[nsd-users] tinydns to nsd

[Andreas Schwarz]

On the "nsd-control addzone/delzone": it works a bit different from defining zones in your configuration, just as the error message says.

It is rather intended to be used with patterns. You configure a pattern in your configuration, then you tell nsd via nsd-control addzone to use a specific pattern for a specific zone. nsd keeps track of these assignments in a file usually in "/var/lib/nsd/zone.list" (configurable via "zonelistfile").

Zones can be added/removed pretty dynamically that way. What nsd does internally when receiving the addzone/delzone I haven't cared about so far.

On the config in general:
"server-count" should be set to the number of CPUs of the respective machine. And, if you have this set to more than 1 and run it on Linux, you might also want to consider setting "reuseport" to "yes". I have more experience with this option from a high performance unbound system, but activating this option helped improve performance by a margin of 30-40%. I think it has a similar impact on nsd when a high amount of requests has to be served.

Am 28. Dezember 2019 22:15:54 MEZ schrieb richard lucassen via nsd-users <nsd-users at lists.nlnetlabs.nl>:
>On Sat, 28 Dec 2019 17:02:09 +0100
>richard lucassen via nsd-users <nsd-users at lists.nlnetlabs.nl> wrote:
>
>> The problem is (was) that I used "include:" statements in nsd.conf
>> to load zone information. Apparently nsd does not reread the include
>> files upon a SIGHUP. I scripted everything into 1 file and a HUP
>> rereads the zone info now.
>
>Wrong, I made a mistake it does not. A SIGHUP does not make nsd reread
>it's config file. When using nsd-control I get an error:
>
># nsd-control delzone test.xaq.nl
>error zone defined in nsd.conf, cannot delete it in this manner: remove
>it from nsd.conf yourself and repattern
>
>The output of "nsd-checkconf -v /etc/nsd/nsd.conf":
>server:
>        debug-mode: no
>        ip-transparent: no
>        ip-freebind: no
>        reuseport: no
>        do-ip4: yes
>        do-ip6: no
>        hide-version: yes
>        database: ""
>        #identity:
>        #version:
>        #nsid:
>        #logfile:
>        server-count: 1
>        tcp-count: 100
>        tcp-query-count: 0
>        tcp-timeout: 120
>        tcp-mss: 0
>        outgoing-tcp-mss: 0
>        ipv4-edns-size: 4096
>        ipv6-edns-size: 4096
>        pidfile: "/var/lib/nsd/nsd.pid"
>        port: "53"
>        statistics: 0
>        chroot: "/var/lib/nsd/"
>        username: "nsd"
>        zonesdir: "/var/lib/nsd/domains/"
>        xfrdfile: ""
>        zonelistfile: "/var/lib/nsd/zone.list"
>        xfrdir: "/var/lib/nsd/tmp/"
>        xfrd-reload-timeout: 1
>        log-time-ascii: yes
>        round-robin: yes
>        verbosity: 0
>        ip-address: "127.0.0.53"
>        rrl-size: 1000000
>        rrl-ratelimit: 200
>        rrl-slip: 2
>        rrl-ipv4-prefix-length: 24
>        rrl-ipv6-prefix-length: 64
>        rrl-whitelist-ratelimit: 2000
>        zonefiles-check: yes
>        zonefiles-write: 3600
>
>remote-control:
>        control-enable: yes
>        control-port: 8952
>        server-key-file: "/etc/nsd/nsd_server.key"
>        server-cert-file: "/etc/nsd/nsd_server.pem"
>        control-key-file: "/etc/nsd/nsd_control.key"
>        control-cert-file: "/etc/nsd/nsd_control.pem"
>
>zone:
>        name: test.xaq.nl
>        zonefile: /var/lib/nsd/domains/nl/xaq/test/zone
>
>(and a lot of other zones)
>
>BTW, a "control-enable: no" gives a config error. Any hints?
>
>And perhaps some more comments on the config? Note: this is a
>supervised version running under "runit"
>
>R.
>
>-- 
>richard lucassen
>http://contact.xaq.nl/
>
>_______________________________________________
>nsd-users mailing list
>nsd-users at lists.nlnetlabs.nl
>https://lists.nlnetlabs.nl/mailman/listinfo/nsd-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.nlnetlabs.nl/pipermail/nsd-users/attachments/20191228/fee70654/attachment-0001.htm>