bind 9.9.6 - Trusty 14.04.5 LTS

[Morgan]

Hi all,
may is possibile to upgrade bind9 package in Ubuntu "Trusty" 14.04.5 LTS to 9.9.6 version or higher that support DNS CAA?

Repo Version on my Ubuntu Server is:

# cat /etc/issue.net
Ubuntu 14.04.5 LTS

# lsb_release -rd
Description: Ubuntu 14.04.5 LTS
Release: 14.04

# named -v
BIND 9.9.5-3ubuntu0.11-Ubuntu (Extended Support Version)

# apt-cache policy bind9
bind9:
  Installed: 1:9.9.5.dfsg-3ubuntu0.11
  Candidate: 1:9.9.5.dfsg-3ubuntu0.11
  Version table:
 *** 1:9.9.5.dfsg-3ubuntu0.11 0
        500 http://archive.ubuntu.com/ubuntu/ trusty-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu/ trusty-security/main amd64 Packages
        100 /var/lib/dpkg/status
     1:9.9.5.dfsg-3 0
        500 http://archive.ubuntu.com/ubuntu/ trusty/main amd64 Packages

# dpkg -s bind9
Package: bind9
Status: install ok installed
Priority: optional
Section: net
Installed-Size: 951
Maintainer: Ubuntu Developers <email address hidden>
Architecture: amd64
Version: 1:9.9.5.dfsg-3ubuntu0.11
Replaces: apparmor-profiles (<< 2.1+1075-0ubuntu4), bind, bind9utils (<< 1:9.9.3.dfsg.P2-3), dnsutils (<< 1:9.1.0-3)
Depends: libbind9-90 (= 1:9.9.5.dfsg-3ubuntu0.11), libc6 (>= 2.14), libcap2 (>= 2.10), libdns100 (= 1:9.9.5.dfsg-3ubuntu0.11), libisc95 (= 1:9.9.5.dfsg-3ubuntu0.11), libisccc90 (= 1:9.9.5.dfsg-3ubuntu0.11), libisccfg90 (= 1:9.9.5.dfsg-3ubuntu0.11), liblwres90 (= 1:9.9.5.dfsg-3ubuntu0.11), libxml2 (>= 2.7.4), debconf (>= 0.5) | debconf-2.0, init-system-helpers (>= 1.13~), netbase, adduser, lsb-base (>= 3.2-14), bind9utils (= 1:9.9.5.dfsg-3ubuntu0.11), net-tools
Suggests: dnsutils, bind9-doc, resolvconf, ufw
Conflicts: apparmor-profiles (<< 2.1+1075-0ubuntu4), bind
Conffiles:
 /etc/init.d/bind9 727ca4fa85681b10089e2b33bbbe5a26
 /etc/apparmor.d/usr.sbin.named 6757ca6899ffe2e9049e4b16eeb31ac9
 /etc/apparmor.d/local/usr.sbin.named 46622a9a6a8abf650eed70019af3cfd4
 /etc/network/if-up.d/bind9 a3c27aae4a7a4e8c93ca98c1eddde038
 /etc/network/if-down.d/bind9 d68b2031e47f995a68d0b0f9601e687c
 /etc/ufw/applications.d/bind9 ac2316819866611a68b976db9125c9a7
 /etc/ppp/ip-up.d/bind9 a3c27aae4a7a4e8c93ca98c1eddde038
 /etc/ppp/ip-down.d/bind9 d68b2031e47f995a68d0b0f9601e687c
 /etc/bind/db.0 8aba258068c8c60a7ade3952a285f57d
 /etc/bind/db.local e5d27ead2d238928a08d33c7a7333477
 /etc/bind/db.root b3b07a2944d29d1f5bd58fe2fe183148
 /etc/bind/zones.rfc1918 d04252b4368b66e28376f92613842888
 /etc/bind/db.empty 4e7a0ebff9a8936e5a72ec18c0c49214
 /etc/bind/named.conf 32be43ecfcb37f69bf967c15c368e184
 /etc/bind/named.conf.local fb15a27656eafd86ff870effabc72f1e
 /etc/bind/named.conf.default-zones cf3c6c70e70516e6b3af112dd0a1907c
 /etc/bind/db.127 64f5cf50e8d8192109dad43b779e5e36
 /etc/bind/bind.keys c57eed259ab3ea28d0322a88d96841f1
 /etc/bind/db.255 8aba258068c8c60a7ade3952a285f57d
Description: Internet Domain Name Server
 The Berkeley Internet Name Domain (BIND) implements an Internet domain
 name server. BIND is the most widely-used name server software on the
 Internet, and is supported by the Internet Software Consortium, www.isc.org.
 .
 This package provides the server and related configuration files.
Original-Maintainer: LaMont Jones <email address hidden>

# apt-cache showpkg bind9
Package: bind9
Versions:
1:9.9.5.dfsg-3ubuntu0.11 (/var/lib/apt/lists/archive.ubuntu.com_ubuntu_dists_trusty-updates_main_binary-amd64_Packages) (/var/lib/apt/lists/security.ubuntu.com_ubuntu_dists_trusty-security_main_binary-amd64_Packages) (/var/lib/dpkg/status)
 Description Language:
                 File: /var/lib/apt/lists/archive.ubuntu.com_ubuntu_dists_trusty_main_binary-amd64_Packages
                  MD5: afd61d02df1ec6f856b928dfbf6fd201
 Description Language: en
                 File: /var/lib/apt/lists/archive.ubuntu.com_ubuntu_dists_trusty_main_i18n_Translation-en
                  MD5: afd61d02df1ec6f856b928dfbf6fd201
 Description Language: en_GB
                 File: /var/lib/apt/lists/archive.ubuntu.com_ubuntu_dists_trusty_main_i18n_Translation-en%5fGB
                  MD5: afd61d02df1ec6f856b928dfbf6fd201

1:9.9.5.dfsg-3 (/var/lib/apt/lists/archive.ubuntu.com_ubuntu_dists_trusty_main_binary-amd64_Packages)
 Description Language:
                 File: /var/lib/apt/lists/archive.ubuntu.com_ubuntu_dists_trusty_main_binary-amd64_Packages
                  MD5: afd61d02df1ec6f856b928dfbf6fd201
 Description Language: en
                 File: /var/lib/apt/lists/archive.ubuntu.com_ubuntu_dists_trusty_main_i18n_Translation-en
                  MD5: afd61d02df1ec6f856b928dfbf6fd201
 Description Language: en_GB
                 File: /var/lib/apt/lists/archive.ubuntu.com_ubuntu_dists_trusty_main_i18n_Translation-en%5fGB
                  MD5: afd61d02df1ec6f856b928dfbf6fd201

Reverse Depends:
  maas-dns,bind9
  dnsutils:i386,bind9 1:9.1.0-3
  bind9utils:i386,bind9 1:9.9.5.dfsg-1
  bind9:i386,bind9
  collectd-core,bind9
  samba,bind9
  samba,bind9 1:9.5.1
  maas-dns,bind9
  dnsutils,bind9 1:9.1.0-3
  bind9utils,bind9 1:9.9.5.dfsg-1
  dnsutils:i386,bind9 1:9.1.0-3
  bind9utils:i386,bind9 1:9.9.5.dfsg-1
  bind9:i386,bind9
  zentyal-dns,bind9
  ldap2zone,bind9
  ldap2dns,bind9
  ikiwiki-hosting-dns,bind9
  gadmin-bind,bind9 9.3.2
  dnssec-tools,bind9
  dlz-ldap-enum,bind9
  dhis-tools-dns,bind9
  dhis-dns-engine,bind9
  collectd-core,bind9
  cobbler,bind9
  bindgraph,bind9
  autodns-dhcp,bind9
  samba,bind9
  samba,bind9 1:9.5.1
  maas-dns,bind9
  dnsutils,bind9 1:9.1.0-3
  bind9utils,bind9 1:9.9.5.dfsg-1
Dependencies:
1:9.9.5.dfsg-3ubuntu0.11 - libbind9-90 (5 1:9.9.5.dfsg-3ubuntu0.11) libc6 (2 2.14) libcap2 (2 2.10) libdns100 (5 1:9.9.5.dfsg-3ubuntu0.11) libisc95 (5 1:9.9.5.dfsg-3ubuntu0.11) libisccc90 (5 1:9.9.5.dfsg-3ubuntu0.11) libisccfg90 (5 1:9.9.5.dfsg-3ubuntu0.11) liblwres90 (5 1:9.9.5.dfsg-3ubuntu0.11) libxml2 (2 2.7.4) debconf (18 0.5) debconf-2.0 (0 (null)) init-system-helpers (2 1.13~) netbase (0 (null)) adduser (0 (null)) lsb-base (2 3.2-14) bind9utils (5 1:9.9.5.dfsg-3ubuntu0.11) net-tools (0 (null)) dnsutils (0 (null)) bind9-doc (0 (null)) resolvconf (0 (null)) ufw (0 (null)) apparmor-profiles (3 2.1+1075-0ubuntu4) apparmor-profiles:i386 (3 2.1+1075-0ubuntu4) bind (0 (null)) bind:i386 (0 (null)) apparmor-profiles (3 2.1+1075-0ubuntu4) apparmor-profiles:i386 (3 2.1+1075-0ubuntu4) bind (0 (null)) bind:i386 (0 (null)) bind9utils (3 1:9.9.3.dfsg.P2-3) bind9utils:i386 (3 1:9.9.3.dfsg.P2-3) dnsutils (3 1:9.1.0-3) dnsutils:i386 (3 1:9.1.0-3) bind9:i386 (0 (null))
1:9.9.5.dfsg-3 - libbind9-90 (5 1:9.9.5.dfsg-3) libc6 (2 2.14) libcap2 (2 2.10) libdns100 (5 1:9.9.5.dfsg-3) libisc95 (5 1:9.9.5.dfsg-3) libisccc90 (5 1:9.9.5.dfsg-3) libisccfg90 (5 1:9.9.5.dfsg-3) liblwres90 (5 1:9.9.5.dfsg-3) libxml2 (2 2.7.4) debconf (18 0.5) debconf-2.0 (0 (null)) init-system-helpers (2 1.13~) netbase (0 (null)) adduser (0 (null)) lsb-base (2 3.2-14) bind9utils (5 1:9.9.5.dfsg-3) net-tools (0 (null)) dnsutils (0 (null)) bind9-doc (0 (null)) resolvconf (0 (null)) ufw (0 (null)) apparmor-profiles (3 2.1+1075-0ubuntu4) apparmor-profiles:i386 (3 2.1+1075-0ubuntu4) bind (0 (null)) bind:i386 (0 (null)) apparmor-profiles (3 2.1+1075-0ubuntu4) apparmor-profiles:i386 (3 2.1+1075-0ubuntu4) bind (0 (null)) bind:i386 (0 (null)) bind9utils (3 1:9.9.3.dfsg.P2-3) bind9utils:i386 (3 1:9.9.3.dfsg.P2-3) dnsutils (3 1:9.1.0-3) dnsutils:i386 (3 1:9.1.0-3) bind9:i386 (0 (null))
Provides:
1:9.9.5.dfsg-3ubuntu0.11 -
1:9.9.5.dfsg-3 -
Reverse Provides:

that no support DNS CAA.

ISC Release Notes in 9.9.6 version introduced DNS CAA support:

https://ftp.isc.org/isc/bind/9.9.6/RELEASE-NOTES-BIND-9.9.6.txt New Features report:

"Support for CAA record types, as described in RFC 6844 "DNS
   Certification Authority Authorization (CAA) Resource Record",
   was added. [RT#36625] [RT #36737]"

Thx and Regards.

[Joshua Powers (powersj)]

If you need a fix for the bug in previous versions of Ubuntu, then the relevant procedure is documented here:

 https://wiki.ubuntu.com/StableReleaseUpdates

However, I am not sure this bug would qualify under that policy, although I am not on the SRU team and cannot make that decision.

[Robie Basak (racb)]

I don't think this would be appropriate under our SRU policy. You can upgrade to 16.04, which ships with bind 9.10.

[Morgan (morganfw-k)]

Thanks for answer, unfortunately I can't upgrade to Ubuntu 16.10 for now because my Ubuntu installation is a Production VPS with several services.

I'll try to compile by myself or to use a PPA version (eg. LaMont Jones PPA).

Regards.