djbdnsを使ったDNS管理

以下のテキストは、執筆時当時の情報を元に書いたものであり、 現在の情勢にそぐわないことを含む場合があるので注意されたい。 また、テキストは最終提出原稿で校正を経る前のものなので、実際にUNIXUSER 本誌に記載されたものとは異なる。誤字脱字等そのままである。

致命的な誤り以外は加筆修正等は行なわないので情報の鮮度に気をつけつつ 利用して欲しい。

目次


djbdnsDNS



djbdns



DNSdjbdns

BIND
Part?? 





djbdns qmail D. J. Bernstein DNS
qmail 

 djbdns




BIND(named)
djbdns
dnscachetinydns
dnscache


1


DNS

UNIX-PC
Web



2

1 ----------------------+
|     Computer
|   +-----------+
|   |           |
|   |           |  (www.hoge.co.jp 
|   |           |   
|   +-+-------+-+   )
|     |     |
|  /~~~~~~~~~\
|   www.hoge.co.jp
+-------------------------------------------+
2 --------------------------+
|  
|   +-----------+
|   |           |
|   |           |  (
|   |           |   )
|   +-+-------+-+   +---+ +---+ +---+ +---+ 
|     |       |     |   | |   | |   | |   | 
|  /~~~~~~~~~~~~~\  +---+ +---+ +---+ +---+ 
|                   [...] [...] [...] [...] 
+-------------------------------------------+

LAN
UNIX
LAN




tinydns
BIND
tinydnsdnscache


 djbdns

djbdnsDNS
 "daemontools" 

daemontoolsdjbdns

UNIX
daemontools

  daemontools

UNIX
daemontools


	sshdsshd_configHUP
	PID? /var/run/sshd.pid 
	 sshd PID
	? ps ps
	? man ps (1)
	ps -le 1234 kill -HUP 1234 
	sshd_config
	SyslogFacilityFacility? man syslog
	man syslog.conf(5
	)sshd_config kill -HUP 1234 
	

sshd
OS
 daemontools 

daemontools

 run 

 D daemontoolssvscan
 D 

daemontools


	1. daemontools

	   

	2.  D 

	   "run" 
	   djbdns
	   

	3. svscan

	   svscan
	   
	    /service 
	   

	4.  D  /service 

	    D /service 
	   
	    /service/ 
	   /var/djbdns 

	     # ln -s /var/djbdns /service

	   svscan(5)
	   

143svscan




  daemontools

CD-ROMdaemontools-0.70.tar.gz
README


  # tar vzxpf daemontools-0.70.tar.gz
  # cd daemontools-0.70
  # less README

 http://cr.yp.to/daemontools.html 


 conf-home daemontools
prefix /usr/local 

make

  # make



  # make setup check




  # ./rts > rts.out
  # cmp rts.out rts.exp



  #  date | ./tai64n | ./tai64nlocal
  #  date | sh -c './multilog t e 2>&1' | ./tai64nlocal



    2000-11-04 13:47:11.523517500 Sat Nov  4 13:47:11 JST 2000
    2000-11-04 13:47:12.428708500 Sat Nov  4 13:47:12 JST 2000





 /service 


/ 
 svc, svstat 
 /service 


  # mkdir /service
  # chmod 755 /service

svscan
(start-sv.sh)

[start-sv.sh]
  #!/bin/sh
  env - \
  PATH=/usr/local/bin:/usr/sbin:/usr/bin:/bin csh -cf 'svscan /service &' 

/usr/local/bin daemontools
conf-home PATH


  # ./start-sv.sh

djbdns
 LinuxSytemV  /etc/rc?.d/ BSD
/etc/rc.local  /usr/local/etc/rc.d start-sv.sh


===  ===================================================================
daemontools 
~~~~~~~~~~~~~~~~~~~~~~~~~~

daemontools
 foo 
/service/foo qmail
/service/qmail 
 "/service/qmail" 

-------------------
supervise

 ./run 

(15)
supervise
 svscan 

svc
supervise

  # svc  




  -u  
  -d  
  -o  
  -p   STOP (Pause)
  -c   CONT 
  -h   HUP 
  -a   ALRM 
  -i   INT 
  -t   TERM 
  -k   KILL 
  -x  supervise 
      

svok
  # svok 

(
supervise)
0100

svstat
svok


svscan
supervise
 /service 
svscanPATHdaemontools


fghack
 supervise  ./run 

supervise
(run)fghacksupervise


multilog


tai64n
TAI64N

tai64nlocal
TAI64N

setuidgid
UID, GID setuid/setgid 

envuidgid
UIDGID

envdir



softlimit


setlock

-------------------

 svc, svstat, tail64nlocal 
svscan

HUP

  # svc -h 



  # svc -d 


 down svc -d 

  # touch /service/Service/down
  # svc -d /service/Service

 supervise 
 down 

  # rm /service/Service/down
  # svc -u /service/Service




  # cd /service/Service
  # rm /service/Service
  # svc -dx . log
==============================================================================

  djbdns

daemontoolssvscan
djbdnsdjbdnsWeb
svscandjbdns
1.02CD-ROM


  # tar vzxpf djbdns-1.02.tar.gz
  # cd djbdns-1.02
  # less README

 http://cr.yp.to/djbdns.html 
djbdnsmakedaemontools
prefix /usr/local 
 conf-home 

  # make
  # make setup check

djbdns
 (/usr/local/bin) PATH


 
DNS



 dnscache,  dnslog 
 `dns' 


  # vi /etc/group
  --------------------------------------------------
  dns:*:9800:    ()
  --------------------------------------------------
  # vipw
  --------------------------------------------------
  dnscache:*:9800:9800:0:0:/var/dns:/bin/noshell	()
  dnslog:*:9801:9800:0:0:/var/dns:/bin/noshell		()
  --------------------------------------------------

UID/GID


dnscache-conf 


  # dnscache-conf dnscache dnslog /var/dnscache

 /var/dnscache 
chroot
()

----------

djbdns /etc/dnscache /etc 
/  /etc 
 /  /var 

----------

 /var/dnscache  daemontools 
 /service 
svscan

  # ln -s /var/dnscache /service

5dnscachelocalhost
/etc/resolv.conf  nameserver 

  --------------------------------------------------
  nameserver	127.0.0.1
  --------------------------------------------------

Web

/var/dnscache/log/main/current 


  # tail -f /var/dnscache/log/main/current | tai64nlocal

tai64nlocal 

log/main/current (
99999)


 


dnscache-conf 


  # dnscache-conf dnscache dnslog /var/dnscachex 10.0.1.23

 /var/dnscachex 


  # ln -s /var/dnscachex /service

svscan5
DNSIP
IP /var/dnscachex/root/ip 


  # touch /var/dnscachex/root/ip/10.0.1.24

 IP  10.0.1.24 DNS

  # touch /var/dnscachex/root/ip/10.0.2

10.0.2.x (x)IPDNS


 

dnscache

 dnscache 
 "root/servers/<>" 
hoge.co.jp(10.1.0.0/16)  
10.1.1.1 

  # echo 10.1.1.1 > /var/dnscachex/root/servers/hoge.co.jp	   ()
  # echo 10.1.1.1 > /var/dnscachex/root/servers/1.10.in-addr.arpa  ()

 

dnscache-conf 
 tinydns 


  * env

  
  

  * log

  
  supervise  run 

  * supervise

  supervise

  * run

  
  envdir
  

env


  * env/CACHESIZE
  1000000

  * env/DATALIMIT
   datasize 
  softlimit 3000000
  env/CACHESIZE

  * env/IP
  dnscachelistenIP

  * env/IPSEND
  0.0.0.0

  * env/ROOT
  

dnscache 
(TTL)
CACHESIZE

(log/main/current) stats  
stats 

 # grep -w stats /var/dnscachex/log/main/current \
     | tai64nlocal | tail -1

24 stats stats


   2000-11-14 02:00:22.750708500 stats 1992 105360 3
                                            ~~~~~~
   2000-11-15 06:15:34.542646500 stats 7153 326252 1
                                            ~~~~~~

stats2
 326252-105360=220892 
7
102000000CACHESIZE
DATALIMIT

  # echo 2000000 > /var/dnscachex/env/CACHESIZE
  # echo 2097152 > /var/dnscachex/env/DATALIMIT
  # svc -t /service/dnscachex






djbdns
tinydnstiny





BINDnamed
(
)

tinydns

()


 tinydns

 daemontools svscan  /service 

tinysdnsUID

  # vipw
  --------------------------------------------------
  dns:*:9802:9800:0:0:/var/dns:/bin/noshell	()
  --------------------------------------------------

 tinydns-conf 

  # tinydns-conf dns dnslog /var/tinydns 192.168.24.8

 /var/tinydns  192.168.24.8 
LAN
IP
IP

 tinydns-conf  /var/tinydns/root 

dataBIND



  add-ns
  

    ./add-ns fqdn ip

    ANSSOA
  data

	.:::

  NS  
  A  
  259200(=3)

  add-host
  IP

    ./add-host fqdn ip

    AIP 
    PTR  
  

	=::

  86400(24)

  add-alias
  IP

    ./add-alias fqdn ip

    AIP 
  
  

	+::

  

  add-mx
  (MX)

    ./add-mx fqdn ip

    MX
   IP  
  

	@::::

   MX  
  A   preferenceadd-mx
  0
  preferencedata

  add-childns
  

    ./add-childns fqdn ip

     NS, A 
  

	&:::

  


data
tinydns
data
http://cr.yp.to/djbdns/tinydns-data.html


 tinydns

tinydns-conf  env 



  * env/IP
  tinydnslistenIP

  * env/ROOT
  data

IP



tinydns

DNS
 subdom.ymzk.org 
 10.8.50.1 IP
djbdns





  # mkdir /var/dns
  # tinydns-conf dns dnslog /var/dns/namedb 10.8.50.1
  # ln -s /var/dns/namedb /service

IP 10.8.50.1 




  # cd /var/dns/namedb/root
  # ./add-ns subdom.ymzk.org 10.8.50.1

add-nsNS a.ns.subdom.ymzk.org 
NS
ns1.subdom.ymzk.org 
data
NS

  # vi data
  ()  .subdom.ymzk.org:10.8.50.1:a:259200
           
  ()  .subdom.ymzk.org:10.8.50.1:ns1.subdom.ymzk.org:259200



smoke(10.2.50.2) 
twin(10.8.50.1)

  # ./add-host smoke.subdom.ymzk.org 10.2.50.2
  # ./add-host twin.subdom.ymzk.org 10.8.50.1

 10.2.50.2 
 10.2.50.4 

  # ./add-mx subdom.ymzk.org 10.2.50.2
  # ./add-mx subdom.ymzk.org 10.2.50.4

 preference 
data

  ()
  # vi data
  ()  @subdom.ymzk.org:10.2.50.2:a::86400
	    @subdom.ymzk.org:10.2.50.4:b::86400
           
  ()  @subdom.ymzk.org:10.2.50.2:a:10:86400
	    @subdom.ymzk.org:10.2.50.4:b:20:86400


POP10.2.50.2WWW10.8.50.1


  # ./add-alias pop.subdom.ymzk.org 10.2.50.2
  # ./add-alias www.subdom.ymzk.org 10.8.50.1

tinydnscdb

  # make


hostdnsquery
nslookupBIND

(1)host, dnsquery


----------
1
http://cr.yp.to/djbdns/faq/tinydns.html#nslookup 
----------

(10.8.50.1)


  anotherhost% host smoke.subdom.ymzk.org 10.8.50.1
               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  Using domain server 10.8.50.1:
  smoke.subdom.ymzk.org has address 10.2.50.2

  anotherhost% dnsquery -n 10.8.50.1 -t mx subdom.ymzk.org
               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33010
  ;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 3
  ;;      subdom.ymzk.org, type = MX, class = IN
  subdom.ymzk.org.        1D IN MX        10 a.mx.subdom.ymzk.org.
  subdom.ymzk.org.        1D IN MX        20 b.mx.subdom.ymzk.org.
  subdom.ymzk.org.        3D IN NS        ns1.subdom.ymzk.org.
  a.mx.subdom.ymzk.org.   1D IN A         10.2.50.2
  b.mx.subdom.ymzk.org.   1D IN A         10.2.50.4
  ns1.subdom.ymzk.org.    3D IN A         10.8.50.1


SOA


  TRX# dnsquery -n 10.8.50.1 -t soa subdom.ymzk.org
       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14707
  ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
  ;;      subdom.ymzk.org, type = SOA, class = IN
  subdom.ymzk.org. 42m40s IN SOA ns1.subdom.ymzk.org. hostmaster.subdom.ymzk.org. (
                                     973855992       ; serial
                                     4h33m4s         ; refresh
                                     34m8s           ; retry
                                     1w5d3h16m16s    ; expiry
                                     42m40s )        ; minimum
  		      	      
  subdom.ymzk.org.     3D IN NS      ns1.subdom.ymzk.org.
  ns1.subdom.ymzk.org. 3D IN A       10.8.50.1



hostmaster 



 

()
djbdns
 tinydns  zone transfer 
datarsync

BIND zone transfer 

djbdns 
 djbdns  zone
transfer 

-----

BIND masterslave djbdns
DNS(replicate)


-----


djbdnsDNS


  djbdns  djbdns

djbdns
rsync
makedatacdb
 Makefile 

  rsync -avz data dns@secondaryserver:/var/dns/tinydns/root

secondaryserver 
 tinydns-data (make)
cron

  djbdns  BIND

djbdnsbind
tinydnszone transfer  axfrdns 
axfrdns  tinydns 
 zone transfer  TCP 53
tcpserver
tcpserver ucspi-tcp
 ucspi-tcp-0.88.tar.gz (CDROM) 
daemontools, djbdns 

  # tar vzxpf ucspi-tcp-0.88.tar.gz
  # cd ucspi-tcp-0.88
  # vi conf-home            (PATH)
  # make
  # make setup check

tcpserver axfrdns 
 /var/dns/namedb 
tinydns axfr  zone transfer 
 /var/dns/axfrdns 

  # axfrdns-conf dns dnslog /var/dns/axfrdns /var/dns/namedb 10.8.50.1

 /var/dns/axfrdns 
 tcp  tcpserver 
IP
tcp


  # sample line:  1.2.3.4:allow,AXFR="heaven.af.mil/3.2.1.in-addr.arpa"

(192.168.5.5)
subdom.ymzk.org   10.in-addr.arpa 


  192.168.5.5:allow,AXFR="subdom.ymzk.org/10.in-addr.arpa"
  :deny

AXFRzone transfer /() 
tcpmaketcpserver
 tcp.cdb 

  axfrsvscan


  # ln -s /var/dns/axfrdns /service

./run  tcpserver 
PATHucspi-tcpdaemontools

 /var/dns/axfrdns/log/main/current 

    softlimit: fatal: unable to run tcpserver: file does not exist


svscan ucspi-tcp PATH
(2)/var/dns/axfrdns/run  tcpserver 

----------
2
axfrdns svscan 
PATH
----------


  # svstat /service/axfrdns
    ~~~~~~~~~~~~~~~~~~~~~~~
  /service/axfrdns: up (pid 30476) 2681 seconds

zone transfer 



--------------------  (192.168.5.5)
   % host -v -l -t any subdom.ymzk.org 10.8.50.1
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Using domain server:
Name: ns1.subdom.ymzk.org
Address: 10.8.50.1
Aliases:

Trying 10.8.50.1
subdom.ymzk.org 2560 IN SOA     ns1.subdom.ymzk.org hostmaster.subdom.ymzk.org(
                        973855992       ;serial (version)
                        16384   ;refresh period
                        2048    ;retry refresh this often
                        1048576 ;expiration period
                        2560    ;minimum TTL
                        )
subdom.ymzk.org 259200 IN       NS      ns1.subdom.ymzk.org
ns1.subdom.ymzk.org     259200 IN       A       10.8.50.1
smoke.subdom.ymzk.org   86400 IN        A       10.2.50.2
twin.subdom.ymzk.org    86400 IN        A       10.8.50.1
subdom.ymzk.org 86400 IN        MX      10 a.mx.subdom.ymzk.org
a.mx.subdom.ymzk.org    86400 IN        A       10.2.50.2
subdom.ymzk.org 86400 IN        MX      20 b.mx.subdom.ymzk.org
b.mx.subdom.ymzk.org    86400 IN        A       10.2.50.4
pop.subdom.ymzk.org     86400 IN        A       10.2.50.2
www.subdom.ymzk.org     86400 IN        A       10.8.50.1
	:
	:(SOA)
	:
--------------------


  BIND  djbdns

BINDdjbdns
 axfr-get 
tinydnsaxfr-get 
ucspi-tcp tcpclient
 other.ymzk.org 
192.168.5.5  other.ymzk.org  zone transfer


  # tcpclient 192.168.5.5  53 axfr-get other.ymzk.org other.dat other.tmp

other.dat  tinydns-data 
 tinydns  data 
IPv6AAAA(

)

%%%%%%%%%%%%%%%% ?
%%%%%% 
===  ===================================================================
/tinydnsTips

axfr-gettinydns-data

cat


 add-host add-* 
tinydns-data  "data" 
cat
add-*  "data" 

 local.domain add-* 
 "local.domain" add-* 
 "data"  "local.domain" 

  # perl -i -pe 's/data/local.domain/g' add-*
  # touch local.domain

 ext1.domain, ext2.domain 
Makefile 3data


  [Makefile]
  TCPCLIENT	= /usr/local/bin/tcpclient
  AXFRGET	= /usr/local/bin/axfr-get

  all:	data.cdb

  ext1.domain:	/dev/null
	${TCPCLIENT} "ext1.domain" 53 ${AXFRGET} $@ $@ dummy.tmp

  ext2.domain:	/dev/null
	${TCPCLIENT} "ext2.domain" 53 ${AXFRGET} $@ $@ dummy.tmp

  data:	ext1.domain ext2.domain local.domain
	cat $> > data

  data.cdb:	data
	/usr/local/bin/tiny-dns
==============================================================================


 

djbdnszone transfer

LAN(NAT
)
(
)zone transfer




    	| 
    ------------+------------------
    dnscache	| UDP 53
    tinydns	| UDP 53
    axfrdns	| TCP 53

dnscachetinydnsIP
 NAT BOX 
LAN (*.mylan.private, 192.168.0.0/24 )


  1. LAN(*.mylan.private)
     
  2. LAN(10.0.0.0/24)
  3. IP
  4. (3)zone transferaxfrdns
   
-------------

   The Internet 
           |
       [gateway]
           |      (global area 10.2.50.0/28)
    ..-----+-------+-------+-------+-------+-------+--.....
                   |       |       |       |       |
               [host1]     |     [WWW]  [host3] [host4] (*.subdom.ymzk.org)
                           |(10.2.50.3)
                         [NAT]
                           |(192.168.0.1)  (private area 192.168.0.0/24)
           ...-----+-------+-------+-------+-------+-------+--.....
                 [pc1]   [pc2]   [pc3]   [pc4]   [pc5]   [pc6]
		     *.mylan.private
                          (LAN)
-------------

NAT
4


  # tinydns-conf dns dnslog /var/dns/private 127.0.0.1		(1)
  # dnscache-conf dnscache dnslog /var/dns/dnscache 192.168.0.1	(2)
  # tinydns-conf dns dnslog /var/dns/global 10.2.50.3		(3)
  # axfrdns-conf dns dnslog /var/dns/axfrdns \			(4)
		 /var/dns/global 10.2.50.3
  # touch /var/dns/dnscache/root/ip/192.168.0       (LAN)
  # echo 127.0.0.1 > /var/dns/dnscache/root/servers/mylan.private
  # echo 10.2.50.3 > /var/dns/dnscache/root/servers/subdom.ymzk.org
    :
  (axfrdnstcpserver)


*.mylan.private
127.0.0.1 *.subdom.ymzk.org  10.2.50.3 




djbdns


 walldns
IP (a.b.c.d) (PTR)
d.c.b.a.in-addr.arpa PTR
tinydns-data

   =d.c.b.a.in-addr.arpa:a.b.c.d:

IP
anonymous ftpIP




tinydns *-conf 

  # walldns-conf    IP
  # ln -s  /service

 pickdns

IP
WWW

  # pickdns-conf    IP
  # ln -s  /service

datatinydns-data

  +fqdn1:ip1
  +fqdn1:ip2
  +fqdn1:ip3
    :
    :

128IP
data +  - IP


IP


  %KO:131.113
  %KO:133.27
  +www.xxxx.yyy:10.8.50.1:KO
  +www.xxxx.yyy:10.8.50.5:KO
  +www.xxxx.yyy:10.8.50.6:KO
    :
    :

%()2
% + IP
IP
prefix
(-)

 rbldns

IP
MAPS RBL()
MAPS RBL SMTP 
DNSSMTP
SMTP

IP
DNSrbldns

----------

Mail Abuse Prevention System, Realtime Blackhole List.
http://mapx.vix.com/
----------



IP

djbdns

Knuthdjb
 djb tools djbdnsOS


djbdns



yuuji@gentei.org
Fingerprint16 = FF F9 FF CC E0 FE 5C F7 19 97 28 24 EC 5D 39 BA
HIROSE Yuuji - ASTROLOGY / BIKE / EPO / GUEST BOOK / YaTeX [Tweet]