named

Adding new DNS zones when using nsupdate & bind

Back in the good old days, I managed my DNS zones files by checking them into the repo, and then running svn up on the name servers. When I started using Let’s Encrypt, I stopped doing that because of the use of nsupdate. This post outlines how I added two new zones to my nameservers: vbsdcon.org vbsdcon.com The zone files Here is the zone I created. $ cat vbsdcon.org.db vbsdcon.org. 3600 IN SOA […]

Adding new DNS zones when using nsupdate & bind Read More »

Collecting statistics from bind / named

I use bind (Berkeley Internet Name Domain) as my DNS server. I am currently running bind 9.11.5P1 on FreeBSD 11.2-RELEASE-p8 in a jail, with iocage as my jail manager. The OS, jail, and jail manager should play no part in how this works. I have been collecting statistics from bind for some time. I have configured LibreNMS to collect the details via snmpd and they are plotted in a lovely looking graph. The

Collecting statistics from bind / named Read More »

Using nsupdate to change NS servers

You have an old DNS server: tallboy.example.org You have a new DNS server: ns1.example.org You have a domain, example.com, for which you want to swap the old DNS server with the new DNS using nsupdate. NOTE: the domain is example.com The NS servers are in example.org (different domains). These are the commands you issue: update delete example.com. IN NS tallboy.example.org. update add example.com. 3600 IN NS ns1.example.org. send Of note, you mention the

Using nsupdate to change NS servers Read More »

acme.sh: getting free SSL certificates – installation configuration on FreeBSD

This blog post describes my Let’s Encrypt solution which uses acme.sh and dns-01 challenges to obtain SSL certificates. If you are using HTTP challenges, this post might still be useful, but your configuration will differ slightly. Let’s Encrypt is a certificate authority which has become wildly popular since it was launched in April 2016 (just a short 14 months ago). Why so popular? It provides a secure way to offer free SSL certificates.

acme.sh: getting free SSL certificates – installation configuration on FreeBSD Read More »

Configuring my BIND/named DNS servers to operate from a hidden master via VPN for Let’s Encrypt

What is a hidden DNS master? If you need to ask that, this is not the blog post for you. This post assumes you already know how to configure DNS and just want ideas for your own hidden master. It also assumes the networking, VPN, and firewall are pre-configured for this. This blog post is mostly about named/BIND. For the record, I am using bind99-9.9.10P1. In my previous blog post, you’ll see how

Configuring my BIND/named DNS servers to operate from a hidden master via VPN for Let’s Encrypt Read More »

Creating a TXT only nsupdate connection for Let’s Encrypt

I’m in the process of designing my own centralized Let’s Encrypt solution. It was Peter Wemm’s blog post about Let’s Encrypt in the FreeBSD cluster which got me started down this road. My rough notes are this this gist. This blog post assumes you are already familiar with Let’s Encrypt and especially with the dns-01 challenge. This previous post might also be useful. In this post, I’ll show you have to generate a

Creating a TXT only nsupdate connection for Let’s Encrypt Read More »

Scroll to Top