SCL and BIND - Software Collections

Introduction

ISC provides RPM packages of BIND built for Red Hat Enterprise Linux (RHEL). These RPMs are built in accordance with the Software Collections (SCL) standard. This means the files are in different locations than one might expect on a "vanilla" Unix/Linux system.

SCL is a standard for software packaging used with RHEL and derivatives. For a time, SCL was promoted by Red Hat Inc as the preferred way for independent software vendors to package their software for RHEL. SCL has the advantage of allowing multiple variations of the same software to be installed in parallel. However, this comes at the cost of a more complicated directory structure and execution model.

Paths

The following directory and file locations are used for SCL:

Read and write

The RHEL environment provides default file permissions and SELinux policy which confine named to certain directories. This increases security in the face of new attacks and exploits. The defaults assume that named will have read-only access to the /etc/opt/isc/scls/isc-bind/ directory, and will have read-write access to the /var/opt/isc/scls/isc-bind/named/data/ directory.

As such, nothing that needs to be updated by the named daemon itself should be placed in the /etc/opt tree. Config files, security keys, and static zone data can be placed here, and gain the benefit of additional protection against unauthorized modification.

Files that may need to be updated by named should be placed in the /var/opt tree. This includes secondary zones, dynamic zones (DNS UPDATE), zones being automatically maintained for DNSSEC, zones subject to runtime changes with rndc addzone / rndc modzone, log files, and diagnostic dumps.

SCL log directory

By default, the standard SCL tooling creates a log directory, which for BIND is /var/opt/isc/scls/isc-bind/log/. Note that ISC does not provision or use this directory. The RPM declarations ISC provides assume all data written by named — including any log files — will be placed under the /var/opt/isc/scls/isc-bind/named/data/ directory. If you wish to use the log directory provided by SCL, you will need to set ownership, permissions, and/or SELinux policies accordingly.

Running commands

By default, commands from SCL packages are not placed in the $PATH, and thus will not be available with a simple invocation. Thus, to make use of commands provided by the ISC RPMs, you will need to take additional steps.

Running one command

To run a single BIND command, you can use the scl run prefix command. For example:

scl run isc-bind dig

Any arguments to the BIND command being run must be passed as a single argument with the command. In other words, the argument to scl run is a shell command line, not just the name of an executable. For example (note the single quotes):

scl run isc-bind 'dig MX isc.org. @ns1.isc.org.'

Importing an SCL environment

To bring the ISC BIND SCL environment into the current shell, you can use the following command:

source /opt/isc/isc-bind/enable

After doing that, you can run BIND commands the same way you would run normal commands:

dig MX isc.org. @ns1.isc.org.

You can place the above source command into a user's $HOME/.profile login profile, or equivalent, to include this in the default environment for that user.

Removing distribution packages

RHEL provides BIND packages, with unique patches and modifications, and typically using an older major release. Having both RHEL and ISC packages installed at once often leads to confusion (for both people and software). People or programs wil run a command like named, expecting it invoke the command from the ISC packaging, and get the RHEL packaging instead.

Thus, ISC suggests you remove the RHEL BIND packages, unless they are needed for some other software that is also installed. That way if a BIND command is invoked without the proper SCL environment, it produces an obvious Command not found, rather than getting the wrong command and inconsistent results.

To do so, run:

dnf remove bind-libs bind-libs-lite bind-utils

Note the lack of the isc- prefix for these package names.

The RHEL BIND packages may not be installed in the first place, so if dnf says there is nothing to remove, no further action is required.

See also

• ISC Knowledgebase
  • ISC Packages for BIND 9
  • BIND 9 Supported Platforms
• External resources
  • Software Collections home page [archived as of 2024 February]
  • How to use Red Hat Software Collections in scripts and cron jobs