dWeb University

Launch a dDNS Server

Setting up a Tier 1 Server

Tier 1 servers are the core DNS servers hosting authoritative zones for all dDNS TLDs and the dDNS root (''.'') zone.

BIND9 setup

Setting up a dDNS Tier 1 server, requires creating slave zones for all the TLDs within the dDNS name-space.

Each zone is presented below. This document will be updated as new zones are created.

This page will show how to configure BIND9 to automatically update available TLDs and their master servers.

In this example BIND9 configuration, zones are stored in directories "/etc/bind/zones" and "/etc/bind/zones/slaves". A Tier 1 BIND9 server may be deployed using other directories. BIND9 directories are different in different computer operating systems.

Run BIND9 in a chroot jail.

Tier 1 servers are listed as 'master' in each zone for redundancy.

Begin with the '.' root zone; add the following directive statement, to the BIND9 ("named") configuration file "named.conf".

== named.conf: ==


zone "." {
	type slave;
	file "/etc/bind/zones/db.root";
	masters { 75.127.96.89; };
	allow-transfer { any; };
	notify no;
};

Insert the following dTLD zones into BIND's named.conf

== distdns.ddns ==
zone "distdns.ddns" IN{
	type slave;
	file "/etc/bind/zones/slaves/ddns.zone";
	masters { 13.59.94.81; };
	allow-transfer { any; };
	notify no;
};

== dns.distdns.ddns ==
zone "**dns**.distdns.ddns" IN{
	type slave;
	file "/etc/bind/zones/slaves/dns.ddns.zone";
	masters { 13.59.94.81; };
	allow-transfer { any; };
	notify no;
};
== dweb ==
zone "dweb" IN{
	type slave;
	file "/etc/bind/zones/slaves/dweb.zone";
	masters { 13.59.94.81; };
	allow-transfer { any; };
	notify no;
};

== bts ==
zone "bts" IN{
	type slave;
	file "/etc/bind/zones/slaves/bts.zone";
	masters { 13.59.94.81; };
	allow-transfer { any; };
	notify no;
};

== eos ==
zone "eos" IN{
	type slave;
	file "/etc/bind/zones/slaves/eos.zone";
	masters { 13.59.94.81; };
	allow-transfer { any; };
	notify no;
};

== chain ==
zone "chain" IN{
	type slave;
	file "/etc/bind/zones/slaves/chain.zone";
	masters { 13.59.94.81; };
	allow-transfer { any; };
	notify no;
};

== dec ==
zone "dec" IN{
	type slave;
	file "/etc/bind/zones/slaves/dec.zone";
	masters { 13.59.94.81; };
	allow-transfer { any; };
	notify no;
};

== dcom ==
zone "dcom" IN {
	type slave;
	file "/etc/bind/zones/slaves/dcom.zone";
	masters { 13.59.94.81; };
	allow-transfer { any; };
	notify no;
};

== dnet ==
zone "dnet" IN{
	type slave;
	file "/etc/bind/zones/slaves/dnet.zone";
	masters { 13.59.94.81; };
	allow-transfer { any; };
	notify no;
};

== dorg ==
zone "dorg" IN{
	type slave;
	file "/etc/bind/zones/slaves/dorg.zone";
	masters { 13.59.94.81; };
	allow-transfer { any; };
	notify no;
};

== dgov ==
zone "dgov" IN{
	type dgov;
	file "/etc/bind/zones/slaves/dgov.zone";
	masters { 13.59.94.81; };
	allow-transfer { any; };
	notify no;
};

== arisen ==
zone "arisen" IN{
	type slave;
	file "/etc/bind/zones/slaves/arisen.zone";
	masters { 13.59.94.81; };
	allow-transfer { any; };
	notify no;
};

== dao ==
zone "dao" IN{
	type slave;
	file "/etc/bind/zones/slaves/dao.zone";
	masters { 13.59.94.81; };
	allow-transfer { any; };
	notify no;
};

== beos ==
zone "beos" IN{
	type slave;
	file "/etc/bind/zones/slaves/beos.zone";
	masters { 13.59.94.81; };
	allow-transfer { any; };
	notify no;
};

== maga ==
zone "maga" IN{
	type slave;
	file "/etc/bind/zones/slaves/maga.zone";
	masters { 13.59.94.81; };
	allow-transfer { any; };
	notify no;
};

== dist ==
zone "dist" IN{
	type slave;
	file "/etc/bind/zones/slaves/dist.zone";
	masters { 13.59.94.81; };
	allow-transfer { any; };
	notify no;
};

== dtb ==
zone "dtb" IN{
	type slave;
	file "/etc/bind/zones/slaves/dtb.zone";
	masters { 13.59.94.81; };
	allow-transfer { any; };
	notify no;
};

Remember that once done, restart bind!

Lets go through turning on some logging for your bind9 DNS server. These logs are interesting to look through, but should not be archived. If you wish to archive them, I have provided a perl script written by Brianko which will remove all IP addresses and replace them with XXX.XXX.XXX.XXX. It is important that we protect our members right to browse the internet in complete privacy, so the use of this perl script is highly encouraged.

To turn on logging, open ''named.conf.options'' in your favourite text editor and add the below to the end of the file:

logging {
	channel "misc" {
		file "/var/log/misc.log" versions 2 size 25M;
		severity info; print-severity no;
		print-category yes; print-time yes;
	};
	channel "querylog" {
		file "/var/log/named.log" versions 2 size 25M;
		severity info; print-severity no;
		print-category no; print-time yes;
	};
	category "queries" { "querylog"; };
	category default { "misc"; };
};

Create the log files so the above code is completely functional.

Depending on your bind setup(we always recommend chroot), the log dir can live in two locations. In a chroot setup it is at /var/lib/named/var/log and in a normal install it is at ''/var/log/''. You know how yours is installed, so go to the log dir, and issue:

$ touch named.log
$ chown bind:bind named.log
$ touch misc.log
$ chown misc.log

Obfuscate all IP addresses in the log file

#! /usr/bin/perl
#
# blurAddys.pl - Obfuscate IP addresses in a file
#
# cat some.log | blurAddys.pl > some_blurred.log
#
#####################################################################
use strict;

while(<STDIN>)
{
	s/\d{1,3}(\.|-)\d{1,3}(\.|-)\d{1,3}(\.|-)\d{1,3}/XX$1XX$2XX$3XX/g;
	print $_;
}

Create a bash script to automate IP address obfuscation

#!/bin/sh

date=`date +%d`
current=`date +%d%m%y`

if [ "$(echo $date)" = 01 ];then
		tar cfvz /var/log/named/named.$current.tar.gz /var/log/named/*.log.*
		rm /var/log/named/*.log.*
fi

cat /var/lib/named/var/log/named.log | /usr/local/bin/blurAddys.pl > /var/log/named/named.log.$current
rm /var/lib/named/var/log/named.log
touch /var/lib/named/var/log/named.log
chown bind:bind /var/lib/named/var/log/named.log

/etc/init.d/bind9 restart

Create a bash script to revolve log files and get rid of old logs

Add the below entry into ''/etc/logrotate.d/syslog-ng''

/var/lib/named/var/log/named-query.log {
   rotate 7
   daily
   compress
   prerotate
	  /usr/local/bin/blurAddys.pl
   endscript
}

Launch a dDNS Server


Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.