I’ve been using DNS Cluster setup for 3 servers. To be honest i do not really understand the differences between master or slave so im hoping to get some insight into my actual setup and how i can improve it with the introduction of DNSSEC.
What is the difference with DNS cluster and DNSSEC?
Ive read that but i still don’t understand the differences? Is DNSSEC better? It doesn’t go too much into detail the differences and implementation for specific scenarios.
Ive never made any changes before to the DNS on both servers. When i installed hestia last time in the documentation this did not exist. So i followed the old guide and all i did was create dns-cluster user
Like this :
Create the user dns-cluster on a server that will be used as dns slave
Run following command on a master
Then you can 't use the DNSSEC as it requires setup via this method. Currently working on a patch to prevent this “behaviour” for systems working like that
Okay so i can’t use DNSSEC but should i still implement this below ?
DNS Cluster with the Hestia API (Master → Slave)
Create a new user on the Hestia server that will act as a “Slave”.
In /usr/local/hestia/conf/hestia.conf, change DNS_CLUSTER_SYSTEM='hestia' to DNS_CLUSTER_SYSTEM='hestia-zone'.
On the master server, open /etc/bind/named.options, do the following changes, then restart bind9 with systemctl restart bind9.
bash
# Change this line
allow-transfer { "none"; };
# To this
allow-transfer { your.slave.ip.address; };
# Or this, if adding multiple slaves
allow-transfer { first.slave.ip.address; second.slave.ip.address; };
# Add this line, if adding multiple slaves
also-notify { second.slave.ip.address; };
On the slave server, open /etc/bind/named.options, do the following changes, then restart bind9 with systemctl restart bind9:
bash
# Change this line
allow-recursion { 127.0.0.1; ::1; };
# To this
allow-recursion { 127.0.0.1; ::1; your.master.ip.address; };
# Add this line
allow-notify{ your.master.ip.address; };
Run the following command to enable the DNS server:
Thanks for explaining, so if thats the case then why does my dns servers become out of sync from time to time or glitched out to the point where i have to go on the slave server to delete the faulty dns entries like in my screenshot above you can see for some reason there are many empty NS entries that were created by itself overtime.
i had installed 2 DNS Servers (Master → Slave) and it worked with the sync without DNSSEC.
Now i have a Problem that i want to enable DNSSEC and dont find the checkbox on Master.
I found out that if i change on Master the setting “DNS_CLUSTER_SYSTEM=‘hestia’” to “DNS_CLUSTER_SYSTEM=‘hestia-zone’” i can activate it, but it dont sync anymore to slave.
i have tested some things, but it dont work. My question is now how do i have to set the hestia.conf on master and hao on slave that it can sync and it is possible to enable DNSSEC.
