• BIND 9.3.0 소스설치 on RedHat 7.3
  

1. bind 9.3.0 최신버전 source 다운로드

# cd /usr/src
# wget ftp://ftp.isc.org/isc/bind9/9.3.0/bind-9.3.0.tar.gz 

2. 압축풀기
# tar xvzf bind-9.3.0.tar.gz

3. 기존의 nameserver 정지
# ntsysv (named 를 uncheck)
# service named stop

4. openssl 업데이트해줘야함 ( --with-openssl 옵션 넣을시) 
* apt-get 설치 (openssl 설치전에 해줌)
http://ftp.freshrpms.net/pub/freshrpms/redhat/7.3/apt/apt-0.5.5cnc5-fr0.rh73.2.i386.rpm

[root@ns local]# rpm -e gated
gated 하고 zebra 하고 충돌나기 때문에 어느 한 패키지는 삭제해줘야 한다. (메시지가 나왔을시만 해당됨)
[root@ns local]# apt-get install openssl

- 주의사항 -
1. 설치전에 OpenSSL을 업그래이드 시켜 준다. 필자는 레드헷 7.3에서 설치하다 OpenSSL에러가 나서 up2date로 업그래이드 시켜 줬다. 아래와 같은 에러나 나면서 0.9.6e이상 버전을 요구하는데 그냥 up2date로 업그래이드 시켜 줬더니 openssl-0.9.6b-32.7버전으로 교체 되면서 이상없이 설치가 되었다.

configure: error: you need OpenSSL 0.9.6e/0.9.7-beta2 (or newer): CERT CA-2002-23
ftp://rpmfind.net/linux/redhat/updates/7.3/en/os/i386/openssl-0.9.6b-35.7.i386.rpm

5. bind 9.3.0 compile
# ./configure --prefix= /usr/local/bind-9.3.0 --enable-threads
# make
# make install

6. 심볼릭 링크 걸어주기
# cd /usr/local
# ln -s bind-9.3.0/ bind

7. etc, var/run, var/named 디렉토리 생성 
# cd /usr/local/bind
# mkdir etc
# mkdir var
# cd var
# mkdir run
# mkdir named

8. 키 생성
# cd /usr/local/bind/sbin
# ./rndc-confgen > /usr/local/bind/etc/rndc.conf

9. bin 파일 심볼링 링크
# cd /usr/sbin
# mv rndc rndc.bak
# mv rndc-confgen rndc-confgen.bak
# ln -s ../local/bind/sbin/rndc rndc
# ln -s ../local/bind/sbin/rndc-confgen rndc-confgen

# cd /usr/bin
# mv dig dig.bak
# mv nslookup nslookup.bak
# ln -s ../local/bind/bin/dig dig
# ln -s ../local/bind/bin/nslookup nslookup

10. named.conf, kkanari.info.zone 생성
# cd /usr/local/bind/etc
# cat named.conf
options {
        directory "/var/named";
        dump-file "/usr/local/bind/var/tmp/named_dump.db";
        statistics-file "/usr/local/bind/var/tmp/named.stats";
        version "no version";
        /*
         * If there is a firewall between you and nameservers you want
         * to talk to, you might need to uncomment the query-source
         * directive below.  Previous versions of BIND always asked
         * questions using port 53, but BIND 8.1 uses an unprivileged
         * port by default.
         */
        // query-source address * port 53;
};
key "rndc-key" {
       algorithm hmac-md5;
      secret "xx4m2r4GlTiKIaAVrW5fbg==";
};
controls {
       inet 127.0.0.1 port 953
               allow { 127.0.0.1; } keys { "rndc-key"; };
};
zone "." IN {
        type hint;
        file "named.ca";
};
zone "localhost" IN {
        type master;
        file "localhost.zone";
        allow-update { none; };
};
zone "0.0.127.in-addr.arpa" IN {
        type master;
        file "named.local";
        allow-update { none; };
};
zone "kkanari.info" IN {
        type master;
        file "kkanari.info.zone";
        allow-update { key rndc-key; };
};
//include "/etc/rndc.key";

# cd /usr/local/bind/var/named
# cat kkanari.info.zone
$TTL 3600
@       IN      SOA     ns.kkanari.info. root.kkanari.info. (
                                      2004121003 ; serial
                                      28800      ; refresh
                                      7200       ; retry
                                      604800     ; expire
                                      86400      ; minimum
                                      )
        IN      NS      ns.kkanari.info.
        IN      A       210.111.16.144
        IN      MX 10   mail
ns      IN      A       210.111.16.144
ns2     IN      A       210.111.16.144
mail    IN      A       210.111.16.144
ftp     IN      A       210.111.16.144
www     IN      A       210.111.16.144
home    IN      A       210.111.16.144
*       IN      A       210.111.16.144


11. rndc.conf 생성
# cd /usr/local/bind/etc
# cat rndc.conf
# Start of rndc.conf
key "rndc-key" {
        algorithm hmac-md5;
        secret "xx4m2r4GlTiKIaAVrW5fbg==";
};
options {
        default-key "rndc-key";
        default-server 127.0.0.1;
        default-port 953;
};
# End of rndc.conf
# Use with the following in named.conf, adjusting the allow list as needed:
# key "rndc-key" {
#       algorithm hmac-md5;
#       secret "xx4m2r4GlTiKIaAVrW5fbg==";
# };
#
# controls {
#       inet 127.0.0.1 port 953
#               allow { 127.0.0.1; } keys { "rndc-key"; };
# };
# End of named.conf

12. 실행
# /usr/local/bind/sbin/named -c /usr/local/bind/etc/named.conf&

13. 캐슁서버 동작확인
[root@ns bind]# nslookup
> server 127.0.0.1
Default server: 127.0.0.1
Address: 127.0.0.1#53
> naver.com
Server:         127.0.0.1
Address:        127.0.0.1#53
Non-authoritative answer:
Name:   naver.com
Address: 211.218.150.200
> kr.yahoo.com
Server:         127.0.0.1
Address:        127.0.0.1#53
Non-authoritative answer:
kr.yahoo.com    canonical name = home.vip.krn.yahoo.com.
Name:   home.vip.krn.yahoo.com
Address: 202.43.214.190

* 위와같이 쿼리가 온다면 이상없음

14. 도메인 쿼리 동작확인
[root@ns bind]# nslookup
> server 127.0.0.1
Default server: 127.0.0.1
Address: 127.0.0.1#53
> kkanari.info
Server:         127.0.0.1
Address:        127.0.0.1#53
Name:   kkanari.info
Address: 210.111.16.144
> www.kkanari.info
Server:         127.0.0.1
Address:        127.0.0.1#53
Name:   www.kkanari.info
Address: 210.111.16.144
>

* 위와같이 쿼리가 온다면 이상없음