Re: turning on recursion in bind 9.2.2 makes ssh login prompt slow


turning on recursion in bind 9.2.2 makes ssh lo...
\ r37ribution (16 Jan 2008)
. \ Stephane Bortzmeyer (16 Jan 2008)
. . \ Chris Thompson (16 Jan 2008)
. . . \ Stephane Bortzmeyer (16 Jan 2008)
. . . . \ r37ribution (16 Jan 2008)
. . . . . \ Alan Clegg (16 Jan 2008)
. . . . . . \ Alan Clegg (16 Jan 2008)
. . . . . . . \ r37ribution (16 Jan 2008)
. . . . . . . . \ Alan Clegg (16 Jan 2008)
. . . . . . . . \ Kevin Darcy (17 Jan 2008)
. . . . . . . . . \ r37ribution (18 Jan 2008)
. . . . . \ Stephane Bortzmeyer (16 Jan 2008)
. \ Jack Tavares (17 Jan 2008)
. \ Jack Tavares (17 Jan 2008)
. . \ r37ribution (18 Jan 2008)
. \ Mark Andrews (18 Jan 2008)

3 msg	bind 9.4 memory exhaustion
7 msg	Bind 9.4.2 not resolving external names but see...
3 msg	Bind-DLZ question
3 msg	Manipulating the Round robin
3 msg	Slaves doesn't handle 'expire' time correctly?
10 msg	Basic setup question for a master / slave setup...
6 msg	split DNS for clients through a proxy
9 msg	out -of-zone records
2 msg	I want to remain log in '/var/log/messages'
5 msg	http fail over with srv records
3 msg	named-checkzone -D
3 msg	named-checkzone comes unglues
1 msg	Spurious 'CNAME and other data' with signed zones
8 msg	BIND and AD DNS
3 msg	Warning: ID mismatch Error!
3 msg	two errors
10 msg	Dynamic updates AND multiple zones referencing ...
2 msg	web interface
4 msg	dns updates from a windows client

Subject:	Re: turning on recursion in bind 9.2.2 makes ssh login prompt slow
Group:	Bind-users
From:	Mark Andrews
Date:	18 Jan 2008

> Ok, I changed my named.conf "." zone to the following:
> zone "." {
> type master;
> file "db.root";
> allow-transfer { any; };
> };
> and each slave has:
> zone "." {
> type slave;
> file "bak.db.root";
> masters { 168.84.1.194; };
> allow-notify { any; };
> };
> The zone for "." looks like this:
> $TTL 3h
> @ IN SOA @ root (
> 2008011801 ;serial YYYYMMDD##
> 3h ;refresh after 3 hours
> 1h ;retry after 1 hour
> 1w ;expire after 1 week
> 1d ) ;negative caching TTL of 1 day
> @ IN NS @
> IN A 168.84.1.194
> IN A 168.84.1.195
> IN A 168.84.1.196
> IN A 168.84.1.197
> IN A 168.84.1.198
> Everything loaded ok and DNS seems to be working. I'd still like a
> 2nd opinion of how I wrote the config/zone file? Thanks again for everyone's
> help I really appreciate this.
> On Jan 16, 2008 7:45 PM, Kevin Darcy <kcd> wrote:

I presume you have names for each of the machines 168.84.1.194
through 168.84.1.198. I would use them. The root servers
should also serve all the zones which contain those names.

"." is often a place holder.

You also need to delegate the rest of the zones. By
convention localhost and 127.in-addr.arpa are not delegated
but are configured on all recursive servers.

Doing it correctly now will allow you to grow.

Mark

$TTL 10800
@ SOA <master> <your.Email.address> 2008011801 10800 3600 604800 86400
@ NS <master>
@ NS <slave>
@ NS <slave>
@ NS <slave>
@ NS <slave>
<master> A 168.84.1.194
<slave> A 168.84.1.195
<slave> A 168.84.1.196
<slave> A 168.84.1.197
<slave> A 168.84.1.198
bms.n2bb.com. NS <nameserver1>
bms.n2bb.com. NS <nameserver2>
1.84.168.in-addr.arpa. NS <nameserver1>
1.84.168.in-addr.arpa. NS <nameserver2>
<nameserver1> A <address>
<nameserver2> A <address>

> > Since this is an isolated network, set up the root zone as *master*, not
> > hint. There's no point in "hint"ing at a root zone, if there's nothing
> > on your network that actually serves that zone authoritatively; you're
> > sending dig +trace on a fool's errand...
> >
> > - Kevin
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: Mark_Andrews