Bind package for pfsense 2.1

johnpoz

Ok I have reinstalled the package, both pkg button and xml button. I go in disable dns forwarder, enable bind in its menu item that is created.

Go in and double check that zones are there, hit save, restart service, etc.

And there is still no etc/namedb folder

[2.1-RELEASE][root@pfsense.local.lan]/root(1): cd /etc/
[2.1-RELEASE][root@pfsense.local.lan]/etc(2): cd namedb
namedb: No such file or directory.
[2.1-RELEASE][root@pfsense.local.lan]/etc(3):

but the log says that is where its loading its conf file from

Oct 16 13:38:26 named[97452]: loading configuration from '/etc/namedb/named.conf'

But I also get this error
Oct 16 13:38:26 named[97452]: the working directory is not writable

I can query bind..

; <<>> DiG 9.9.2-P1 <<>> chaos txt version.bind @192.168.1.253
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29640
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;version.bind. CH TXT

;; ANSWER SECTION:
version.bind. 0 CH TXT "9.9.4"

;; AUTHORITY SECTION:
version.bind. 0 CH NS version.bind.

;; Query time: 3 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Wed Oct 16 13:43:05 2013
;; MSG SIZE rcvd: 73

And it looks up stuff from net - but it does not serve up zones I created

budman@ubuntu:~$ dig @192.168.1.253 www.pfsense.org +short
192.207.126.26
budman@ubuntu:~$

;; QUESTION SECTION:
;local.lan. IN SOA

;; AUTHORITY SECTION:
. 0 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2013101601 1800 900 604800 86400

;; Query time: 43 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Wed Oct 16 13:44:32 2013
;; MSG SIZE rcvd: 113

Something is not right with this package.. Running on

2.1-RELEASE (i386)
built on Wed Sep 11 18:16:50 EDT 2013
FreeBSD 8.3-RELEASE-p11

stalks

@johnpoz:

stalks – what flavor of pfsense are you running? And your etc/namedb/named.conf got created?

Where were your zone files created? I could not find the named.conf file that it was saying it was loading to look to see what it was even calling the forwards or reverse zones.

HDD install i386

named.conf was created, can see zone "domain.com" { .. etc .. but the actual zone files, don't know where they are going

@johnpoz

$: find / -name 'named.conf'
/usr/local/etc/named.conf
/usr/pbi/bind-i386/etc/named.conf
/cf/conf/named/etc/namedb/named.conf

johnpoz

ok yup I can view that

cat /cf/conf/named/etc/namedb/named.conf
#Bind pfsense configuration
#Do not edit this file!!!

options {
directory "/etc/namedb";
pid-file "/var/run/named/pid";

but notice it points to /etc/namedb – which isn't there!

Those other locations get shown in the find - but they are not really there. Why does the log say its loading /etc/namedb/named.conf ??

stalks

named runs in a jail so it has its own folder structure seperate from /

johnpoz

ok - where is it suppose to be loading the zone files from, because they are not loading.. And lots of errors get put into the system log.

shouldn't they be in
/cf/conf/named/etc/namedb

I only show named.conf and named.root in there

stalks

Thats what I can't find as well :)

johnpoz

but your saying your zones resolve? I have a forward zone and none of the entries resolve. Even though bind comes up and I an resolve outside stuff, my local zone is not working.

I don't think they are getting created - and clearly there is something not quite right when the log says it is loading /etc/named/named.conf – but its really in /cf/conf/named/etc/namedb/named.conf and in that .conf it says working directory is /etc/namedb -- when it should point to /cf/conf/named/etc/namedb/

Not a real jail expert, but this does not seem right to me.

Would love to start playing with it and looking for more bugs, etc. But if I can not even get it to resolve my pfsense.local.lan -- how can I use it?

marcelloc

version 0.1.4 is out.

zone tab now shows result config.
fixed slave zone fields checks
fixed master zone ip missing ";"
changed folder check/creation from /conf symlink to /cf dir.

I've testes several times folder creation and it's fine under /cf/named

stalks

@marcelloc:

version 0.1.4 is out.

zone tab now shows result config.
fixed slave zone fields checks
fixed master zone ip missing ";"
changed folder check/creation from /conf symlink to /cf dir.

I've testes several times folder creation and it's fine under /cf/named

The zone files are not being created because the permissions of the directories are not allowing the user "bind" to write.

I created a view called "default", and the permissions of /cf/named/etc/namedb/slave/default are "drwxr-xr-x root wheel"

I then ran the following command: chgrp bind /cf/named/etc/namedb/slave/default; chmod g+w /cf/named/etc/namedb/slave/default;

The new permissions are then "drwxrwxr-x root bind"

Then restarted bind using the web interface, and the files are all created, and the resulting config can be seen in the web interface.

stalks

Feature request: forward zones

Woudl be similar to slave zones, but even more simple.

Example of forward zone config:

zone "example.com" { type forward; forward only; forwarders { 192.168.1.1; 192.168.1.2; }; };

marcelloc

Check version 0.1.5

main changes

Add forward zone option
Add rndc config to named.conf
Add widget to dashboard
Include dev/random,null and zero on named chroot dir
Check slave zone dir permissions

marcelloc

and on pkg 0.2

dnssec

:)

stalks

This is awesome :) All seems to be working great, nice work indeed.

johnpoz

Ok – wtf, now getting refused..

C:>dig pfsense.local.lan

; <<>> DiG 9.9.4 <<>> pfsense.local.lan
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 16069
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;pfsense.local.lan. IN A

;; Query time: 4 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Fri Oct 18 07:48:22 Central Daylight Time 2013
;; MSG SIZE rcvd: 46

I have edited the ACL every which way I can think of, I see the configs in the zones.. Gone and updated them - restared.. Let me take a look at the named.conf and see what it says for acls, etc..

This package is looking like one sweet deal -- just not able to get it work ;)

edit: YEAH!!! Its working!!! have to actually highlight the lists in vies section.

; <<>> DiG 9.9.4 <<>> pfsense.local.lan
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31349
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;pfsense.local.lan. IN A

;; ANSWER SECTION:
pfsense.local.lan. 86400 IN A 192.168.1.253

;; AUTHORITY SECTION:
local.lan. 86400 IN NS pfsense.local.lan.

;; Query time: 4 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Fri Oct 18 07:53:50 Central Daylight Time 2013
;; MSG SIZE rcvd: 76

Got my PTR zones working -- yeah this seems to ROCK!!!! Will have to test out the dnssec stuff today.. But THANK YOU! This has been a long awaited addition to pfsense...

AhnHEL

Is there a setup tutorial for this that I can follow?

johnpoz

Might not be a bad idea - seems you have to have a view setup, and ACLs - and you have to highlight them in the zone or it doesn't like to work.

I just broke mine again with trying to enable the dnssec, had to delete the zone files and then go back in into the zones so they were recreated, etc.

Might be nice to allow checkconf from the gui to see its output.. But there is clearly some stuff with the chroot that I don't quite get.. still looks like /etc/namedb/named.conf - but this is really in /cf/named/etc/namedb but there there is also something to do with /usr/pbi/bind-i386/etc/named.conf ???

Some info on how this chroot stuff works for this package would be just fantastic!!!

marcelloc

@AhnHEL:

Is there a setup tutorial for this that I can follow?

Just follow package tabs from left to right.

All you need is there :)

marcelloc

@johnpoz:

Might not be a bad idea - seems you have to have a view setup, and ACLs - and you have to highlight them in the zone or it doesn't like to work.

These are all bind requirementes but I've included more info on acl options to get it clear.

@johnpoz:

I just broke mine again with trying to enable the dnssec, had to delete the zone files and then go back in into the zones so they were recreated, etc.

what erros? I'm testing it massively and getting no errors.

@johnpoz:

Might be nice to allow checkconf from the gui to see its output.. But there is clearly some stuff with the chroot that I don't quite get.. still looks like /etc/namedb/named.conf - but this is really in /cf/named/etc/namedb but there there is also something to do with /usr/pbi/bind-i386/etc/named.conf ???

Some info on how this chroot stuff works for this package would be just fantastic!!!

Just take a look on named process:
ps ax | grep -i named
83446 ?? Is 0:00.02 /usr/pbi/bind-amd64/sbin/named -c /etc/namedb/named.conf -u bind -t /cf/named/

Join chroot dir and conf dir to understand how it works.

johnpoz

I get SERVFAIL - thought I posted up a screenie before, anyway can repeat the error.

So as you can see working fine - did a query for pfsense.local.lan get an answer all is good.

Then I go into the zone, click "Enable inline DNSSEC Signing for this zones. " hit save in the zone, then on the overall zone tab hit save again. Do my query again and get SERVFAIL

Going back into the zone and unchecking it and resaving does not correct the problem.. Have to delete all the files for that zone in the zone file area - for me its /cf/named/etc/namedb/master/everyone and then resave then it its back to working. Because I call my view everyone.

My point about having to highlight, I understand those are requirements for the configuration. But it doesn't auto use if there is only 1.. You still have to actually click on it so its highlighted on the gui page, or its not used in the config. Was like what the hell. It says its using my all acl allow.. No not really have to highlight them for it to work - see second pic

So notes about having to highlight might be good thing to add to documentation on the section, etc.

errordnssec.png_thumb

highlighted.png_thumb

marcelloc

@johnpoz:

Then I go into the zone, click "Enable inline DNSSEC Signing for this zones. " hit save in the zone, then on the overall zone tab hit save again. Do my query again and get SERVFAIL

I'm not a DNSSEC specialist but if IRC, you need a parent zone to validate your dnssec zone(DS record on parent/root domain).

take a look on this whitepaper.

page 3
The Chain of trust
"…Surely the
public key isn’t just signed by the zone’s private key, which would mean that the public key would validate itself..."

"...No, the public key’s validity is established by the zone’s parent. For example, if our signed zone is called infoblox.
com, it’s the com zone that vouches for the infoblox.com zone’s public key..."

"...after the infoblox.com zone has been signed, the administrator sends a copy of his public key to the administrator of the com zone..."

@johnpoz:

Going back into the zone and unchecking it and resaving does not correct the problem

I'll test it here.

Other point. I've updated field info for zone acl. Transfer and updated acl should be restricted, not allowed to everyone. If you do not select any acl on it, means no access. That's why the package does not select automatically when only one acl is defined.