BIND template substitution variables

Hi Eric,

Thanks for your reply. I prefer CNAMEs because they greatly simplify the sometimes hectic process of trying to get clients to log into the correct servers, especially as we try to avoid placing everything on one server for security, safety and redundancy reasons. I'll spare you and everyone else the details of my thinking though -- and I understand why A records are often preferred -- but that is my preference.

Anyway, I took another look at it and what I've done is list a bunch of records such as ...

www.${DOM}. IN CNAME ${DOM}.

... in the "BIND DNS records for new domains" textarea, and instead of selecting "Use only the records above" as I did previously I've selected the "Add above to automatically generated records" radio button and deselected the "Address records for new domains" options below that that I don't like that create A records. This way Virtualmin should be able to generate a syntactically correct zone file with default SOA and TTL values, just using my defined records and only a couple of default records.

I'm just going through the server template I'm creating right now and will be able to report of my success (or failure) shortly, I hope.

That said, an authoritative list of substitution variables would still be nice, as the contents of /etc/webmin/virtual-server/domain-template (assuming that was what you were referring to, as there is no /etc/webmin/virtual-server/domains/) are clearly not complete, just to use the one example I discovered of "${IP6}".

Out of curiosity though, how would I create an SOA record using the client's own email address? If I just enter ...

${DOM}. IN SOA ns1.example.net. ${EMAILTO}.

... in the "BIND DNS records for new domains" textarea, Virtualmin is going to complain that my syntax is incorrect (presumably because it wants all of the times following that inside curly brackets), not to mention that fact that even if Virtualmin didn't complain this would result in an SOA record with an @ sign in it, which isn't correct.

I guess what is becoming clear is that I'm being difficult and wondering if there's a way for me to build an entire zone file based on substitution variables. Perhaps there isn't, and I should just accept that. :)

Craig

Hi Eric,

Thanks for your feedback. I've been pretty busy over the last 24 hours getting this server online and live, so my apologies for my slow response.

You're right, the /etc/webmin/virtual-server/domains directory did appear only after I started creating domains on the server, and the files in there do appear to contain a comprehensive list of possible substitution variables.

Seeing as I'm not hosting email on this server, the default behaviour of creating a hostmaster@domain.tld alias doesn't really help me. I create RFC 2142 addresses on my own domains, but it's too much to create them on all of our clients' domains. I used to lie awake at night thinking about that, but I don't any more. :) The only exception is abuse@, which I do create on certain domains.

However, I did run into either a bug, or perhaps an unintended violation (on my part) of a DNS RFC I haven't read. (I don't know and I don't have time to look it up right now.) Under "Webmin | Servers | BIND DNS Server | Zone Defaults" I had the email address "cp.hostmaster@example.com" (using my own real domain, of course) entered in the "Default email address" field. When I set up my first domain, Virtualmin created a zone file with the following in the SOA record:

"cp/.hostmaster.example.com."

Yes, with the quotation marks and backslash and all, although on my real domain of course. (The forum software removes the backslash between "cp" and the dot, so I have replaced it with a forward slash so that something is plainly visible.) As a result, BIND would not restart and I had to manually edit the zone file.

Is this a Virtualmin bug -- escaping the dot in the left hand side and then enclosing the whole thing in quotation marks -- or have I unintentionally violated some DNS RFC by including a dot in the LHS of my email address? I've never run into this before on any nameserver, BIND or otherwise.

Thanks for the IRC information. I'll keep that in mind but I think I'm essentially through the fire where I was hoping to have a hand to guide me to help me get through it quicker. The server is online with live domains, and now it's mostly a matter of tying up lose ends and transferring domains from the older servers that this one is replacing.

Craig

Hi Jamie,

Thanks for your reply. Yes, a backslash. (As I said, the forum software removes a backslash, so I can't actually post the literal string here.) If a backslash is expected, why does BIND choke on it? I've never seen a backslash in a BIND zone file. And the quotation marks don't help either, of course.

Craig

This is the actual string Virtualmin creates in the SOA record of the zone file:

"cp\.hostmaster.example.com."

Including, as I say, the quotation marks, which shouldn't be there.

(Figured escaping the backslash when I post might allow it through. It did.)

Hi Jamie,

Yes, I understand how an email address is formatted in an SOA record. But why is Webmin/Virtualmin taking cp.hostmaster@example.net and turning it into (literally, quotation marks and all):

"cp\.hostmaster.example.net"

Isn't that a bug? Or is it intentional? Virtualmin is getting this address from the "Default email address" field at "Webmin | Servers | BIND DNS Server | Zone Defaults".

Craig

Hi Jamie,

Thanks for your reply. I've never seen an SOA record with backslashes or quotation marks in it. With them, yes, BIND rejected the configuration and would not start. When I removed them manually, it started.

Before (failure):

After (success):

Craig

Hi Jamie,

Thanks for your reply. Virtualmin reports BIND version 9.9.4, command line reports "9.9.4-RedHat-9.9.4-29.el7_2.2". This is (or was) a clean VPS with Virtualmin added (after doing nothing but a "yum update") from the installation script. I've made no changes to base configurations (except for ProFTPd) other than through Virtualmin and Webmin.

And yes, I'm aware of the ambiguity of such an address, and that's not unintentional on my part, to be honest. Call me paranoid, but there are enough ways for spammers to scrape addresses that direct email to my accounts without opening another one that is rarely used (in my experience) for legitimate purpose. I'm big on the "an ounce of prevention is worth a pound of cure" concept when it comes to spam avoidance.

The thing is, it's my assumption that the backslash and quotation marks should not be there and are being inadvertently introduced by the Virtualmin script that creates a virtual server. Am I wrong?

Craig

Jamie,

OK, I did a couple of tests, and it's possible I'm wrong on the backslash, and the piling of assumptions on top of assumptions probably doesn't help either.

I manually edited (through "Virtualmin | Server Configuration | DNS Records | Manually Edit Records") a zone file and introduced only a backslash and BIND accepted that. I then removed the backslash and added only quotation marks, and that failed.

So clearly you are correct (and I was wrong) about the backslash, but it's the quotation marks that are the problem. And going back to assumptions -- because I'm not analysing code -- I'm guessing that the script that creates the virtual server is perhaps introducing the quotation marks because of the backslash, as it doesn't add quotation marks if the contact address in Webmin doesn't have a dot in the LHS.

Hope that clarifies things.

Craig

Oops, sorry. We were writing and coming to the same conclusions at the same time. :)

Jamie, I should add that I appreciate this level of interaction with you. In my experience with certain other control panels -- mostly Plesk, but also cPanel to a more limited extent since I haven't used it that much -- you're mostly dealing with (essentially) PR people whose job it is to either ignore you and hope you go away, or respond with "Nothing to see here, move along, everything is fine!" That's an incredibly broad brush and a massive generalisation, but it's my observation for what it's worth.

Craig

And I should add Eric in there too, of course. :)