Cara Bikin Master dan Slave NSD Authoritative Name Server di FreeBSD

Terbit: 23 September 2026 09:07 Perbarui: 23 September 2026 09:07

RFC Internet mengharuskan setiap zona DNS memiliki setidaknya dua server nama (master dan slave) untuk menyediakan redundansi jika salah satu server offline. Kedua server nama ini akan melayani rekaman sumber daya dan perlu disinkronkan setiap saat. Untuk melakukannya, kita dapat mengatur konfigurasi master/slave untuk server nama yang digunakan, misalnya NSD atau Yadifa.

Satu server dipilih sebagai server nama master, yang merupakan otoritas untuk semua rekaman sumber daya dalam berkas zona. Server lain dipilih sebagai server nama slave, yang akan mencerminkan rekaman sumber daya master.

Zona master akan mendapatkan rekaman sumber dayanya secara lokal, sementara zona slave akan mendapatkan rekaman sumber daya mereka dengan menyalin dari master. Baik master maupun slave kemudian dapat melayani rekaman kepada klien yang meminta resolusi server nama.

Untuk mereplikasi rekaman sumber daya, server nama master perlu mentransfer rekaman sumber dayanya secara berkala ke server nama slave. Setiap kali ada perubahan pada rekaman lokal server master, server nama master dapat mengirimkan pesan NOTIFY ke server slave untuk segera menyebarkan perubahan tersebut.

Dalam artikel ini, kami akan mencoba menjelaskan secara lengkap cara konfigurasi Server DNS Otoritatif NSD. Dalam implementasinya, kami akan menggunakan 2 komputer server, 1 komputer untuk NSD Master dan 1 komputer untuk NSD Slave.

A. Spesifikasi Sytem:

Server NSD Master:

OS: PFSense 2.6.0-RELEASE (amd64)
CPU: Intel(R) Core(TM)2 Duo CPU E8400 @ 3.00GHz
Karena menggunakan PFSense, jadi ada 2 Land Card
IP WAN: 192.168.1.2
IP LAN: 192.168.5.2
Hostname: ns1
Domain: unixexplore.com
Unbound Caching DNS Server: 192.168.5.2@53
Master NSD DNS Server: 192.168.5.2@5053

Server NSD Slave:

OS: FreeBSD 13.2 Stable
Processor: AMD Phenom II X4 965 3400 MHz
Memori: 2 GB
Hostname: ns2
Domain: unixexplore.com
IP LAN: 192.168.5.3/24
Unbound Caching DNS Server: 192.168.5.3@53
Slave NSD DNS Server: 192.168.5.3@5053

Perhatikan spesifikasi sistem yang kita buat. Pada server NSD Master, saya menggunakan Router PFSense, sedangkan pada Server NSD Slave, saya menggunakan Server FreeBSD 13.2 Stable. Perlu diketahui, dalam tutorial ini kami tidak akan menjelaskan cara menginstal dan mengonfigurasi Server Unbound.

Anda dapat membaca artikel sebelumnya tentang cara menginstal Unbound. Dalam artikel ini, Unbound digunakan sebagai server caching DNS untuk klien di LAN kita. Setiap permintaan DNS dari klien akan dilayani oleh Unbound.

B. Instalasi NSD

Baiklah, mari kita mulai menginstal aplikasi NSD. Untuk menginstal NSD, Anda dapat menggunakan FreeBSD Ports atau paket pkg. Kita akan berlatih menginstal NSD menggunakan FreeBSD Port.

root@ns1:~ # cd /usr/ports/dns/nsd
root@ns1:/usr/ports/dns/nsd # make install clean
root@ns1:/usr/ports/dns/nsd # cd /usr/ports/converters/base64
root@ns1:/usr/ports/converters/base64 # make install clean

Setelah instalasi NSD selesai, nsd secara otomatis memiliki pengguna: "nsd" dan grup: "nsd". Langkah selanjutnya adalah membuat struktur direktori yang diperlukan untuk pengaturan NSD.

Buat struktur direktori di folder /usr/local/etc/nsd. Perintah chown di bawah ini akan menetapkan pengguna dan grup "nsd" ke folder log db zonefile dan tmp.

root@ns1:/usr/ports/converters/base64 # cd /usr/local/etc/nsd
root@ns1:/usr/local/etc/nsd # mkdir -p log db zonefile tmp
root@ns1:/usr/local/etc/nsd # chown nsd:nsd log db zonefile tmp
root@ns1:/usr/local/etc/nsd # chmod 755 log db zonefile tmp

Langkah selanjutnya, atur NSD agar otomatis RUNNING saat komputer server dimatikan atau dihidupkan ulang, buat skrip berikut di file /etc/rc.conf.

root@ns1:/usr/local/etc/nsd # ee ee /etc/rc.conf
nsd_enable="YES"

C. Buat Kunci TSIG

NSD mendukung Tanda Tangan Transaksi (TSIG) untuk transfer zona dan untuk memberi tahu pengiriman dan penerimaan, untuk setiap permintaan ke server. Kunci Tanda Tangan Transaksi (TSIG) digunakan untuk mengamankan dan mengenkripsi transfer zona. Pembuatan kunci TSIG ini hanya dapat dilakukan di Server Master NSD.

root@ns1:~ # cd /usr/local/etc/nsd
root@ns1:/usr/local/etc/nsd # dd if=/dev/random of=/dev/stdout count=1 bs=32 | openssl base64
1+0 records in
1+0 records out
32 bytes transferred in 0.000062 secs (517808 bytes/sec)
/9u+zAEFCCcSe15VKuicwGIMuNCEZkWRJp+1tYWjCW8=
root@ns1:/usr/local/etc/nsd #

Pada skrip di atas tulisan /9u+zAEFCCcSe15VKuicwGIMuNCEZkWRJp+1tYWjCW8= adalah kunci TSIG yang dibuat oleh NSD. Simpan kunci TSIG agar tidak hilang. Untuk mengantisipasi kerusakan server NSD, kami memiliki cadangan kunci TSIG. Setelah Anda menyimpan kunci TSIG,

Selanjutnya, kita jalankan skrip nsd-control-setup.

root@ns1:/usr/local/etc/nsd # nsd-control-setup
setup in directory /usr/local/etc/nsd
Generating RSA private key, 3072 bit long modulus (2 primes)
.....................................++++
.....++++
e is 65537 (0x010001)
Generating RSA private key, 3072 bit long modulus (2 primes)
................++++
.................................++++
e is 65537 (0x010001)
Signature ok
subject=CN = nsd-control
Getting CA Private Key
removing artifacts
Setup success. Certificates created. Enable in nsd.conf file to use
root@ns1:/usr/local/etc/nsd #

D. Membuat File Zona

Langkah selanjutnya adalah membuat berkas zona (forward dan reverse) pada server NSD Master dan NSD Slave. Pada setiap server NSD (master dan slave), kita membuat dua berkas zona, dan meletakkannya di folder /usr/local/etc/nsd/zonefile.

Untuk penamaan zona pada berkas secara bebas, dalam artikel ini kita akan memberi nama zona berkas sebagai berikut:

Berkas unixexplore.com.forward (/usr/local/etc/nsd/zonefile/unixexplore.com.forward).
Berkas unixexplore.com.reverse (/usr/local/etc/nsd/zonefile/unixexplore.com.reverse).

root@ns1:/usr/local/etc/nsd # touch /usr/local/etc/nsd/zonefile/unixexplore.com.forward
root@ns1:/usr/local/etc/nsd # chmod +x /usr/local/etc/nsd/zonefile/unixexplore.com.forward
root@ns1:/usr/local/etc/nsd # touch /usr/local/etc/nsd/zonefile/unixexplore.com.reverse
root@ns1:/usr/local/etc/nsd # chmod +x /usr/local/etc/nsd/zonefile/unixexplore.com.reverse

Di bawah ini adalah contoh file skrip "unixexplore.com.forward" untuk NSD Master dan Slave.

$ORIGIN unixexplore.com. ; default zone domain
$TTL 86400               ; default time to live

@ IN SOA ns1.unixexplore.com. admin.unixexplore.com. (
                 2014010203 ; serial number
                 28800      ; Refresh
                 7200       ; Retry
                 864000     ; Expire
                 86400      ; Min TTL
                   )

@		IN NS ns1.unixexplore.com.
@		IN NS ns2.unixexplore.com.

@               IN    A    192.168.5.2
ns1             IN    A    192.168.5.2 
ns2             IN    A    192.168.5.3

Di bawah ini adalah contoh file skrip "unixexplore.com.reverse" untuk NSD Master dan Slave.

$ORIGIN unixexplore.com. ; default zone domain
$TTL 86400       ; default time to live

5.168.192.in-addr.arpa. IN SOA ns1.unixexplore.com. admin.unixexplore.com. (
                            2014010203 ; serial number
                            28800      ; Refresh
                            7200       ; Retry
                            864000     ; Expire
                            86400      ; Min TTL
                             )
; Name Servers

@				IN		NS		ns1
@				IN		NS		ns2

2.5.168.192.in-addr.arpa.	IN		PTR		@
2.5.168.192.in-addr.arpa.	IN		PTR		ns1
3.5.168.192.in-addr.arpa.	IN		PTR		ns2

E. Konfigurasi NSD

Karena kita akan menjalankan NSD dengan server caching DNS Unbound, untuk menghindari konflik void, konfigurasikan NSD menggunakan port 5053, karena port 53 digunakan oleh server caching DNS Unbound.

NSD akan mendengarkan permintaan dari IP server LAN. Sebelum menjalankan aplikasi NSD, pastikan kita telah mengedit berkas nsd.conf di folder /usr/local/etc agar sesuai dengan kebutuhan internet dan spesifikasi komputer server kita.

Di bawah ini adalah contoh skrip dari file "/usr/local/etc/nsd/nsd.conf" untuk melayani NSD Master.

#
# nsd.conf -- the NSD(8) configuration file, nsd.conf(5).
#
# Copyright (c) 2001-2011, NLnet Labs. All rights reserved.
#
# See LICENSE for the license.
#

# This is a comment.
# Sample configuration file
# include: "file" # include that file's text over here.

# options for the nsd server

server:
 
# Number of NSD servers to fork. Put the number of CPUs to use here.
# server-count: 1

# uncomment to specify specific interfaces to bind (default are the
# wildcard interfaces 0.0.0.0 and ::0).
# ip-address: 1.2.3.4
# ip-address: 1.2.3.4@5678
# ip-address: 12fe::8ef0
ip-address: 192.168.9.1
ip-address: 127.0.0.1

# Allow binding to non local addresses. Default no.
# ip-transparent: no

# enable debug mode, does not fork daemon process into the background.
# debug-mode: no

# listen on IPv4 connections
  do-ip4: yes

# listen on IPv6 connections
# do-ip6: yes

# port to answer queries on. default is 53.
port: 5053

# Verbosity level.
  verbosity: 2

# After binding socket, drop user privileges.
# can be a username, id or id.gid.
username: nsd

# Run NSD in a chroot-jail.
# make sure to have pidfile and database reachable from there.
# by default, no chroot-jail is used.
chroot: "/usr/local/etc/nsd"

# The directory for zonefile: files. The daemon chdirs here.
  zonesdir: "/usr/local/etc/nsd/zonefile"
 
# the list of dynamically added zones.
  zonelistfile: "/usr/local/etc/nsd/db/zone.list"

# the database to use
  database: "/usr/local/etc/nsd/db/nsd.db"

# log messages to file. Default to stderr and syslog (with
# facility LOG_DAEMON). stderr disappears when daemon goes to bg.
  logfile: "/usr/local/etc/nsd/log/nsd.log"

# File to store pid for nsd in.
  pidfile: "/usr/local/etc/nsd/nsd.pid"

# The file where secondary zone refresh and expire timeouts are kept.
# If you delete this file, all secondary zones are forced to be 
# 'refreshing' (as if nsd got a notify).
  xfrdfile: "/usr/local/etc/nsd/db/xfrd.state"

# The directory where zone transfers are stored, in a subdir of it.
  xfrdir: "/usr/local/etc/nsd/tmp"

# don't answer VERSION.BIND and VERSION.SERVER CHAOS class queries
  hide-version: yes

# identify the server (CH TXT ID.SERVER entry).
  identity: "unidentified server"

# NSID identity (hex string, or "ascii_somestring"). default disabled.
# nsid: "aabbccdd"

# Maximum number of concurrent TCP connections per server.
# tcp-count: 100

# Maximum number of queries served on a single TCP connection.
# By default 0, which means no maximum.
# tcp-query-count: 0

# Override the default (120 seconds) TCP timeout.
# tcp-timeout: 120

# Preferred EDNS buffer size for IPv4.
# ipv4-edns-size: 4096

# Preferred EDNS buffer size for IPv6.
# ipv6-edns-size: 4096

# statistics are produced every number of seconds. Prints to log.
# statistics: 3600

# Number of seconds between reloads triggered by xfrd.
# xfrd-reload-timeout: 1

# check mtime of all zone files on start and sighup
# zonefiles-check: yes

# RRLconfig
# Response Rate Limiting, size of the hashtable. Default 1000000.
# rrl-size: 1000000

# Response Rate Limiting, maximum QPS allowed (from one query source).
# Default 200. If set to 0, ratelimiting is disabled. Also set
# rrl-whitelist-ratelimit to 0 to disable ratelimit processing.
# rrl-ratelimit: 200

# Response Rate Limiting, number of packets to discard before
# sending a SLIP response (a truncated one, allowing an honest
# resolver to retry with TCP). Default is 2 (one half of the
# queries will receive a SLIP response, 0 disables SLIP (all
# packets are discarded), 1 means every request will get a
# SLIP response.
# rrl-slip: 2

# Response Rate Limiting, IPv4 prefix length. Addresses are
# grouped by netblock. 
# rrl-ipv4-prefix-length: 24

# Response Rate Limiting, IPv6 prefix length. Addresses are
# grouped by netblock. 
# rrl-ipv6-prefix-length: 64

# Response Rate Limiting, maximum QPS allowed (from one query source)
# for whitelisted types. Default 2000.
# rrl-whitelist-ratelimit: 2000
# RRLend

# Remote control config section. 

remote-control:
 
# Enable remote control with nsd-control(8) here.
# set up the keys and certificates with nsd-control-setup.
  control-enable: yes 

# what interfaces are listened to for control, default is on localhost.
  control-interface: 127.0.0.1
# control-interface: ::1

# port number for remote control operations (uses TLS over TCP).
  control-port: 8952

# nsd server key file for remote control.
  server-key-file: "/usr/local/etc/nsd/nsd_server.key"

# nsd server certificate file for remote control.
  server-cert-file: "/usr/local/etc/nsd/nsd_server.pem"

# nsd-control key file.
  control-key-file: "/usr/local/etc/nsd/nsd_control.key"

# nsd-control certificate file.
  control-cert-file: "/usr/local/etc/nsd/nsd_control.pem"


# Secret keys for TSIGs that secure zone transfers.
# You could include: "secret.keys" and put the 'key:' statements in there,
# and give that file special access control permissions.
#
key:
# The key name is sent to the other party, it must be the same
name: "secure_key"
# algorithm hmac-md5, or hmac-sha1, or hmac-sha256 (if compiled in)
algorithm: hmac-sha256
# secret material, must be the same as the other party uses.
# base64 encoded random number.
# e.g. from dd if=/dev/random of=/dev/stdout count=1 bs=32 | base64
secret: "D4Xurm0OcyfCxMCcXpnPC/F1LpcRtLIQrlcH4ABxy/Y="                              


# Patterns have zone configuration and they are shared by one or more zones.
# 
# pattern:
# name by which the pattern is referred to
# name: "myzones"
# the zonefile for the zones that use this pattern.
# if relative then from the zonesdir (inside the chroot).
# the name is processed: %s - zone name (as appears in zone:name).
# %1 - first character of zone name, %2 second, %3 third.
# %z - topleveldomain label of zone, %y, %x next labels in name.
# if label or character does not exist you get a dot '.'.
# for example "%s.zone" or "zones/%1/%2/%3/%s" or "secondary/%z/%s"
# zonefile: "%s.zone"
 
# If no master and slave access control elements are provided,
# this zone will not be served to/from other servers.

# A master zone needs notify: and provide-xfr: lists. A slave
# may also allow zone transfer (for debug or other secondaries).
# notify these slaves when the master zone changes, address TSIG|NOKEY
# IP can be ipv4 and ipv6, with @port for a nondefault port number.
# notify: 192.0.2.1 NOKEY
# allow these IPs and TSIG to transfer zones, addr TSIG|NOKEY|BLOCKED
# address range 192.0.2.0/24, 1.2.3.4&255.255.0.0, 3.0.2.20-3.0.2.40
# provide-xfr: 192.0.2.0/24 my_tsig_key_name
# set the number of retries for notify.
# notify-retry: 5

# uncomment to provide AXFR to all the world
# provide-xfr: 0.0.0.0/0 NOKEY
# provide-xfr: ::0/0 NOKEY

# A slave zone needs allow-notify: and request-xfr: lists.
# allow-notify: 2001:db8::0/64 my_tsig_key_name
# By default, a slave will request a zone transfer with IXFR/TCP.
# If you want to make use of IXFR/UDP use: UDP addr tsigkey
# for a master that only speaks AXFR (like NSD) use AXFR addr tsigkey
# request-xfr: 192.0.2.2 the_tsig_key_name
# Attention: You cannot use UDP and AXFR together. AXFR is always over 
# TCP. If you use UDP, we higly recommend you to deploy TSIG.
# Allow AXFR fallback if the master does not support IXFR. Default
# is yes.
# allow-axfr-fallback: yes
# set local interface for sending zone transfer requests.
# default is let the OS choose.
# outgoing-interface: 10.0.0.10

# if you give another pattern name here, at this point the settings
# from that pattern are inserted into this one (as if it were a 
# macro). The statement can be given in between other statements,
# because the order of access control elements can make a difference
# (which master to request from first, which slave to notify first).
# include-pattern: "common-masters"


# Fixed zone entries. Here you can config zones that cannot be deleted.
# Zones that are dynamically added and deleted are put in the zonelist file.
#
# zone:
# name: "example.com"
# you can give a pattern here, all the settings from that pattern
# are then inserted at this point
# include-pattern: "master"
# You can also specify (additional) options directly for this zone.
# zonefile: "example.com.zone"
# request-xfr: 192.0.2.1 example.com.key

# RRLconfig
# Response Rate Limiting, whitelist types
# rrl-whitelist: nxdomain
# rrl-whitelist: error
# rrl-whitelist: referral
# rrl-whitelist: any
# rrl-whitelist: rrsig
# rrl-whitelist: wildcard
# rrl-whitelist: nodata
# rrl-whitelist: dnskey
# rrl-whitelist: positive
# rrl-whitelist: all
# RRLend

  zone:
   name: "unixexplore.com"
   zonefile: unixexplore.com.forward
   notify: 192.168.9.3@5053 secure_key
   provide-xfr: 192.168.9.3 secure_key

  zone:
   name: "9.168.192.in-addr.arpa"
   zonefile: unixexplore.com.reverse
   notify: 192.168.9.3@5053 secure_key
   provide-xfr: 192.168.9.3 secure_key

Di bawah ini adalah skrip "/usr/local/etc/nsd/nsd.conf" untuk server NSD Slave.

#
# nsd.conf -- the NSD(8) configuration file, nsd.conf(5).
#
# Copyright (c) 2001-2011, NLnet Labs. All rights reserved.
#
# See LICENSE for the license.
#

# This is a comment.
# Sample configuration file
# include: "file" # include that file's text over here.

# options for the nsd server

server:
 
# Number of NSD servers to fork. Put the number of CPUs to use here.
 server-count: 1

# uncomment to specify specific interfaces to bind (default are the
# wildcard interfaces 0.0.0.0 and ::0).
# ip-address: 1.2.3.4
# ip-address: 1.2.3.4@5678
# ip-address: 12fe::8ef0
  ip-address: 192.168.9.3
  ip-address: 127.0.0.1
 

# Allow binding to non local addresses. Default no.
# ip-transparent: no

# enable debug mode, does not fork daemon process into the background.
# debug-mode: no

# listen on IPv4 connections
  do-ip4: yes

# listen on IPv6 connections
# do-ip6: yes

# port to answer queries on. default is 53.
  port: 5053

# Verbosity level.
  verbosity: 2 

# After binding socket, drop user privileges.
# can be a username, id or id.gid.
  username: nsd

# Run NSD in a chroot-jail.
# make sure to have pidfile and database reachable from there.
# by default, no chroot-jail is used.
  chroot: "/usr/local/etc/nsd"

# The directory for zonefile: files. The daemon chdirs here.
  zonesdir: "/usr/local/etc/nsd/zonefile"
 
# the list of dynamically added zones.
  zonelistfile: "/usr/local/etc/nsd/db/zone.list"

# the database to use
  database: "/usr/local/etc/nsd/db/nsd.db"

# log messages to file. Default to stderr and syslog (with
# facility LOG_DAEMON). stderr disappears when daemon goes to bg.
  logfile: "/usr/local/etc/nsd/log/nsd.log"

# File to store pid for nsd in.
  pidfile: "/usr/local/etc/nsd/nsd.pid"

# The file where secondary zone refresh and expire timeouts are kept.
# If you delete this file, all secondary zones are forced to be 
# 'refreshing' (as if nsd got a notify).
  xfrdfile: "/usr/local/etc/nsd/db/xfrd.state"

# The directory where zone transfers are stored, in a subdir of it.
  xfrdir: "/usr/local/etc/nsd/tmp"

# don't answer VERSION.BIND and VERSION.SERVER CHAOS class queries
  hide-version: yes 

# identify the server (CH TXT ID.SERVER entry).
  identity: "unidentified server"

# NSID identity (hex string, or "ascii_somestring"). default disabled.
# nsid: "aabbccdd"

# Maximum number of concurrent TCP connections per server.
# tcp-count: 100

# Maximum number of queries served on a single TCP connection.
# By default 0, which means no maximum.
# tcp-query-count: 0

# Override the default (120 seconds) TCP timeout.
# tcp-timeout: 120

# Preferred EDNS buffer size for IPv4.
# ipv4-edns-size: 4096

# Preferred EDNS buffer size for IPv6.
# ipv6-edns-size: 4096

# statistics are produced every number of seconds. Prints to log.
# statistics: 3600

# Number of seconds between reloads triggered by xfrd.
# xfrd-reload-timeout: 1

# check mtime of all zone files on start and sighup
# zonefiles-check: yes

# RRLconfig
# Response Rate Limiting, size of the hashtable. Default 1000000.
# rrl-size: 1000000

# Response Rate Limiting, maximum QPS allowed (from one query source).
# Default 200. If set to 0, ratelimiting is disabled. Also set
# rrl-whitelist-ratelimit to 0 to disable ratelimit processing.
# rrl-ratelimit: 200

# Response Rate Limiting, number of packets to discard before
# sending a SLIP response (a truncated one, allowing an honest
# resolver to retry with TCP). Default is 2 (one half of the
# queries will receive a SLIP response, 0 disables SLIP (all
# packets are discarded), 1 means every request will get a
# SLIP response.
# rrl-slip: 2

# Response Rate Limiting, IPv4 prefix length. Addresses are
# grouped by netblock. 
# rrl-ipv4-prefix-length: 24

# Response Rate Limiting, IPv6 prefix length. Addresses are
# grouped by netblock. 
# rrl-ipv6-prefix-length: 64

# Response Rate Limiting, maximum QPS allowed (from one query source)
# for whitelisted types. Default 2000.
# rrl-whitelist-ratelimit: 2000
# RRLend

# Remote control config section. 

remote-control:
 
# Enable remote control with nsd-control(8) here.
# set up the keys and certificates with nsd-control-setup.
  control-enable: yes 

# what interfaces are listened to for control, default is on localhost.
  control-interface: 127.0.0.1
# control-interface: ::1

# port number for remote control operations (uses TLS over TCP).
  control-port: 8952

# nsd server key file for remote control.
  server-key-file: "/usr/local/etc/nsd/nsd_server.key"

# nsd server certificate file for remote control.
  server-cert-file: "/usr/local/etc/nsd/nsd_server.pem"

# nsd-control key file.
  control-key-file: "/usr/local/etc/nsd/nsd_control.key"

# nsd-control certificate file.
  control-cert-file: "/usr/local/etc/nsd/nsd_control.pem"


# Secret keys for TSIGs that secure zone transfers.
# You could include: "secret.keys" and put the 'key:' statements in there,
# and give that file special access control permissions.
#
key:
# The key name is sent to the other party, it must be the same
name: "secure_key"
# algorithm hmac-md5, or hmac-sha1, or hmac-sha256 (if compiled in)
algorithm: hmac-sha256
# secret material, must be the same as the other party uses.
# base64 encoded random number.
# e.g. from dd if=/dev/random of=/dev/stdout count=1 bs=32 | base64
secret: "D4Xurm0OcyfCxMCcXpnPC/F1LpcRtLIQrlcH4ABxy/Y="


# Patterns have zone configuration and they are shared by one or more zones.
# 
# pattern:
# name by which the pattern is referred to
# name: "myzones"
# the zonefile for the zones that use this pattern.
# if relative then from the zonesdir (inside the chroot).
# the name is processed: %s - zone name (as appears in zone:name).
# %1 - first character of zone name, %2 second, %3 third.
# %z - topleveldomain label of zone, %y, %x next labels in name.
# if label or character does not exist you get a dot '.'.
# for example "%s.zone" or "zones/%1/%2/%3/%s" or "secondary/%z/%s"
# zonefile: "%s.zone"
 
# If no master and slave access control elements are provided,
# this zone will not be served to/from other servers.

# A master zone needs notify: and provide-xfr: lists. A slave
# may also allow zone transfer (for debug or other secondaries).
# notify these slaves when the master zone changes, address TSIG|NOKEY
# IP can be ipv4 and ipv6, with @port for a nondefault port number.
# notify: 192.0.2.1 NOKEY
# allow these IPs and TSIG to transfer zones, addr TSIG|NOKEY|BLOCKED
# address range 192.0.2.0/24, 1.2.3.4&255.255.0.0, 3.0.2.20-3.0.2.40
# provide-xfr: 192.0.2.0/24 my_tsig_key_name
# set the number of retries for notify.
# notify-retry: 5

# uncomment to provide AXFR to all the world
# provide-xfr: 0.0.0.0/0 NOKEY
# provide-xfr: ::0/0 NOKEY

# A slave zone needs allow-notify: and request-xfr: lists.
# allow-notify: 2001:db8::0/64 my_tsig_key_name
# By default, a slave will request a zone transfer with IXFR/TCP.
# If you want to make use of IXFR/UDP use: UDP addr tsigkey
# for a master that only speaks AXFR (like NSD) use AXFR addr tsigkey
# request-xfr: 192.0.2.2 the_tsig_key_name
# Attention: You cannot use UDP and AXFR together. AXFR is always over 
# TCP. If you use UDP, we higly recommend you to deploy TSIG.
# Allow AXFR fallback if the master does not support IXFR. Default
# is yes.
# allow-axfr-fallback: yes
# set local interface for sending zone transfer requests.
# default is let the OS choose.
# outgoing-interface: 10.0.0.10

# if you give another pattern name here, at this point the settings
# from that pattern are inserted into this one (as if it were a 
# macro). The statement can be given in between other statements,
# because the order of access control elements can make a difference
# (which master to request from first, which slave to notify first).
# include-pattern: "common-masters"


# Fixed zone entries. Here you can config zones that cannot be deleted.
# Zones that are dynamically added and deleted are put in the zonelist file.
#
# zone:
# name: "example.com"
# you can give a pattern here, all the settings from that pattern
# are then inserted at this point
# include-pattern: "master"
# You can also specify (additional) options directly for this zone.
# zonefile: "example.com.zone"
# request-xfr: 192.0.2.1 example.com.key

# RRLconfig
# Response Rate Limiting, whitelist types
# rrl-whitelist: nxdomain
# rrl-whitelist: error
# rrl-whitelist: referral
# rrl-whitelist: any
# rrl-whitelist: rrsig
# rrl-whitelist: wildcard
# rrl-whitelist: nodata
# rrl-whitelist: dnskey
# rrl-whitelist: positive
# rrl-whitelist: all
# RRLend

  zone:
   name: "unixexplore.com"
   zonefile: unixexplore.com.forward
   allow-notify: 192.168.9.1 secure_key
   allow-notify: 127.0.0.1 NOKEY
   request-xfr: AXFR 192.168.9.1@5053 secure_key
 
  zone:
   name: "9.168.192.in-addr.arpa"
   zonefile: unixexplore.com.reverse
   allow-notify: 192.168.9.1 secure_key
   allow-notify: 127.0.0.1 NOKEY
   request-xfr: AXFR 192.168.9.1@5053 secure_key

F. Buat berkas Log (log rotation)

Karena NSD akan menghasilkan banyak entri log tergantung pada tingkat verbositasnya, mengelola rotasi log sangatlah penting. Skrip di bawah ini diperlukan di Server Master dan Slave NSD.

Tambahkan skrip di bawah ini ke berkas /etc/newsyslog.conf.

root@ns1:~ # cd /usr/local/etc/nsd/log
root@ns1:/usr/local/etc/nsd/log # ee /etc/newsyslog.conf
/usr/local/etc/nsd/log/nsd.log  bind:wheel     640  7     *    @T12  R   /usr/local/etc/nsd/log_reopen

Setelah itu, buat file log_reopen di folder /usr/local/etc/nsd, dan anda masukkan skrip di bawah ini.

root@ns1:~ # cd /usr/local/etc/nsd
root@ns1:/usr/local/etc/nsd # touch log_reopen
root@ns1:/usr/local/etc/nsd # ee log_reopen

# !/bin/sh
# This script restarts NSD after log rotation by newsyslog(8)
/usr/local/sbin/nsd-control log_reopen
exit 0

Lanjutkan dengan membuat izin pada file log_reopen.

root@ns1:/usr/local/etc/nsd # chown -R nsd:nsd /usr/local/etc/nsd/log_reopen

Ketika Anda memperbarui berkas zona dengan rekaman DNS baru dan meningkatkan nomor seri domain, NSD akan memperbarui Server Slave NSD, saat berkas zona dimuat ulang menggunakan nsd-control reload atau jika layanan nsd dimulai ulang dari Server Master NSD.

Karena basis data NSD diperbarui dengan informasi zona yang berubah, berkas zona yang sebenarnya, dalam kasus kami, unixexplore.com.forward dan unixexplore.com.reverse tidak diperbarui di Server Slave NSD.

Namun, NSD menyediakan utilitas penulisan nsd-control untuk melakukan tugas ini. Disarankan untuk menggunakan pekerjaan cron sekali sehari untuk memperbarui berkas zona teks di Server Master dan Slave NSD.

root@ns1:/usr/local/etc/nsd # touch /usr/local/etc/nsd/zone_write
root@ns1:/usr/local/etc/nsd # ee /usr/local/etc/nsd/zone_write

#!/bin/sh
#This script writes the zone files to the NSD Slave Server
/usr/local/sbin/nsd-control write
exit 0

root@ns1:/usr/local/etc/nsd # ee /etc/crontab
00     08     *     *     *     /usr/local/etc/nsd/zone_write

root@ns1:/usr/local/etc/nsd # chown -R nsd:nsd /usr/local/etc/nsd/zone_write

Untuk menerapkan perubahan terebut, restart/reboot server NSD anda.

root@ns1:/usr/local/etc/nsd # service nsd restart
Stopping nsd.
Waiting for PIDS: 954.
Starting nsd.
root@router1:~ #

Sejauh ini, NSD berjalan dengan baik, tetapi belum dapat digunakan. NSD BERJALAN tetapi tidak berfungsi, mengapa? Di awal artikel yang telah kita bahas, Server NSD berfungsi dengan Server DNS Unbound.

Agar Server NSD dapat berfungsi dengan baik, kita harus menambahkan skrip berikut ke berkas unbound.conf di folder /usr/local/etc/unbound. Skrip berikut ditambahkan ke berkas unbound.conf di komputer Master dan Slave.

Di bawah ini adalah contoh skrip zona stub dari file /usr/local/etc/unbound/unbound.conf di server NSD Master.

stub-zone:
   name: "unixexplore.com"
   stub-addr: 192.168.5.2@5053

   stub-zone:
   name: "9.168.192.in-addr.arpa."
   stub-addr: 192.168.5.2@5053

Di bawah ini adalah contoh skrip zona stub dari file /usr/local/etc/unbound/unbound.conf di server NSD Slave.

stub-zone:
   name: "unixexplore.com"
   stub-addr: 192.168.5.3@5053

   stub-zone:
   name: "9.168.192.in-addr.arpa."
   stub-addr: 192.168.5.3@5053

Anda dapat menempatkan skrip di unbound.conf di atas, di akhir file /usr/local/etc/unbound/unbound.conf. Sekarang, mulai ulang/restart NSD.

root@ns1:/usr/local/etc/nsd # service nsd restart
Stopping nsd.
Waiting for PIDS: 954.
Starting nsd.
root@router1:~ #

Sekarang komputer server Anda telah terinstal aplikasi NSD yang sedang BERJALAN dan dapat berfungsi dengan baik bersama Server Unbound.

Dalam artikel ini, NSD sebagai Server DNS Otoritatif telah dikonfigurasi untuk resolusi DNS LAN internal. Menggabungkan unbound dengan nsd merupakan kombinasi yang efektif sebagai pengganti Bind, untuk melayani server DNS dan server nama otoritatif bagi klien yang memerlukan DNS.

Cara Menggunakan Java Scala di FreeBSD

Menambahkan Sertifikat TLS SSL pada database MariaDB dengan OpenSSL

UNIXBSDSHELL

Website Statis Tutorial Opensource