Both dig and nslookup can initiate a zone transfer. By default, both master and slave servers can give out all zone information. With dig,

    dig @target example.org axfr

shows the complete information about example.org. With nslookup in interactive mode,

    ls -d example.org

shows the same information.

Strictly speaking, only a slave name server needs a zone transfer to get the full information about the zone from a master name server for the zone.

A setup where only these zone transfers are allowed, but all other zone transfers are prohibited, is described here. It consists of extras in the named.conf's of both the master and all the slaves for a particular zone.

On master name servers.  On a master name server for the example.org zone, the allow-transfer statement is used to limit zone transfers to a list of known slave servers.

    acl "my_slave_servers" {
        224.123.240.3;  // cat.example.org
    };

    // ...

    zone "example.org" IN {
        type master;
        // ....

        allow-transfer {
            my_slave_servers;
        };
    };

Now only the slaves (only cat here) can request a zone transfer from this master name server.

On slave name servers.  On a slave name server for the same zone, the complete zone should not be exposed at all. This too is implemented using an allow-transfer statement.

    zone "example.org" IN {
        type slave;
        // ....

        allow-transfer {
            none;
        };
    };

Now this slave will not accept zone transfer requests.

For security reasons, normal queries can also be limited to a set of clients. This limits access to a certain set of hosts.

    acl "myhosts" {
        224.123.240.0/24;
    };

    // ...

    zone "example.org" IN {
        // ...

        allow-queries {
            myhosts;
        };
    };

This limits queries to hosts with an IP address that starts with 224.123.240.

Since BIND uses all sorts of files, these files must be copied to a directory structure below the new root that mimics the original directory structure. Article Lugo00 lists files to copy. Here is an abstract:

To get the BIND name server in a chroot jail, simply add the -t and a directory name to the command line used to start the name server.

So, for example, in /etc/init.d/bind:

    start-stop-daemon ... --exec /usr/sbin/named -- -t /var/cache/bind

This will make /var/cache/bind the new root directory for the name server.

Or, in /etc/rc.d/init.d/dns:

    daemon ... /sbin/named -t /var/cache/bind

This makes /var/cache/bind the new root directory for the name server.

Remember that the double dash -- after named tells the start-stop-daemon to pass options after the double dash to named.

The configuration files are read after the name server has chrooted to the specified directory. As a consequence, every configuration file (e.g. zone files and the named.conf file) must be present in a configuration directory (e.g., /etc/bind) under the chroot directory.

One of the things that must be reconfigured is logging. The normal logging to syslog will not work because of the chroot jail (cannot reach the Unix socket /dev/log and cannot recreate it). Here is an example logging statement from the named.conf file inside the chroot environment that can solve this problem:

    logging {
        channel some_log { 
            file "bind.log" versions 3; 
            severity info;
        };

        category default { some_log; };

        // ...
    };

This will write logging information to the file /var/cache/bind/var/cache/bind/bind.log, which was composed as follows:

Zone files, if any, are also placed inside the chroot environment. For instance, if named.conf contains a definition of a master zone like

    zone "example.com" IN {
        type master;
        file "/etc/bind/example.com.zone";
    };

the example.com.zone file will be in /var/cache/bin/etc/bind.

First, prepare a master file for the internal root zone For example:

    $TTL 25h
    .       IN  SOA privdns.exworks. postmaster.privdns.exworks. (
                2001121000    ; yyyymmhhee (ee == ser/day start 00)
                     28800
                      3600
                    604800
                     86400 )
            IN  NS privdns.exworks.
    privdns.exworks. IN  A  192.168.72.2

    ; glue records
    exworks.                 IN NS privdns.exworks.
    72.168.192.in-addr.arpa. IN NS privdns.exworks.

Note the glue records that delegate the exworks and 72.168.192.in-addr.arpa zones.

Next, add a zone statement in named.conf that points to the master file for the root zone:

    // ROOT MASTER zone for internal DNS server
    zone "." IN {
            type master;
            file "/etc/bind/internal.root.zone";
            allow-transfer { none; };
            allow-query    { none; };
    };

Using the type master tells the DNS that this really is a master server for the root zone. The root zone should not be known to any other name servers, therefore the allow-transfer and allow-query are set to none.

Now, prepare zone files for the exworks and 72.168.192.in-addr.arpa zones, and add the corresponding zone entries in the named.conf file. The entry for exworks should look like this:

    zone "exworks" IN {
            type master;
            file "/etc/bind/exworks.zone";
            allow-transfer { none; };
            allow-query    { 192.168.72.1; }; // liongate
    };

The name server on liongate is the one providing names to the other hosts, so the IP address of liongate must be listed in the allow-query field.

The same must be done for the corresponding reverse zone.

Make sure the options statement contains

        recursion no;
        fetch-glue no;

These statements tell the name server it should not accept queries for zones other than the ones it knows about.

Hosts in the exworks zone should point their resolv.conf to liongate. That is, the file should contain the line:

    nameserver 192.168.72.1

where 192.168.72.1 is the IP address of liongate. On liongate itself, however,

    nameserver 127.0.0.1

is more efficient.

The functionality of the DNS is twofold: first it should resolve names of the exworks zone (and corresponding reverse zone), secondly, it should resolve names from the outside world.

With the following forwarders statement queries to this name server are being forwarded to one on the listed IP addresses (remember that forwarders is part of the options statement):

        forwarders {
            192.168.72.2;   // privdns
            224.121.121.99; // ISP's DNS
        };

The name servers are tried in the order in which they are listed. Requests are forwarded to privdns first. If that one does not have the answer, the DNS of the ISP is contacted instead.

Note that the IP address of privdns should be mentioned first: we don't want requests for internal names be sent to the ISP.

Alternatively, the name server on liongate can be configured as slave for the exworks domain and corresponding reverse domain. Because this is a must in the setup where both name servers are on one host (which is described next), it is not discussed here.

    nameserver 192.168.72.2
    nameserver 192.168.72.1

In order to do this, the following settings must be made:

The nameserver line in the resolv.conf file points to 127.0.0.1; other hosts in the exworks domain point their resolver to 192.168.72.1 (the IP address of liongate).

The name server is put into a chroot jail with own user and group ID's. The name server will chroot to /var/cache/bindInternal. It will run as user inamed with UID 5301 and as group with the same name and GID 5301.

This chrooted name server should be able to write to some directories. To allow this, these directories should be owned by the inamed UID and GID. The directories (inside the chroot jail) that need this are /var/run (because it needs to write named.pid) and /var/cache/bind (because it needs to write e.g. a logfile).

The configuration directory will be /var/cache/bindInternal/etc/bind, so that references from the named.conf file in that directory will be to /etc/bind. Files in that directory include the master file for the root zone and the zone files for both the exworks and 72.168.192.in-addr.arpa domains.

Here are the three master zone definitions:

    options {
        directory "/var/cache/bind";
        listen-on port 5353 { 127.0.0.1; };
        recursion no;
        fetch-glue no;
    };

    // NOT SHOWN HERE, described elsewhere:
    // - special chroot logging, see above
    // - zones "localhost", "127.in-addr.arpa", "0.in-addr.arpa" and
    //   "255.in-addr.arpa" as usual

    // ROOT MASTER for internal DNS server
    zone "." IN {
        type master;
        file "/etc/bind/internal.root.zone";
        allow-transfer { none; };
        allow-query    { none; };
    };
    // NO root zone, type hint definition!

    // EXWORKS ZONES
    zone "exworks" IN {
        type master;
        file "/etc/bind/exworks.zone";
        allow-transfer { 127.0.0.1; };
        allow-query    { 127.0.0.1; };
    };

    zone "72.168.192.in-addr.arpa" IN {
        type master;
        file "/etc/bind/exworks.rev";
        allow-transfer { 127.0.0.1; };
        allow-query    { 127.0.0.1; };
    };

The directory refers to a location inside the chrooted tree. The listen-on specifies that this name server should only listen on port 5353 on the internal address 127.0.0.1. The other two, recursion and fetch-glue, prevent resolving anything but the zones that were defined here.

The root zone is purely local, it is only for this name server. Therefore, the configuration does not allow queries and transfers.

The exworks and 72.168.192.in-addr.arpa zone definitions allow for internal zone transfers and queries, both specifically to the other name server running there (the visible one). No other transfers and queries are allowed for these zones.

This section will describe how to configure the visible name server (if in doubt read the section called “Two name servers on one host” again). Remember it does not run chrooted and listens on a normal port. Instead, it runs under its own UID/GID.

The visible name server should be able to answer queries about both the inside and the outside worlds.

The named.conf for the visible name server, with common parts omitted, looks like this:

    // /etc/bind/named.conf
    // bind visible configuration on liongate

    options {
        directory "/var/cache/bindVisible";

        // point to the ISP's name server for outside world
        forwarders {
            224.121.121.99; // ISP's DNS
        };
    };

    // NOT SHOWN HERE, described elsewhere:
    // - logging as usual
    // - root zone type hint as usual
    // - zones "localhost", "127.in-addr.arpa", "0.in-addr.arpa" and
    //   "255.in-addr.arpa" as usual

    // point to port 5353 for these zones, be slave for both
    zone "exworks" IN {
         type slave;
         masters port 5353 { 127.0.0.1; };
         file "exworks.slave";
         allow-transfer { none; };
         allow-query    { 127.0.0.1; 192.168.72.0/24; };
    };

    zone "72.168.192.in-addr.arpa" IN {
         type slave;
         masters port 5353 { 127.0.0.1; };
         file "72.168.192.in-addr.arpa.slave";
         allow-transfer { none; };
         allow-query    { 127.0.0.1; 192.168.72.0/24; };
    };

This implements the following:

The directory specified by the directory statement must be writable by the running name server. That is, if the name server is running as user vnamed and group vnamed, the directory /var/cache/bindVisible must be owned by user vnamed and group vnamed. The slave files exworks.slave and 72.168.192.in-addr.arpa.slave will be put there.

Let's look at the slave zone definitions. Both refer to a master at port 5353 on the same host. Both definitions do not allow full zone transfers. The only zone transfers are from master (at port 5353) to slave (the configuration for the master allows this, see the section called “Configuring the master on privdns”). Normal queries are allowed for the localhost (127.0.0.1, i.e., internal connections on liongate), as well as all hosts in the exworks zone (192.168.72.x).

On liongate the resolv.conf file will contain

    nameserver 127.0.0.1

that is, it points to the visible name server which listens on port 53. Other hosts in the exworks domain will have

    nameserver 192.168.72.1

(the IP address of liongate) in their resolv.conf.