#bind9 — Public Fediverse posts

BIND, Pydantic и грабли (bindantic)

Началось всё не с идеи «напишу‑ка я библиотеку», а с гораздо более скучной задачи — разобраться в BIND9. Причём разобраться по‑настоящему: не «погуглил директиву, вставил в конфиг, заработало, забыл», а понять, как эта штука вообще устроена, потому что конфигурации нужно было генерировать не для одного сервера, а для нескольких, и делать это регулярно. Управлять этим вручную, руками редактировать named.conf на каждом сервере и следить, чтобы зоны, ACL и view не разъехались, показалось мне откровенно плохой идеей с самого начала...

https://habr.com/ru/articles/1066596/

#bind9 #namedconf #dns #python #iac #infrastructure_as_code #bind

I stand up from working all day on Subjam server infra updates & PR, to take a break in a cooler room. I did good and need to rest my eyes.

I pick up my phone and start to walk away from my desk, and immediately receive an e-mail telling me there was a bind9 security update.

🙃

The life of a sysadmin is getting more and more demanding by the day.

https://lists.debian.org/debian-security-announce/2026/msg00306.html

#selfhosted #cybersecurity #bind9 #security #sysadmin #devops

I stand up from working all day on Subjam server infra updates & PR, to take a break in a cooler room. I did good and need to rest my eyes.

I pick up my phone and start to walk away from my desk, and immediately receive an e-mail telling me there was a bind9 security update.

🙃

The life of a sysadmin is getting more and more demanding by the day.

https://lists.debian.org/debian-security-announce/2026/msg00306.html

#selfhosted #cybersecurity #bind9 #security #sysadmin #devops

Check this out. In the screenshot below, you can see me pinging my mastodon server over the wireguard vpn. But I'm using a domain name?

I installed bind9 on my vpn server, and it serves up wireguard IP addresses for custom domain names. Note the TLD, which is "wg". That is not a valid TLD and only exists on my wireguard network thanks to the magic of bind9.

#Wireguard #ServerAdmin #Bind9 #DNS #Mastodon #MastoAdmin #SelfHosted

Check this out. In the screenshot below, you can see me pinging my mastodon server over the wireguard vpn. But I'm using a domain name?

I installed bind9 on my vpn server, and it serves up wireguard IP addresses for custom domain names. Note the TLD, which is "wg". That is not a valid TLD and only exists on my wireguard network thanks to the magic of bind9.

#Wireguard #ServerAdmin #Bind9 #DNS #Mastodon #MastoAdmin #SelfHosted

Derzeit nutze ich #Bind9 und wuerde nun entweder auf dnssec-policy muessen oder alternativ zu #PowerDNS wechseln?

Beides hat so seine Vor- und Nachteile...

Meinungen dazu? Auch gerne als Kommentar...

#followerpower #sysadmin :boost_ok:

Derzeit nutze ich #Bind9 und wuerde nun entweder auf dnssec-policy muessen oder alternativ zu #PowerDNS wechseln?

Beides hat so seine Vor- und Nachteile...

Meinungen dazu? Auch gerne als Kommentar...

#followerpower #sysadmin :boost_ok:

IPv6 в школе и дома

Решаем проблемы с использованием IPv6 в быту. Проблемы, возникающие при использовании IPv6 дома и один из способов их решения.

https://habr.com/ru/articles/1033568/

#ipv6 #dns #bind9 #named #youtube

@bortzmeyer Hey ! est-ce que tu as déjà implémenté la RFC8482 avec bind (oui je sais qu'elle est seulement proposed, mais semblerait supporté dans bind ... )
#dns #bind9

@bortzmeyer Hey ! est-ce que tu as déjà implémenté la RFC8482 avec bind (oui je sais qu'elle est seulement proposed, mais semblerait supporté dans bind ... )
#dns #bind9

DNS: Does Not Service

#BIND9

@jpmens Just guessing here but as the file actually has a Bind DB format, perhaps it’s handler remains open (as long as #Bind9 is running) and is just written to.
What happens when Bind is stopped/restarted?
Certainly @ondrej or anyone at @iscdotorg can most confidently reply.

@jpmens Just guessing here but as the file actually has a Bind DB format, perhaps it’s handler remains open (as long as #Bind9 is running) and is just written to.
What happens when Bind is stopped/restarted?
Certainly @ondrej or anyone at @iscdotorg can most confidently reply.

Tu connais Gougueule ?

https://friendica.mesnumeriques.fr/display/3a8d2dbf-2069-85e3-b879-45f972137442

Tu connais Gougueule ?

https://friendica.mesnumeriques.fr/display/3a8d2dbf-2069-85e3-b879-45f972137442

Ich wünsche mir für #Bind9 eine Option

ksk-manage no-fuckup;

Visited #CSNOG26 conference, it was great event. I had to disable #DNSSEC validation on their wifi network. Asked for a contact to local network admin to ask what is the implementation used. Surprise, they said #bind9. If you operate anything old enough capable of ``dnssec-enabled no;``, please don't use it anyway. Use ``dnssec-validation no;`` only. It will stop servfail caused by validation failures, but won't prevent validation at clients. Fix your forwarders or firewalls if that is not ok

Visited #CSNOG26 conference, it was great event. I had to disable #DNSSEC validation on their wifi network. Asked for a contact to local network admin to ask what is the implementation used. Surprise, they said #bind9. If you operate anything old enough capable of ``dnssec-enabled no;``, please don't use it anyway. Use ``dnssec-validation no;`` only. It will stop servfail caused by validation failures, but won't prevent validation at clients. Fix your forwarders or firewalls if that is not ok

Haack's Networking - Authoritative DNS w/ Bind9

- root zone and base server cluster
- name server registration; glue records
- full CLI-driven zones/records
- full Webmin-driven zones/records
- DNSSEC howto for CLI & Webmin

Wiki Tutorial: https://wiki.haacksnetworking.org/doku.php?id=computing:bind9dns

You can add zones/domains & create A, AAAA, SPF, DMARC, DKIM, SRV, CNAME, and/or any DNS record you want; it's self-hosting heaven ;O

#gnulinux #freesoftware #sysadmin #live #debian #peertube #bind9 #dns #opensource #selfhost

Haack's Networking - Authoritative DNS w/ Bind9

- root zone and base server cluster
- name server registration; glue records
- full CLI-driven zones/records
- full Webmin-driven zones/records
- DNSSEC howto for CLI & Webmin

Wiki Tutorial: https://wiki.haacksnetworking.org/doku.php?id=computing:bind9dns

You can add zones/domains & create A, AAAA, SPF, DMARC, DKIM, SRV, CNAME, and/or any DNS record you want; it's self-hosting heaven ;O

#gnulinux #freesoftware #sysadmin #live #debian #peertube #bind9 #dns #opensource #selfhost

Haack's Networking - Informal Hacking Sessions #03

Today's agenda includes:

1) Writing the bind9 authoritative tutorial
2) Monitoring the rebuilt rsnapshot nodes
3) Editing and adding to the hard drive vitals post

https://content.haacksnetworking.org/w/byjvKm4LXLLn7q4ngYaG8f

#gnulinux #freesoftware #sysadmin #live #debian #peertube #bind9 #dns

Haack's Networking - Informal Hacking Sessions #03

Today's agenda includes:

1) Writing the bind9 authoritative tutorial
2) Monitoring the rebuilt rsnapshot nodes
3) Editing and adding to the hard drive vitals post

https://content.haacksnetworking.org/w/byjvKm4LXLLn7q4ngYaG8f

#gnulinux #freesoftware #sysadmin #live #debian #peertube #bind9 #dns

I have started poking about running Bind9 authoritative DNS on my OPNsense router.

Lord help me.

#OPNsense #DNS #Bind #Bind9 #HomeLab

I have started poking about running Bind9 authoritative DNS on my OPNsense router.

Lord help me.

#OPNsense #DNS #Bind #Bind9 #HomeLab

In November, Debian LTS contributors released 33 Debian LTS Advisories, fixing 219 CVEs across multiple packages. Notable updates included security fixes for bind9, unbound, pdfminer, firefox-esr, thunderbird, and the Linux 6.1 kernel.

In addition, the LTS team also contributed security updates to latest Debian releases and carried out significant work to revamp the LTS team documentation.

Read the full report here:
https://www.freexian.com/blog/debian-lts-report-2025-11/?utm_source=mastodon&utm_medium=social

This work is funded through Freexian’s Debian LTS offering. Consider sponsoring Debian LTS (https://www.freexian.com/lts/debian/?utm_source=mastodon&utm_medium=social) to support this effort and benefit from it: https://www.freexian.com/lts/debian/details/#benefits

#freexian #debianLTS #debian #linux #bind9 #unbound #thunderbird

In November, Debian LTS contributors released 33 Debian LTS Advisories, fixing 219 CVEs across multiple packages. Notable updates included security fixes for bind9, unbound, pdfminer, firefox-esr, thunderbird, and the Linux 6.1 kernel.

In addition, the LTS team also contributed security updates to latest Debian releases and carried out significant work to revamp the LTS team documentation.

Read the full report here:
https://www.freexian.com/blog/debian-lts-report-2025-11/?utm_source=mastodon&utm_medium=social

This work is funded through Freexian’s Debian LTS offering. Consider sponsoring Debian LTS (https://www.freexian.com/lts/debian/?utm_source=mastodon&utm_medium=social) to support this effort and benefit from it: https://www.freexian.com/lts/debian/details/#benefits

#freexian #debianLTS #debian #linux #bind9 #unbound #thunderbird

Bind9 question.

Can I allow-transfers on both port 53 and 853 with TLS?

If I list allow-transfer twice in a zone it won't start.

#DNS #Bind9

Bind9 question.

Can I allow-transfers on both port 53 and 853 with TLS?

If I list allow-transfer twice in a zone it won't start.

#DNS #Bind9

Just checked AlmaLinux container image. CentOS Stream were just created and Alma has #bind9 CVEs fixed already in their repos. If they say they got their changes from Stream, they are lying. These are RHEL fixes for RH customers only.

Just checked AlmaLinux container image. CentOS Stream were just created and Alma has #bind9 CVEs fixed already in their repos. If they say they got their changes from Stream, they are lying. These are RHEL fixes for RH customers only.

Mon hypothèse est que #bind9 ne sert qu'à vérifier que #apt fonctionne bien. Un canari, quoi.

#debian

@neverpanic @bagder we got bitten in #bind9 by RSA1 signature verification regression. Is it possible to emulate RHEL default crypto policy also on Fedora somehow? To have it refuse SHA1 verification like on RHEL?

@neverpanic @bagder we got bitten in #bind9 by RSA1 signature verification regression. Is it possible to emulate RHEL default crypto policy also on Fedora somehow? To have it refuse SHA1 verification like on RHEL?

Рунет в стране кошмаров: ТОП/АНТИТОП уязвимостей октября

Как прошел ваш Хэллоуин? Вот мы в СайберОК качественно повеселились и попугались, потому что наши эксперты-охотники на привидений до самого рассвета рыскали по внешнему периметру Рунета и вытаскивали на свет главных монстров октября – как новых, так и хорошо забытых старых.

https://habr.com/ru/articles/963384/

#уязвимости #инстансы #cve #wsus #bind9 #патч #эксплойт #информационная_безопасность #rce #рунет

#bind9 #trixie as well as #bookworm -

Fails to resolve mcr.microsoft.com on the first try.

rndc flush
dig -t a mcr.microsoft.com
-> SERVFAIL

wait a couple seconds. Then it works. Sporadically fails again.

Interesting - the #bind9 from #Debian #Bookworm - 9.18.33 has sporadic issues resolving mcr.microsoft.com with

dnssec-validation auto.

Building bind with --enable-querytrace shows SERVFAIL for mcr.trafficmanager.net

Disabled dnssec-validation now - lets see ...

instalar #bind9 en @alpinelinux en un lxc de @proxmox es complicado y divertido.
Que buena y minimalista aplicación.

Создание wildcart сертификата от Let`s Encrypt

Данный туториал является компиляцией информации по выпуску wildcart сертификата от let`s encrypt, с полезными дополнениями, без которых выпуск сертификата оказывается затруднительным. В статье используется bind9 - dns сервер и предполагается что вы уже делегировали ваш домен на свои DNS сервера.

https://habr.com/ru/articles/925358/

#letsencrypt #bind9 #dns #wildcard #sslсертификаты

Заметил, что #cloudns работает с зонами #opennic
Поэтому уберу-ка у себя с серверов #bind9 и воспользуюсь бесплатным их предложением, ибо всякие левые ебланы через меня стали всякие левые домены запрашивать

Things I learnt about DNS:

1. You can't "redirect" an entire domain with CNAME, only subdomains, which is why my website has been broken.

2. You can't specify an AAAA record and use a wildcard for the A record. You have to explicitly put both.

If the IP changes, you have to change it everywhere. I wonder if there is a modern DNS server which lets you avoid this sort of data duplication.

#DNS #Networking #Admin #SysAdmin #BIND9 #BIND

Things I learnt about DNS:

1. You can't "redirect" an entire domain with CNAME, only subdomains, which is why my website has been broken.

2. You can't specify an AAAA record and use a wildcard for the A record. You have to explicitly put both.

If the IP changes, you have to change it everywhere. I wonder if there is a modern DNS server which lets you avoid this sort of data duplication.

#DNS #Networking #Admin #SysAdmin #BIND9 #BIND

What's the least #evil #DNS provider?

I've put some of my properties on #Cloudflare, and I can still hear the boo's.
#Google cloud DNS and #AWS are no better.

I can put #Bind9 on my own #FOSS stacks, but I probably lack the uptime for reliability.

I'm moving away from my CPanel provider into my own #Selfhosting on a #VPS.

I'm thinking one NS on something reliable and one on my own stack.

What does #masodon hivemind recommend?

DNS-сервер на базе BIND9 на Ubuntu Server VMware Workstation

Я потратил на это в общей сложности 3 месяца и здесь сугубо мой опыт вперемешку с информацией из интернета. Здесь будет рассмотрена настройка Bind9 для виртуальной машины Ubuntu Server. Делаю я это под своими IP. Установка BIND9 Установим пакеты BIND9 и необходимые инструменты: sudo apt install bind9 bind9utils bind9-doc -y

https://habr.com/ru/articles/894524/

#ubuntu #ubuntu_server #bind #bind9 #dns

Schöner DNS-Workaround, den ich bis jetzt noch nicht kannte/brauchte: Um die (z.B. aus versehen zu weit in die Zukunft gesetzte) serial number eines Eintrags zurückzusetzen, muss man einfach nur das 32-bit große Feld zum Überlauf und damit wieder auf 0 bringen. Anschließend kann man es neu auf den Wunschwert setzen 😅

https://www.zytrax.com/books/dns/ch9/serial.html

#DNS #bind9

Schöner DNS-Workaround, den ich bis jetzt noch nicht kannte/brauchte: Um die (z.B. aus versehen zu weit in die Zukunft gesetzte) serial number eines Eintrags zurückzusetzen, muss man einfach nur das 32-bit große Feld zum Überlauf und damit wieder auf 0 bringen. Anschließend kann man es neu auf den Wunschwert setzen 😅

https://www.zytrax.com/books/dns/ch9/serial.html

#DNS #bind9

Hey #PiHole, and #ISC #Bind9 admins, can someone explain this to me?

dig A pi.hole -> noerror
dig HTTPS pi.hole -> NXDOMAIN
dig A pi.hole -> NXDOMAIN

https://github.com/lancachenet/lancache-dns/issues/147

#Named #Network #DNS

"Let me quickly try this one #Bind9 thing in #Docker", I thought.
No arm64 image. Can't tell if my configuration is bad or if x86 emulation isn't working :/

Someone here know their way around #bind9 releases? I expected v9.20 end of March 2024 as documented in https://kb.isc.org/docs/aa-00896 :/

https://gitlab.isc.org/isc-projects/bind9/-/milestones/69#tab-issues also does not really help with an ETA

#dns
@iscdotorg

Edit: release will be on 17.7.2024: https://lists.isc.org/pipermail/bind-announce/2024-July/001251.html
And the boxes in the Timeline are not to be read as "release beginning of that box" but "release within that box". The linked project milestones might hint to when something will happen in that direction :)

@bortzmeyer @draeath @Shamar it depends. No stable #bind9 release can forward over DoT (yet). None of them can forward over #DoH even on the latest commit afaik.

@draeath @Shamar no, both #bind9 and #unbound implement only server side. They can accept queries over DoH, but cannot forward them to DoH remote server. I am not sure about Knot, but might have the same problem. Forwarding over DoH is rare ability. Dnsdist is one of few capable of it.

ISC's Matthijs Mekking recently spoke on an Encrypted DNS Policy call about the #DNSSEC multi-signer model. His presentation covered best practices, rollovers, automation, and #BIND9 configuration.

Slides and recording available at https://www.isc.org/presentations/

A lot of IT professionals trash talk #Windows and I think a lot of the criticism is warranted.
Having said that, one-off #DNS configurations are so much easier for me to do than configuring a zone file in something like #bind9.

Don't get me wrong, BIND9 is awesome. It's lightweight, powerful, and scalable. It's also free/libre where Windows DNS Manager is most assuredly not.

I started on MS-DOS when I was quite young, but I grew up on Windows, so maybe it's just a comfort zone or bias because I love Linux, too.

@jhx For writing some kind of "howto", I'll have to find a sane scope ... otherwise there would be just too much to describe I guess 😮

I could of course assume you already have

- network segmentation with a #DMZ
- a working "domain" setup with a directory and #DNS (e.g. #samba, but could be #OpenLDAP with #bind9 as well)
- (virtual) machines providing #RDP (with #xrdp in case of #Linux or #FreeBSD)
- a working mechanism to distribute X.509 #TLS #certificates (I request them from #letsencrypt using #uacme and distribute them with simple shell scripts using special-purpose restricted #SSH keys)

With all that in place, it would "just" be describing the setup of #guacamole in a #FreeBSD #jail, enabling #TLS on all connection paths...