bind

Formulas to set up and configure the bind DNS server.

Note

See the full Salt Formulas installation and usage instructions.

Available states

• bind
• bind.config

bind

Install the bind package and start the bind service.

bind.config

Manage the bind configuration file.

Example Pillar

bind:
  configured_zones:
    example.com:
      type: master
      notify: False
  available_zones:
    example.com:
      file: example.com.txt
      soa:
        ns: ns1.example.com                       # Required
        contact: hostmaster.example.com           # Required
        serial: 2017041001                        # Required
      records:                                    # Records for the zone, grouped by type
        A:
          mx1:                                    # A RR with multiple values can
            - 1.2.3.228                           # be written as an array
            - 1.2.3.229
          cat: 2.3.4.188
          rat: 1.2.3.231
          live: 1.2.3.236
  configured_views:
    myview1:
      match_clients:
        - client1
        - client2
    configured_zones:
      my.zone:
        type: master
        notify: False

See bind/pillar.example for a more complete example.

Management of zone files

named.conf.local

<zone> entries in named.conf.local will point to the file declared in

• bind:configured_zones:<zone>:file (this takes precedence)
• bind:available_zones:<zone>:file

zone files

The config.sls state will iterate on bind:available_zones and manage <zone> files for each <zone> that has bind:available_zones:<zone>:file` declared.

• If bind:available_zones:<zone>:records exist, a zone file will be created using those records (see pillar.example for more details)
• If bind:available_zones:<zone>:records is NOT declared, bind:available_zones:<zone>:file should point to an existing zone file that will be sourced by the formula.

External zone files

To use an external tool to manage the <zone> file, simply declare the location of the zone file in bind:configured_zones:<zone>:file and don't add any entry for the <zone> in bind:available_zones

DNSSEC

The bind formula currently support two ways to enable DNSSEC:

• Using the zonesigner binary provided by dnssec-tools (legacy) ;
• Using internal features of bind.

Here is sample pillar entries to use the latter.

On the master server :

bind:

lookup:

key_directory: '/etc/bind/keys'

config:

options:

dnssec-enable: 'yes' dnssec-validation: 'yes'

configured_acls:

slave_server:

• 192.168.1.2

configured_zones:

domain.tld:

file: "db.domain.tld" type: master notify: True allow-transfer:

• localnets
• localhost
• slave_server

allow-update: 'none' auto-dnssec: 'maintain'

On the slave server :

bind:

config:

options:

dnssec-enable: 'yes' dnssec-validation: 'yes'

configured_zones:

domain.tld:

file: "db.domain.tld.signed" type: slave masters:

• master_server

configured_masters:

master_server:

• 192.168.1.1

Notes

• When using views all zones must be configured in views!

Salt Compatibility

Tested with:

• 2017.7.x
• 2018.3.x

OS Compatibility

Tested with:

• Archlinux
• CentOS 7
• Debian-8
• Debian-9
• Fedora-27
• Ubuntu-16.04
• Ubuntu-18.04