Introduction

This document describes how DNS and DHCP work on the Arda Network. I’ve managed to use many of the features of DNS and DHCP in my setup so this document should provide a fairly comprehensive guide as to how to get things working. Features you’ll find described here include:

• Dynamic updates between DHCP and DNS
• Automatic zone updates between master and slave name servers
• Control of DNS using rndc
• Secure DNS operations using TSIG
• Access control lists
• Views
• CIDR networks

I chose to use the Internet Systems Consortium’s (ISC) implementations of DNS and DHCP for the Arda Network. Why you ask? Because they are both in wide use so I thought I would be able to find a lot of resources to assist me in setting up the software. It turned out that I was correct in this assumption. In particular, I relied on an excellent book from O'Reilly Press called ‘DNS and BIND’. This book provides much useful information; I highly recommend it.

The particular versions of software I use are:

• BIND 9.3.2 and 9.3.1
• DHCP 3.0.4

In the DHCP configuration file, the option used to invoke dynamic updates with a DNS server is also sensitive to the particular version of DHCP you are using.

DNS on the Arda Network is handled by two machines, Europa and Io, that act as a master/slave pair. These two machines use automated zone transfers, secured using TSIG keys, to stay in sync. The master DNS server is also dynamically updated by the DHCP server. Dynamic updates are also secured using TSIG.

On both Europa and Io, all TSIG keys were generated using this command.

dnssec-keygen -a HMAC-MD5 -b 256 -n HOST <key name>

Configuration Files

Because I’m using TSIG to secure such things as zone transfers and rndc, getting the permissions on the various configuration files right is very important. Here are the ownership and permissions of the various configuration files on Europa. Take note of the ownership and permissions of the rndc related files. They are set up this way so that named can read these files but only a process with root privileges can change them.

File Name	Owner	Permissions
/etc/namedb/etc/named.conf	root:root	644
/etc/namedb/etc/rndc.key	root:named	640
/etc/rndc.conf	root:root	600
/etc/resolv.conf	root:root	644

Here is my named.conf file.

// named.conf

// secret must be the same as in /etc/rndc.conf
include "/etc/rndc.key";

acl "internal-net" { 192.168.10/27; 127.0.0.1; };
acl "colonies" { 10.10.0.1; };

controls {
    inet 127.0.0.1 allow { any; } keys { "rndc-key"; };
};

logging {
    channel "named_log" {
        // send most BIND logs to a dedicated log file
        file "/var/log/named.log" versions 10 size 500k;
        severity dynamic;
        print-category yes;
        print-severity yes;
        print-time yes;
    };

    channel "query_log" {
        // query logs go to a separate file
        file "/var/log/query.log" versions 10 size 500k;
        severity debug;
        print-severity yes;
        print-time yes;
    };
	
    category default { named_log; };
    category queries { query_log; };
};

options {
    directory "/";
    pid-file "var/run/named.pid";
    statistics-file "master/named.stats";
    dump-file "master/named.dump";
    listen-on { "internal-net"; };
    allow-query { "internal-net"; "colonies"; };
    allow-transfer { none; };
    notify no;

    forwarders { <ISP DNS server 1>; <ISP DNS server 2>; };
	
    /*
     * If there is a firewall between you and nameservers you want
     * to talk to, you might need to uncomment the query-source
     * directive below.  Previous versions of BIND always asked
     * questions using port 53, but BIND 8.1 uses an unprivileged
     * port by default.
     */
     // query-source address * port 53;
};

view "standard-in" in {

    zone "." {
        type hint;
        file "master/named.root";
    };

    zone "arda.homeunix.net" {
        type master;
        file "master/arda.homeunix.net.zone";
        allow-transfer { key "europa-io"; };
        //allow-update { key "europa-dhcp"; };
        update-policy { grant europa-dhcp subdomain arda.homeunix.net. A TXT; };
        notify yes;
    };

    zone "arda.homelinux.net" {
        type master;
        file "master/arda.homelinux.net.zone";
        allow-transfer { key "europa-io"; };
        notify yes;
    };

    zone "10.168.192.in-addr.arpa" {
        type master;
        file "master/10.168.192.in-addr.arpa";
        allow-transfer { key "europa-io"; };
        //allow-update { key "europa-dhcp"; };
        update-policy { grant europa-dhcp subdomain 10.168.192.in-addr.arpa. PTR TXT; };
        notify yes;
    };
	
    zone "0.10.10.in-addr.arpa" {
        type master;
        file "master/0.10.10.in-addr.arpa";
        allow-transfer { key "europa-io"; };
        notify yes;
    };

    zone "localhost" {
        type master;
        file "master/localhost.zone";
    };

    zone "0.0.127.in-addr.arpa" {
        type master;
        file "master/localhost.rev";
    };

    zone "0.in-addr.arpa" {
        type master;
        file "master/named.network";
    };

    zone "255.in-addr.arpa" {
        type master;
        file "master/named.broadcast";
    };
};

view "ultimate-chaos" chaos {

    recursion no;

    zone "." {
        type hint;
        file "/dev/null";
    };
	
    zone "bind" {
        type master;
        file "master/named.bind";
    };
};

Some things to note concerning my named.conf file include the following points.

Zone Files

There are times when I’ve needed to manually update a zone file. Since Europa is the master name server, I always make the change on this machine and allow the normal zone transfer process to propogate the change to Io. Of course, because I have a slave name server and because I’m doing dynamic updates with DHCP, the process of making a change takes a few steps.

1. Use rndc to stop BIND.
2. Remove any .jnl files from the zone file directory.
3. Edit the zone files as necessary. Make sure to increment the serial number of any file edited.
4. Start BIND using its startup script.

On Europa, not only do I run BIND with reduced privileges, but it also runs in a chroot jail. Here is how I did it.

1. The first thing to do was to decide where to put everything. I decided to create the directory /etc/namedb which would become BIND’s root.

2. I needed to add a number of directories and files to namedb. Here is what things looked like after I was done.
   
   

   drwxr-xr-x    6 root     root         4096 Jan 19 20:13 /etc/namedb/
   drwxr-xr-x    2 root     root         4096 Jan 19 20:21 /etc/namedb/dev/
   crw-rw-rw-    1 root     root       1,   3 Jan 19 20:00 /etc/namedb/dev/null
   crw-r--r--    1 root     root       1,   8 Jan 19 20:21 /etc/namedb/dev/random
   drwxr-xr-x    2 root     root         4096 Jan 19 19:59 /etc/namedb/etc/
   -rw-r--r--    1 root     root         1267 Jan 19 19:54 /etc/namedb/etc/localtime
   -rw-r--r--    1 root     root         1592 Jul  5 16:38 /etc/namedb/etc/named.conf
   -rw-r-----    1 root     named         344 Jan 19 19:55 /etc/namedb/etc/rndc.key
   drwxr-xr-x    2 named    named        4096 Jan 19 19:56 /etc/namedb/master/
   -rw-r--r--    1 root     root          412 Jul  5 17:00 /etc/namedb/master/0.10.10.in-addr.arpa
   -rw-r--r--    1 named    named         803 Jul  5 16:56 /etc/namedb/master/10.168.192.in-addr.arpa
   -rw-r--r--    1 named    named        1460 Jul  5 16:56 /etc/namedb/master/10.168.192.in-addr.arpa.jnl
   -rw-r--r--    1 root     root          781 Jul  5 17:35 /etc/namedb/master/arda.homelinux.net.zone
   -rw-r--r--    1 named    named         797 Jul  5 16:57 /etc/namedb/master/arda.homeunix.net.zone
   -rw-r--r--    1 named    named        1460 Jul  5 16:57 /etc/namedb/master/arda.homeunix.net.zone.jnl
   -rw-r--r--    1 root     root          620 Jul  5 16:46 /etc/namedb/master/localhost.rev
   -rw-r--r--    1 root     root          619 Jul  5 16:46 /etc/namedb/master/localhost.zone
   -rw-r--r--    1 root     root          592 Jul  5 16:47 /etc/namedb/master/named.bind
   -rw-r--r--    1 root     root          551 Jul  5 16:48 /etc/namedb/master/named.broadcast
   -rw-r--r--    1 root     root          551 Jul  5 16:48 /etc/namedb/master/named.network
   -rw-r--r--    1 root     root         1516 Jul  6 08:00 /etc/namedb/master/named.root
   drwxr-xr-x    3 root     root         4096 Jan 19 20:14 /etc/namedb/var/
   drwxr-xr-x    2 named    named        4096 Jan 19 20:24 /etc/namedb/var/run/
   

   • The var/run directory is where BIND’s pid file will go.
   • Create the dev/null special file using the command 'mknod /etc/namedb/dev/null c 1 3'.
   • Create the dev/random special file using the command 'mknod /etc/namedb/dev/random c 1 8'.
   • When creating the special files with mknod, it’s a good idea to check the corresponding files in the /dev directory to make sure the major and minor numbers are correct. You want to use whatever the files in the /dev directory use.
   • The etc/localtime file is copied from /etc. This file ensures BIND uses the correct timezone in its log messages.
   • The arda.homeunix.net.zone and 10.168.192.in-addr.arpa zone files must be writable by the user named because they are dynamically updated by dhcpd. The two *.jnl files are owned by named when they are created by dhcpd.

3. Before I started using log channels in named.conf, I needed to give BIND a way to send messages to syslog from within the chroot jail. To accomplish this, I modified one line in the file /etc/sysconfig/syslog.
   SYSLOGD_OPTIONS="-m 0"
       became
   SYSLOGD_OPTIONS="-m 0 -a /etc/namedb/dev/log"
   
   Stopping and starting syslog will cause a new syslog socket to appear in the /etc/namedb/dev directory. Since I use log channels now, I don’t do this step anymore.

4. The last thing to do is modify BIND’s startup parameters to tell it to run in the jail. I did this by adding the following line to the /etc/sysconfig/named file.
   ROOTDIR="/etc/namedb"

Startup Scripts

I run BIND under the user and group 'named'. Here is what my /etc/rc.d/init.d/named startup script looks like. I needed to modify it so that it would look for binaries in /usr/local/sbin instead of /usr/sbin and to look for rndc.conf in /etc and not in the chroot jail.

#!/bin/bash
#
# named           This shell script takes care of starting and stopping
#                 named (BIND DNS server).
#
# chkconfig: 345 55 45
# description: named (BIND) is a Domain Name Server (DNS) \
# that is used to resolve host names to IP addresses.
# probe: true

# Source function library.
. /etc/rc.d/init.d/functions

# Source networking configuration.
. /etc/sysconfig/network

# Check that networking is up.
[ "${NETWORKING}" = "no" ] && exit 0

[ -f /etc/sysconfig/named ] && . /etc/sysconfig/named

[ -f /usr/local/sbin/named ] || exit 0

[ -f ${ROOTDIR}/etc/named.conf ] || exit 0

RETVAL=0
prog="named"

start() {
        # Start daemons.
        gprintf "Starting %s: " $prog
        if [ -n "${ROOTDIR}" -a "x${ROOTDIR}" != "x/" ]; then
                OPTIONS="${OPTIONS} -t ${ROOTDIR}"
        fi
        daemon /usr/local/sbin/named -u named ${OPTIONS}
        RETVAL=$?
        [ $RETVAL -eq 0 ] && touch /var/lock/subsys/named
        echo
        return $RETVAL
}
stop() {
        # Stop daemons.
        gprintf "Stopping %s: " $prog
        killproc named
        RETVAL=$?
        [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/named
        echo
        return $RETVAL
}
rhstatus() {
        #/usr/sbin/rndc -c ${ROOTDIR}/etc/rndc.conf status
        /usr/local/sbin/rndc -c /etc/rndc.conf status
        return $?
}
restart() {
        stop
        start
}
reload() {
        #/usr/sbin/rndc -c ${ROOTDIR}/etc/rndc.conf reload >/dev/null 2>&1 || /usr/bin/killall -HUP named
        /usr/local/sbin/rndc -c /etc/rndc.conf reload >/dev/null 2>&1 || /usr/bin/killall -HUP named
        return $?
}
probe() {
        # named knows how to reload intelligently; we don't want linuxconf
        # to offer to restart every time
        #/usr/sbin/rndc -c ${ROOTDIR}/etc/rndc.conf reload >/dev/null 2>&1 || echo start
        /usr/local/sbin/rndc -c /etc/rndc.conf reload >/dev/null 2>&1 || echo start
        return $?
}

# See how we were called.
case "$1" in
        start)
                start
                ;;
        stop)
                stop
                ;;
        status)
                rhstatus
                ;;
        restart)
                restart
                ;;
        condrestart)
                [ -f /var/lock/subsys/named ] && restart
                ;;
        reload)
                reload
                ;;
        probe)
                probe
                ;;
        *)
                gprintf "Usage: %s {start|stop|status|restart|condrestart|reload|probe}\n" $0
                exit 1
esac

exit $?

Slave DNS Server

Here are the ownership and permissions of the various configuration files.

File Name	Owner	Permissions
/var/named/etc/namedb/named.conf	root:wheel	644
/var/named/etc/namedb/rndc.key	root:bind	640
/var/named/etc/namedb/rndc.conf	root:wheel	600
/etc/resolv.conf	root:wheel	644

Here is my named.conf file.

// Refer to the named.conf(5) and named(8) man pages for details.  If
// you are ever going to setup a primary server, make sure you've
// understood the hairy details of how DNS is working.  Even with
// simple mistakes, you can break connectivity for affected parties,
// or cause huge amount of useless Internet traffic.

include "/etc/namedb/rndc.key";

acl "internal-net" { 192.168.10/27; 127.0.0.1; };
acl "colonies" { 10.10.0.1; };

controls {
        inet 127.0.0.1 allow { any; } keys { "rndc-key"; };
};

//key to use for zone transfers
server 192.168.10.9 {
        keys { "europa-io"; };
};

logging {
    channel "named_log" {
        // send most BIND logs a dedicated log file
        file "/var/log/named.log" versions 10 size 500k;
        severity dynamic;
        print-category yes;
        print-severity yes;
        print-time yes;
    };

    channel "query_log" {
        // query logs go to a separate file
        file "/var/log/query.log" versions 10 size 500k;
        severity debug;
		print-severity yes;
        print-time yes;
    };
	
    category default { named_log; };
    category queries { query_log; };
};

options {
        directory "/etc/namedb";
		pid-file "/var/run/named/pid";
        statistics-file "/var/stats/named.stats";
        dump-file "/var/dump/named.dump";
        listen-on { "internal-net"; };
        allow-query { "internal-net"; "colonies"; };
        allow-transfer { none; };

// In addition to the "forwarders" clause, you can force your name
// server to never initiate queries of its own, but always ask its
// forwarders only, by enabling the following line:
//
//      forward only;

// If you've got a DNS server around at your upstream provider, enter
// its IP address here, and enable the line below.  This will make you
// benefit from its cache, thus reduce overall DNS traffic in the Internet.
        forwarders {
                <ISP DNS server 1>; <ISP DNS server 2>;
        };

        /*
         * If there is a firewall between you and nameservers you want
         * to talk to, you might need to uncomment the query-source
         * directive below.  Previous versions of BIND always asked
         * questions using port 53, but BIND 8.1 uses an unprivileged
         * port by default.
         */
        // query-source address * port 53;
};

// Setting up secondaries is way easier and the rough picture for this
// is explained below.
//
// If you enable a local name server, don't forget to enter 127.0.0.1
// into your /etc/resolv.conf so this server will be queried first.
// Also, make sure to enable it in /etc/rc.conf.

view "standard-in" in {

        zone "." {
                type hint;
                file "master/named.root";
        };

        zone "arda.homeunix.net" {
                type slave;
                file "slave/bak.arda.homeunix.net.zone";
                masters { 192.168.10.9; };
        };

        zone "arda.homelinux.net" {
                type slave;
                file "slave/bak.arda.homelinux.net.zone";
                masters { 192.168.10.9; };
        };

        zone "10.168.192.in-addr.arpa" {
                type slave;
                file "slave/bak.10.168.192.in-addr.arpa";
                masters { 192.168.10.9; };
        };
		
        zone "0.10.10.in-addr.arpa" {
                type slave;
                file "slave/bak.0.10.10.in-addr.arpa";
                masters { 192.168.10.9; };
        };

        zone "localhost" {
                type master;
                file "master/localhost.zone";
        };

        zone "0.0.127.in-addr.arpa" {
                type master;
                file "master/localhost.rev";
        };

        zone "0.in-addr.arpa" {
                type master;
                file "master/named.network";
        };

        zone "255.in-addr.arpa" {
                type master;
                file "master/named.broadcast";
        };
};

view "ultimate-chaos" chaos {

        recursion no;

        zone "." {
                type hint;
                file "/dev/null";
        };
		
        zone "bind" {
                type master;
                file "master/named.bind";
        };
};

This file looks a lot like my named.conf file on Europa but there are some differences.

• The server clause tells BIND which TSIG key to use when doing zone transfers with Europa, my primary name server.
• The allow-transfer option in the options section is not overridden in the arda.homeunix.net, arda.homelinux.net, 10.168.192.in-addr.arpa, and 0.10.10.in-addr.arpa zones. Zone transfers should only be done from a name server primary for the zones. Not setting allow-transer to none could also open up a back door if you don’t want to share your zone data.

Here is my rndc.conf file.

/*
 * Copyright (C) 2000, 2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
 * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
 * INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
 * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
 * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
 * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

/* $Id: rndc.conf,v 1.7 2001/01/09 21:40:45 bwelling Exp $ */

options {
        default-server  localhost;
        default-key     "rndc-key";
};

server 127.0.0.1 {
        key     "rndc-key";
};

key "rndc-key" {
        algorithm       hmac-md5;
        secret
        "<rndc-key>";
};

And here is my rndc.key file.

key "rndc-key" {
        algorithm       hmac-md5;
        secret
        "<rndc-key>";
};

key "europa-io" {
        algorithm       hmac-md5;
        secret
        "<europa-io key>";
};

My /etc/resolv.conf file looks like this.

domain  arda.homeunix.net
nameserver      127.0.0.1
nameserver      192.168.10.9

Zone Files

As on Europa, on Io I run BIND with reduced privileges and in a chroot jail. There’s really nothing to doing this on FreeBSD as the startup script supplied with the OS does everything for you the first time you start the named process. In my case, all I needed to do was edit the existing named.conf file, copy zone files from Europa, and create the rndc.key, rndc.conf files and that’s it. The directory FreeBSD uses for its jail is /var/named. Here is what it looked like after I was done adding files and after the first zone transfer from Europa.

drwxr-xr-x   5 root    wheel      512 Oct 10 00:28 /var/named
dr-xr-xr-x  4 root  wheel  512 Oct  9 15:46 /var/named/dev
crw-rw-rw-  1 root  wheel    2,   2 Oct 11 18:00 var/named/dev/null
crw-rw-rw-  1 root  wheel  246,   0 Oct  5 20:28 var/named/dev/random
drwxr-xr-x  3 root  wheel  512 Oct 10 00:28 /var/named/etc
-r--r--r--  1 root  wheel  1252 Sep 11 12:10 /var/named/etc/localtime
drwxr-xr-x  5 root  wheel   512 Oct 10 00:28 /var/named/etc/namedb
-rw-r--r--  1 root  wheel   423 May  8 03:05 /var/named/etc/namedb/PROTO.localhost-v6.rev
-rw-r--r--  1 root  wheel   423 May  8 03:05 /var/named/etc/namedb/PROTO.localhost.rev
drwxr-xr-x  2 bind  wheel   512 May  8 03:00 /var/named/etc/namedb/dynamic
-rw-r--r--  1 root  wheel  1093 May  8 03:05 /var/named/etc/namedb/make-localhost
drwxr-xr-x  2 root  wheel   512 Oct  9 15:01 /var/named/etc/namedb/master
-rw-r--r--  1 root  wheel   621 Oct  9 21:46 /var/named/etc/namedb/master/localhost.rev
-rw-r--r--  1 root  wheel   597 Oct  9 21:46 /var/named/etc/namedb/master/localhost.zone
-rw-r--r--  1 root  wheel   581 Oct  9 15:41 /var/named/etc/namedb/master/named.bind
-rw-r--r--  1 root  wheel   562 Oct  9 21:47 /var/named/etc/namedb/master/named.broadcast
-rw-r--r--  1 root  wheel   562 Oct  9 21:47 /var/named/etc/namedb/master/named.network
-rw-r--r--  1 root  wheel  1516 Oct  9 15:44 /var/named/etc/namedb/master/named.root
-rw-r--r--  1 root  wheel  4468 Jun 12 07:46 /var/named/etc/namedb/named.conf
-rw-------  1 root  wheel   299 Oct 10 00:28 /var/named/etc/namedb/rndc.conf
-rw-r-----  1 root  bind    314 Oct  9 15:37 /var/named/etc/namedb/rndc.key
drwxr-xr-x  2 bind  wheel   512 Oct  9 21:57 /var/named/etc/namedb/slave
-rw-r--r--  1 bind  wheel   412 Jul  5 21:40 /var/named/etc/namedb/slave/bak.0.42.10.in-addr.arpa
-rw-r--r--  1 bind  wheel   718 Jul  5 22:37 /var/named/etc/namedb/slave/bak.42.168.192.in-addr.arpa
-rw-r--r--  1 bind  wheel   503 Jul  5 22:20 /var/named/etc/namedb/slave/bak.arda.homelinux.net.zone
-rw-r--r--  1 bind  wheel   796 Jul  5 21:48 /var/named/etc/namedb/slave/bak.arda.homeunix.net.zone
drwxr-xr-x  6 root  wheel  512 May  8 03:00 /var/named/var
drwxr-xr-x  2 bind  wheel  512 May  8 03:00 /var/named/var/dump
drwxr-xr-x  2 bind  wheel  512 Oct 11 06:47 /var/named/var/log
-rw-r--r--  1 bind  wheel  300465 Oct 11 18:24 /var/named/var/log/named.log
-rw-r--r--  1 bind  wheel  240046 Oct 11 18:30 /var/named/var/log/query.log
drwxr-xr-x  3 bind  wheel  512 May  8 03:00 /var/named/var/run
drwxr-xr-x  2 bind  wheel  512 Oct  9 21:54 /var/named/var/run/named
-rw-r--r--  1 bind  wheel  6 Oct  9 21:54 /var/named/var/run/named/pid
drwxr-xr-x  2 bind  wheel  512 May  8 03:00 /var/named/var/stats

To run BIND on system boot, put this line into /etc/rc.conf.

named_enable="YES"

If you really want BIND’s chroot jail to reside in a different directory, you can add this line to /etc/rc.conf as well.

named_chrootdir="/your/chosen/path"

If you decide to do this, remember to copy the directory structure found in /var/named to your preferred chroot otherwise all that wonderful automation I talked about won’t work.

Configuration Files

Here is my dhcpd.conf file.

# DHCP Daemon configuration file

authoritative;

max-lease-time 86400;
default-lease-time 14400;
ddns-update-style interim;
ddns-ttl 14400;

subnet 192.168.10.0 netmask 255.255.255.224 {
    range 192.168.10.24 192.168.10.30;

    # don't let clients modify their own A records
    ignore client-updates;

    # options
    option subnet-mask 255.255.255.224;
    option broadcast-address 192.168.10.31;

    option domain-name "arda.homeunix.net";
    option domain-name-servers 192.168.10.9, 192.168.10.5;
    option routers 192.168.10.1;

    option ntp-servers 192.168.10.1;

    option netbios-scope "";
    option netbios-node-type 8;
    option netbios-name-servers 192.168.10.9;
    option netbios-dd-server 192.168.10.9;

    # dynamic DNS updates
    ddns-updates on;
    ddns-domainname "arda.homeunix.net.";
    ddns-rev-domainname "in-addr.arpa.";

    key "europa-dhcp" {
        algorithm       hmac-md5;
        secret
        "<europa-dhcp key goes here>";
    };

    zone arda.homeunix.net {
        primary 192.168.10.9;
        key "europa-dhcp";
    }

    zone 10.168.192.in-addr.arpa {
        primary 192.168.10.9;
        key "europa-dhcp";
    }

}

The dhcpd.conf file supplies all the information that will be given to DHCP clients and also controls dynamic updates with DNS servers. There are several points to note with this file.

Running DHCP Chrooted

Like BIND, I run DHCP with reduced privileges and in a chroot jail. The process to do this is similar to what I did for BIND but there are a few differences. Here is how I set up DHCP to run from the directory /etc/dhcpdb.

1. The first thing to do was to create the user and group dhcpd would run as. Unlike BIND, I needed to do this manually. I chose the entirely predictable name 'dhcpd' for both user and group.

2. I needed to add a number of directories and files to /etc/dhcpdb. Here is what things looked like after I was done.
   
   

   drwxr-xr-x    2 root     root         1024 Jul 17 10:12 /etc/dhcpdb/dev/
   crw-rw-rw-    1 root     root       1,   3 Jul 17 22:06 /etc/dhcpdb/dev/null
   crw-r--r--    1 root     root       1,   8 Jul 17 22:07 /etc/dhcpdb/dev/random
   drwxr-xr-x    2 root     root         1024 Jul 17 15:32 /etc/dhcpdb/etc/
   -rw-r--r--    1 root     root         1218 Jul 17 15:32 /etc/dhcpdb/etc/localtime
   drwxr-xr-x    4 root     root         1024 Jul 17 10:02 /etc/dhcpdb/var/
   drwxr-xr-x    2 dhcpd    dhcpd        1024 Jul 17 15:40 /etc/dhcpdb/var/run/
   drwxr-xr-x    3 root     root         1024 Jul 17 10:09 /etc/dhcpdb/var/state/
   drwxr-x---    2 dhcpd    dhcpd        1024 Jul 18 11:31 /etc/dhcpdb/var/state/dhcp/
   

   • The var/run directory is where DHCP’s pid file will go.
   • The var/state/dhcp directory is where the lease files will go.
   • Create the dev/null special file using the command 'mknod /etc/dhcpdb/dev/null c 1 3'.
   • Create the dev/random special file using the command 'mknod /etc/dhcpdb/dev/random c 1 8'.
   • As with BIND, the major and minor numbers for null and random are the same as the corresponding files found in /dev. I don’t know whether these files are actually necessary to run DHCP chrooted. dhcpd doesn’t complain when started without these special files present. I’ve put them in the jail more for insurance than anything else.
   • The etc/localtime file is copied from /etc. This file ensures DHCP uses the correct timezone when sending messages to syslog.
   • The var/run directory is owned by dhcpd:dhcpd. This is because the pid file is written after dhcpd has dropped privileges.

3. I needed to give DHCP a way to send messages to syslog from within the chroot jail. To accomplish this, I modified one line in the file /etc/sysconfig/syslog.
   SYSLOGD_OPTIONS="-m 0"
       became
   SYSLOGD_OPTIONS="-m 0 -a /etc/dhcpdb/dev/log"
   
   Stopping and starting syslog will cause a new syslog socket to appear in the /etc/dhcpdb/dev directory.

4. You’ll notice that dhcpd’s configuration file isn’t in the jail. It is located in /etc. Here is a listing of the file.

   -rw-------    1 root     root         1225 Jul 17 10:51 /etc/dhcpd.conf
   

   The dhcp-3.0+paranoia patch tells dhcpd to read dhcpd.conf before dropping privileges and invoking the chroot jail which is why the file is owned by root and is located outside the jail. I’ve set the permissions on this file to be restrictive because it contains the TSIG key used to dynamically update BIND. Having file permissions and ownership set up this particular way prevents the daemon from being able to modify the configuration file while still being able to read it at start up. Only a process with root privileges (presumably a sysadmin logged in as root) is able to modify the file.

Startup Scripts

Not only do I specify DHCP’s user, group, and chroot jail at startup, I also specify the particular interface DHCP listens on for requests. Here is my /etc/rc.d/init.d/dhcpd startup script. I modified this file, rather messily, to deal with DHCP running chrooted.

#!/bin/bash
#
# dhcpd           This shell script takes care of starting and stopping
#                 dhcpd (dynamic boot parameter server).
#
# chkconfig: 345 55 45
# description: dhcpd dynamically assigned network \
# parameters to clients at boot time.
# probe: true

# Source function library.
. /etc/rc.d/init.d/functions

# Source networking configuration.
. /etc/sysconfig/network

# Check that networking is up.
[ "${NETWORKING}" = "no" ] && exit 0

#[ -f /etc/sysconfig/named ] && . /etc/sysconfig/named

[ -f /usr/sbin/dhcpd ] || exit 0

# set the chroot directory
chrootdir="/etc/dhcpdb"

[ -f /etc/dhcpd.conf ] || exit 0

RETVAL=0
prog="dhcpd"

start() {
        # Start daemons.
        gprintf "Starting %s: " $prog
        daemon $prog -q -user dhcpd -group dhcpd -chroot $chrootdir eth0
        RETVAL=$?
        [ $RETVAL -eq 0 ] && touch /var/lock/subsys/dhcpd
        echo
        return $RETVAL
}
stop() {
        # Stop daemons.
        gprintf "Stopping %s: " $prog
        pid=`pidofproc $prog`
        kill -TERM $pid
        RETVAL=$?
        [ $RETVAL -eq 0 ] && success "dhcpd shutdown" || failure "dhcpd shutdown"
        [ $RETVAL -eq 0 ] && rm -f $chrootdir/var/run/dhcpd.pid
        [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/dhcpd
        echo
        return $RETVAL
}
status() {
        status dhcpd
}
restart() {
        stop
        start
}
reload() {
        stop
        start
}

# See how we were called.
case "$1" in
        start)
                start
                ;;
        stop)
                stop
                ;;
        status)
                status
                ;;
        restart)
                restart
                ;;
        condrestart)
                [ -f /var/lock/subsys/dhcpd ] && restart
                ;;
        reload)
                reload
                ;;
        *)
                gprintf "Usage: %s {start|stop|status|restart|condrestart|reload}\n" $0
                exit 1
esac

exit $?

Software Home Sites

Further Reading

Bind9.net - An excellent source of DNS and DHCP information	http://www.bind9.net/
DNS Group Webstart Page - Lots of links to DNS information	http://www.the-paynes.com/DNS/
DNS Setup and Troubleshooting - Covers BIND version 8	http://www.troubleshooters.com/linux/dns.htm
Building and Running BIND 9	http://www.unixwiz.net/techtips/bind9-chroot.html
Secure BIND Template	http://www.cymru.com/Documents/secure-bind-template.html

Copyright © 2003-2006 Andrew St. Jean	Last update Jul. 06, 2006