-
Notifications
You must be signed in to change notification settings - Fork 3
/
Copy pathbind9_playbook
115 lines (103 loc) · 4.72 KB
/
bind9_playbook
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
---
- hosts: all
become: yes
tasks:
- name: Install packages needed for BIND9 Server
apt:
update_cache: yes
name:
- bind9
- bind9utils
- bind9-dnsutils
- bind9-doc
- bind9-host
- dnsutils
state: latest
- name: Enable bind9 service
ansible.builtin.systemd:
name: "{{ item }}"
enabled: yes
with_items:
- named
- name: Remove default config file
ansible.builtin.file:
path: /etc/bind/named.conf
state: absent
- name: Re-add it
ansible.builtin.file:
path: /etc/bind/named.conf
state: touch
mode: 0640
owner: root
group: bind
- name: Copy over bind9 configuration file
blockinfile:
path: /etc/bind/named.conf
marker: "// {mark} ANSIBLE MANAGED BLOCK"
block: |
// Main options including querylog enabling
options {
directory "/var/cache/bind";
dnssec-validation no;
listen-on-v6 { any; };
recursion yes;
allow-recursion { any; };
allow-query { any; };
querylog yes;
};
// Forwarding zone for malicious DNS server
zone "example.attack" {
type forward;
forward only;
forwarders { 192.168.0.20; };
};
// BIND9 logging template
// https://webinar.defaultroutes.de/webinar/bind9-logging-template.html
// https://youtu.be/th7uyioH55Y
logging {
channel named { file "named.log" versions 10 size 20M; severity info; print-time iso8601-utc; print-category yes; print-severity yes;};
channel security { file "security.log" versions 10 size 20M; severity info; print-time iso8601-utc; print-severity yes; };
channel dnssec { file "dnssec.log" versions 10 size 20M; severity info; print-time iso8601-utc; print-severity yes; };
channel resolver { file "resolver.log" versions 10 size 20M; severity info; print-time iso8601-utc; print-severity yes; };
channel query_log { file "query.log" versions 10 size 80M; severity debug; print-time iso8601-utc; print-severity yes; };
channel query-error { file "query-errors.log" versions 10 size 20M; severity info; print-time iso8601-utc; print-severity yes; };
channel lame_servers { file "lame-servers.log" versions 10 size 20M; severity info; print-time iso8601-utc; print-severity yes; };
channel capacity { file "capacity.log" versions 10 size 20M; severity info; print-time iso8601-utc; print-severity yes; };
channel rpz { file "rpz.log" versions 10 size 20M; severity info; print-time iso8601-utc; print-severity yes; };
category default { default_syslog; named; };
category general { default_syslog; named; };
category security { security; };
category queries { query_log; };
category lame-servers { lame_servers;};
category dnssec { dnssec; };
category edns-disabled { default_syslog; };
category config { default_syslog; named; };
category resolver { resolver; };
category edns-disabled { resolver; };
category cname { resolver; };
category serve-stale { resolver; };
category spill { capacity; };
category rate-limit { capacity; };
category database { capacity; };
category client { default_syslog; named; };
category network { default_syslog; named; };
//category dnstap { dnstap;};
category unmatched { named; };
category client { named; };
category network { named; };
category delegation-only { named;};
category dispatch { named; };
category trust-anchor-telemetry { named; };
category rpz { rpz;};
};
notify:
- named_restart
- name: Check named config validity
command: named-checkconf
register: named_check
failed_when: named_check.rc != 0
handlers:
- name: named_restart
service:
name: named
state: restarted