Should I use /etc/bind/zones/ or /var/cache/bind/?

Question

Each tutorial seems to have a different opinion on this. For my ISC BIND zones, should I use /etc/bind/zones/ or /var/cache/bind/? In the last install, I used /var/cache/bind/ but only because I was guided to do so; however I just spotted a pid file in there for this new Debian install, so I figured that using the "working directory" to store zone files probably wasn't the best idea. It seems that many admins use this so they don't have to type the full path when declaring a new zone.

For example:

file "/etc/bind/zones/db.foobar.com";

Instead of:

file "db.foobar.com";

Is obviously easier to type, but is it good or bad practice?

Some may also suggest setting the working directory to /etc/bind/zones:

options {
    // directory "/var/cache/bind";
    directory "/etc/bind/zones";
}

... but something tells me this isn't good practice, since the pid file would be created there I assume (unless it's just in /var/cache/bind by coincidence).

I took a look at the manpage but it didn't seem to say what the directory option was for, any ideas exactly what it was design for?

score 17 · Accepted Answer · answered Nov 16 '09 at 14:14

17

For your master zones, they should go in /etc/bind/zones because they're config. Secondary (slave) zones should be in /var/cache/bind/secondary or similar, because it's just cached data that can be retrieved from the master if the data is lost.

answered Nov 16 '09 at 14:14

womble

96,255
29
175
230

score 7 · Answer 2 · edited Jul 08 '21 at 11:53

7

/var/lib/bind/ - master and dynamic zones

/var/cache/bind/ - secondary zones

/etc/bind/ - zones that should not change for the lifetime of the server.

edited Jul 08 '21 at 11:53

Anthony Geoghegan

2,875
1
24
34

answered Mar 30 '10 at 02:38

I also prefer this pattern, but is this an official recommendation somewhere? – Jon Skarpeteig Apr 25 '16 at 09:48
1

This is what says the [Ubuntu documentation](https://ubuntu.com/server/docs/service-domain-name-service-dns). `/etc/bind` is the default directory for static authoritative zone files. `/var/lib/bind` is the default directory for authoritative files that will be updated dynamically. `/var/cache/bind/` is the default directory for non-authoritative zone files. – Laurent Simon May 21 '22 at 18:16

score 2 · Answer 3 · edited Sep 25 '15 at 19:35

2

A short answer is that it doesn't matter and either will work.

I used to use /var/cache/bind, but now I always use /etc/bind as /var/cache is usually excluded from backups (per the FHS /var/cache must be able to be recreated automatically).

Any secondary or dynamic zones still live in /var/cache.

edited Sep 25 '15 at 19:35

Cristian Ciupitu

6,396
2
42
56

answered Nov 16 '09 at 14:14

LapTop006

6,496
20
26

score 2 · Answer 4 · edited Apr 13 '17 at 12:14

Just like womble, I agree with the fact that /var/cache/bind is good for secondary (slave) zones. On the other hand, I don't think that master zones should be under /etc. They are configuration files just as much as content served by Apache is, so they should be stored somewhere under /var, but not under /var/cache.

Just for the record, Red Hat based systems store zones under /var/named (from where they might be copied automatically to /var/named/chroot/var/named). The configuration file is /etc/named.conf.

score 1 · Answer 5 · answered Nov 16 '09 at 16:38

I would think /var/cache would be something you could delete, and so would use something else.

What that is, is neither a standard nor a requirement to be so. BIND doesn't care, just so long as you're consistent about it you won't go blind editing config files.

I would not consider zone files as configuration data exactly. named.conf and keys.conf are config to me, zone data is, well, zone data. Just pick a place -- perhaps even a user directory dedicated for the purpose -- and run with it.

In my specific setup, I use /local/named, which may be a symlink elsewhere on the machine. I put named.conf in /local/named/, and set the directory option to /local/named as well. I then give filenames like pri/example.com or sec/example.com to keep zones I am authoritative for distinct from those I pull from other sources. This lets me remove all secondaries and re-fetch without worry should I need to.

score 1 · Answer 6 · answered Nov 16 '09 at 16:58

This isn't really a Bind question -- the answer depends on how you manage your Linux/Unix boxes.

I've worked in places with change management/security standards that require specific approval to make modifications in the /etc tree on a production server, and use Tripwire or similar tools to monitor for changes. In those places, files with a high tempo of change (ie Zone files, etc) would live in /var and would be subject to a different level of change review.

If you're change control process isn't an issue, the actual location doesn't matter much, but you should keep it consistent. Personally, I think it belongs in the /var tree, but that's more of an old school unix habit that I have.

Should I use /etc/bind/zones/ or /var/cache/bind/?

6 Answers6