Dyomedea
/
binder
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Major documentation update on readme. Provide examples and workflow for getting binder running.

This commit is contained in:
Jeffrey Forman 2013-01-07 21:03:43 -05:00
parent f6c09a737f
commit fea960a52a
1 changed files with 56 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

80
README.markdown
View File

@ -1,37 +1,73 @@
# Binder # # Binder #
Home: A Django web application for viewing and editing BIND DNS zone records.
A Django web application for viewing and editing your BIND DNS zones.
Binder supports adding and deleting DNS records (and eventually editing in place). TSIG-authenticated transfers and updates are supported.
## Requirements ## ## Requirements ##
Packages: Packages:
* [Django](http://www.djangoproject.com) * [Django](http://www.djangoproject.com)
* Python * Python Modules
* [python-beautifulsoup](http://www.crummy.com/software/BeautifulSoup/) * [python-beautifulsoup](http://www.crummy.com/software/BeautifulSoup/)
* [python-dnspython](http://www.dnspython.org/) * [python-dnspython](http://www.dnspython.org/)
* python-sqlite (if you will be using sqlite during development) * [python-sqlite](http://docs.python.org/2/library/sqlite3.html) (If you will be using Sqlite for server and key storage)
* [Bind DNS Server](http://www.isc.org/software/bind). At least version 9.5.x, which is needed for gathering remote statistics. * [Bind DNS Server](http://www.isc.org/software/bind). At least version 9.5.x, which provides instrumentation for gathering process and zone statistics remotely.
## Installation & Configuration ## ## Installation & Configuration ##
The Binder repository is housed in a [Github](http://github.com/jforman/binder) repository. The repo containts all the Django code and example configuration data for running Binder both in development and production.
To verify that required and optional dependencies are installed, execute [check-dependencies.py](https://github.com/jforman/binder/blob/master/check-dependencies.py). This script checks that various Python modules will import correctly.
Binder is intended to be installed into the /opt directory in /opt/binder. Forthcoming deb packages will provide for this easy installation and upgrades.
Provided under the config directory are various example configurations for runing Binder:
config/
* binder-apache.conf.dist: Name-based virtual host configuration for running Binder under Apache.
* django.wsgi: WSGI configuration file called by Apache to run Binder.
* binder-nginx.conf.dist: Name-based virtual host configuration for running Binder under Nginx using fcgi.
* binder-upstart.conf.dist: Ubuntu Upstart configuration file for starting Binder upon machine startup.
binder/
* local_settings.py: Local settings called by Binder templates for TTL choices, record types handled, etc.
The development server is run as most Django dev servers are run.
/opt/binder/manage.py syncdb
/opt/binder/manage.py runserver
Once you have the Django server up and running, you will want to configure at least one BIND server in the Django Admin app. This includes a hostname, TCP statistics port and a default TSIG transfer key to be used when doing AXFR actions (if necessary).
Keys should also be created, if needed. The name of the key should match the contents of the below noted key file. Along side the name, key data and type should also be specified.
Once these two pieces of configuration are done, open up [http://yourserver:port/](http://yourserver:port) to access Binder and begin DNS zone management.
### BIND Name Servers ### ### BIND Name Servers ###
In each of the BIND servers you wish to be able to query, the following stanza will be needed in your named.conf: When Binder accesses your BIND DNS server, it first queries the statistics port to gather various zone information. This data includes zone name, view, and serial number. This is all configured by some of the following configuration examples.
This tells BIND to publish statistics on all interfaces on tcp port 853. There is a simple ACL allowing localhost and the noted subnet, 10.10.0.0/24, to access statistics. This can be verified by querying your DNS server with your perferred web browser at [http://dnsserver:853](http://dnsserver:853/)
In each zone specification, you will need to determine how locked down you want zone updates and transfer to be. #### Key Configuration ####
##### named.conf #####
We must provide server statistics from the BIND process itself. This allows Binder to query BIND itself and get a list of zones, views, and other statistics.
statistics-channels {
inet * port 8053 allow { 10.10.0.0/24; };
};
This tells bind to start an HTTP server on port 8053 on all interfaces, allowing 10.10.0.0/24 to make requests on this interface, http://${bind_server}:8053/. You will most likely want to narrow down the subset of hosts or subnets that can query BIND for this data. This data can be viewed via your choice of Browser, or read by your favorite programming language and progamatically processed by your choice of XML library.
include "/etc/bind/dynzone.key"; include "/etc/bind/dynzone.key";
statistics-channels { This tells Bind to load a TSIG key from dynzone.key that can be referenced later in named.conf.
inet * port 853 allow { 10.10.0.0/24; };
};
controls { Moving on to zone declaration, determine how locked down you want zone updates and transfers to be. The following zone is defined to allow all zone transfers, but restrict updates to those provided with the dynzone-key TSIG key.
inet * port 953 allow { 10.10.0.0/24; } keys { dynzone-key; };
};
zone "dynzone.yourdomain.org" IN { zone "dynzone.yourdomain.org" IN {
type master; type master;
@ -39,17 +75,13 @@ In each zone specification, you will need to determine how locked down you want
allow-update { key dynzone-key; }; allow-update { key dynzone-key; };
}; };
Where /etc/bind/test.key: ##### /etc/bind/dynzone.key #####
Below are the entire contents of the dynzone.key file. This specifies the name, algorith and TSIG secret.
key dynzone-key { key dynzone-key {
algorithm hmac-md5; algorithm hmac-md5;
secret "foobar...BhBrq+Ra3fBzhA4IWjXY85AVUdxkSSObbw3D30xgsf....."; secret "foobar...BhBrq+Ra3fBzhA4IWjXY85AVUdxkSSObbw3D30xgsf.....";
}; };
### Django Application ### referenced as 'dynzone-key' in named.conf
Deploy the Django application as you see fit, and create the database via `manage.py syncdb`.
Using the Admin UI, add each DNS Server to the 'Bind Servers' model.
Once you have completed this, surf over to the URL where the binder Django app is installed and enjoy.