I am using 2 dns server here. 192.168.2.83 (Master) and 192.168.2.86 (Slave)<\/p>\n
First lets setup the Master<\/p>\n
1. Create \/etc\/named.conf as RHEL 5.8 does not provide a sample file. Then add the following content to it<\/p>\n
\r\ninclude \"\/etc\/transfer.key\";\r\nserver 192.168.2.86 {\r\n keys { HOST1-HOST2. ;};\r\n};\r\nacl domblocal { 192.168.2.0\/24;\r\n 127.0.0.1;\r\n};\r\n\r\noptions { allow-transfer { 192.168.2.86;};\r\n directory \"\/var\/named\";\r\n notify yes;\r\n };\r\n\r\n\/\/include \"\/etc\/named.rfc1912.zones\";\r\n\r\nzone \"2.168.192.in-addr.arpa\" {\r\n type master;\r\n\/\/ allow-transfer { 192.168.2.86;};\r\n allow-transfer { key HOST1-HOST2. ;};\r\n allow-query { domblocal;};\r\n file \"2.168.192.in-addr.arpa.zone\";\r\n};\r\n\r\nzone \"local.domb.com\" {\r\n type master;\r\n\/\/ allow-transfer { 192.168.2.86;};\r\n allow-transfer { key HOST1-HOST2. ;};\r\n allow-query { domblocal;};\r\n file \"local.domb.com.zone\";\r\n};\r\n<\/pre>\n2. Create the zone files. Lets begin with the reverse zone in \/var\/named\/2.168.192.in-addr.arpa.zone<\/p>\n
\r\n$ORIGIN .\r\n$TTL 86400\r\n2.168.192.in-addr.arpa IN SOA ns1.local.domb.com. root.2.168.192.in-addr.arpa. (\r\n 50 ; serial\r\n 1H ; refresh\r\n 15M ; retry\r\n 1W ; expiry\r\n 1D ; minimum\r\n )\r\n NS ns1.local.domb.com.\r\n NS ns2.local.domb.com.\r\n$ORIGIN 2.168.192.in-addr.arpa.\r\n83 PTR ns1.local.domb.com.\r\n86 PTR ns2.local.domb.com.\r\n231 PTR test.local.domb.com.\r\n<\/pre>\n3. Add forward zone local.domb.com.zone<\/p>\n
\r\n$ORIGIN .\r\n$TTL 86400\r\nlocal.domb.com IN SOA ns1.local.domb.com. root.local.domb.com. (\r\n 50 ; serial\r\n 1H ; refresh\r\n 15M ; retry\r\n 1W ; expiry\r\n 1D) ; minimum\r\n NS ns1.local.domb.com.\r\n NS ns2.local.domb.com.\r\n$ORIGIN local.domb.com.\r\nns1 A 192.168.2.83\r\nns2 A 192.168.2.86\r\ntest A 192.168.2.231\r\n<\/pre>\n4. Add iptables<\/p>\n
\r\n# iptables -I INPUT -p udp --dport 53 -j ACCEPT\r\n# iptables -I INPUT -p udp --dport 953 -j ACCEPT\r\n# iptables -I INPUT -p tcp --dport 53 -j ACCEPT\r\n# iptables -I INPUT -p tcp --dport 953 -j ACCEPT\r\n<\/pre>\n5. Create the TSIG key<\/p>\n
\r\n# dnssec-keygen -a HMAC-MD5 -b 128 -n HOST rndc-key\r\n<\/pre>\n6. Create the transfer.key file. Cat the file and add its content to the transfer.key file<\/p>\n
\r\n# cat Ktransfer.+157+58702.private\r\n<\/pre>\n7. This how the transfer key file should look like. After you added the keyfile transfer it to the slave host.<\/p>\n
\r\nkeys HOST1-HOST2. {\r\nalgorithm hmac-md5;\r\nsecret \"SKDuwwhNH+adsfasfda\/aJ\/zOV9PPIblBNiehnFo=\";\r\n};\r\n<\/pre>\n8. Login to the slave add add the named.conf<\/p>\n
\r\ninclude \"\/etc\/transfer.key\";\r\nserver 192.168.2.83 { \r\n keys { HOST1-HOST2. ;};\r\n};\r\n\r\nacl domblocal { 192.168.2.0\/24;\r\n 127.0.0.1;\r\n};\r\n\r\noptions { allow-transfer { 192.168.2.83;};\r\n directory \"\/var\/named\";\r\n };\r\n\r\n\/\/include \"\/etc\/named.rfc1912.zones\";\r\n\r\nzone \"2.168.192.in-addr.arpa\" {\r\n type slave;\r\n allow-query { domblocal; };\r\n file \"\/var\/named\/slaves\/2.168.192.in-addr.arpa.zone\";\r\n masters { 192.168.2.83; };\r\n allow-notify { 192.168.2.86;};\r\n\/\/ allow-transfer { none; };\r\n};\r\n\r\nzone \"local.domb.com\" {\r\n type slave;\r\n allow-query { domblocal; };\r\n file \"\/var\/named\/slaves\/local.domb.com.zone\";\r\n allow-notify { 192.168.2.86;};\r\n masters { 192.168.2.83; };\r\n\/\/ allow-transfer { none; };\r\n};\r\n<\/pre>\n9. Now create the zone files for the slave. Lets start with the reverse zone file in \/var\/namend\/slaves\/<\/p>\n
\r\n$ORIGIN .\r\n$TTL 86400 ; 1 day\r\n2.168.192.in-addr.arpa IN SOA ns1.local.domb.com. root.2.168.192.in-addr.arpa. (\r\n 50 ; serial\r\n 3600 ; refresh (1 hour)\r\n 900 ; retry (15 minutes)\r\n 604800 ; expire (1 week)\r\n 86400 ; minimum (1 day)\r\n )\r\n NS ns1.local.domb.com.\r\n NS ns2.local.domb.com.\r\n$ORIGIN 2.168.192.in-addr.arpa.\r\n231 PTR test.local.domb.com.\r\n83 PTR ns1.local.domb.com.\r\n86 PTR ns2.local.domb.com.\r\n<\/pre>\n10. Add the foreward Zone<\/p>\n
\r\n$ORIGIN .\r\n$TTL 86400 ; 1 day\r\nlocal.domb.com IN SOA ns1.local.domb.com. root.local.domb.com. (\r\n 50 ; serial\r\n 3600 ; refresh (1 hour)\r\n 900 ; retry (15 minutes)\r\n 604800 ; expire (1 week)\r\n 86400 ; minimum (1 day)\r\n )\r\n NS ns1.local.domb.com.\r\n NS ns2.local.domb.com.\r\n$ORIGIN local.domb.com.\r\ntest A 192.168.2.231\r\nns1 A 192.168.2.83\r\nns2 A 192.168.2.86\r\n<\/pre>\n11. Restart both dns server and do an rndc reload on the master. Look at \/var\/log\/messages on the client. You should see something like<\/p>\n
\r\nMay 13 00:00:58 ns2 named[2913]: zone local.domb.com\/IN: transferred serial 49: TSIG 'host1-host2'\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"I am using 2 dns server here. 192.168.2.83 (Master) and 192.168.2.86 (Slave) First lets setup the Master 1. Create \/etc\/named.conf as RHEL 5.8 does not provide a sample file. Then add the following content to it include “\/etc\/transfer.key”; server 192.168.2.86 { keys { HOST1-HOST2. ;}; }; acl domblocal { 192.168.2.0\/24; 127.0.0.1; }; options { allow-transfer…<\/p>\n","protected":false},"author":2,"featured_media":162,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_themeisle_gutenberg_block_has_review":false,"footnotes":""},"categories":[3],"tags":[15],"class_list":["post-475","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","tag-dns-tsig-rhcss"],"_links":{"self":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/475","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=475"}],"version-history":[{"count":22,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/475\/revisions"}],"predecessor-version":[{"id":508,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/475\/revisions\/508"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/media\/162"}],"wp:attachment":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=475"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=475"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=475"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}