Rob Gallagher
Switching to NSD
Mar 7th
Whilst BIND is a nameserver I use nearly every day, it’s somewhat large and unwieldy being a reference implementation of the DNS spec.
Where possible, I always like to split out resolving and authoritative functionality into two seperate pieces of software. Unbound does a great job in the latter role – also from the authors of NSD, NLnetlabs – so I thought I’d give NSD a go on ns.spoofedpacket.net.
This machine serves only handful of zones, so it’s easy enough to migrate. The transition is made even simpler since NSD supports the old bind zonefile format out of the box. I decided to install NSD from source, following the tried and tested method:
cd /usr/local/src wget http://www.nlnetlabs.nl/downloads/nsd/nsd-3.2.4.tar.gz tar zxvf nsd-3.2.4.tar.gz cd nsd-3.2.4 ./configure make make install
The dependencies are very few, it should compile without much fuss on nearly any modern *nix system.
By default, all configuration files and zones go into /etc/nsd. There is also an nsd.conf.sample that you can use as a base config. The config file is extremely simple, for a basic setup you only need to look at the server: and the n-number of zone: sections. In the server: section, I only changed the location of the zone files:
zonesdir: "/etc/nsd/zones"
At this point, it’s always good practice to organise your zonefiles into directories according to their roles. Here is what I have:
/etc/nsd/zones/master /etc/nsd/zones/slave (nothing here yet) /etc/nsd/zones/master/forward /etc/nsd/zones/master/reverse /etc/nsd/zones/master/reverse/IPv4 /etc/nsd/zones/master/reverse/IPv6
If you have an old BIND install that you are replacing, it is just a simple matter of copying/moving the existing zonefiles to their new locations. The zones can then be configured in nsd.conf as follows:
# spoofedpacket.net
zone:
name: "spoofedpacket.net"
zonefile: "master/forward/spoofedpacket.net.zone"
notify: 193.1.193.194 NOKEY
provide-xfr: 193.1.193.194 NOKEY
name and zonefile are pretty self explanatory, just remember that the path to your zonefile is always prefixed with the zonesdir statement from earlier on. notify lists all the nameservers you wish to send DNS notifies to when a zone is updated. provide-xfr controls who can carry out zone transfers (AFXR) from your nameserver. The NOKEY statement tells NSD that no cryptographic keys are required to authenticate the notifies or zone transfers between your nameserver and the secondary nameservers.
Once you’ve finished editing nsd.conf, you must now compile your zonefiles into the binary format that NSD understands. This is one of the main reasons for NSDs speed and low footprint:
nsdc rebuild nsdc reload
Verify that nsd is running and serving zones:
pgrep -lf nsd dig @ns.spoofedpacket.net www.spoofedpacket.net
2009/2010 Winter and Spring Anime season
Jan 7th
So, whilst we’re all stuck indoors due to the snowpocalypse, it’s a good time to take a look at what’s been released and what’s going to be released in Japan over the coming few months. Things are somewhat thin on the ground, there’s a lot of the usual loli and h-game based stuff but a few things jump out as worth watching.
Durarara!:
From the makers of the excellent Baccano! (they must have a thing for !’s in the title). There’s a guy stamping on some ko-gal’s phone in the trailer, whilst laughing hysterically… I like this:
Dance in the Vampire Bund:
Oh, something about vampires. The premise looks interesting however, an extremely rich vampire from the Tepes family (as in, Vlad Tepes, Vlad the Impaler) pays off the national debt of Japan (!!) in order to get her own island which can be used as a safe haven for the blood drinkers of this world. She proceeds to make preparations for revealing the existence of vampires to the public at large, before some terrorists decide to attack and wreck their buzz:
Katanagatari:
A very nice period piece with some swordplay, interesting artwork and music. The director worked on Legend of the Galactic Heroes and Crest of the Stars, amongst other things:
Uchuu Senkan Yamato Fukkatsu-hen (Movie):
Power up the wave motion gun! After nearly 26 years of false starts there’s finally a new Yamato movie:
The Disappearance of Haruhi Suzumiya (Movie):
It goes without saying that this will be enormous.
Gundam Unicorn (OVA):
I’m saving the best till last. A new Yamato movie and now the first UC Gundam show since 1993. Mabye this season isn’t so bad after all. Neo Zeon are back and there is a Char-like character called …wait for it…Full Frontal. This is going to rock.
spoofedpacket.net signed
Dec 1st
I recently signed spoofedpacket.net, here’s the DS sets:
spoofedpacket.net. IN DS 15871 5 1 6D6B3C370091ECF38D81B2D91B54C7B2EB6D47E6 spoofedpacket.net. IN DS 15871 5 2 41D36F7DEC5827F650E772DE1DA33A219B3B994757DDF763830EBC12 E2DCEC80
And the keysets:
spoofedpacket.net 604800 IN DNSKEY 257 3 5 (
AwEAAa1qyDcvEEsXZYvzI5TwlJks8pK95OSE
RjMtg0aN/cBfpNeyyYwX1O5zQy1G13qklxYR
CbPHbbeZkxMxfVxc3pUSDOqYtu6IBhhPTv9Z
Gwnjn6CRBdKVrkdMI5ZPJ3uwvMj9yk6a9jjg
tUZZfIRkbURa/Q75AaqB8ihQN7pU5N9Tui0i
V3eoKZrVfc5mUDATnggSw/Pk7blHKn8OWwEJ
b7Q5Uulg4fmHYSxX2sTzt5kgZxWAVbaZ5IWn
XwMJkUN7kM9Lz04exn4JmpeMpfAo3+tyDC1F
LLJVPAk4KmhDKPhiY1y9yeZxLiloYh8KvG4b
W18D465/RQRkoLufF+/6htk=
) ; key id = 15871
Domain renewal scams
Oct 28th
Some of my domains are coming up for renewal, right on cue the scam letters start arriving in the post. The scammers trawl whois information and send out demands for “renewal” to unsuspecting domain users. Send enough of them and somebody, somewhere will pay up.
They’re getting pretty sophisticated compared to the ones from previous years, an accounts department could be easily tricked into paying them.
DWM config
Oct 16th
Recently, I started using dwm as my main window manager. At less than 3000 lines of C, it’s somewhat more lightweight than others I’ve used in the past.
The automatic window placement and stacking is really handy, especially when you tend to have a lot of terminals open, it keeps things nice and organised. There is very little to configure, but I did modify the colourscheme a bit to make it darker. I also added some handy key bindings and a few wrapper scripts to allow the window manager to run in a loop so you can restart it without killing all your applications. My config.h and associated scripts are in subversion.
