How to Configure DJBDNS on FreeBSD

This tutorial will show you how to configure a DNS service that is easy to maintain, easy to configure, and that is generally more secure than the classic BIND service. This article assumes that you are running a VPS with FreeBSD installed.

To begin, open your terminal and install this package:

<ceph>[~]# pkg install djbdns                                              
Updating FreeBSD repository catalogue...
FreeBSD repository is up-to-date.
All repositories are up-to-date.
The following 3 packages will be affected (of 0 checked):

New packages to be INSTALLED:
djbdns: 1.05_20,1
ucspi-tcp: 0.88_2
daemontools: 0.76_17

The process will require 1 MB more space.
251 KB to be downloaded.

Proceed with this action? [y/N]: y
Fetching djbdns-1.05_20,1.txz: 100%  139 KB 142.4k/s    00:01    
Fetching ucspi-tcp-0.88_2.txz: 100%   62 KB  63.1k/s    00:01    
Fetching daemontools-0.76_17.txz: 100%   51 KB  51.7k/s    00:01    
Checking integrity... done (0 conflicting)
[1/3] Installing ucspi-tcp-0.88_2...
[1/3] Extracting ucspi-tcp-0.88_2: 100%
[2/3] Installing daemontools-0.76_17...
[2/3] Extracting daemontools-0.76_17: 100%
[3/3] Installing djbdns-1.05_20,1...
[3/3] Extracting djbdns-1.05_20,1: 100%

Installation will automatically install additional packages (daemontools and ucspi-tcp).

Create two users, gtinydns and gdnslog. Start with the first user:

<ceph>[~]# adduser         
Username: gtinydns
Full name: gtinydns
Uid (Leave empty for default): 
Login group [gtinydns]: 
Login group is gtinydns. Invite gtinydns into other groups? []: 
Login class [default]: 
Shell (sh csh tcsh zsh rzsh nologin) [sh]: nologin
Home directory [/home/gtinydns]: 
Home directory permissions (Leave empty for default): 
Use password-based authentication? [yes]: 
Use an empty password? (yes/no) [no]: 
Use a random password? (yes/no) [no]: yes
Lock out the account after creation? [no]: 
Username   : gtinydns
Password   : <random>
Full Name  : gtinydns
Uid        : 1002
Class      : 
Groups     : gtinydns 
Home       : /home/gtinydns
Home Mode  : 
Shell      : /usr/sbin/nologin
Locked     : no
OK? (yes/no): yes
adduser: INFO: Successfully added (gtinydns) to the user database.
adduser: INFO: Password for (gtinydns) is: rTsada2131sa1Mg
Add another user? (yes/no): no
Goodbye!

Now, add the second user:

<ceph>[~]# adduser
Username: gdnslog
Full name: gdnslog
Uid (Leave empty for default):  
Login group [gdnslog]: 
Login group is gdnslog. Invite gdnslog into other groups? []: 
Login class [default]: 
Shell (sh csh tcsh zsh rzsh nologin) [sh]: nologin
Home directory [/home/gdnslog]: 
Home directory permissions (Leave empty for default): 
Use password-based authentication? [yes]: 
Use an empty password? (yes/no) [no]: 
Use a random password? (yes/no) [no]: yes
Lock out the account after creation? [no]: 
Username   : gdnslog
Password   : <random>
Full Name  : gdnslog
Uid        : 1003
Class      : 
Groups     : gdnslog 
Home       : /home/gdnslog
Home Mode  : 
Shell      : /usr/sbin/nologin
Locked     : no
OK? (yes/no): yes
adduser: INFO: Successfully added (gdnslog) to the user database.
adduser: INFO: Password for (gdnslog) is: jWsdad33aasdaFa0
Add another user? (yes/no): no
Goodbye!

Run the following command. Replace the IP address with the address of your Vultr server.

<ceph>[~]# tinydns-conf gtinydns gdnslog /usr/local/etc/tinydns 108.61.100.100

This command will create directories, files, and other sub directories in /usr/local/etc/tinydns. It will also put the IP address of the VPS in /usr/local/etc/tinydns/env/IP.

Create the directory /service.

<ceph>[~]# mkdir /service

Edit your /etc/rc.conf file:

<ceph>[~]# ee /etc/rc.conf

… and and these lines:

svscan_enable="YES"
svscan_servicedir="/service"

Save the configuration and start the svscan service:

<ceph>[~]# /usr/local/etc/rc.d/svscan start
Starting svscan.

Next, go to this directory:

 <ceph>[~]# cd /usr/local/etc/tinydns/root

Edit the data file:

 <ceph>[root]# ee data

… and add some DNS data:

# domain1.com
Zdomain1.com:dns1.domain1.com.:ns.domain1.com.:2013101203:604800:86400:2419200:604800:3600
&domain1.com::dns1.domain1.com.:3600
&domain1.com::dns2.domain1.com.:3600

# MX
@domain1.com::mail1.domain1.com.:10:3600
@domain1.com::mail2.domain1.com.:30:3600

# IP's (A records)
=dns1.domain1.com:108.61.210.99:3600
=dns2.domain1.com:89.201.163.42:3600
=mail1.domain1.com:89.201.163.42:3600
=mail2.domain1.com:85.114.41.8:3600
=www.domain1.com:108.61.178.194:3600
=test1.domain1.com:193.198.184.100:3600
=test2.domain1.com:108.61.178.215:3600

# Aliases
+domain1.com:108.61.178.194:3600
+smtp.domain1.com:89.201.163.42:3600
+imap.domain1.com:89.201.163.42:3600

Save the file and exit.

Run ls:

<ceph>[root]# ls
Makefile  add-alias  add-childns  add-host  add-mx  add-ns  data

Convert your text data to the database format:

<ceph>[root]# make
/usr/local/bin/tinydns-data

Run ls again:

<ceph>[root]# ls
Makefile  add-alias  add-childns  add-host  add-mx  add-ns  data  data.cdb

Notice the data.cdb file. You have created it with the make command.

And one more thing, create a symbolic link:

<ceph>[root]# ln -s /usr/local/etc/tinydns /service

Now test your new DNS server. Replace 108.61.178.110 with IP address of your server.

<ceph>[root]# host www.domain1.com 108.61.178.110 
Using domain server:
Name: 108.61.178.110
Address: 108.61.178.110#53
Aliases: 

www.domain1.com has address 108.61.178.194

Nameserver lookup:

<ceph>[root]# host -t ns domain1.com 108.61.178.110 
Using domain server:
Name: 108.61.178.110
Address: 108.61.178.110#53
Aliases: 

domain1.com name server dns1.domain1.com.
domain1.com name server dns2.domain1.com.

Mailserver MX lookup:

<ceph>[root]# host -t mx domain1.com 108.61.178.110 
Using domain server:
Name: 108.61.178.110
Address: 108.61.178.110#53
Aliases: 

domain1.com mail is handled by 10 mail1.domain1.com.
domain1.com mail is handled by 30 mail2.domain1.com.

One more time to be sure:

<ceph>[root]# host mail1.domain1.com 108.61.178.110 
Using domain server:
Name: 108.61.178.110
Address: 108.61.178.110#53
Aliases: 

mail1.domain1.com has address 89.201.163.42

Congratulations! You have a working DNS server. Replace domain1.com with your domain. After every change, run the make command to make new data.cdb file.

Explanation of the data file:

“A” records begin with an = sign. Aliases or CNAME records with a + sign. Mail servers begin with the @ sign. Nameservers with the & sign.

Example 1:

=test1.domain1.com:193.198.184.100:3600

= stands for “A” record. test1.domain1.com is the DNS name, IP 193.198.184.100 is the address in which test1.domain1.com resolves, and 3600 is the TTL (time to live).

Example 2:

# MX
@domain1.com::mail1.domain1.com.:10:3600
@domain1.com::mail2.domain1.com.:30:3600

In this example, mail1 and mail2 are mail servers for domain1.com. mail1 has priority 10 and mail2 has priority 30. That means that mail servers will first try to deliver mail to mail1. If mail1 fails, then they will try mail2.

The following line marks beginning of the zone info. It is required.

Zdomain1.com:dns1.domain1.com.:ns.domain1.com.:2013101203:604800:86400:2419200:604800:3600

2013101203 number is used when you have secondary DNS on some other provider. When you change the number to 2013101204, the secondary DNS will know that there are some changes in DNS and will pick up the changes. This is just for informative purposes (you would need the AXFR DNS transfer service). Alternatively, you can copy and paste your DNS changes between two DJBDNS servers with the rsync program.

If you have PF Firewall on your FreeBSD server, add this line to allow DNS queries:

pass quick proto {tcp, udp} from any to $me port 53 flags S/SA keep state