2008 - Debian 4 - djbDNS - very secure DNS tools
The Slovak original of this document: 2008 - Debian 4 - djbDNS - very secure DNS tools (slovensky).
|=-------------------------------=[ djbDNS ]=------------------------------=| +---------------------------------------------------------------------------+ | | | Debian 4.0 | | DJBDNS : very secure DNS tools | | | +---------------------------------------------------------------------------+ |=-------------------------------=[ BH 2007 ]=-----------------------------=| DJBDNS is not available in Debian Etch as binary packages. There are only packages with the source code, and those too only in the 'contrib' and 'non-free' repositories. Requirements: - daemontools - ucspi-tcp-src Notes: - the IP address of the DNS server will be 10.62.2.44
Install - daemontools
# apt-get install daemontools-installer
# build-daemontools
-------------------
Enter a directory where you would like to do this [/tmp/daemontools] <- ENTER
Which format would you like to use? [fD] <- ENTER
Do you want to remove all files in /tmp/daemontools,
except daemontools_0.76-9_i386.deb now? [Yn] <- ENTER
Do you want to install daemontools_0.76-9_i386.deb now? [Yn] <- ENTER
Do you want to purge daemontools-installer now? [yN] <- ENTER
-------------------Install - ucspi-tcp-src
# apt-get install ucspi-tcp-src
# build-ucspi-tcp
-----------------
Enter a directory where you would like to do this [/tmp/ucspi-tcp] <- ENTER
Do you want to remove all files in /tmp/ucspi-tcp,
except ucspi-tcp_0.88-10_i386.deb now? [Yn] <- ENTER
Do you want to install ucspi-tcp_0.88-10_i386.deb now? [Yn] <- ENTER
Do you want to purge ucspi-tcp-src now? [yN] <- ENTER
-------------------Install - djbdns
# apt-get install djbdns-installer
# build-djbdns
--------------
Enter a directory where you would like to do this [/tmp/djbdns] <- ENTER
Do you want to remove all files in /tmp/djbdns,
except djbdns_1.05-11_i386.deb now? [Yn] <- ENTER
Do you want to install djbdns_1.05-11_i386.deb now? [Yn] <- ENTER
Do you want to purge djbdns-installer now? [yN] <- ENTERInstall - Config - djbdns
# mkdir /var/lib/svscan
# dnscache-conf dnscache dnslog /var/lib/svscan/dnscache
# axfrdns-conf axfrdns dnslog /var/lib/svscan/axfrdns /var/lib/svscan/tinydns 10.62.2.44
# tinydns-conf tinydns dnslog /var/lib/svscan/tinydns 10.62.2.44
# ln -s /var/lib/svscan/dnscache /service
# ln -s /var/lib/svscan/axfrdns /service
# ln -s /var/lib/svscan/tinydns /serviceConfig - djbdns (Setting up a domain - domena1.sk)
# cd /service/tinydns/root
domena1.sk - adding a DNS server for the domain
-----------------------------------------------
# ./add-ns domena1.sk 10.62.2.44
domena1.sk - adding an A record for the domain
----------------------------------------------
# ./add-host server-hajzer.domena1.sk 10.62.2.22
# ./add-host server-soliar.domena1.sk 10.62.2.5
domena1.sk - adding an MX record for the domain
-----------------------------------------------
# ./add-mx domena1.sk 10.62.2.44
domena1.sk - reverse records (the reverse records for 10.62.2. are provided by 10.62.2.44)
------------------------------------------------------------------------------------------
# ./add-ns 2.62.10.in-addr.arpa 10.62.2.44
Save the changes
----------------
# makeLinkZ - DOCs
DJBDNS - homepage
-----------------
http://cr.yp.to/djbdns.html
DJBDNS
------
http://www.thedjbway.org/djbdns.html
Life With djbdns
----------------
http://www.lifewithdjbdns.com/
djbdns - Continuous DNS service without continual software upgrades
-------------------------------------------------------------------
http://www.tinydns.org/
Guide & tutorial for the installation for djbdns
------------------------------------------------
http://www.djbdnsrocks.org/LinkZ - SOFTs
Wizard for DNS (both BIND and TINY)
-----------------------------------
http://old.openspf.org/wizard.htmlCurrent practice (checked 2026-10)
noteThe article above is kept as it was written in 2008. This section lists what has changed since and what to do instead today.
- The
-installerand-srcpackages:daemontools-installer,ucspi-tcp-srcanddjbdns-installerexisted because the licence did not allow modified binary packages. D. J. Bernstein placed daemontools, ucspi-tcp and djbdns into the public domain on 2007-12-28, and Debian now ships ordinary binary packages (daemontools,ucspi-tcp,tinydns,dnscache,axfrdns,djbdns-conf,djbdns-utils), so thebuild-*steps are gone. - Upstream state: the upstream version is still 1.05; there has been no newer release. Security fixes come only from distributions: the Debian security tracker lists CVE-2008-4392 and CVE-2012-1191 (dnscache) and CVE-2009-0858 (response handling) as fixed in the package, so do not build the pristine tarball.
- Missing protocol features: stock djbdns 1.05 has no DNSSEC (tinydns cannot serve signed zones, dnscache does not validate) and no IPv6 transport. A public zone or a resolver that needs either cannot be done with it.
- What is used instead: for an authoritative server NSD, Knot DNS or PowerDNS; for a caching resolver Unbound. All are packaged, maintained and support DNSSEC and IPv6.
- daemontools:
svscanwith/servicesymlinks still works, but service supervision and logging are what systemd does on a current Debian. A new installation would not add a second supervisor only for DNS. - Still right: the split the article keeps (dnscache as resolver, tinydns as authoritative server, axfrdns for zone transfers, each a separate process under its own account) is still good design, and the
./add-ns,./add-host,./add-mxandmakeworkflow in/service/tinydns/rootis unchanged in 1.05.
Sources: