Chroot-BIND HOWTO: Installing Your Shiny New BIND

Next Previous Contents

## 4. Installing Your Shiny New BIND

I should mention that if you have an existing installation of BIND, such as from an RPM, you should probably remove it before installing the new one. On Red Hat systems, this probably means removing the packages `bind` and `bind-utils`, and possibly `bind-devel` and `caching-nameserver`, if you have them.

You may want to save a copy of the init script (e.g., `/etc/rc.d/init.d/named`), if any, before doing so; it'll be useful later on.

If you are upgrading from an older version of BIND, such as BIND 8, you will want to read the migration documentation in the file `doc/misc/migration` in the BIND source package. I don't deal with any migration issues in this document; I simply assume that you are replacing an existing, working installation of BIND 9.

## 4.1 Installing the Binaries

This is the easy part :-). Just run `make install` and let it take care of it for you. Really, that's it!

## 4.2 Setting up the Init Script

If you have an existing init script from your distribution, it would probably be best simply to modify it to run the new binary, with the appropriate switches. The switches are... (drumroll please...)

- `-u named`, which tells BIND to run as the user `named`, rather than `root`.
- `-t /chroot/named`, which tells BIND to chroot itself to the jail that we've set up.
- `-c /etc/named.conf`, which tells BIND where to find its configuration file within the jail.

The following is the init script I use with my Red Hat 6.0 system. As you can see, it is almost exactly the same as the way it shipped from Red Hat. I haven't tried the `rndc` commands yet, but I can't see any reason why they shouldn't work.

> `

>     #!/bin/sh
>     #
>     # named           This shell script takes care of starting and stopping
>     #                 named (BIND DNS server).
>     #
>     # chkconfig: 345 55 45
>     # description: named (BIND) is a Domain Name Server (DNS) \
>     # that is used to resolve host names to IP addresses.
>     # probe: true

>     # Source function library.
>     . /etc/rc.d/init.d/functions

>     # Source networking configuration.
>     . /etc/sysconfig/network

>     # Check that networking is up.
>     [ ${NETWORKING} = "no" ] && exit 0

>     [ -f /usr/local/sbin/named ] || exit 0

>     [ -f /chroot/named/etc/named.conf ] || exit 0

>     # See how we were called.
>     case "$1" in
>       start)
>             # Start daemons.
>             echo -n "Starting named: "
>             daemon /usr/local/sbin/named -u named -t /chroot/named -c /etc/named.conf
>             echo
>             touch /var/lock/subsys/named
>             ;;
>       stop)
>             # Stop daemons.
>             echo -n "Shutting down named: "
>             killproc named
>             rm -f /var/lock/subsys/named
>             echo
>             ;;
>       status)
>             status named
>             exit $?
>             ;;
>       restart)
>             $0 stop
>             $0 start
>             exit $?
>             ;;
>       reload)
>             /usr/local/sbin/rndc reload
>             exit $?
>             ;;
>       probe)
>             # named knows how to reload intelligently; we don't want linuxconf
>             # to offer to restart every time
>             /usr/local/sbin/rndc reload >/dev/null 2>&1 || echo start
>             exit 0
>             ;;

>       *)
>             echo "Usage: named {start|stop|status|restart|reload}"
>             exit 1
>     esac

>     exit 0

> `

As with syslogd, as of Red Hat 7.2 this process is now even easier. There is a file called `/etc/sysconfig/named` in which extra parameters for syslogd can be defined. The default `/etc/rc.d/init.d/named` on Red Hat 7.2, however, will check for the existance of `/etc/named.conf` before starting. You will need to correct this path.

On Caldera OpenLinux systems, you simply need to modify the variables defined at the top, and it will apparently take care of the rest for you:

> `

>     NAME=named
>     DAEMON=/usr/local/sbin/$NAME
>     OPTIONS="-t /chroot/named -u named -c /etc/named.conf"

> `

And for FreeBSD 4.3, you can edit the `rc.conf` file and put in the following:

> `

>     named_enable="YES"
>     named_program="chroot/named/bin/named"
>     named_flags="-u named -t /chroot/named -c /etc/namedb/named.conf"

> `

## 4.3 Configuration Changes

You will also have to add or change a few options in your `named.conf` to keep the various directories straight. In particular, you should add (or change, if you already have them) the following directives in the `options` section:

> `

>     directory "/etc/namedb";
>     pid-file "/var/run/named.pid";
>     statistics-file "/var/run/named.stats";

> `

Since this file is being read by the `named` daemon, all the paths are of course relative to the chroot jail. As of this writing, BIND 9 does not support many of the statistics and dump files that previous versions did. Presumably later versions will; if you are running such a version, you may have to add additional entries to cause BIND to write them to the `/var/run` directory as well.

Next Previous Contents