How do I disable zone transfers in BIND

Discussion in 'Installation/Configuration' started by Agent_M, Jul 9, 2010.

  1. Agent_M

    Agent_M Member

    Hi all,

    First the setup:
    ISPConfig ( with BIND, not mydns )
    Ubuntu 10.04 64bit
    Server is a VM
    Only 1 server at the moment ( although am playing around with a 2nd as a sec dns, but will leave the problems I've got with that one until I've reloaded everything )

    Have set everything up on the one server, seems to work great except 2 areas I am not sure about ( I'll post the second separately as it relates to firewall and not DNS ).

    1. From what I understand its not a good thing to allow zone transfers, is this correct?

    2. Zone transfers seem to be enabled by default ( Bind ), how do I disable this?

    3. In the "DNS Zone" setup page there are 2 settings one called "Allow zone transfers to these IPs" and the other "Also Notify", now reading through the forums apparently these are for MyDNS and Not BIND? is this still true? ( I only ask because putting an entry in here does seem to add it to the zone file ).

    4. If I add an IP in "Allow zone transfers to these IPs" it does disable zone transfers ( presumably to all except the IP listed ). Is this how I disable zone transfers, or is there another way that will disable it for all zones?

    5. If I have to do it one by one ( by entering "none" or something in this field, what can I add to the DNS Zone Template to do this automatically.

    Cheers for you help in advance.

    Also the Perfect Server set up guide was brilliant!!!

    I notice though that there doesn't seem to be a user guide that explains some of the settings, what they do or what they are for, and what you should enter etc. Rather than winge or bitch about it though, if there are any plans or desires to make one ( either pdf or maybe a help section within ispconfig3 control panel ), then I would be happy to give some time helping to write them ( although I may need some clarification myself on what some of them do :) ).

    Please let me know, have only recently come across this project, and although I'm not a programmer myself ( although could manage some basic html help pages ), I would be happy to contribute towards it in other ways if there's a need.
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    In named.conf file within the "options" section add:

    allow-transfer {"none";};
    to disable all zone transfers.

    Regarding the user manual. Would be great if you might be able to help us to write one.
  3. Agent_M

    Agent_M Member

    Thanks Till,

    My "named.conf" file actually only looks like this:

    include "/etc/bind/named.conf.options";
    include "/etc/bind/named.conf.local";
    include "/etc/bind/named.conf.default-zones";

    So added it to the "named.conf.options" instead.

            auth-nxdomain no;    # conform to RFC1035
            listen-on-v6 { any; };
            allow-transfer {"none";};
    Works a treat :D Cheers.

    Just going back quickly to point 3 in my original post, I'm sure I've read on the forums that this was for Mydns and not Bind, but I've played about with it a bit, and it appears as if it works for bind to?, and if set can override the setting above in the "named.conf.options" file for a particular zone. So am I right in thinking its ok to use it for Bind if needed?

    Cool, no Probs.
    I'm assuming nothings been started yet?
    If so I'll start it in a basic html pages, and create the structure first. Perhaps it could be a subfolder of the ispconfig site, a link could then be added to the help page in ispconfig?
    I'll write the pages for the areas that I know about first, and then will get some clarification on the areas I'm unsure about.
  4. Agent_M

    Agent_M Member

    also should "auth-nxdomain no;" be set to yes?
  5. till

    till Super Moderator Staff Member ISPConfig Developer

    This hs been added in ispconfig

    I will setup a cms system for the documentation which makes it easier to edit the pages and upload screenshots etc.
  6. Agent_M

    Agent_M Member both points ^ :)

Share This Page