmod 0755 'profile.d' @@ -1559,6 +1589,7 @@ maybe chmod 0640 'ufw/after6.rules' maybe chmod 0755 'ufw/applications.d' maybe chmod 0755 'ufw/applications.d/apache2' maybe chmod 0644 'ufw/applications.d/apache2-utils.ufw.profile' +maybe chmod 0644 'ufw/applications.d/bind9' maybe chmod 0644 'ufw/applications.d/dovecot-imapd' maybe chmod 0644 'ufw/applications.d/openssh-server' maybe chmod 0644 'ufw/applications.d/postfix' diff --git a/apparmor.d/local/usr.sbin.named b/apparmor.d/local/usr.sbin.named new file mode 100644 index 000000000..e69de29bb diff --git a/apparmor.d/usr.sbin.named b/apparmor.d/usr.sbin.named new file mode 100644 index 000000000..4d94706a5 --- /dev/null +++ b/apparmor.d/usr.sbin.named @@ -0,0 +1,70 @@ +# vim:syntax=apparmor +# Last Modified: Fri Jun 1 16:43:22 2007 +#include + +/usr/sbin/named flags=(attach_disconnected) { + #include + #include + + capability net_bind_service, + capability setgid, + capability setuid, + capability sys_chroot, + capability sys_resource, + + # /etc/bind should be read-only for bind + # /var/lib/bind is for dynamically updated zone (and journal) files. + # /var/cache/bind is for slave/stub data, since we're not the origin of it. + # See /usr/share/doc/bind9/README.Debian.gz + /etc/bind/** r, + /var/lib/bind/** rw, + /var/lib/bind/ rw, + /var/cache/bind/** lrw, + /var/cache/bind/ rw, + + # gssapi + /etc/krb5.keytab kr, + /etc/bind/krb5.keytab kr, + + # ssl + /etc/ssl/openssl.cnf r, + + # GeoIP data files for GeoIP ACLs + /usr/share/GeoIP/** r, + + # dnscvsutil package + /var/lib/dnscvsutil/compiled/** rw, + + # Allow changing worker thread names + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + + @{PROC}/net/if_inet6 r, + @{PROC}/*/net/if_inet6 r, + @{PROC}/sys/net/ipv4/ip_local_port_range r, + /usr/sbin/named mr, + /{,var/}run/named/named.pid w, + /{,var/}run/named/session.key w, + # support for resolvconf + /{,var/}run/named/named.options r, + + # some people like to put logs in /var/log/named/ instead of having + # syslog do the heavy lifting. + /var/log/named/** rw, + /var/log/named/ rw, + + # gssapi + /var/lib/sss/pubconf/krb5.include.d/** r, + /var/lib/sss/pubconf/krb5.include.d/ r, + /var/lib/sss/mc/initgroups r, + /etc/gss/mech.d/ r, + + # ldap + /etc/ldap/ldap.conf r, + /{,var/}run/slapd-*.socket rw, + + # dynamic updates + /var/tmp/DNS_* rw, + + # Site-specific additions and overrides. See local/README for details. + #include +} diff --git a/bind/bind.keys b/bind/bind.keys new file mode 100644 index 000000000..5e5a32ba9 --- /dev/null +++ b/bind/bind.keys @@ -0,0 +1,50 @@ +# The bind.keys file is used to override the built-in DNSSEC trust anchors +# which are included as part of BIND 9. The only trust anchors it contains +# are for the DNS root zone ("."). Trust anchors for any other zones MUST +# be configured elsewhere; if they are configured here, they will not be +# recognized or used by named. +# +# The built-in trust anchors are provided for convenience of configuration. +# They are not activated within named.conf unless specifically switched on. +# To use the built-in key, use "dnssec-validation auto;" in the +# named.conf options. Without this option being set, the keys in this +# file are ignored. +# +# This file is NOT expected to be user-configured. +# +# These keys are current as of October 2017. If any key fails to +# initialize correctly, it may have expired. In that event you should +# replace this file with a current version. The latest version of +# bind.keys can always be obtained from ISC at https://www.isc.org/bind-keys. +# +# See https://data.iana.org/root-anchors/root-anchors.xml +# for current trust anchor information for the root zone. + +managed-keys { + # This key (19036) is to be phased out starting in 2017. It will + # remain in the root zone for some time after its successor key + # has been added. It will remain this file until it is removed from + # the root zone. + . initial-key 257 3 8 "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF + FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX + bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD + X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz + W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS + Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq + QxA+Uk1ihz0="; + + # This key (20326) was published in the root zone in 2017. + # Servers which were already using the old key (19036) should + # roll seamlessly to this new one via RFC 5011 rollover. Servers + # being set up for the first time can use the contents of this + # file as initializing keys; thereafter, the keys in the + # managed key database will be trusted and maintained + # automatically. + . initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3 + +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv + ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF + 0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e + oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd + RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN + R1AkUTV74bU="; +}; diff --git a/bind/db.0 b/bind/db.0 new file mode 100644 index 000000000..e3aabdbee --- /dev/null +++ b/bind/db.0 @@ -0,0 +1,12 @@ +; +; BIND reverse data file for broadcast zone +; +$TTL 604800 +@ IN SOA localhost. root.localhost. ( + 1 ; Serial + 604800 ; Refresh + 86400 ; Retry + 2419200 ; Expire + 604800 ) ; Negative Cache TTL +; +@ IN NS localhost. diff --git a/bind/db.127 b/bind/db.127 new file mode 100644 index 000000000..cd05bef14 --- /dev/null +++ b/bind/db.127 @@ -0,0 +1,13 @@ +; +; BIND reverse data file for local loopback interface +; +$TTL 604800 +@ IN SOA localhost. root.localhost. ( + 1 ; Serial + 604800 ; Refresh + 86400 ; Retry + 2419200 ; Expire + 604800 ) ; Negative Cache TTL +; +@ IN NS localhost. +1.0.0 IN PTR localhost. diff --git a/bind/db.255 b/bind/db.255 new file mode 100644 index 000000000..e3aabdbee --- /dev/null +++ b/bind/db.255 @@ -0,0 +1,12 @@ +; +; BIND reverse data file for broadcast zone +; +$TTL 604800 +@ IN SOA localhost. root.localhost. ( + 1 ; Serial + 604800 ; Refresh + 86400 ; Retry + 2419200 ; Expire + 604800 ) ; Negative Cache TTL +; +@ IN NS localhost. diff --git a/bind/db.empty b/bind/db.empty new file mode 100644 index 000000000..8a128589a --- /dev/null +++ b/bind/db.empty @@ -0,0 +1,14 @@ +; BIND reverse data file for empty rfc1918 zone +; +; DO NOT EDIT THIS FILE - it is used for multiple zones. +; Instead, copy it, edit named.conf, and use that copy. +; +$TTL 86400 +@ IN SOA localhost. root.localhost. ( + 1 ; Serial + 604800 ; Refresh + 86400 ; Retry + 2419200 ; Expire + 86400 ) ; Negative Cache TTL +; +@ IN NS localhost. diff --git a/bind/db.local b/bind/db.local new file mode 100644 index 000000000..2f272d408 --- /dev/null +++ b/bind/db.local @@ -0,0 +1,14 @@ +; +; BIND data file for local loopback interface +; +$TTL 604800 +@ IN SOA localhost. root.localhost. ( + 2 ; Serial + 604800 ; Refresh + 86400 ; Retry + 2419200 ; Expire + 604800 ) ; Negative Cache TTL +; +@ IN NS localhost. +@ IN A 127.0.0.1 +@ IN AAAA ::1 diff --git a/bind/db.root b/bind/db.root new file mode 100644 index 000000000..f0b79d2af --- /dev/null +++ b/bind/db.root @@ -0,0 +1,90 @@ +; This file holds the information on root name servers needed to +; initialize cache of Internet domain name servers +; (e.g. reference this file in the "cache . " +; configuration file of BIND domain name servers). +; +; This file is made available by InterNIC +; under anonymous FTP as +; file /domain/named.cache +; on server FTP.INTERNIC.NET +; -OR- RS.INTERNIC.NET +; +; last update: February 17, 2016 +; related version of root zone: 2016021701 +; +; formerly NS.INTERNIC.NET +; +. 3600000 NS A.ROOT-SERVERS.NET. +A.ROOT-SERVERS.NET. 3600000 A 198.41.0.4 +A.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:ba3e::2:30 +; +; FORMERLY NS1.ISI.EDU +; +. 3600000 NS B.ROOT-SERVERS.NET. +B.ROOT-SERVERS.NET. 3600000 A 192.228.79.201 +B.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:84::b +; +; FORMERLY C.PSI.NET +; +. 3600000 NS C.ROOT-SERVERS.NET. +C.ROOT-SERVERS.NET. 3600000 A 192.33.4.12 +C.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2::c +; +; FORMERLY TERP.UMD.EDU +; +. 3600000 NS D.ROOT-SERVERS.NET. +D.ROOT-SERVERS.NET. 3600000 A 199.7.91.13 +D.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2d::d +; +; FORMERLY NS.NASA.GOV +; +. 3600000 NS E.ROOT-SERVERS.NET. +E.ROOT-SERVERS.NET. 3600000 A 192.203.230.10 +; +; FORMERLY NS.ISC.ORG +; +. 3600000 NS F.ROOT-SERVERS.NET. +F.ROOT-SERVERS.NET. 3600000 A 192.5.5.241 +F.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2f::f +; +; FORMERLY NS.NIC.DDN.MIL +; +. 3600000 NS G.ROOT-SERVERS.NET. +G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4 +; +; FORMERLY AOS.ARL.ARMY.MIL +; +. 3600000 NS H.ROOT-SERVERS.NET. +H.ROOT-SERVERS.NET. 3600000 A 198.97.190.53 +H.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:1::53 +; +; FORMERLY NIC.NORDU.NET +; +. 3600000 NS I.ROOT-SERVERS.NET. +I.ROOT-SERVERS.NET. 3600000 A 192.36.148.17 +I.ROOT-SERVERS.NET. 3600000 AAAA 2001:7fe::53 +; +; OPERATED BY VERISIGN, INC. +; +. 3600000 NS J.ROOT-SERVERS.NET. +J.ROOT-SERVERS.NET. 3600000 A 192.58.128.30 +J.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:c27::2:30 +; +; OPERATED BY RIPE NCC +; +. 3600000 NS K.ROOT-SERVERS.NET. +K.ROOT-SERVERS.NET. 3600000 A 193.0.14.129 +K.ROOT-SERVERS.NET. 3600000 AAAA 2001:7fd::1 +; +; OPERATED BY ICANN +; +. 3600000 NS L.ROOT-SERVERS.NET. +L.ROOT-SERVERS.NET. 3600000 A 199.7.83.42 +L.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:3::42 +; +; OPERATED BY WIDE +; +. 3600000 NS M.ROOT-SERVERS.NET. +M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33 +M.ROOT-SERVERS.NET. 3600000 AAAA 2001:dc3::35 +; End of file diff --git a/bind/named.conf b/bind/named.conf new file mode 100644 index 000000000..880786afd --- /dev/null +++ b/bind/named.conf @@ -0,0 +1,11 @@ +// This is the primary configuration file for the BIND DNS server named. +// +// Please read /usr/share/doc/bind9/README.Debian.gz for information on the +// structure of BIND configuration files in Debian, *BEFORE* you customize +// this configuration file. +// +// If you are just adding zones, please do that in /etc/bind/named.conf.local + +include "/etc/bind/named.conf.options"; +include "/etc/bind/named.conf.local"; +include "/etc/bind/named.conf.default-zones"; diff --git a/bind/named.conf.default-zones b/bind/named.conf.default-zones new file mode 100644 index 000000000..355338bda --- /dev/null +++ b/bind/named.conf.default-zones @@ -0,0 +1,30 @@ +// prime the server with knowledge of the root servers +zone "." { + type hint; + file "/etc/bind/db.root"; +}; + +// be authoritative for the localhost forward and reverse zones, and for +// broadcast zones as per RFC 1912 + +zone "localhost" { + type master; + file "/etc/bind/db.local"; +}; + +zone "127.in-addr.arpa" { + type master; + file "/etc/bind/db.127"; +}; + +zone "0.in-addr.arpa" { + type master; + file "/etc/bind/db.0"; +}; + +zone "255.in-addr.arpa" { + type master; + file "/etc/bind/db.255"; +}; + + diff --git a/bind/named.conf.local b/bind/named.conf.local new file mode 100644 index 000000000..7a57b1019 --- /dev/null +++ b/bind/named.conf.local @@ -0,0 +1,8 @@ +// +// Do any local configuration here +// + +// Consider adding the 1918 zones here, if they are not used in your +// organization +//include "/etc/bind/zones.rfc1918"; + diff --git a/bind/named.conf.options b/bind/named.conf.options new file mode 100644 index 000000000..b1bef512a --- /dev/null +++ b/bind/named.conf.options @@ -0,0 +1,26 @@ +options { + directory "/var/cache/bind"; + + // If there is a firewall between you and nameservers you want + // to talk to, you may need to fix the firewall to allow multiple + // ports to talk. See http://www.kb.cert.org/vuls/id/800113 + + // If your ISP provided one or more IP addresses for stable + // nameservers, you probably want to use them as forwarders. + // Uncomment the following block, and insert the addresses replacing + // the all-0's placeholder. + + // forwarders { + // 0.0.0.0; + // }; + + //======================================================================== + // If BIND logs error messages about the root key being expired, + // you will need to update your keys. See https://www.isc.org/bind-keys + //======================================================================== + dnssec-validation auto; + + auth-nxdomain no; # conform to RFC1035 + listen-on-v6 { any; }; +}; + diff --git a/bind/rndc.key b/bind/rndc.key new file mode 100644 index 000000000..3d9839a0d --- /dev/null +++ b/bind/rndc.key @@ -0,0 +1,4 @@ +key "rndc-key" { + algorithm hmac-md5; + secret "R3tBQ/HutMOMhqxY3mUVfA=="; +}; diff --git a/bind/zones.rfc1918 b/bind/zones.rfc1918 new file mode 100644 index 000000000..03b554629 --- /dev/null +++ b/bind/zones.rfc1918 @@ -0,0 +1,20 @@ +zone "10.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; + +zone "16.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "17.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "18.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "19.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "20.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "21.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "22.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "23.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "24.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "25.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "26.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "27.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "28.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "29.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "30.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "31.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; + +zone "168.192.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; diff --git a/default/bind9 b/default/bind9 new file mode 100644 index 000000000..66352f0a0 --- /dev/null +++ b/default/bind9 @@ -0,0 +1,6 @@ +# +# run resolvconf? +RESOLVCONF=no + +# startup options for the server +OPTIONS="-u bind" diff --git a/group b/group index 39fc0dbbe..4092d277e 100644 --- a/group +++ b/group @@ -59,3 +59,4 @@ dovenull:x:118: opendkim:x:119:postfix amavis:x:120:postfix debian-spamd:x:121: +bind:x:122: diff --git a/group- b/group- index c24f5e64e..39fc0dbbe 100644 --- a/group- +++ b/group- @@ -57,5 +57,5 @@ vmail:x:1000: dovecot:x:117: dovenull:x:118: opendkim:x:119:postfix -amavis:x:120: +amavis:x:120:postfix debian-spamd:x:121: diff --git a/gshadow b/gshadow index dcc90f6cc..948f7c5f6 100644 --- a/gshadow +++ b/gshadow @@ -59,3 +59,4 @@ dovenull:!:: opendkim:!::postfix amavis:!::postfix debian-spamd:!:: +bind:!:: diff --git a/gshadow- b/gshadow- index f2f220273..dcc90f6cc 100644 --- a/gshadow- +++ b/gshadow- @@ -57,5 +57,5 @@ vmail:!:: dovecot:!:: dovenull:!:: opendkim:!::postfix -amavis:!:: +amavis:!::postfix debian-spamd:!:: diff --git a/init.d/bind9 b/init.d/bind9 new file mode 100755 index 000000000..59d8e3dc4 --- /dev/null +++ b/init.d/bind9 @@ -0,0 +1,145 @@ +#!/bin/sh -e + +### BEGIN INIT INFO +# Provides: bind9 +# Required-Start: $remote_fs +# Required-Stop: $remote_fs +# Should-Start: $network $syslog +# Should-Stop: $network $syslog +# Default-Start: 2 3 4 5 +# Default-Stop: 0 1 6 +# Short-Description: Start and stop bind9 +# Description: bind9 is a Domain Name Server (DNS) +# which translates ip addresses to and from internet names +### END INIT INFO + +PATH=/sbin:/bin:/usr/sbin:/usr/bin + +# for a chrooted server: "-u bind -t /var/lib/named" +# Don't modify this line, change or create /etc/default/bind9. +OPTIONS="" +RESOLVCONF=no + +test -f /etc/default/bind9 && . /etc/default/bind9 + +test -x /usr/sbin/rndc || exit 0 + +. /lib/lsb/init-functions +PIDFILE=/run/named/named.pid + +check_network() { + if [ -x /usr/bin/uname ] && [ "X$(/usr/bin/uname -o)" = XSolaris ]; then + IFCONFIG_OPTS="-au" + else + IFCONFIG_OPTS="" + fi + if [ -z "$(/sbin/ifconfig $IFCONFIG_OPTS)" ]; then + #log_action_msg "No networks configured." + return 1 + fi + return 0 +} + +case "$1" in + start) + log_daemon_msg "Starting domain name service..." "bind9" + + modprobe capability >/dev/null 2>&1 || true + + # dirs under /run can go away on reboots. + mkdir -p /run/named + chmod 775 /run/named + chown root:bind /run/named >/dev/null 2>&1 || true + + if [ ! -x /usr/sbin/named ]; then + log_action_msg "named binary missing - not starting" + log_end_msg 1 + fi + + if ! check_network; then + log_action_msg "no networks configured" + log_end_msg 1 + fi + + if start-stop-daemon --start --oknodo --quiet --exec /usr/sbin/named \ + --pidfile ${PIDFILE} -- $OPTIONS; then + if [ "X$RESOLVCONF" != "Xno" ] && [ -x /sbin/resolvconf ] ; then + echo "nameserver 127.0.0.1" | /sbin/resolvconf -a lo.named + fi + log_end_msg 0 + else + log_end_msg 1 + fi + ;; + + stop) + log_daemon_msg "Stopping domain name service..." "bind9" + if ! check_network; then + log_action_msg "no networks configured" + log_end_msg 1 + fi + + if [ "X$RESOLVCONF" != "Xno" ] && [ -x /sbin/resolvconf ] ; then + /sbin/resolvconf -d lo.named + fi + pid=$(/usr/sbin/rndc stop -p | awk '/^pid:/ {print $2}') || true + if [ -z "$pid" ]; then # no pid found, so either not running, or error + pid=$(pgrep -f ^/usr/sbin/named) || true + start-stop-daemon --stop --oknodo --quiet --exec /usr/sbin/named \ + --pidfile ${PIDFILE} -- $OPTIONS + fi + if [ -n "$pid" ]; then + sig=0 + n=1 + while kill -$sig $pid 2>/dev/null; do + if [ $n -eq 1 ]; then + echo "waiting for pid $pid to die" + fi + if [ $n -eq 11 ]; then + echo "giving up on pid $pid with kill -0; trying -9" + sig=9 + fi + if [ $n -gt 20 ]; then + echo "giving up on pid $pid" + break + fi + n=$(($n+1)) + sleep 1 + done + fi + log_end_msg 0 + ;; + + reload|force-reload) + log_daemon_msg "Reloading domain name service..." "bind9" + if ! check_network; then + log_action_msg "no networks configured" + log_end_msg 1 + fi + + /usr/sbin/rndc reload >/dev/null && log_end_msg 0 || log_end_msg 1 + ;; + + restart) + if ! check_network; then + log_action_msg "no networks configured" + exit 1 + fi + + $0 stop + $0 start + ;; + + status) + ret=0 + status_of_proc -p ${PIDFILE} /usr/sbin/named bind9 2>/dev/null || ret=$? + exit $ret + ;; + + *) + log_action_msg "Usage: /etc/init.d/bind9 {start|stop|reload|restart|force-reload|status}" + exit 1 + ;; +esac + +exit 0 diff --git a/insserv.conf.d/bind9 b/insserv.conf.d/bind9 new file mode 100644 index 000000000..1861a99a9 --- /dev/null +++ b/insserv.conf.d/bind9 @@ -0,0 +1 @@ +$named bind9 diff --git a/network/if-down.d/bind9 b/network/if-down.d/bind9 new file mode 100755 index 000000000..d06965ffe --- /dev/null +++ b/network/if-down.d/bind9 @@ -0,0 +1,15 @@ +#!/bin/sh -e +# Called when an interfaces comes up or down +# Written by LaMont Jones + +# kick named as needed + +# If /usr isn't mounted yet, silently bail. +if [ ! -d /usr/sbin ]; then + exit 0 +fi + +# if named is running, reconfig it. +rndc reconfig >/dev/null 2>&1 & + +exit 0 diff --git a/network/if-up.d/bind9 b/network/if-up.d/bind9 new file mode 100755 index 000000000..d06965ffe --- /dev/null +++ b/network/if-up.d/bind9 @@ -0,0 +1,15 @@ +#!/bin/sh -e +# Called when an interfaces comes up or down +# Written by LaMont Jones + +# kick named as needed + +# If /usr isn't mounted yet, silently bail. +if [ ! -d /usr/sbin ]; then + exit 0 +fi + +# if named is running, reconfig it. +rndc reconfig >/dev/null 2>&1 & + +exit 0 diff --git a/passwd b/passwd index a2df7aa7c..971120195 100644 --- a/passwd +++ b/passwd @@ -33,3 +33,4 @@ dovenull:x:112:118:Dovecot login user,,,:/nonexistent:/usr/sbin/nologin opendkim:x:113:119::/var/run/opendkim:/usr/sbin/nologin amavis:x:114:120:AMaViS system user,,,:/var/lib/amavis:/bin/sh debian-spamd:x:115:121::/var/lib/spamassassin:/bin/sh +bind:x:116:122::/var/cache/bind:/usr/sbin/nologin diff --git a/passwd- b/passwd- index a2df7aa7c..971120195 100644 --- a/passwd- +++ b/passwd- @@ -33,3 +33,4 @@ dovenull:x:112:118:Dovecot login user,,,:/nonexistent:/usr/sbin/nologin opendkim:x:113:119::/var/run/opendkim:/usr/sbin/nologin amavis:x:114:120:AMaViS system user,,,:/var/lib/amavis:/bin/sh debian-spamd:x:115:121::/var/lib/spamassassin:/bin/sh +bind:x:116:122::/var/cache/bind:/usr/sbin/nologin diff --git a/ppp/ip-down.d/bind9 b/ppp/ip-down.d/bind9 new file mode 100755 index 000000000..d06965ffe --- /dev/null +++ b/ppp/ip-down.d/bind9 @@ -0,0 +1,15 @@ +#!/bin/sh -e +# Called when an interfaces comes up or down +# Written by LaMont Jones + +# kick named as needed + +# If /usr isn't mounted yet, silently bail. +if [ ! -d /usr/sbin ]; then + exit 0 +fi + +# if named is running, reconfig it. +rndc reconfig >/dev/null 2>&1 & + +exit 0 diff --git a/ppp/ip-up.d/bind9 b/ppp/ip-up.d/bind9 new file mode 100755 index 000000000..d06965ffe --- /dev/null +++ b/ppp/ip-up.d/bind9 @@ -0,0 +1,15 @@ +#!/bin/sh -e +# Called when an interfaces comes up or down +# Written by LaMont Jones + +# kick named as needed + +# If /usr isn't mounted yet, silently bail. +if [ ! -d /usr/sbin ]; then + exit 0 +fi + +# if named is running, reconfig it. +rndc reconfig >/dev/null 2>&1 & + +exit 0 diff --git a/rc0.d/K01bind9 b/rc0.d/K01bind9 new file mode 120000 index 000000000..63fcfddf2 --- /dev/null +++ b/rc0.d/K01bind9 @@ -0,0 +1 @@ +../init.d/bind9 \ No newline at end of file diff --git a/rc1.d/K01bind9 b/rc1.d/K01bind9 new file mode 120000 index 000000000..63fcfddf2 --- /dev/null +++ b/rc1.d/K01bind9 @@ -0,0 +1 @@ +../init.d/bind9 \ No newline at end of file diff --git a/rc2.d/S01bind9 b/rc2.d/S01bind9 new file mode 120000 index 000000000..63fcfddf2 --- /dev/null +++ b/rc2.d/S01bind9 @@ -0,0 +1 @@ +../init.d/bind9 \ No newline at end of file diff --git a/rc3.d/S01bind9 b/rc3.d/S01bind9 new file mode 120000 index 000000000..63fcfddf2 --- /dev/null +++ b/rc3.d/S01bind9 @@ -0,0 +1 @@ +../init.d/bind9 \ No newline at end of file diff --git a/rc4.d/S01bind9 b/rc4.d/S01bind9 new file mode 120000 index 000000000..63fcfddf2 --- /dev/null +++ b/rc4.d/S01bind9 @@ -0,0 +1 @@ +../init.d/bind9 \ No newline at end of file diff --git a/rc5.d/S01bind9 b/rc5.d/S01bind9 new file mode 120000 index 000000000..63fcfddf2 --- /dev/null +++ b/rc5.d/S01bind9 @@ -0,0 +1 @@ +../init.d/bind9 \ No newline at end of file diff --git a/rc6.d/K01bind9 b/rc6.d/K01bind9 new file mode 120000 index 000000000..63fcfddf2 --- /dev/null +++ b/rc6.d/K01bind9 @@ -0,0 +1 @@ +../init.d/bind9 \ No newline at end of file diff --git a/shadow b/shadow index 1c0ef49d1..c0b0180ee 100644 --- a/shadow +++ b/shadow @@ -33,3 +33,4 @@ dovenull:*:17840:0:99999:7::: opendkim:*:17840:0:99999:7::: amavis:*:17840:0:99999:7::: debian-spamd:*:17840:0:99999:7::: +bind:*:17844:0:99999:7::: diff --git a/shadow- b/shadow- index 1c0ef49d1..c0b0180ee 100644 --- a/shadow- +++ b/shadow- @@ -33,3 +33,4 @@ dovenull:*:17840:0:99999:7::: opendkim:*:17840:0:99999:7::: amavis:*:17840:0:99999:7::: debian-spamd:*:17840:0:99999:7::: +bind:*:17844:0:99999:7::: diff --git a/systemd/system/multi-user.target.wants/bind9.service b/systemd/system/multi-user.target.wants/bind9.service new file mode 120000 index 000000000..d7c8ee449 --- /dev/null +++ b/systemd/system/multi-user.target.wants/bind9.service @@ -0,0 +1 @@ +/lib/systemd/system/bind9.service \ No newline at end of file diff --git a/ufw/applications.d/bind9 b/ufw/applications.d/bind9 new file mode 100644 index 000000000..6cd6fcacc --- /dev/null +++ b/ufw/applications.d/bind9 @@ -0,0 +1,5 @@ +[Bind9] +title=Internet Domain Name Server +description=The Berkeley Internet Name Domain (BIND) implements an Internet domain name server. +ports=53 + -- 2.43.0