Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Securing BIND

|

189

The match-clients match list has the same format and built-in labels as the element

lists described earlier in this chapter under “acl{} sections.” Nested

zone{} state-

ments are no different from ordinary standalone

zone{} statements.

Example 6-8 illustrates two views defined for a split DNS scenario in which internal

users’ queries are answered with complete zone information, but external users are

served from a zone file containing a subset. Internal users may also query for infor-

mation about an internal zone, intranet.ourorg.org, for which the DNS server won’t

answer any external queries.

As the comments in Example 6-8 imply, the

view{} definition is parsed top to bot-

tom: when a user’s IP address is compared against the defined views, it will progress

down the list until a match is found.

Zone File Security

Our secure DNS service is trapped in its padded cell and very particular about what

it says to whom; in other words, it’s shaping up nicely. But what about the actual

zone databases?

Example 6-8. Some example views

view "inside" {

// Our internal hosts are:

match-clients { 192.168.100.0/24; };

// ...and for them we'll do recursive queries...

recursion yes;

// Here are the zones we'll serve for them:

zone "ourorg.ORG" {

type master;

file "master/ourorg_int.hosts"; ...