RHEL 6 Migration - 4.4. BIND

Red Hat Enterprise Linux 9 Essentials Book now available.

Purchase a copy of Red Hat Enterprise Linux 9 (RHEL 9) Essentials

Red Hat Enterprise Linux 9 Essentials Print and eBook (PDF) editions contain 34 chapters and 298 pages

4.4. BIND

There are several major changes in BIND configuration:

Default ACL configuration - in Red Hat Enterprise Linux 5, the default ACL configuration allowed queries and offered recursion for all hosts. By default in Red Hat Enterprise Linux 6, all hosts can make queries for authoritative data but only hosts from the local network can make recursive queries.
New allow-query-cache option - the allow-recursion option has been deprecated in favor of this option. It is used to control access to server caches, which include all non-authoritative data (like recursive lookups and root nameserver hints).
Chroot environment management - the bind-chroot-admin script, which was used to create symlinks from a non-chroot environment to a chroot enviromnent, is deprecated and no longer exists. Instead, configuration can be managed directly in a non-chroot environment and init scripts automatically mount needed files to the chroot environment during named startup in the case that files are not already present in the chroot.
/var/named directory permissions - The /var/named directory is no longer writable. All zone files that need to be writable (such as dynamic DNS zones, DDNS) should be placed in the new writable directory: /var/named/dynamic.
The dnssec [yes|no] option no longer exists - The global dnssec [yes|no] options have been split into two new options: dnssec-enable and dnssec-validation. The dnssec-enable option enables DNSSEC support. The dnssec-validation option enables DNSSEC validation. Note that setting dnssec-enable to "no" on recursive server means that it cannot be used as a forwarder by another server that performs DNSSEC validation. Both options are set to yes by default.
You no longer need to specify the controls statement in /etc/named.conf if you use the rndc management utility. The named service automatically allows control connections via the loopback device and both named and rndc use the same secret key generated during installation (located in /etc/rndc.key).

In a default installation, BIND is installed with DNSSEC validation enabled, and uses the ISC DLV register. This means all signed domains (such as gov., se., cz.), that have their key in the ISC DLV register, are cryptographically validated on the recursive server. If validation fails due to attempts at cache poisoning, then the end user will not be given this forged/spoofed data. DNSSEC deployment is now a widely-implemented feature, is an important step in making the Internet more secure for end users, and is fully supported in Red Hat Enterprise Linux 6. As previously mentioned, DNSSEC validation is controlled with the dnssec-validation option in /etc/named.conf.