Show Table of Contents
There are several major changes in BIND configuration:
- Default ACL configuration
- In Red Hat Enterprise Linux 5, the default ACL configuration allowed queries and offered recursion for all hosts. By default in Red Hat Enterprise Linux 6, all hosts can make queries for authoritative data but only hosts from the local network can make recursive queries.
allow-recursionoption has been deprecated in favor of this option. It is used to control access to server caches, which include all non-authoritative data (like recursive lookups and root nameserver hints).
- Chroot environment management
bind-chroot-adminscript, which was used to create symlinks from a non-chroot environment to a chroot environment, is deprecated and no longer exists. Instead, configuration can be managed directly in a non-chroot environment and init scripts automatically mount needed files to the chroot environment during
namedstartup in the case that files are not already present in the chroot.
/var/nameddirectory is no longer writable. All zone files that need to be writable (such as dynamic DNS zones, DDNS) must be placed in the new writable directory:
dnssec [yes|no]option removed
- The global
dnssec [yes|no]options have been split into two new options:
dnssec-enableoption enables DNSSEC support. The
dnssec-validationoption enables DNSSEC validation. Note that setting
dnssec-enableto "no" on recursive server means that it cannot be used as a forwarder by another server that performs DNSSEC validation. Both options are set to yes by default.
controlsstatement not required
- You no longer need to specify the
/etc/named.confif you use the
rndcmanagement utility. The
namedservice automatically allows control connections using the loopback device and both
rndcuse the same secret key generated during installation (located in
In a default installation, BIND is installed with DNSSEC validation enabled, and uses the ISC DLV register. This means all signed domains (such as gov., se., cz.), that have their key in the ISC DLV register, are cryptographically validated on the recursive server. If validation fails due to attempts at cache poisoning, then the end user will not be given this forged/spoofed data. DNSSEC deployment is fully supported in Red Hat Enterprise Linux 6. DNSSEC is an important step in making the Internet more secure for end users, and is widely implemented. As previously mentioned, DNSSEC validation is controlled with the