Introduction
Knot DNS server is a high-performance authoritative-only DNS server which supports all of the key features of the domain name system including zone transfers and DNSSEC. It was developed by the CZ.NIC. Knot DNS is open-source and multi-threaded. Current features include:
- Full and incremental zone transfers (AXFR/IXFR)
- Dynamic DNS updates
- EDNS0 and DNSSEC extensions, including NSEC3
- Response Rate Limiting
- NSID
- TSIG
- and all of the standard features you’d expect with an authoritative-only nameserver implementation
Knot used to require zone files to be compiled (like NSD), but this requirement was removed as of Knot 1.3.0.
For this article, I’ll be running the latest stable version of Knot, 1.3.3, on CentOS 6.4. The test environment will comprise two hosts - venus (master) on 192.168.122.12 and earth (slave) on 192.168.122.13.
Knot 1.4.0-rc1 was also available at the time of writing which supports experimental DNSSEC auto-signing, so that may be worth checking out if relevant to your needs.
Software Compilation
First, install the pre-requisite packages to prepare the build environment and fetch the appropriate libraries:
|
1 |
# yum -y install make gcc gcc-c++ bison flex openssl-devel zlib-devel |
Knot uses the Userspace RCU data-synchronisation library, so download and compile. The latest version at the time of writing was 0.8.1.
|
1 2 3 4 5 6 7 |
# cd /usr/local/src # wget http://lttng.org/files/urcu/userspace-rcu-0.8.1.tar.bz2 # tar xjf userspace-rcu-0.8.1.tar.bz2 # cd userspace-rcu-0.8.1 # ./configure # make # make install |
Next, compile and install Knot. Note, that as per the information on this page, we disable recvmmsg as we’re running glibc 2.12 and kernel 2.6.32:
|
1 2 3 4 5 6 |
# cd .. # tar xzf knot-1.3.3.tar.gz # cd knot-1.3.3 # ./configure --enable-recvmmsg=no # make # make install |
Knot is now installed. As we don’t want to run Knot as root, create an unprivileged user and group:
|
1 2 3 |
# groupadd -g 53 knot # useradd -m -d /var/lib/knot -s /bin/bash -g knot -u 53 knot # passwd knot |
Taking a look under /usr/local/etc/knot you will find two files, example.com.zone and knot.sample.conf. Using the sample file, and the documentation, you can build your knot.conf.
Configuration
In this configuration example, I’ll configure earth to slave the example.com zone from venus. TSIG keys could also be employed to secure the transfer.
First, copy the example.com zone file into place:
|
1 |
# cp /usr/local/etc/knot/example.com.zone /var/lib/knot |
On your master server, create knot.conf as follows. You will see that I have commented all appropriate configuration options and the documentation can be consulted for further information:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 |
system { # Identity of the server (see RFC 4892) identity off; # Version of the server (see RFC 4892) version off; # user.group to run server user knot.knot; # Default directory to place zone files, journals, etc. storage "/var/lib/knot"; # Directory for storing run-time data, PID file, sockets, etc. rundir "/var/run/knot"; } interfaces { # interface(s) on which we want to listen bond0 { address 192.168.122.12; port 53; } } control { # Socket filename, relative to rundir listen-on "knot.sock"; } remotes { # Remote server addresses earth { address 192.168.122.13@53; } } zones { example.com { # relative to storage directory file "example.com.zone"; # allow our slave to XFR xfr-out earth; # send notifies to our slave notify-out earth; } } log { syslog { # log errors of any category any error; # log also warnings and notices from category 'zone' zone warning, notice; # log info from server server info; } } |
On the slave server:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 |
system { # Identity of the server (see RFC 4892) identity off; # Version of the server (see RFC 4892) version off; # user.group to run server user knot.knot; # Default directory to place zone files, journals, etc. storage "/var/lib/knot"; # Directory for storing run-time data, PID file, sockets, etc. rundir "/var/run/knot"; } interfaces { # interface(s) on which we want to listen bond0 { address 192.168.122.13; port 53; } } remotes { # Remote server addresses venus { address 192.168.122.12@53; } } control { # Socket filename, relative to rundir listen-on "knot.sock"; } zones { example.com { # relative to storage directory file "example.com.zone"; # XFR in from the master xfr-in venus; # Accept notifies from the master notify-in venus; } } log { syslog { # log errors of any category any error; # log also warnings and notices from category 'zone' zone warning, notice; # log info from server server info; } } |
Knot is now configured.
Controlling Knot and Verifying
Start the Knot daemon in the foreground with:
|
1 |
# /usr/local/sbin/knotd |
If no errors are noted, hit Ctrl-C, then start in daemon mode:
|
1 |
# /usr/local/sbin/knotd -d |
To control Knot, use knotc. For example, to stop the Knot daemon:
|
1 |
# knotc stop |
Or to update the configuration, or add/update zones:
|
1 |
# /usr/local/sbin/knotc reload |
Looking at the messages file on the master (venus) we can see that the slave has successfully AXFR’d the zone:
|
1 2 3 4 5 6 7 8 9 10 11 |
venus ~ # tail -f /var/log/messages Nov 27 16:27:28 venus knot[20726]: Changing user id to '53'. Nov 27 16:27:28 venus knot[20726]: Server started as a daemon, PID = 20726 Nov 27 16:27:28 venus knot[20726]: PID stored in '/var/run/knot/knot.pid' Nov 27 16:27:28 venus knot[20726]: Loading 1 zones... Nov 27 16:27:28 venus knot[20726]: Loaded zone 'example.com.' serial 2010111213 Nov 27 16:27:28 venus knot[20726]: Loaded 1 out of 1 zones. Nov 27 16:27:28 venus knot[20726]: Starting server... Nov 27 16:27:28 venus knot[20726]: Binding remote control interface to /var/run/knot/knot.sock Nov 27 16:27:35 venus knot[20726]: Outgoing AXFR of 'example.com.' to '192.168.122.13@57581': Started (serial 2010111213). Nov 27 16:27:35 venus knot[20726]: Outgoing AXFR of 'example.com.' to '192.168.122.13@57581': Finished in 0.00s. |
And on the slave:
|
1 2 3 4 5 6 7 8 9 10 11 |
earth log # tail -f messages Nov 27 16:27:35 earth knot[29308]: Configured 1 interfaces and 1 zones. Nov 27 16:27:35 earth knot[29308]: Changing group id to '53'. Nov 27 16:27:35 earth knot[29308]: Changing user id to '53'. Nov 27 16:27:35 earth knot[29308]: Server started as a daemon, PID = 29308 Nov 27 16:27:35 earth knot[29308]: PID stored in '/var/run/knot/knot.pid' Nov 27 16:27:35 earth knot[29308]: Loading 1 zones... Nov 27 16:27:35 earth knot[29308]: Loaded 1 out of 1 zones. Nov 27 16:27:35 earth knot[29308]: Starting server... Nov 27 16:27:35 earth knot[29308]: Binding remote control interface to /var/run/knot/knot.sock Nov 27 16:27:35 earth knot[29308]: Incoming AXFR of 'example.com.' with '192.168.122.12@53': Started. |
Make a change to example.com zone, and issue the knotc reload command. On the slave, you should see messages along the lines of the following:
|
1 2 3 |
Nov 27 16:30:49 earth knot[29308]: NOTIFY of 'example.com.' from '192.168.122.12@44966': received serial 0. Nov 27 16:30:49 earth knot[29308]: SOA query of 'example.com.' to '192.168.122.12@53': Query issued. Nov 27 16:30:49 earth knot[29308]: Incoming IXFR of 'example.com.' with '192.168.122.12@53': Started. |
Troubleshooting
If you receive messages such as:
|
1 2 |
Nov 27 16:26:26 earth knot[29286]: [notice] Incoming AXFR of 'example.com.' with '192.168.122.12@53': Bootstrap failed, next attempt in 46 seconds. Nov 27 16:27:13 earth knot[29286]: [notice] Incoming AXFR of 'example.com.' with '192.168.122.12@53': Bootstrap failed, next attempt in 56 seconds. |
Check for connectivity issues (e.g. iptables not being updated on the master).
Conclusion
This article has been a brief introcuction on getting the Knot DNS server up and running. There are still a few features I want to investigate, such as rate-limiting and the DNSSEC extensions. I will definitely be keeping an eye on Knot as an alternative to NSD, and perhaps BIND 10.