Bind will be setup chrooted to improve security we will also use views to prevent abuse of the dns server.
The basic configuration disables by default, recursive queries and zone transfers. We also obscure the version of BIND we are running such that we are not hit by zero day vulnerabilities from script kiddies.
options {
directory "/var/named";
pid-file "/var/run/named/named.pid";
listen-on {
127.0.0.1;
192.168.1.5;
};
version "just guess";
allow-recursion { "localhost"; };
allow-transfer { "none"; };
};
The logging is customized to remove the annoying “lame-server” and update errors that appear in the logs
logging {
category update { null; };
category update-security { null; };
category lame-servers{ null; };
};
Ensure that this is set in the file /etc/sysconfig/named (its usually set by the bind-chroot package)
ROOTDIR=/var/named/chroot
Let the machine use this server for dns resolution edit /etc/resolv.conf and prepend
nameserver 127.0.0.1