30.13. Editing Access Control Lists

An access control list (or ACL) is a list of IP addresses, IP networks or other ACLs that are grouped together under a single name. The ACL name can then be used when specifying the list of clients allowed to query, update or perform zone transfers from a zone. This can be used to reduce the amount of duplication in your BIND configuration, and to make it clearer. For example, the ACL corpnet might match the IP networks 192.168.1.0/24, 192.168.2.0/24, and 1.2.3.0/24, which are all part of your company's network. When configuring who can query a zone, you could just enter corpnet instead of that list of network addresses.

To view and edit ACLs in Webmin, the steps to follow are:

1.
On the module's main page, click on the Access Control Lists icon. This will take you to a page listing existing ACLs and allowing the addition of one more. If you want to add more than one ACL, you will need to save the form and re-edit it to force the display of a new blank row.

2.
To add a new ACL, find the blank row at the bottom of the table and enter a short name consisting of only letters and numbers in the ACL Name column. Then in the field under Matching addresses, networks, and ACLs, enter a list of IP addresses, IP networks and other ACL names that this new ACL will contain.

IP addresses must be entered in their standard format like 192.168.1.1, but hostnames are not allowed. IP networks must be entered in network/prefix format like 192.168.1.0/24 or 192.168.1/24. You can also precede any address, network or ACL name with a ! to negate it. For example, the entry !192.168.1.0/24 would match all hosts outside the 192.168.1 network.

3.
Existing entries in the list can be edited by changing their fields in the table and ACLs can be deleted by clearing out the field containing their names.

4.
When you are done adding and editing ACLs, click the Save button. To activate the changes, hit Apply Changes back on the main page. After an ACL is created it can be used in the query and it can transfer and update restrictions of master and slave zones.

BIND has four built-in ACLs that can be used in all the same places that user-defined ACLs can. They are:

any Matches any client address.

none Matches nothing.

localhost Matches the IP addresses of all network interfaces on your system. Even though it is called localhost, it doesn't just match 127.0.0.1.

localnets Matches all clients on all networks that your system is directly connected to. BIND works this out by looking at the IP addresses and netmasks of all network interfaces.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.135.192.144