Skip to main content
emisar

BIND DNS server

v0.1.18

Authoritative/recursive BIND ops: rndc status + stats, zone validation, cache inspection, local resolution probes, plus narrow operator actions (rndc reload, zone freeze/thaw). Requires rndc key on the runner host.

10 allowed by default 1 need approval by default
Pack ID
bind
Vendor
emisar
OS
linux
Actions
11
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
dig named-checkconf named-checkzone rndc

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install bind --hash sha256:59ef04f858f0e9d62c19a2e6d7788ecbf3b42bc4849ac6fd5d65d2d934b7aa3c

Setup

Operates on the local named instance on the runner host — no credentials needed. rndc controls named via its key file; dig queries 127.0.0.1.

Host access

Run these commands yourself on the runner host. Emisar shows and copies setup recipes; it never runs them.

Read BIND's protected configuration and RNDC key and control the local named process.

bind.rndc_statusbind.rndc_statsbind.named_checkconfbind.named_checkzonebind.rndc_reloadbind.rndc_freezebind.rndc_thawbind.rndc_flush

Add the default Emisar service user to bind on Debian or Ubuntu

Grant access 
sudo usermod -aG bind emisar
sudo systemctl restart emisar
Verify access 
id -nG emisar | tr ' ' '\n' | grep -Fx bind
sudo -u emisar rndc status >/dev/null
sudo -u emisar named-checkconf

Impact: Every process running as emisar can read files exposed to the bind group and use the RNDC key to mutate named beyond the actions exposed by this pack.

Add the default Emisar service user to named on RHEL-family hosts

Grant access 
sudo usermod -aG named emisar
sudo systemctl restart emisar
Verify access 
id -nG emisar | tr ' ' '\n' | grep -Fx named
sudo -u emisar rndc status >/dev/null
sudo -u emisar named-checkconf

Impact: Every process running as emisar can read files exposed to the named group and use the RNDC key to mutate named beyond the actions exposed by this pack.

Notes

  • zone_dump (AXFR) requires named's allow-transfer to include 127.0.0.1.

Verify it works

Runs bind.rndc_status, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify bind

Install and configure a pack walks through the whole sequence on a host.

Actions 11 total

View on GitHub
  • bind.named_checkconf exec low Low — read-only or trivially reversible

    named-checkconf

    Validate named.conf syntax. Run before any rndc reload.

    View source on GitHub
  • bind.named_checkzone exec low Low — read-only or trivially reversible

    named-checkzone <zone> <file>

    Validate one zone file.

    View source on GitHub
  • bind.query_local exec low Low — read-only or trivially reversible

    dig @localhost <name> <type>

    Resolve one name against the local named.

    View source on GitHub
  • bind.rndc_flush exec medium Medium — changes state, easily reversible

    rndc flush

    Flush the resolver cache. Use after a downstream domain's records change and BIND is still serving stale answers. All clients hit upstream until cache repopulates.

    View source on GitHub
  • bind.rndc_freeze exec medium Medium — changes state, easily reversible

    rndc freeze <zone>

    Freeze a zone (suspend dynamic updates) — used before editing zone file by hand.

    View source on GitHub
  • bind.rndc_reload exec high High — service-affecting

    rndc reload [zone]

    Reload named config (or one zone). Validates first if zone specified.

    View source on GitHub
  • bind.rndc_stats exec medium Medium — changes state, easily reversible

    rndc stats + read dump

    Force a stats dump and read it. Includes query counts, cache stats, NSID.

    View source on GitHub
  • bind.rndc_status exec low Low — read-only or trivially reversible

    rndc status

    Show named version, uptime, zone count, configured vs current settings.

    View source on GitHub
  • bind.rndc_thaw exec medium Medium — changes state, easily reversible

    rndc thaw <zone>

    Unfreeze a zone — resumes dynamic updates + reloads it.

    View source on GitHub
  • bind.zone_dump exec low Low — read-only or trivially reversible

    dig @localhost <zone> AXFR

    Dump zone transfer from localhost (requires allow-transfer to include 127.0.0.1).

    View source on GitHub
  • bind.zone_serial exec low Low — read-only or trivially reversible

    SOA serial of <zone>

    Show SOA serial from localhost — use to confirm a zone reloaded.

    View source on GitHub
← Back to registry
Pack reference  Publish your own