From: Frank Brehm <frank@brehm-online.com>
Date: Wed, 7 Apr 2021 19:12:49 +0000 (+0200)
Subject: committing changes in /etc made by "apt install -y bind9 dnsutils"
X-Git-Url: https://git.uhu-banane.org/?a=commitdiff_plain;h=df7aaecee7ae0f2bdf136a6d71bece38bc074619;p=config%2Fhelga-hetzner%2Fetc.git

committing changes in /etc made by "apt install -y bind9 dnsutils"

Package changes:
+bind9 1:9.11.5.P4+dfsg-5.1+deb10u3 amd64
+bind9utils 1:9.11.5.P4+dfsg-5.1+deb10u3 amd64
+dns-root-data 2019031302 all
+dnsutils 1:9.11.5.P4+dfsg-5.1+deb10u3 amd64
+libirs161 1:9.11.5.P4+dfsg-5.1+deb10u3 amd64
+python3-ply 3.11-3 all
---

diff --git a/.etckeeper b/.etckeeper
index 6d94051..e7073c9 100755
--- a/.etckeeper
+++ b/.etckeeper
@@ -2,6 +2,7 @@
 
 mkdir -p './X11/xkb'
 mkdir -p './acpi/events'
+mkdir -p './apparmor.d/force-complain'
 mkdir -p './apt/auth.conf.d'
 mkdir -p './apt/preferences.d'
 mkdir -p './binfmt.d'
@@ -22,7 +23,6 @@ mkdir -p './initramfs-tools/scripts/nfs-premount'
 mkdir -p './initramfs-tools/scripts/nfs-top'
 mkdir -p './initramfs-tools/scripts/panic'
 mkdir -p './kernel/install.d'
-mkdir -p './network/if-down.d'
 mkdir -p './network/if-post-down.d'
 mkdir -p './opt'
 mkdir -p './perl/CPAN'
@@ -53,9 +53,12 @@ maybe chmod 0755 'apm'
 maybe chmod 0755 'apm/event.d'
 maybe chmod 0755 'apm/event.d/20hdparm'
 maybe chmod 0755 'apparmor.d'
+maybe chmod 0755 'apparmor.d/force-complain'
 maybe chmod 0755 'apparmor.d/local'
 maybe chmod 0644 'apparmor.d/local/usr.bin.man'
+maybe chmod 0644 'apparmor.d/local/usr.sbin.named'
 maybe chmod 0644 'apparmor.d/usr.bin.man'
+maybe chmod 0644 'apparmor.d/usr.sbin.named'
 maybe chmod 0755 'apt'
 maybe chmod 0644 'apt/SALTSTACK-GPG-KEY.pub'
 maybe chmod 0755 'apt/apt.conf.d'
@@ -94,6 +97,26 @@ maybe chmod 0644 'bash.bashrc'
 maybe chmod 0644 'bash_completion'
 maybe chmod 0755 'bash_completion.d'
 maybe chmod 0644 'bash_completion.d/git-prompt'
+maybe chgrp 'bind' 'bind'
+maybe chmod 2755 'bind'
+maybe chmod 0644 'bind/bind.keys'
+maybe chmod 0644 'bind/db.0'
+maybe chmod 0644 'bind/db.127'
+maybe chmod 0644 'bind/db.255'
+maybe chmod 0644 'bind/db.empty'
+maybe chmod 0644 'bind/db.local'
+maybe chgrp 'bind' 'bind/named.conf'
+maybe chmod 0644 'bind/named.conf'
+maybe chgrp 'bind' 'bind/named.conf.default-zones'
+maybe chmod 0644 'bind/named.conf.default-zones'
+maybe chgrp 'bind' 'bind/named.conf.local'
+maybe chmod 0644 'bind/named.conf.local'
+maybe chgrp 'bind' 'bind/named.conf.options'
+maybe chmod 0644 'bind/named.conf.options'
+maybe chown 'bind' 'bind/rndc.key'
+maybe chgrp 'bind' 'bind/rndc.key'
+maybe chmod 0640 'bind/rndc.key'
+maybe chmod 0644 'bind/zones.rfc1918'
 maybe chmod 0644 'bindresvport.blacklist'
 maybe chmod 0755 'binfmt.d'
 maybe chmod 0755 'ca-certificates'
@@ -202,6 +225,7 @@ maybe chmod 0644 'debconf.conf'
 maybe chmod 0644 'debian_version'
 maybe chmod 0755 'default'
 maybe chmod 0644 'default/acpid'
+maybe chmod 0644 'default/bind9'
 maybe chmod 0644 'default/bsdmainutils'
 maybe chmod 0644 'default/console-setup'
 maybe chmod 0644 'default/cron'
@@ -315,6 +339,7 @@ maybe chmod 0644 'hosts.deny'
 maybe chmod 0755 'init.d'
 maybe chmod 0755 'init.d/acpid'
 maybe chmod 0755 'init.d/atd'
+maybe chmod 0755 'init.d/bind9'
 maybe chmod 0755 'init.d/cloud-config'
 maybe chmod 0755 'init.d/cloud-final'
 maybe chmod 0755 'init.d/cloud-init'
@@ -358,6 +383,8 @@ maybe chmod 0755 'initramfs-tools/scripts/nfs-top'
 maybe chmod 0755 'initramfs-tools/scripts/panic'
 maybe chmod 0644 'initramfs-tools/update-initramfs.conf'
 maybe chmod 0644 'inputrc'
+maybe chmod 0755 'insserv.conf.d'
+maybe chmod 0644 'insserv.conf.d/bind9'
 maybe chmod 0755 'iproute2'
 maybe chmod 0644 'iproute2/bpf_pinning'
 maybe chmod 0644 'iproute2/ematch_map'
@@ -444,10 +471,12 @@ maybe chmod 0644 'motd'
 maybe chmod 0644 'nanorc'
 maybe chmod 0755 'network'
 maybe chmod 0755 'network/if-down.d'
+maybe chmod 0755 'network/if-down.d/bind9'
 maybe chmod 0755 'network/if-post-down.d'
 maybe chmod 0755 'network/if-pre-up.d'
 maybe chmod 0755 'network/if-pre-up.d/ethtool'
 maybe chmod 0755 'network/if-up.d'
+maybe chmod 0755 'network/if-up.d/bind9'
 maybe chmod 0755 'network/if-up.d/ethtool'
 maybe chmod 0644 'network/interfaces'
 maybe chmod 0755 'network/interfaces.d'
@@ -484,6 +513,11 @@ maybe chmod 0755 'perl'
 maybe chmod 0755 'perl/CPAN'
 maybe chmod 0755 'perl/Net'
 maybe chmod 0644 'perl/Net/libnet.cfg'
+maybe chmod 0755 'ppp'
+maybe chmod 0755 'ppp/ip-down.d'
+maybe chmod 0755 'ppp/ip-down.d/bind9'
+maybe chmod 0755 'ppp/ip-up.d'
+maybe chmod 0755 'ppp/ip-up.d/bind9'
 maybe chmod 0644 'profile'
 maybe chmod 0755 'profile.d'
 maybe chmod 0644 'profile.d/Z99-cloud-locale-test.sh'
@@ -602,6 +636,7 @@ maybe chmod 0644 'udev/rules.d/70-persistent-net.rules'
 maybe chmod 0644 'udev/udev.conf'
 maybe chmod 0755 'ufw'
 maybe chmod 0755 'ufw/applications.d'
+maybe chmod 0644 'ufw/applications.d/bind9'
 maybe chmod 0644 'ufw/applications.d/openssh-server'
 maybe chmod 0755 'update-motd.d'
 maybe chmod 0755 'update-motd.d/10-uname'
diff --git a/apparmor.d/local/usr.sbin.named b/apparmor.d/local/usr.sbin.named
new file mode 100644
index 0000000..e69de29
diff --git a/apparmor.d/usr.sbin.named b/apparmor.d/usr.sbin.named
new file mode 100644
index 0000000..a4622da
--- /dev/null
+++ b/apparmor.d/usr.sbin.named
@@ -0,0 +1,94 @@
+# vim:syntax=apparmor
+# Last Modified: Fri Jun  1 16:43:22 2007
+#include <tunables/global>
+
+/usr/sbin/named flags=(attach_disconnected) {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+
+  capability net_bind_service,
+  capability setgid,
+  capability setuid,
+  capability sys_chroot,
+  capability sys_resource,
+
+  # /etc/bind should be read-only for bind
+  # /var/lib/bind is for dynamically updated zone (and journal) files.
+  # /var/cache/bind is for slave/stub data, since we're not the origin of it.
+  # See /usr/share/doc/bind9/README.Debian.gz
+  /etc/bind/** r,
+  /var/lib/bind/** rw,
+  /var/lib/bind/ rw,
+  /var/cache/bind/** lrw,
+  /var/cache/bind/ rw,
+
+  # Database file used by allow-new-zones
+  /var/cache/bind/_default.nzd-lock rwk,
+
+  # gssapi
+  /etc/krb5.keytab kr,
+  /etc/bind/krb5.keytab kr,
+
+  # ssl
+  /etc/ssl/openssl.cnf r,
+
+  # root hints from dns-data-root
+  /usr/share/dns/root.* r,
+
+  # GeoIP data files for GeoIP ACLs
+  /usr/share/GeoIP/** r,
+
+  # dnscvsutil package
+  /var/lib/dnscvsutil/compiled/** rw,
+
+  # Allow changing worker thread names
+  owner @{PROC}/@{pid}/task/@{tid}/comm rw,
+
+  @{PROC}/net/if_inet6 r,
+  @{PROC}/*/net/if_inet6 r,
+  @{PROC}/sys/net/ipv4/ip_local_port_range r,
+  /usr/sbin/named mr,
+  /{,var/}run/named/named.pid w,
+  /{,var/}run/named/session.key w,
+  # support for resolvconf
+  /{,var/}run/named/named.options r,
+
+  # some people like to put logs in /var/log/named/ instead of having
+  # syslog do the heavy lifting.
+  /var/log/named/** rw,
+  /var/log/named/ rw,
+
+  # gssapi
+  /var/lib/sss/pubconf/krb5.include.d/** r,
+  /var/lib/sss/pubconf/krb5.include.d/ r,
+  /var/lib/sss/mc/initgroups r,
+  /etc/gss/mech.d/ r,
+
+  # ldap
+  /etc/ldap/ldap.conf r,
+  /{,var/}run/slapd-*.socket rw,
+
+  # dynamic updates
+  /var/tmp/DNS_* rw,
+
+  # dyndb backends
+  /usr/lib/bind/*.so rm,
+
+  # Samba DLZ
+  /{usr/,}lib/@{multiarch}/samba/bind9/*.so rm,
+  /{usr/,}lib/@{multiarch}/samba/gensec/*.so rm,
+  /{usr/,}lib/@{multiarch}/samba/ldb/*.so rm,
+  /{usr/,}lib/@{multiarch}/ldb/modules/ldb/*.so rm,
+  /var/lib/samba/bind-dns/dns.keytab rk,
+  /var/lib/samba/bind-dns/named.conf r,
+  /var/lib/samba/bind-dns/dns/** rwk,
+  /var/lib/samba/private/dns.keytab rk,
+  /var/lib/samba/private/named.conf r,
+  /var/lib/samba/private/dns/** rwk,
+  /etc/samba/smb.conf r,
+  /dev/urandom rwmk,
+  owner /var/tmp/krb5_* rwk,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.named>
+}
diff --git a/bind/bind.keys b/bind/bind.keys
new file mode 100644
index 0000000..5e5a32b
--- /dev/null
+++ b/bind/bind.keys
@@ -0,0 +1,50 @@
+# The bind.keys file is used to override the built-in DNSSEC trust anchors
+# which are included as part of BIND 9.  The only trust anchors it contains
+# are for the DNS root zone (".").  Trust anchors for any other zones MUST
+# be configured elsewhere; if they are configured here, they will not be
+# recognized or used by named.
+#
+# The built-in trust anchors are provided for convenience of configuration.
+# They are not activated within named.conf unless specifically switched on.
+# To use the built-in key, use "dnssec-validation auto;" in the
+# named.conf options.  Without this option being set, the keys in this
+# file are ignored.
+#
+# This file is NOT expected to be user-configured.
+#
+# These keys are current as of October 2017.  If any key fails to
+# initialize correctly, it may have expired.  In that event you should
+# replace this file with a current version.  The latest version of
+# bind.keys can always be obtained from ISC at https://www.isc.org/bind-keys.
+#
+# See https://data.iana.org/root-anchors/root-anchors.xml
+# for current trust anchor information for the root zone.
+
+managed-keys {
+        # This key (19036) is to be phased out starting in 2017. It will
+        # remain in the root zone for some time after its successor key
+        # has been added. It will remain this file until it is removed from
+        # the root zone.
+        . initial-key 257 3 8 "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF
+                FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX
+                bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD
+                X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz
+                W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS
+                Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq
+                QxA+Uk1ihz0=";
+
+        # This key (20326) was published in the root zone in 2017.
+        # Servers which were already using the old key (19036) should
+        # roll seamlessly to this new one via RFC 5011 rollover. Servers
+        # being set up for the first time can use the contents of this
+        # file as initializing keys; thereafter, the keys in the
+        # managed key database will be trusted and maintained
+        # automatically.
+        . initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+                +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
+                ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
+                0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
+                oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
+                RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
+                R1AkUTV74bU=";
+};
diff --git a/bind/db.0 b/bind/db.0
new file mode 100644
index 0000000..e3aabdb
--- /dev/null
+++ b/bind/db.0
@@ -0,0 +1,12 @@
+;
+; BIND reverse data file for broadcast zone
+;
+$TTL	604800
+@	IN	SOA	localhost. root.localhost. (
+			      1		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			 604800 )	; Negative Cache TTL
+;
+@	IN	NS	localhost.
diff --git a/bind/db.127 b/bind/db.127
new file mode 100644
index 0000000..cd05bef
--- /dev/null
+++ b/bind/db.127
@@ -0,0 +1,13 @@
+;
+; BIND reverse data file for local loopback interface
+;
+$TTL	604800
+@	IN	SOA	localhost. root.localhost. (
+			      1		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			 604800 )	; Negative Cache TTL
+;
+@	IN	NS	localhost.
+1.0.0	IN	PTR	localhost.
diff --git a/bind/db.255 b/bind/db.255
new file mode 100644
index 0000000..e3aabdb
--- /dev/null
+++ b/bind/db.255
@@ -0,0 +1,12 @@
+;
+; BIND reverse data file for broadcast zone
+;
+$TTL	604800
+@	IN	SOA	localhost. root.localhost. (
+			      1		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			 604800 )	; Negative Cache TTL
+;
+@	IN	NS	localhost.
diff --git a/bind/db.empty b/bind/db.empty
new file mode 100644
index 0000000..8a12858
--- /dev/null
+++ b/bind/db.empty
@@ -0,0 +1,14 @@
+; BIND reverse data file for empty rfc1918 zone
+;
+; DO NOT EDIT THIS FILE - it is used for multiple zones.
+; Instead, copy it, edit named.conf, and use that copy.
+;
+$TTL	86400
+@	IN	SOA	localhost. root.localhost. (
+			      1		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			  86400 )	; Negative Cache TTL
+;
+@	IN	NS	localhost.
diff --git a/bind/db.local b/bind/db.local
new file mode 100644
index 0000000..2f272d4
--- /dev/null
+++ b/bind/db.local
@@ -0,0 +1,14 @@
+;
+; BIND data file for local loopback interface
+;
+$TTL	604800
+@	IN	SOA	localhost. root.localhost. (
+			      2		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			 604800 )	; Negative Cache TTL
+;
+@	IN	NS	localhost.
+@	IN	A	127.0.0.1
+@	IN	AAAA	::1
diff --git a/bind/named.conf b/bind/named.conf
new file mode 100644
index 0000000..880786a
--- /dev/null
+++ b/bind/named.conf
@@ -0,0 +1,11 @@
+// This is the primary configuration file for the BIND DNS server named.
+//
+// Please read /usr/share/doc/bind9/README.Debian.gz for information on the 
+// structure of BIND configuration files in Debian, *BEFORE* you customize 
+// this configuration file.
+//
+// If you are just adding zones, please do that in /etc/bind/named.conf.local
+
+include "/etc/bind/named.conf.options";
+include "/etc/bind/named.conf.local";
+include "/etc/bind/named.conf.default-zones";
diff --git a/bind/named.conf.default-zones b/bind/named.conf.default-zones
new file mode 100644
index 0000000..1a85ad3
--- /dev/null
+++ b/bind/named.conf.default-zones
@@ -0,0 +1,30 @@
+// prime the server with knowledge of the root servers
+zone "." {
+	type hint;
+	file "/usr/share/dns/root.hints";
+};
+
+// be authoritative for the localhost forward and reverse zones, and for
+// broadcast zones as per RFC 1912
+
+zone "localhost" {
+	type master;
+	file "/etc/bind/db.local";
+};
+
+zone "127.in-addr.arpa" {
+	type master;
+	file "/etc/bind/db.127";
+};
+
+zone "0.in-addr.arpa" {
+	type master;
+	file "/etc/bind/db.0";
+};
+
+zone "255.in-addr.arpa" {
+	type master;
+	file "/etc/bind/db.255";
+};
+
+
diff --git a/bind/named.conf.local b/bind/named.conf.local
new file mode 100644
index 0000000..7a57b10
--- /dev/null
+++ b/bind/named.conf.local
@@ -0,0 +1,8 @@
+//
+// Do any local configuration here
+//
+
+// Consider adding the 1918 zones here, if they are not used in your
+// organization
+//include "/etc/bind/zones.rfc1918";
+
diff --git a/bind/named.conf.options b/bind/named.conf.options
new file mode 100644
index 0000000..4778d18
--- /dev/null
+++ b/bind/named.conf.options
@@ -0,0 +1,24 @@
+options {
+	directory "/var/cache/bind";
+
+	// If there is a firewall between you and nameservers you want
+	// to talk to, you may need to fix the firewall to allow multiple
+	// ports to talk.  See http://www.kb.cert.org/vuls/id/800113
+
+	// If your ISP provided one or more IP addresses for stable 
+	// nameservers, you probably want to use them as forwarders.  
+	// Uncomment the following block, and insert the addresses replacing 
+	// the all-0's placeholder.
+
+	// forwarders {
+	// 	0.0.0.0;
+	// };
+
+	//========================================================================
+	// If BIND logs error messages about the root key being expired,
+	// you will need to update your keys.  See https://www.isc.org/bind-keys
+	//========================================================================
+	dnssec-validation auto;
+
+	listen-on-v6 { any; };
+};
diff --git a/bind/rndc.key b/bind/rndc.key
new file mode 100644
index 0000000..2ef8012
--- /dev/null
+++ b/bind/rndc.key
@@ -0,0 +1,4 @@
+key "rndc-key" {
+	algorithm hmac-md5;
+	secret "S3bAJnekUD5dwQVxPuCs/Q==";
+};
diff --git a/bind/zones.rfc1918 b/bind/zones.rfc1918
new file mode 100644
index 0000000..03b5546
--- /dev/null
+++ b/bind/zones.rfc1918
@@ -0,0 +1,20 @@
+zone "10.in-addr.arpa"      { type master; file "/etc/bind/db.empty"; };
+ 
+zone "16.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "17.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "18.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "19.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "20.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "21.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "22.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "23.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "24.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "25.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "26.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "27.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "28.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "29.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "30.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "31.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+
+zone "168.192.in-addr.arpa" { type master; file "/etc/bind/db.empty"; };
diff --git a/default/bind9 b/default/bind9
new file mode 100644
index 0000000..66352f0
--- /dev/null
+++ b/default/bind9
@@ -0,0 +1,6 @@
+#
+# run resolvconf?
+RESOLVCONF=no
+
+# startup options for the server
+OPTIONS="-u bind"
diff --git a/group b/group
index 49c016c..eb0de48 100644
--- a/group
+++ b/group
@@ -49,3 +49,4 @@ netdev:x:109:
 messagebus:x:110:
 ssh:x:111:
 systemd-coredump:x:999:
+bind:x:112:
diff --git a/group- b/group-
index 41bcaaa..49c016c 100644
--- a/group-
+++ b/group-
@@ -48,3 +48,4 @@ crontab:x:108:
 netdev:x:109:
 messagebus:x:110:
 ssh:x:111:
+systemd-coredump:x:999:
diff --git a/gshadow b/gshadow
index 0bbaa0e..24ca8c4 100644
--- a/gshadow
+++ b/gshadow
@@ -49,3 +49,4 @@ netdev:!::
 messagebus:!::
 ssh:!::
 systemd-coredump:!!::
+bind:!::
diff --git a/gshadow- b/gshadow-
index 0e160de..0bbaa0e 100644
--- a/gshadow-
+++ b/gshadow-
@@ -48,3 +48,4 @@ crontab:!::
 netdev:!::
 messagebus:!::
 ssh:!::
+systemd-coredump:!!::
diff --git a/init.d/bind9 b/init.d/bind9
new file mode 100755
index 0000000..59d8e3d
--- /dev/null
+++ b/init.d/bind9
@@ -0,0 +1,145 @@
+#!/bin/sh -e
+
+### BEGIN INIT INFO
+# Provides:          bind9
+# Required-Start:    $remote_fs
+# Required-Stop:     $remote_fs
+# Should-Start:      $network $syslog
+# Should-Stop:       $network $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Start and stop bind9
+# Description:       bind9 is a Domain Name Server (DNS)
+#        which translates ip addresses to and from internet names
+### END INIT INFO
+
+PATH=/sbin:/bin:/usr/sbin:/usr/bin
+
+# for a chrooted server: "-u bind -t /var/lib/named"
+# Don't modify this line, change or create /etc/default/bind9.
+OPTIONS=""
+RESOLVCONF=no
+
+test -f /etc/default/bind9 && . /etc/default/bind9
+
+test -x /usr/sbin/rndc || exit 0
+
+. /lib/lsb/init-functions
+PIDFILE=/run/named/named.pid
+
+check_network() {
+    if [ -x /usr/bin/uname ] && [ "X$(/usr/bin/uname -o)" = XSolaris ]; then
+	IFCONFIG_OPTS="-au"
+    else
+	IFCONFIG_OPTS=""
+    fi
+    if [ -z "$(/sbin/ifconfig $IFCONFIG_OPTS)" ]; then
+       #log_action_msg "No networks configured."
+       return 1
+    fi
+    return 0
+}
+
+case "$1" in
+    start)
+	log_daemon_msg "Starting domain name service..." "bind9"
+
+	modprobe capability >/dev/null 2>&1 || true
+
+	# dirs under /run can go away on reboots.
+	mkdir -p /run/named
+	chmod 775 /run/named
+	chown root:bind /run/named >/dev/null 2>&1 || true
+
+	if [ ! -x /usr/sbin/named ]; then
+	    log_action_msg "named binary missing - not starting"
+	    log_end_msg 1
+	fi
+
+	if ! check_network; then
+	    log_action_msg "no networks configured"
+	    log_end_msg 1
+	fi
+
+	if start-stop-daemon --start --oknodo --quiet --exec /usr/sbin/named \
+		--pidfile ${PIDFILE} -- $OPTIONS; then
+	    if [ "X$RESOLVCONF" != "Xno" ] && [ -x /sbin/resolvconf ] ; then
+		echo "nameserver 127.0.0.1" | /sbin/resolvconf -a lo.named
+	    fi
+	    log_end_msg 0
+	else
+	    log_end_msg 1
+	fi
+    ;;
+
+    stop)
+	log_daemon_msg "Stopping domain name service..." "bind9"
+	if ! check_network; then
+	    log_action_msg "no networks configured"
+	    log_end_msg 1
+	fi
+
+	if [ "X$RESOLVCONF" != "Xno" ] && [ -x /sbin/resolvconf ] ; then
+	    /sbin/resolvconf -d lo.named
+	fi
+	pid=$(/usr/sbin/rndc stop -p | awk '/^pid:/ {print $2}') || true
+	if [ -z "$pid" ]; then		# no pid found, so either not running, or error
+	    pid=$(pgrep -f ^/usr/sbin/named) || true
+	    start-stop-daemon --stop --oknodo --quiet --exec /usr/sbin/named \
+		    --pidfile ${PIDFILE} -- $OPTIONS
+	fi
+	if [ -n "$pid" ]; then
+	    sig=0
+	    n=1
+	    while kill -$sig $pid 2>/dev/null; do
+		if [ $n -eq 1 ]; then
+		    echo "waiting for pid $pid to die"
+		fi
+		if [ $n -eq 11 ]; then
+		    echo "giving up on pid $pid with kill -0; trying -9"
+		    sig=9
+		fi
+		if [ $n -gt 20 ]; then
+		    echo "giving up on pid $pid"
+		    break
+		fi
+		n=$(($n+1))
+		sleep 1
+	    done
+	fi
+	log_end_msg 0
+    ;;
+
+    reload|force-reload)
+	log_daemon_msg "Reloading domain name service..." "bind9"
+	if ! check_network; then
+	    log_action_msg "no networks configured"
+	    log_end_msg 1
+	fi
+
+	/usr/sbin/rndc reload >/dev/null && log_end_msg 0 || log_end_msg 1
+    ;;
+
+    restart)
+	if ! check_network; then
+	    log_action_msg "no networks configured"
+	    exit 1
+	fi
+
+	$0 stop
+	$0 start
+    ;;
+    
+    status)
+    	ret=0
+	status_of_proc -p ${PIDFILE} /usr/sbin/named bind9 2>/dev/null || ret=$?
+	exit $ret
+	;;
+
+    *)
+	log_action_msg "Usage: /etc/init.d/bind9 {start|stop|reload|restart|force-reload|status}"
+	exit 1
+    ;;
+esac
+
+exit 0
diff --git a/insserv.conf.d/bind9 b/insserv.conf.d/bind9
new file mode 100644
index 0000000..1861a99
--- /dev/null
+++ b/insserv.conf.d/bind9
@@ -0,0 +1 @@
+$named bind9
diff --git a/network/if-down.d/bind9 b/network/if-down.d/bind9
new file mode 100755
index 0000000..d06965f
--- /dev/null
+++ b/network/if-down.d/bind9
@@ -0,0 +1,15 @@
+#!/bin/sh -e
+# Called when an interfaces comes up or down
+# Written by LaMont Jones <lamont@debian.org>
+
+# kick named as needed
+
+# If /usr isn't mounted yet, silently bail.
+if [ ! -d /usr/sbin ]; then
+	exit 0
+fi
+
+# if named is running, reconfig it.
+rndc reconfig >/dev/null 2>&1 &
+
+exit 0
diff --git a/network/if-up.d/bind9 b/network/if-up.d/bind9
new file mode 100755
index 0000000..d06965f
--- /dev/null
+++ b/network/if-up.d/bind9
@@ -0,0 +1,15 @@
+#!/bin/sh -e
+# Called when an interfaces comes up or down
+# Written by LaMont Jones <lamont@debian.org>
+
+# kick named as needed
+
+# If /usr isn't mounted yet, silently bail.
+if [ ! -d /usr/sbin ]; then
+	exit 0
+fi
+
+# if named is running, reconfig it.
+rndc reconfig >/dev/null 2>&1 &
+
+exit 0
diff --git a/passwd b/passwd
index 1abd8d9..303c799 100644
--- a/passwd
+++ b/passwd
@@ -23,3 +23,4 @@ systemd-resolve:x:103:104:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
 messagebus:x:104:110::/nonexistent:/usr/sbin/nologin
 sshd:x:105:65534::/run/sshd:/usr/sbin/nologin
 systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
+bind:x:106:112::/var/cache/bind:/usr/sbin/nologin
diff --git a/passwd- b/passwd-
index 3e32547..303c799 100644
--- a/passwd-
+++ b/passwd-
@@ -22,3 +22,5 @@ systemd-network:x:102:103:systemd Network Management,,,:/run/systemd:/usr/sbin/n
 systemd-resolve:x:103:104:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
 messagebus:x:104:110::/nonexistent:/usr/sbin/nologin
 sshd:x:105:65534::/run/sshd:/usr/sbin/nologin
+systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
+bind:x:106:112::/var/cache/bind:/usr/sbin/nologin
diff --git a/ppp/ip-down.d/bind9 b/ppp/ip-down.d/bind9
new file mode 100755
index 0000000..d06965f
--- /dev/null
+++ b/ppp/ip-down.d/bind9
@@ -0,0 +1,15 @@
+#!/bin/sh -e
+# Called when an interfaces comes up or down
+# Written by LaMont Jones <lamont@debian.org>
+
+# kick named as needed
+
+# If /usr isn't mounted yet, silently bail.
+if [ ! -d /usr/sbin ]; then
+	exit 0
+fi
+
+# if named is running, reconfig it.
+rndc reconfig >/dev/null 2>&1 &
+
+exit 0
diff --git a/ppp/ip-up.d/bind9 b/ppp/ip-up.d/bind9
new file mode 100755
index 0000000..d06965f
--- /dev/null
+++ b/ppp/ip-up.d/bind9
@@ -0,0 +1,15 @@
+#!/bin/sh -e
+# Called when an interfaces comes up or down
+# Written by LaMont Jones <lamont@debian.org>
+
+# kick named as needed
+
+# If /usr isn't mounted yet, silently bail.
+if [ ! -d /usr/sbin ]; then
+	exit 0
+fi
+
+# if named is running, reconfig it.
+rndc reconfig >/dev/null 2>&1 &
+
+exit 0
diff --git a/rc0.d/K01bind9 b/rc0.d/K01bind9
new file mode 120000
index 0000000..63fcfdd
--- /dev/null
+++ b/rc0.d/K01bind9
@@ -0,0 +1 @@
+../init.d/bind9
\ No newline at end of file
diff --git a/rc1.d/K01bind9 b/rc1.d/K01bind9
new file mode 120000
index 0000000..63fcfdd
--- /dev/null
+++ b/rc1.d/K01bind9
@@ -0,0 +1 @@
+../init.d/bind9
\ No newline at end of file
diff --git a/rc2.d/S01bind9 b/rc2.d/S01bind9
new file mode 120000
index 0000000..63fcfdd
--- /dev/null
+++ b/rc2.d/S01bind9
@@ -0,0 +1 @@
+../init.d/bind9
\ No newline at end of file
diff --git a/rc3.d/S01bind9 b/rc3.d/S01bind9
new file mode 120000
index 0000000..63fcfdd
--- /dev/null
+++ b/rc3.d/S01bind9
@@ -0,0 +1 @@
+../init.d/bind9
\ No newline at end of file
diff --git a/rc4.d/S01bind9 b/rc4.d/S01bind9
new file mode 120000
index 0000000..63fcfdd
--- /dev/null
+++ b/rc4.d/S01bind9
@@ -0,0 +1 @@
+../init.d/bind9
\ No newline at end of file
diff --git a/rc5.d/S01bind9 b/rc5.d/S01bind9
new file mode 120000
index 0000000..63fcfdd
--- /dev/null
+++ b/rc5.d/S01bind9
@@ -0,0 +1 @@
+../init.d/bind9
\ No newline at end of file
diff --git a/rc6.d/K01bind9 b/rc6.d/K01bind9
new file mode 120000
index 0000000..63fcfdd
--- /dev/null
+++ b/rc6.d/K01bind9
@@ -0,0 +1 @@
+../init.d/bind9
\ No newline at end of file
diff --git a/shadow b/shadow
index 087bc27..00cd84d 100644
--- a/shadow
+++ b/shadow
@@ -23,3 +23,4 @@ systemd-resolve:*:18686:0:99999:7:::
 messagebus:*:18686:0:99999:7:::
 sshd:*:18686:0:99999:7:::
 systemd-coredump:!!:18686::::::
+bind:*:18724:0:99999:7:::
diff --git a/shadow- b/shadow-
index 087bc27..00cd84d 100644
--- a/shadow-
+++ b/shadow-
@@ -23,3 +23,4 @@ systemd-resolve:*:18686:0:99999:7:::
 messagebus:*:18686:0:99999:7:::
 sshd:*:18686:0:99999:7:::
 systemd-coredump:!!:18686::::::
+bind:*:18724:0:99999:7:::
diff --git a/systemd/system/multi-user.target.wants/bind9.service b/systemd/system/multi-user.target.wants/bind9.service
new file mode 120000
index 0000000..d7c8ee4
--- /dev/null
+++ b/systemd/system/multi-user.target.wants/bind9.service
@@ -0,0 +1 @@
+/lib/systemd/system/bind9.service
\ No newline at end of file
diff --git a/ufw/applications.d/bind9 b/ufw/applications.d/bind9
new file mode 100644
index 0000000..6cd6fca
--- /dev/null
+++ b/ufw/applications.d/bind9
@@ -0,0 +1,5 @@
+[Bind9]
+title=Internet Domain Name Server
+description=The Berkeley Internet Name Domain (BIND) implements an Internet domain name server.
+ports=53
+