MARaDNS na Debianie — instalacja i podstawowa konfiguracja

MARaDNS na Debianie — instalacja i podstawowa konfiguracja

MaraDNS is a small, free and lightweight Domain Name Server. It is an alternative open-source DNS server, which acts as a caching, recursive, or authoritative nameserver. It is remarkably easy to configure and available for Linux and Windows platform.

MaraDNS is written entirely in C. far cleaner code. It is also called as DNS forwarding. It can be downloaded from here.

Co to jest MaraDNS i jakie role może pełnić

MaraDNS called Duende. MaraDNS is now installed. The MaraDNS service is installed at /etc/init.d/maradns.

Authoritative DNS servers “know” the mapping of URL to IP for any given domain. They are the source of the information that the recursive DNS servers send to web clients like browsers(Chrome, Firefox).

A recursive DNS server is a DNS server that is able to contact other DNS servers in order to resolve a given domain name label. An authoritative DNS server is a DNS server that a recursive server contacts in order to find out the answer to a given DNS query.

Wymagania i tryb pracy: recursive vs authoritative

By default the authoritative nameserver listens on port 127.0.0.1 and the recursive one on port 127.0.0.2.

The recursive DNS server’s init script is required to be made compatible with chkconfig before you can have it run at startup.

For security reasons, MaraDNSaq fetchzone client does not add records which are not part of the zone in question.

Deadwood, a recursive name server. server called coLunacyDNS.

Instalacja na Debianie: przygotowanie pakietów i uruchomienie

Let us now get started with MaraDNS on CentOS 7. Download the latest source archive from here.

We are done with setting up the MaraDNS server! You can these sample files from here.

MaraDNS is now installed. The MaraDNS service is installed at /etc/init.d/maradns.

In order for MaraDNS to function as an authoritative nameserver, two or more files need to be set up: the mararc file and one or more "csv1" zone files.

In order for MaraDNS to function as a daemon, the duende program is used to daemonize MaraDNS.

If MaraDNS is being used as an authoritative nameserver, allow UDP connections from all hosts on the internet to UDP port 53 for the IP that the authoritative nameserver uses.

Uruchamianie i plik konfiguracyjny

The first is the location of a mararc file which MaraDNS obtains all configuration information from. The default location of this file is /etc/mararc. This is specified in the form maradns -f mararc_file_location; mararc_file_location is the location of the mararc file.

It is also possible to have MaraDNS display the version number and exit. If MaraDNS is functioning only as a recursive nameserver, just one file needs to be set up: The mararc file.

The configuration format of the mararc file can be obtained from the mararc(5) manual page.

Konfiguracja serwera: podstawowe zasady plików

Edit the MaraDNS’ configuration file i.e. The first line tells MaraDNS to listen on IP-127.0.0.1. You can add more IPs to it, separated by comma.

example.net. +14400 soa ns1.example.net. example.net. +14400 ns ns1.example.net. example.net. +14400 ns ns2.example.net. ns1.example.net. ns2.example.net. example.net. www.example.net. example.net.

You begin with the Start Of Authority (SOA) line. You then specify the authoritative nameservers and the other records.

A record consists of the domain name, TTL (Time to live), record type and the value of the record.

Two things to note are that all domain names end with a period i.e. they must be fully qualified domain names and all records end with a tilde character (~).

To know more, check out the documentation on the format of zone files.

To be more simple, lets just point example.net to 127.0.0.1.

Strefy (zone) w MaraDNS: csv1 i format

In order for MaraDNS to function as an authoritative nameserver, two or more files need to be set up: the mararc file and one or more "csv1" zone files.

The configuration formation of a csv1 zone file can be obtained from the csv1(5) manual page.

While csv1 zone files are fully supported in MaraDNS 1.2, there is a Perl script for updating from CSV1 to CSV2 zone files in the tools/ directory of MaraDNS 1.2.

Przykład: wpisy SOA i rekordy NS/A

You begin with the Start Of Authority (SOA) line. You then specify the authoritative nameservers and the other records.

A record consists of the domain name, TTL (Time to live), record type and the value of the record.

For security reasons, MaraDNSaq fetchzone client does not add records which are not part of the zone in question.

1.1.1.10.in-addr.arpa. PTR dns.example.com. MaraDNS will not add the record, since the record is out-of-bailiwick. In other words, it is a host name that does not end in .example.com.

Konfiguracja recursive DNS: DNS forwarding

When your web browser sends out a DNS query - assuming the browser doesn’t already have the mapping stored in its cache - it is sent to a recursive DNS server.

It is also called as DNS forwarding.

It by default listens on port- 127.0.0.2 and you can add more IPs to it, separated by comma. For eg.- 127.0.0.2, x.x.x.x.

Note the ["."]. The reason for this is so future versions of MaraDNS may have more fine-grained control over the upstream_servers and root_servers values.

Note that the upstream_servers variable needs to be initialized before being used via upstream_servers = {} (the reason for this is so that a mararc file has 100% Python-compatible syntax).

Czas odpowiedzi i zachowanie przy problemach upstream

MaraDNS, by default, only waits two seconds for a reply from a remote DNS server.

Note that making this too high will slow MaraDNS down when DNS servers are down, which is, alas, all too common on todayaqs internet.

Reverse DNS w MaraDNS (PTR)

Reverse DNS (sometimes called "reverse mapping") is set up by using PTR (pointer) records.

4.3.2.10.in-addr.arpa. PTR www.example.com. www.example.com.

If you wish to have a PTR (reverse DNS lookup; getting a DNS name from a numeric IP) record work on the internet at large, it is not a simple matter of just adding a record like this to a MaraDNS zonefile.

One also needs control of the appropriate in-addr.arpa. domain.

While it is possible to obtain a domain and run a DNS server without the knowledge or intervention of an ISP, being able to control reverse DNS lookups for those IPs requires ISP intervention.

Przykładowa konfiguracja: minimalny „punkt” domeny do IP

To be more simple, lets just point example.net to 127.0.0.1.

On a related note, the reason why MaraDNSaq web page validate? HTML pages on the MaraDNS.org web site should validate as HTML 4.0 Transitional. However, the CSS will not validate.

Cross-browser support is more important than strict W3 validation.

Bezpieczeństwo i odporność

MaraDNS uses a strong secure RNG for both the query (16 bits of entropy) and the source port of the query (12 bits of entropy).

MaraDNSaq fetchzone client does not add records which are not part of the zone in question.

This feature is only available to subscribers. and remarkably secure. or clang.

Wsparcie dla SPF i rekordów tekstowych

MaraDNS has full support for SPF, both via TXT records and, starting with MaraDNS 1.2.08, via RFC4408 SPF records.

SPF configuration is beyond the scope of MaraDNSaq documentation.

The BIND examples will work in MaraDNS csv2 zone files as long as the double quotes (") are replaced by single quotes (aq).

For example, a SPF TXT record that looks like example.net. IN... obtains all configuration information from.

Rozwiązywanie typowych problemów uruchomieniowych

When I try to run MaraDNS, I get a cryptic error message.

There is usually some context of where there is a syntax error in a data file before the cryptic error message.

For example, when there is a syntax error in a csv2 zone file, MaraDNS will tell you exactly at what point it had to terminate parsing of the zone file.

MaraDNS is designed to be easy to use; cryptic error messages go against this spirit.

Porty, UDP i sprawdzanie działania

Udp services do not have a prominent "LISTEN" when netstat is run.

While on the topic of netstat, if you run netstat -nap as root on Linux and some other *nix operating systems, you can see the names of the processes which are providing internet services.

MaraDNS uses UDP DNS port (port 53).

Ograniczenia i kompatybilność czasowa (Y2038)

MaraDNS is fully Y2038 compliant on systems with a 64-bit time_t. OS-level time and date libraries are disabled.

OS-level time and date libraries are disabled if time_t is 32-bit.

MaraDNS 1.0 is not Y2038 compliant, and will have problems starting in 2036 or so. MaraDNS 1.2, on the other hand, is fully Y2038 compliant.

Przenośność i platformy

MaraDNS may compile or run on other systems-there are official MaraDNS ports for Debian/Ubuntu, Slackware, FreeBSD, and NetBSD.

Note that MaraDNS needs a system with a robust threading library, which some systems do not have.

Yes. There is both a partial mingw32 (native win32 binary) port and a full Cygwin port of MaraDNS; both of these ports are part of the native build of MaraDNS.

FAQ: różnice między recursive i authoritative oraz inne podstawy

What is the difference between an authoritative and a recursive DNS server?

An authoritative DNS server is a DNS server that a recursive server contacts in order to find out the answer to a given DNS query.

A recursive DNS server is a DNS server that is able to contact other DNS servers in order to resolve a given domain name label.

Is MaraDNS portable? MaraDNS is developed on a CentOS 3 and Windows XP dual boot laptop.

Can MaraDNS act as a primary nameserver? Yes. The zoneserver program serves zones so that other DNS servers can be secondaries for zones which MaraDNS serves.

Can MaraDNS act as a secondary nameserver? Yes. Please read the DNS slave document, which is part of the MaraDNS tutorial.

Wersje i aktualizacja: MaraDNS 1.0 vs 1.2

MaraDNS 1.0 will continue to be supported until December 21, 2007; this means that MaraDNS 1.0 bug fixes will still be applied.

After 2007/12/21, MaraDNS 1.0 will no longer be fully supported; the only updates, at that point, would be bugtraq-worthy critical security fixes.

Not even these security updates will be applied after December 21, 2010.

People who wish to run MaraDNS 1.0 unsupported after 2010/12/21 need to keep in mind that MaraDNS 1.0 is not Y2038 compliant, and will have problems starting in 2036 or so.

Updating from 1.0 to 1.2 requires a minimum number of changes; with most configurations, MaraDNS 1.2 is fully compatible with MaraDNS 1.0 data files.

Mini-ściąga składni: kroki konfiguracji

• MaraDNS obtains all configuration information from /etc/mararc.
• The first line tells MaraDNS to listen on IP-127.0.0.1. You can add more IPs to it, separated by comma.
• Zone plik zaczyna się od SOA: You begin with the Start Of Authority (SOA) line.
• Rekordy mają postać: domena, TTL, typ rekordu i wartość rekordu.
• Wszystkie domeny kończą się kropką, a rekordy kończą się tyldą (~).

Cel	Wymagane pliki	Kluczowe elementy
Recursive nameserver	mararc	Port 127.0.0.2, DNS forwarding, lista upstreamów rozdzielana przecinkami
Authoritative nameserver	mararc + csv1 zone(s)	SOA, NS, A i inne rekordy w strefie; domeny z kropką; rekordy z tyldą (~)

Powiązane zagadnienia: reverse, MX i CNAMES

How do MX records work? As an aside, do not have MX records point to CNAMEs.

Iaqm having problems resolving CNAMES I have set up.

I have a NS delegation, and MaraDNS is doing strange things. I am transferring a zone from another server, but the NS records are these strange "synth-ip" records.

Dodatkowe uwagi: ograniczanie zachowania i wydajność

MaraDNS is optimized for serving a small number of domains as quickly as possible.

That said, MaraDNS is remarkably efficnent for serving a large number of domains, as long as the server MaraDNS is on has the memory to fit all of the domains, and as long as the startup time for loading a large number of domains can be worked around.

As can be seen, MaraDNS will process 1 or 100000 domains in the same amount of time, once the domain names are loaded in to memory.

Deadwood can block up to about 20,000 domains.

MaraDNS uses a multi-threaded model. The multi-threaded model is, plain and simple, the simplest way to write a functioning recursive DNS server.

SPF: przykład logiki rekordów

MaraDNS has full support for SPF, both via TXT records and, starting with MaraDNS 1.2.08, via RFC4408 SPF records.

The BIND examples will work in MaraDNS csv2 zone files as long as the double quotes (") are replaced by single quotes (aq).

For example, a SPF TXT record that looks like example.net. IN... obtains all configuration information from.

Zmiana i utrzymanie: jak wprowadzać poprawki

Is there any process I need to follow to add a patch to MaraDNS? Yes.

Copy over the file that you wish to modify to another file name.

If I find that the patch works well, I will integrate it in to MaraDNS.

Co warto sprawdzić przy konfiguracji

• Porty: authoritative na 127.0.0.1, recursive domyślnie na 127.0.0.2.
• Składnia: domeny kończą się kropką, rekordy kończą się tyldą (~).
• SOA i reszta rekordów strefy są określone po linii SOA.
• Upstreamy dla recursive są dodawane rozdzielone przecinkami.

tags: #maradns #debian #instalacja

Popularne posty:

• Problemy z niewykorzystaną pamięcią RAM w Windows 7 – przyczyny i rozwiązania
• Kontrola połączeń Bluetooth w Windows 7 — najlepsze praktyki
• Acer Aspire Switch 10: przywracanie systemu i diagnostyka BIOS przy braku wykrycia dysku
• Aktualizacje jądra w Debianie: przewodnik po repozytoriach
• Jak przyspieszyć Windows 7 Starter: poradnik optymalizacyjny