There are several major changes in BIND configuration:
- Default ACL configuration
In Red Hat Enterprise Linux 5, the default ACL configuration allowed queries and offered recursion for all hosts. By default in Red Hat Enterprise Linux 6, all hosts can make queries for authoritative data but only hosts from the local network can make recursive queries.
allow-recursion option has been deprecated in favor of this option. It is used to control access to server caches, which include all non-authoritative data (like recursive lookups and root nameserver hints).
- Chroot environment management
bind-chroot-admin script, which was used to create symlinks from a non-chroot environment to a chroot environment, is deprecated and no longer exists. Instead, configuration can be managed directly in a non-chroot environment and init scripts automatically mount needed files to the chroot environment during
named startup in the case that files are not already present in the chroot.
/var/named directory permissions
/var/named directory is no longer writable. All zone files that need to be writable (such as dynamic DNS zones, DDNS) must be placed in the new writable directory:
dnssec [yes|no] option removed
dnssec [yes|no] options have been split into two new options:
dnssec-enable option enables DNSSEC support. The
dnssec-validation option enables DNSSEC validation. Note that setting
dnssec-enable to "no" on recursive server means that it cannot be used as a forwarder by another server that performs DNSSEC validation. Both options are set to yes by default.
controls statement not required
You no longer need to specify the
controls statement in
/etc/named.conf if you use the
rndc management utility. The
named service automatically allows control connections using the loopback device and both
rndc use the same secret key generated during installation (located in
In a default installation, BIND is installed with DNSSEC validation enabled, and uses the ISC DLV register. This means all signed domains (such as gov., se., cz.), that have their key in the ISC DLV register, are cryptographically validated on the recursive server. If validation fails due to attempts at cache poisoning, then the end user will not be given this forged/spoofed data. DNSSEC deployment is fully supported in Red Hat Enterprise Linux 6. DNSSEC is an important step in making the Internet more secure for end users, and is widely implemented. As previously mentioned, DNSSEC validation is controlled with the
dnssec-validation option in