diff options
Diffstat (limited to 'debian/extras')
| -rw-r--r-- | debian/extras/apparmor.d/usr.sbin.named | 101 | ||||
| -rw-r--r-- | debian/extras/etc/db.0 | 12 | ||||
| -rw-r--r-- | debian/extras/etc/db.127 | 13 | ||||
| -rw-r--r-- | debian/extras/etc/db.255 | 12 | ||||
| -rw-r--r-- | debian/extras/etc/db.empty | 14 | ||||
| -rw-r--r-- | debian/extras/etc/db.local | 14 | ||||
| -rw-r--r-- | debian/extras/etc/named.conf | 11 | ||||
| -rw-r--r-- | debian/extras/etc/named.conf.default-zones | 30 | ||||
| -rw-r--r-- | debian/extras/etc/named.conf.local | 8 | ||||
| -rw-r--r-- | debian/extras/etc/named.conf.options | 24 | ||||
| -rw-r--r-- | debian/extras/etc/zones.rfc1918 | 20 | ||||
| -rwxr-xr-x | debian/extras/if-reconfig.d/bind9 | 15 | ||||
| -rw-r--r-- | debian/extras/insserv.conf.d/bind9 | 1 | ||||
| -rw-r--r-- | debian/extras/ufw/bind9 | 5 |
14 files changed, 280 insertions, 0 deletions
diff --git a/debian/extras/apparmor.d/usr.sbin.named b/debian/extras/apparmor.d/usr.sbin.named new file mode 100644 index 0000000..f572f4d --- /dev/null +++ b/debian/extras/apparmor.d/usr.sbin.named @@ -0,0 +1,101 @@ +# vim:syntax=apparmor +# Last Modified: Fri Jun 1 16:43:22 2007 +#include <tunables/global> + +profile named /usr/sbin/named flags=(attach_disconnected) { + #include <abstractions/base> + #include <abstractions/nameservice> + + capability net_bind_service, + capability setgid, + capability setuid, + capability sys_chroot, + capability sys_resource, + + # /etc/bind should be read-only for bind + # /var/lib/bind is for dynamically updated zone (and journal) files. + # /var/cache/bind is for slave/stub data, since we're not the origin of it. + # See /usr/share/doc/bind9/README.Debian.gz + /etc/bind/** r, + /var/lib/bind/** rw, + /var/lib/bind/ rw, + /var/cache/bind/** lrw, + /var/cache/bind/ rw, + + # Database file used by allow-new-zones + /var/cache/bind/_default.nzd-lock rwk, + + # gssapi + /etc/krb5.keytab kr, + /etc/bind/krb5.keytab kr, + + # ssl + /etc/ssl/*.cnf r, + /etc/ssl/*.conf r, + + # root hints from dns-data-root + /usr/share/dns/root.* r, + + # GeoIP data files for GeoIP ACLs + /usr/share/GeoIP/** r, + + # dnscvsutil package + /var/lib/dnscvsutil/compiled/** rw, + + # Allow changing worker thread names + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + + # named need to check if hugepages is available + /sys/kernel/mm/transparent_hugepage/enabled r, + + @{PROC}/net/if_inet6 r, + @{PROC}/*/net/if_inet6 r, + @{PROC}/sys/net/ipv4/ip_local_port_range r, + /usr/sbin/named mr, + /{,var/}run/named/named.pid w, + /{,var/}run/named/session.key w, + # support for resolvconf + /{,var/}run/named/named.options r, + + # some people like to put logs in /var/log/named/ instead of having + # syslog do the heavy lifting. + /var/log/named/** rw, + /var/log/named/ rw, + + # gssapi + /var/lib/sss/pubconf/krb5.include.d/** r, + /var/lib/sss/pubconf/krb5.include.d/ r, + /var/lib/sss/mc/initgroups r, + /etc/gss/mech.d/ r, + + # ldap + /etc/ldap/ldap.conf r, + /{,var/}run/slapd-*.socket rw, + + # dynamic updates + /var/tmp/DNS_* rw, + + # dyndb backends + /usr/lib/bind/*.so rm, + + # Samba DLZ + /{usr/,}lib/@{multiarch}/samba/bind9/*.so rm, + /{usr/,}lib/@{multiarch}/samba/gensec/*.so rm, + /{usr/,}lib/@{multiarch}/samba/ldb/*.so rm, + /{usr/,}lib/@{multiarch}/ldb/modules/ldb/*.so rm, + /var/lib/samba/bind-dns/dns.keytab rk, + /var/lib/samba/bind-dns/named.conf r, + /var/lib/samba/bind-dns/dns/** rwk, + /var/lib/samba/private/dns.keytab rk, + /var/lib/samba/private/named.conf r, + /var/lib/samba/private/dns/** rwk, + /etc/samba/smb.conf r, + /dev/urandom rwmk, + owner /var/tmp/krb5_* rwk, + + # systemd sd_notify + /run/systemd/notify w, + + # Site-specific additions and overrides. See local/README for details. + #include <local/usr.sbin.named> +} diff --git a/debian/extras/etc/db.0 b/debian/extras/etc/db.0 new file mode 100644 index 0000000..0cbfc38 --- /dev/null +++ b/debian/extras/etc/db.0 @@ -0,0 +1,12 @@ +; +; BIND reverse data file for "this host on this network" zone +; +$TTL 604800 +@ IN SOA localhost. root.localhost. ( + 1 ; Serial + 604800 ; Refresh + 86400 ; Retry + 2419200 ; Expire + 604800 ) ; Negative Cache TTL +; +@ IN NS localhost. diff --git a/debian/extras/etc/db.127 b/debian/extras/etc/db.127 new file mode 100644 index 0000000..cd05bef --- /dev/null +++ b/debian/extras/etc/db.127 @@ -0,0 +1,13 @@ +; +; BIND reverse data file for local loopback interface +; +$TTL 604800 +@ IN SOA localhost. root.localhost. ( + 1 ; Serial + 604800 ; Refresh + 86400 ; Retry + 2419200 ; Expire + 604800 ) ; Negative Cache TTL +; +@ IN NS localhost. +1.0.0 IN PTR localhost. diff --git a/debian/extras/etc/db.255 b/debian/extras/etc/db.255 new file mode 100644 index 0000000..e3aabdb --- /dev/null +++ b/debian/extras/etc/db.255 @@ -0,0 +1,12 @@ +; +; BIND reverse data file for broadcast zone +; +$TTL 604800 +@ IN SOA localhost. root.localhost. ( + 1 ; Serial + 604800 ; Refresh + 86400 ; Retry + 2419200 ; Expire + 604800 ) ; Negative Cache TTL +; +@ IN NS localhost. diff --git a/debian/extras/etc/db.empty b/debian/extras/etc/db.empty new file mode 100644 index 0000000..8a12858 --- /dev/null +++ b/debian/extras/etc/db.empty @@ -0,0 +1,14 @@ +; BIND reverse data file for empty rfc1918 zone +; +; DO NOT EDIT THIS FILE - it is used for multiple zones. +; Instead, copy it, edit named.conf, and use that copy. +; +$TTL 86400 +@ IN SOA localhost. root.localhost. ( + 1 ; Serial + 604800 ; Refresh + 86400 ; Retry + 2419200 ; Expire + 86400 ) ; Negative Cache TTL +; +@ IN NS localhost. diff --git a/debian/extras/etc/db.local b/debian/extras/etc/db.local new file mode 100644 index 0000000..2f272d4 --- /dev/null +++ b/debian/extras/etc/db.local @@ -0,0 +1,14 @@ +; +; BIND data file for local loopback interface +; +$TTL 604800 +@ IN SOA localhost. root.localhost. ( + 2 ; Serial + 604800 ; Refresh + 86400 ; Retry + 2419200 ; Expire + 604800 ) ; Negative Cache TTL +; +@ IN NS localhost. +@ IN A 127.0.0.1 +@ IN AAAA ::1 diff --git a/debian/extras/etc/named.conf b/debian/extras/etc/named.conf new file mode 100644 index 0000000..bc71baa --- /dev/null +++ b/debian/extras/etc/named.conf @@ -0,0 +1,11 @@ +// This is the primary configuration file for the BIND DNS server named. +// +// Please read /usr/share/doc/bind9/README.Debian for information on the +// structure of BIND configuration files in Debian, *BEFORE* you customize +// this configuration file. +// +// If you are just adding zones, please do that in /etc/bind/named.conf.local + +include "/etc/bind/named.conf.options"; +include "/etc/bind/named.conf.local"; +include "/etc/bind/named.conf.default-zones"; diff --git a/debian/extras/etc/named.conf.default-zones b/debian/extras/etc/named.conf.default-zones new file mode 100644 index 0000000..1a85ad3 --- /dev/null +++ b/debian/extras/etc/named.conf.default-zones @@ -0,0 +1,30 @@ +// prime the server with knowledge of the root servers +zone "." { + type hint; + file "/usr/share/dns/root.hints"; +}; + +// be authoritative for the localhost forward and reverse zones, and for +// broadcast zones as per RFC 1912 + +zone "localhost" { + type master; + file "/etc/bind/db.local"; +}; + +zone "127.in-addr.arpa" { + type master; + file "/etc/bind/db.127"; +}; + +zone "0.in-addr.arpa" { + type master; + file "/etc/bind/db.0"; +}; + +zone "255.in-addr.arpa" { + type master; + file "/etc/bind/db.255"; +}; + + diff --git a/debian/extras/etc/named.conf.local b/debian/extras/etc/named.conf.local new file mode 100644 index 0000000..7a57b10 --- /dev/null +++ b/debian/extras/etc/named.conf.local @@ -0,0 +1,8 @@ +// +// Do any local configuration here +// + +// Consider adding the 1918 zones here, if they are not used in your +// organization +//include "/etc/bind/zones.rfc1918"; + diff --git a/debian/extras/etc/named.conf.options b/debian/extras/etc/named.conf.options new file mode 100644 index 0000000..4778d18 --- /dev/null +++ b/debian/extras/etc/named.conf.options @@ -0,0 +1,24 @@ +options { + directory "/var/cache/bind"; + + // If there is a firewall between you and nameservers you want + // to talk to, you may need to fix the firewall to allow multiple + // ports to talk. See http://www.kb.cert.org/vuls/id/800113 + + // If your ISP provided one or more IP addresses for stable + // nameservers, you probably want to use them as forwarders. + // Uncomment the following block, and insert the addresses replacing + // the all-0's placeholder. + + // forwarders { + // 0.0.0.0; + // }; + + //======================================================================== + // If BIND logs error messages about the root key being expired, + // you will need to update your keys. See https://www.isc.org/bind-keys + //======================================================================== + dnssec-validation auto; + + listen-on-v6 { any; }; +}; diff --git a/debian/extras/etc/zones.rfc1918 b/debian/extras/etc/zones.rfc1918 new file mode 100644 index 0000000..03b5546 --- /dev/null +++ b/debian/extras/etc/zones.rfc1918 @@ -0,0 +1,20 @@ +zone "10.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; + +zone "16.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "17.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "18.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "19.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "20.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "21.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "22.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "23.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "24.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "25.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "26.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "27.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "28.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "29.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "30.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; +zone "31.172.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; + +zone "168.192.in-addr.arpa" { type master; file "/etc/bind/db.empty"; }; diff --git a/debian/extras/if-reconfig.d/bind9 b/debian/extras/if-reconfig.d/bind9 new file mode 100755 index 0000000..d06965f --- /dev/null +++ b/debian/extras/if-reconfig.d/bind9 @@ -0,0 +1,15 @@ +#!/bin/sh -e +# Called when an interfaces comes up or down +# Written by LaMont Jones <lamont@debian.org> + +# kick named as needed + +# If /usr isn't mounted yet, silently bail. +if [ ! -d /usr/sbin ]; then + exit 0 +fi + +# if named is running, reconfig it. +rndc reconfig >/dev/null 2>&1 & + +exit 0 diff --git a/debian/extras/insserv.conf.d/bind9 b/debian/extras/insserv.conf.d/bind9 new file mode 100644 index 0000000..1861a99 --- /dev/null +++ b/debian/extras/insserv.conf.d/bind9 @@ -0,0 +1 @@ +$named bind9 diff --git a/debian/extras/ufw/bind9 b/debian/extras/ufw/bind9 new file mode 100644 index 0000000..6cd6fca --- /dev/null +++ b/debian/extras/ufw/bind9 @@ -0,0 +1,5 @@ +[Bind9] +title=Internet Domain Name Server +description=The Berkeley Internet Name Domain (BIND) implements an Internet domain name server. +ports=53 + |