Securing and Optimizing Linux: RedHat Edition -A Hands on Guide
Prev	Chapter 21. Software -Networking	Next

21.3. `Caching-only` name Server

Caching-only name servers are servers not authoritative for any domains except 0.0.127.in-addr.arpa, the localhost. A caching-only name server can look up names inside and outside your zone, as can primary and slave name servers. The difference is that when a caching-only name server initially looks up a name within your zone, it ends up asking one of the primary or slave names servers for your zone for the answer.

The necessary files to setup a simple caching name server are:

named.conf
db.127.0.0
db.cache
named script

To configure the /etc/named.conf file for a simple caching name server, use this for all servers that dont act as a master or slave name server. Setting up a simple caching server for local client machines will reduce the load on the network's primary server. Many users on dialup connections may use this configuration along with bind for such a purpose. Create the named.conf file, touch /etc/named.conf and add the following lines to the file:

 options {
 directory "/var/named";
 forwarders { 208.164.186.1; 208.164.186.2; };
 forward only;
 };

 //
 // a caching only nameserver config
 zone "." in {
 type hint;
 file "db.cache";
 };

 zone "0.0.127.in-addr.arpa" in {
 type master;
 file "db.127.0.0";
 };

: In the forwarders line, 208.164.186.1 and 208.164.186.2 are the IP addresses of your Primary Master and Secondary Slave DNS server. They can also be the IP addresses of your ISPs DNS server and another DNS server, respectively.

: To improve the security of your BIND/DNS server you can stop it from even trying to contact an off-site server if their forwarder is down or doesn't respond. With the forward only option set in your named.conf file, the name server doesn't try to contact other servers to find out information if the forwarder doesn't give it an answer.

To configure the /var/named/db.127.0.0 file for a simple caching name server,you can use this configuration for all machines on your network that don't act as a master or slave name server. The db.127.0.0 file covers the loopback network. Create the following files in /var/named/, touch /var/named/db.127.0.0 and add the following lines in the file:

 $TTL 345600
 @       IN      SOA     localhost. root.localhost.  (
 00     ; Serial
 86400  ; Refresh
 7200   ; Retry
 2592000        ; Expire
 345600 )       ; Minimum
 IN      NS      localhost.

 1        IN      PTR     localhost.

Configure the /var/named/db.cache file for a simple caching name server before starting your DNS server. You must take a copy of db.cache file and copy this file to the /var/named/ directory. The db.cache tells your server where the servers for the root zone are.

Use the following commands on another Unix computer in your organization to query a new db.cache file for your DNS Server or pick one from your Red Hat Linux CD-ROM source distribution:

 [root@deep]# dig @.aroot-servers.net . ns > db.cache

Don't forget to copy the db.cache file to the /var/named/ directory on your server where you're installing DNS server after retrieving it over the Internet.

: Internal addresses like 192.168.1/24 are not included in the DNS configuration files for security reasons. It is very important that DNS doesn't exist between hosts on the corporate network and external hosts.

21.3. Caching-only name Server

21.3. `Caching-only` name Server