raymond blogs…

This how-to assumes a Debian-type Linux server. 

1)  Install BIND

$ sudo apt-get install bind9

2)  Run BIND chrooted.  For security reasons we want to run BIND chrooted so we have to do the following:

$ sudo /etc/init.d/bind9 stop

Edit the file /etc/default/bind9 so that the daemon will run as the unprivileged user bind, chrooted to /var/lib/named. Modify the line: OPTIONS=”-u bind” so that it reads OPTIONS=”-u bind -t /var/lib/named”:

$ sudo vi /etc/default/bind9

OPTIONS="-u bind -t /var/lib/named"
# Set RESOLVCONF=no to not run resolvconf

RESOLVCONF=yes

3)  Create the necessary directories under /var/lib:

$ sudo mkdir -p /var/lib/named/etc
$ sudo mkdir /var/lib/named/dev
$ sudo mkdir -p /var/lib/named/var/cache/bind
$ sudo mkdir -p /var/lib/named/var/run/bind/run

4)  Then move the config directory from /etc to /var/lib/named/etc:

$ sudo mv /etc/bind /var/lib/named/etc

5)  Create a symlink to the new config directory from the old location (to avoid problems when bind gets updated in the future):

$ sudo ln -s /var/lib/named/etc/bind /etc/bind

6)  Make null and random devices, and fix permissions of the directories:

$ sudo mknod /var/lib/named/dev/null c 1 3
$ sudo mknod /var/lib/named/dev/random c 1 8
$ sudo chmod 666 /var/lib/named/dev/null /var/lib/named/dev/random
$ sudo chown -R bind:bind /var/lib/named/var/*
$ sudo chown -R bind:bind /var/lib/named/etc/bind

7)  We need to modify /etc/default/syslogd so that we can still get important messages logged to the system logs. Modify the line: SYSLOGD=”" so that it reads: SYSLOGD=”-a /var/lib/named/dev/log”:

$ sudo vi /etc/default/syslogd

## Top configuration file for syslogd
##
# Full documentation of possible arguments are found in the manpage
# syslogd(8).
#
#
# For remote UDP logging use SYSLOGD="-r"
#
SYSLOGD="-a /var/lib/named/dev/log"

9)  Restart the logging daemon:

$ sudo /etc/init.d/sysklogd restart

10)  Start up BIND, and check /var/log/syslog for errors:

$ sudo /etc/init.d/bind9 start