Manage dns forward and reverse zonefiles, from a resource file
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
.gitignore
.project
.pydevproject
LICENSE
README.md
dnsmgr-example.conf
dnsmgr.py
dnsmgr_api.py
dnsmgr_isc_bind.py
dnsmgr_isc_dhcp.py
dnsmgr_util.py
file_loader.py
records-example.com

README.md

DNSMGR

Manage dns forward and reverse zonefiles, from one or multiple record files

DNSMGR can be run as a standalone application, or used as a library from other applications.

DNSMGR can run directly on the server where the nameserver is running on, or on another computer using SSH to manage the nameserver and its configuration.

DNSMGR can generate

  • Partial zonefiles
    • Use when zone file content is a mix of manual and DNSMGR created entries
    • Partial zonefiles needs to be included from the zone file
    • More flexible, but more work to setup
  • Full zonefiles (TODO, not implemented yet see issue #16)
    • Use when all zone file content will be generated from the zonefile
    • Simple, all of zone file is automatically generated including SOA and NS records

The code

  • Is developed and tested on Ubuntu 14.04 and Fedora 24
  • Uses python3.4 or later
    • if the nameserver is using an older python version, run DNSMGR on another machine and modifying the nameserver over SSH

Format and available options in the record file can be found in the records-example.com file.

Installation and setup

These instructions are for running DNSMGR on the primary nameserver.

Note! Installation of nameserver software is not described here, see the nameserver documentation (isc-bind etc)

Use of a configuration file is not needed but recommended to simplify usage.

Assumption, Ubuntu

  • the primary zonefiles are stored at /etc/bind/primary
  • the generated include files are stored at /etc/bind/primary/include
  • the script will be run by user anders

Assumption, Fedora

  • the primary zonefiles are stored at /etc/named
  • the generated include files are stored at /etc/named/include
  • the script will be run by user anders

Install dependencies

Ubuntu

sudo apt-get install git python3-pip python3-yaml
sudo pip3 install orderedattrdict

Fedora

sudo dnf install git python3-PyYAML
sudo pip3 install orderedattrdict

Create directories and adjust permissions

sudo mkdir /etc/dnsmgr
sudo chown anders /etc/dnsmgr

Ubuntu

sudo usermod -G bind anders
sudo mkdir -p /etc/bind/primary/include
sudo chown root:bind /etc/bind/primary/include
sudo chmod g+w /etc/bind/primary

Fedora

sudo usermod -G named anders
sudo mkdir -p /etc/named/include
sudo chown root:named /etc/named/include
sudo chmod g+w /etc/named/primary

Clone repository with the code

cd /opt
sudo mkdir DNSMGR
sudo chown bind DNSMGR
git clone https://github.com/lowinger42/DNSMGR.git

Create configuration and zones file

cd /etc/dnsmgr
cp /opt/dnsmgr/records-example.com records
cp /opt/dnsmgr/dnsmgr-example.conf dnsmgr.conf

Edit file with records and add/update/delete entries according to your environment.

Verify that the content of the configuration file is ok.

Add permissions so user can reload updated zonefiles

visudo

%bind ALL=(root) NOPASSWD: /usr/sbin/rndc *
%bind ALL=(root) NOPASSWD: /usr/sbin/service bind9 restart

Check if sudo works

sudo rndc reload

Test setup

cd /opt/dnsmgr
./dnsmgr.py rebuild

This will create include files in /etc/bind/primary/include

Inspect and verify that they are correct before using them in production.

Use generated files

For each zonefile, add a statement that includes the generated zonefiles

cd /etc/bind/primary
echo "$INCLUDE /etc/bind/primary/include/example.com" >>example.com
echo "$INCLUDE /etc/bind/primary/include/1.168.192.in-addr.arpa" >>1.168.192.in-addr.arpa
echo "$INCLUDE /etc/bind/primary/include/0.0.0.0.1.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa"  >>0.0.0.0.1.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa

Finalize setup

To simplify, put this in a shell script in for example /usr/bin/update-dns

#!/bin/sh
cd /opt/dnsmgr
./DNSMGR.py rebuild

Every time the zones file is changed, just rerun the update-dns script.

When run, DNSMGR will check all zones in bind config, and generate include files such as

 /tmp/example.com
 /tmp/1.168.192.in-addr.arpa
 /tmp/0.0.0.0.1.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa

Each file will then be compared to these files

 /etc/bind/primary/include/example.com
 /etc/bind/primary/include/1.168.192.in-addr.arpa
 /etc/bind/primary/include/0.0.0.0.1.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa

If there is a change

  • The file in /tmp/ is copied to /etc/bind/primary/include
  • The SOA serial is incremented for the zone
  • The zone is reloaded in bind

Summary of configuration files

This shows an example setup, in a Ubuntu 14.04 system

DNSMGR zones file /etc/dnsmgr/zones

content

$DOMAIN example.com

ns1                     192.168.1.1
ns1                     2001:db8:1::1

www                     192.168.1.2
www                     2001:db8:1::2

bind zone definitions /etc/bind/named.conf.local

content

zone "example.com" {
     type master;
     file "/etc/bind/primary/example.com";
};
zone "1.168.192.in-addr.arpa" {
     type master;
     file "/etc/bind/primary/1.168.192.in-addr.arpa";
};
zone "0.0.0.0.1.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa" {
     type master;
     file "/etc/bind/primary/0.0.0.0.1.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa";
};

bind zone files

Note the format of the serial number (YYYYMMDDxx), and the comment after. If the serial is not in this format (needs to be a valid date), with the comment after, the automatic increment of the serial number will not work.

/etc/bind/primary/example.com

content

$TTL 900
@         SOA     ns1.example.com. support.example.com. (
                          2016082231 ; serial
                               36000 ; refresh
                                3600 ; retry
                              604800 ; expire
                                 900 ; minimum
                  )

@                       NS      ns1.example.com.

$INCLUDE /etc/bind/primary/include/example.com

# Add additional entries below, which are unmanaged by DNSMGR

/etc/bind/primary/1.168.192.in-addr.arpa

content

$TTL 900
@         SOA     ns1.example.com. support.example.com. (
                          2016082231 ; serial
                               36000 ; refresh
                                3600 ; retry
                              604800 ; expire
                                 900 ; minimum
                  )

@                       NS      ns1.example.com.

$INCLUDE /etc/bind/primary/include/1.168.192.in-addr.arpa

# Add additional entries below, which are unmanaged by DNSMGR

/etc/bind/primary/0.0.0.0.1.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa

content

$TTL 900
@         SOA     ns1.example.com. support.example.com. (
                          2016082231 ; serial
                               36000 ; refresh
                                3600 ; retry
                              604800 ; expire
                                 900 ; minimum
                  )

@                       NS      ns1.example.com.

$INCLUDE /etc/bind/primary/include/

# Add additional entries below, which are unmanaged by DNSMGR

Files generated by DNSMGR

/etc/bind/primary/include/example.com

content

; File generated by DNSMGR
; Do not edit, changes will be overwritten
;
; Zonefile : example.com
; Records  : 2

$ORIGIN example.com.

ns1                                A       192.168.1.1
www                                A       192.168.1.2

/etc/bind/primary/include/1.168.192.in-addr.arpa

content

; File generated by DNSMGR
; Do not edit, changes will be overwritten
;
; Zonefile : 25.25.172.in-addr.arpa
; Records  : 2

$ORIGIN 25.25.172.in-addr.arpa.

1                                  PTR     ns1.example.com.      
2                                  PTR     www.example.com.      

/etc/bind/primary/include/0.0.0.0.1.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa

content

; File generated by DNSMGR
; Do not edit, changes will be overwritten
;
; Zonefile : 0.0.0.0.1.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
; Records  : 2

$ORIGIN 0.0.0.0.1.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.

1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0    PTR     ns1.example.com.
2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0    PTR     www.example.com.