Franske ITC-2480 DNS Lab

Introduction

In this lab you will perform the following tasks:

• Install BIND and configure as caching plus zones for a local domain
• Learn how to create domains using Webmin
• Learn how to manually edit using a zone file

You will be introduced to the following commands:

• dig
• nslookup
• systemctl

Lab Procedure

Prerequisites

1. Open an SSH console to your Linux system using the PuTTY software, login with your standard user account.
2. Make sure that Webmin is installed on your system.

Install BIND & Enable Caching

Video Tutorial - Installing BIND and Enabling Caching

1. First you will need to install BIND. to install it, use the package manager to install bind9
BIND (Berkeley Internet Name Domain) is one of the available DNS server applications for Linux and the most well known and used nameserver on the Internet.
2. You will also want to install the dnsutils package.
In order to use the nslookup and dig programs for DNS testing and troubleshooting you'll need dnsutils
3. Open up /etc/bind/named.conf.options with your favorite text editor.
Now we will need to enable DNS caching and forwarding on the BIND server. This will allow us to use it for DNS resolving locally, as well as speed up frequent DNS requests.
• You are now in the local options file for BIND. You will need to uncomment (remove the // from the front of) the following lines:



• NOTE: You will also need to replace 0.0.0.0 with 172.17.139.11 for outside DNS lookups to function correctly.
The reason we setup a forwarder address is so that domain requests that are not on our system are passed to another DNS server instead of being searched against the root nameservers. You may want to do this in domain or enterprise environments as most large networks have internal domain names setup that only redirect inside of a local LAN. By using a forwarder, as long as the DNS server you push requests to is able to access those internal records, you will be able to access local content from internal domain names instead of needing to rely on IP addresses.
4. To apply these changes, you will need to restart the BIND server with administrative permissions.
sudo service bind9 restart
5. Next, open up your interfaces file (/etc/network/interfaces) with your favorite file editor.
• Change the dns server for the primary network interface to 127.0.0.1.
The change to /etc/network/interfaces will take effect if you restart your system. To avoid doing that right now you can edit the /etc/resolv.conf file so that it has only one nameserver line like nameserver 127.0.0.1 Note that unless you reboot the system it will eventually get reset back to it's prior setting by a background system process so at some point you will want to reboot your system to make the change permanent.
6. Run the command:
nslookup inverhills.edu
If BIND is working, you should now see the following output:



• Notice how it shows it is using 127.0.0.1 as the server. If you do not see this, then your interface file or resolv.conf file is not set to use the local machine for DNS lookups. Note also that the IP address returned for this domain may vary from the one shown in the output above.
7. Run:
dig inverhills.edu
See if you can find where the IP address for the domain is reported in the output as well as where the server IP address is reported in the output.
8. Now would be a good time to reboot your server to ensure the DNS server network interface configuration changes remain permanent.
sudo shutdown -r now
9. Once the system reboots log back in and use nslookup or dig to verify the default nameserver being used is 127.0.0.1.

Create a Domain using Webmin

Video Tutorial - Create a Domain Using Webmin
Now we are going to use Webmin to create a few different type of domain records and have our system serve as a DNS server for a domain. We will utilize A (Host), AAAA (IPv6 host), MX (Mail Exchange), and CNAME (Canonical Name) records.

1. Open up your Webmin panel and sign in.
Now that we have BIND installed, you will need to click the Refresh Modules option on the left sidebar to have Webmin recheck the system for installed packages and services so that it will show up as an option in the Servers tab.
2. Under the Servers tab, open up BIND DNS Server, under Existing DNS Zones click Create master zone.
From here we will create a new domain name for our server to respond to DNS queries for.
3. Use the following options, where * is replaced by your System ID that was defined in Lab 5 (just the letter of your system, for example the domain name would be debserv-A.test if you had System ID "A").

   Zone type: Forward (Names to Addresses)
   Domain name / Network: debserv-*.test
   Records file: Automatic
   Master server: Leave as your hostname
   Email address: root@debserv-*.test

4. Click the create button to add the domain.
As this point you should now be on the Edit Master Zone page. From here you can add and edit domain records for this domain name.
5. To create our A record which points your domain to an IP address, click the Address button.
• For the Name enter @. Note: The @ symbol in DNS Zones defines the parent domain (alternatively you could re-enter the parent domain debserv-*.test. with the period at the end).
• In the address field enter your VM's static IP set in Lab 5 and click Create.
6. Return to the main BIND DNS Server page. Click the Apply Configuration link (which looks like two arrows chasing each other) in the top right corner. You'll see the "Apply Configuration" text if you hover your mouse over the button.
7. To test the record use nslookup or dig to lookup the domain you just created (Replace the * with your letter.)
nslookup debserv-*.test dig debserv-*.test
• If you have issues looking up the domain, make sure that the system is still using 127.0.0.1 as the DNS server. If not, check your /etc/resolv.conf file.

Additional DNS Record Types

Video Tutorial - Additional DNS Record Types
Now we are going to add a few more record types to our Domain. This will include an MX (Mail Exchange) and CNAME (Canonical Name) record. We will start with the MX record. MX records are used by email servers to look up where to forward email for a specific domain.

1. In Webmin on the BIND DNS Server page, click the domain on the bottom named debserv-*.test and then click the Mail Server button. Under name, enter @ again, and for mail server enter mail.debserv-*.test. (with the period at the end). For Priority, enter 10.
• This entry has said we want other servers trying to send mail to users@debserv-*.test to actually send it to the server at mail.debserv-*.test which allows us to use a different server for email than we use fore web serving, etc.
• The Priority entry allows people to define more than one MX record for a name, and the order which the sending service will try to use for contacting the various mail servers at your domain.
2. Go back to the domain zone overview page. Add an A record for mail.debserv-*.test which points to the IP of your system.
Because we don't currently have an "A" (address) record for mail.debserv-*.test the mail would currently go undelivered.
• Reapply configuration settings like you did in the last section of this lab using the button with the two arrows in a circle.
3. To test an MX record we need to make multiple queries and ask nslookup or dig to fist check for MX records for the domain like:
nslookup -type=MX debserv-*.test
or

dig debserv-*.test MX

which will return the names of the mail servers for that domain. We then need to do a regular nslookup or dig on those names to determine what IP addresses those are pointed to. Of course, for mail to actually work we'd also need to insure mail server software is installed and configured on that server as well.
4. Again return to the domain zone overview page.
We are now going to create a CNAME record. CNAME records are useful as they allow you to create virtual A records (aliases), but point them to another domain or host name instead of to a specific IP address. This allows you to have many hostnames all pointed to the same A record which contains the actual IP address so if the IP address changes you only need to change a single A record and all the hostnames will change. It can also be used to redirect a hostname at one domain to an entirely different domain.
5. On the Edit Master Zone page for your domain, click the Name Alias button. For the Name, enter blog and for the Real Name, enter your domain debserv-*.test. but remember to put a period at the end of the domain as this is an absolute name. Press create to add the record.
6. Click the Apply Configuration link at the top right of the page again. This will apply the records you have created. Now back in PuTTY, run:
   nslookup blog.debserv-*.test or the equivalent dig command.
   You should get a response similar to:

Server:		127.0.0.1
Address:	127.0.0.1#53

blog.debserv-*.test	canonical name = debserv-*.test.
Name:	debserv-*.test
Address: 172.17.50.XXX

One thing we can use CNAMEs for is to create virtual web hosts in Apache that listens for the domain blog.debserv-*.test, and then forwards you directly to your blog folder instead of to our main web page.
7. In Webmin under the Servers tab, select Apache Webserver. Then on the top, click the Create virtual host button and use the following configuration:

   Handle Connections to Address: any address
   Port: 80
   Document Root: /var/www/html/blog/
   Server Name: blog.debserv-*.test
   Add virtual server to file: new file under virtual servers directory
   Copy directives from: nowhere
   

   When done, press Create Now.

8. When you are back at the Apache Webserver page, then click Apply Changes in the top right.
9. Now in a SSH session, open up your favorite command line web browser like links and visit blog.debserv-*.test. make special note that when you enter the URL in Links you need to include the extra period at the end.
This is because the .test domain is not a regular TLD like .com .org etc. and the Links browser doesn't know how to handle it unless we force it as a domain name by adding the period at the end. This is not related to it being a CNAME or our Apache configuration and with a regular domain name would not be required. Notice how you are now visiting the blog directly, instead of your modified index.html file. This is because we setup a virtual host in Apache that listens for requests to the CNAME we created and points to the document root where the Wordpress software is installed.
• Note that you will not be able to use this URL to access the blog from your local PC yet because your local PC isn't using your Linux server as it's DNS server and the .test domain isn't registered to your DNS server.
10. Congrats, at this point you have a basic domain working with a MX, CNAME, and A record.

Adding a AAAA record

Video Tutorial - Adding an AAAA Record
Now we are going to add an AAAA (IPv6 host) record to our domain. To do this, we will first need to make sure that IPv6 networking is setup in our virtual machine.

1. Use ip address show to check the inet6 address (IPv6 Address) on the primary network interface.
You should have an address starting with 2607:f930:1c00:50:. If you do not please check with your instructor. You will need to write down or remember this full address as we will use it in Webmin to create our AAAA record.
2. Back in Webmin, under the BIND DNS Server tab, select your debserv-*.test domain from the bottom and then click the IPv6 Address button. For the name, enter @ and for the address enter your IPv6 address WITHOUT the subnet prefix (No /64 on the end).
It should look similar to this: 2607:f930:1c00:50:xxxx:xxxx:xxxx:xxxx.
3. When done click create. Remember to click the apply configuration link in the top right to apply the changes.
4. In order to verify the AAAA record is working we need to modify the nslookup or dig command to check for AAAA records instead of the default of A records. Try:
   nslookup -type=AAAA debserv-*.test
   and
   dig debserv-*.test AAAA
   to see the output from AAAA records.
5. Congratulations, you have now setup a dual-stack DNS records for your Debian server. This means your server is accessible from both IPv4 and IPv6 at the same name because both the A and AAAA records we created have the same host name).

Adding a Delegated Domain

Video Tutorial - Adding a Delegated Domain
The problem with the name we have been using so far is that it only works on the DNS server itself. This is because we didn't purchase the name and so no other nameservers know to send requests for it to our server. Normally if you purchase a domain or someone else gives you control of a subdomain it is delegated to your server meaning that other DNS servers will query your server for addresses related to that name. In order to practice this we are going to add another domain to the system, but this domain will be a delegated domain which is a subdomain of itc2480.campus.ihitc.net. Luckily we can add this to BIND the same way we added our original domain.

1. In Webmin, go to Servers, then BIND DNS Server. Under Existing DNS Zones click on Create Master Zone and use the following settings:

   Zone type: Forward (Names to Addresses)
   Domain name / Network: *.itc2480.campus.ihitc.net
   Records file: Automatic
   Master server: *.itc2480.campus.ihitc.net.
   Email address: root@ *.itc2480.campus.ihitc.net

   • NOTE: the * stands for your System ID letter, the same as you used for the previous domain we created.
2. Using webmin, create an A record for @ the same way as we did for the last domain.
If you need help with this step, you can review the process we did earlier. Make sure to apply your changes after adding the record.
3. Test that the record and delegation are working correctly. This time you should be able to check from your host computer too!
Windows does not include the dig command so you'll need to use nslookup on *.itc2480.campus.ihitc.net (replace the * with your System ID). Does the correct address come back?
4. Test your setup using a web browser on your local computer
can you access your webserver by going to http://*.itc2480.campus.ihitc.net (where * is your hostname letter)?
5. Create an MX record for the domain which directs mail for your delegated domain to your system as well just like we did with the test domain (this will involve creating another A record for mail.*.itc2480.campus.ihitc.net as well).
Test that the MX record and associated A record are working correctly. This time you should be able to check from your host computer too! Windows does not include the dig command so you'll need to use nslookup. Does the correct mail server name and address come back?
6. Create a CNAME record for the blog just like in the previous example (blog.*.itc2480.campus.ihitc.net' though) and create a new Apache virtual server just like in the previous example as well.
Test your setup using a web browser on your local computer, can you access your blog directly by going to http://blog.*.itc2480.campus.ihitc.net (where * is your hostname letter)?

Manually editing a zone file

Video Tutorial - Manually Editing a Zone File
Lastly we are going to look at the domain zone file. While Webmin provides a nice interface to add records, all it is doing is manually adding our records to our text based zone file. When you use BIND for DNS, every domain created gets its own record file which is called the zone file. In this file all subdomains and records are stored for said domain.

1. By default, the location for these records on Debian will be in /var/lib/bind, so go to that directory and list the contents.
2. Now, with your favorite text editor, open up the file which corresponds to the debserv-*.test domain.
   It should look similar to this:

   $ttl 38400
   debserv-Z.test. IN      SOA     2480-Z.itc2480.campus.ihitc.net. root.debserv-Z.test. (
                           1519434495
                           10800
                           3600
                           604800
                           38400 )
   debserv-Z.test. IN      NS      2480-Z.itc2480.campus.ihitc.net.
   debserv-Z.test. IN      A       172.17.50.36
   debserv-Z.test. IN      MX      10 mail.debserv-Z.test.
   mail.debserv-Z.test.    IN      A       172.17.50.36
   blog.debserv-Z.test.    IN      CNAME   debserv-z.test.
   debserv-Z.test. IN      AAAA    2607:f930:1c00:50:250:56ff:feb1:8756
   mail.debserv-Z.test.    IN      AAAA    2607:f930:1c00:50:250:56ff:feb1:8756

Notice the formatting for domain records. Each record is defined by the domain or subdomain name, IN, then the record type (like A, AAAA, NS, or MX), followed by what the record is pointed to. For this example, we want to change the MX priority from 10 to 15.
3. Using your text editor change the MX record settings priority from 10 to 15.
4. When you are done, restart the bind9 service to reload the changes.
   sudo systemctl restart bind9
   • Note: when restarting bind, if you have any errors restarting the service this normally means you have a typo in one of your zone files. If this is the case, go through the file again in a text editor to make sure you did not add anything extra or remove anything else.
5. Use the dig tool to check the MX record and see that the new priority is active. You should see something similar to the following response:

   ; <<>> DiG 9.10.3-P4-Debian <<>> debserv-z.test MX
   ;; global options: +cmd
   ;; Got answer:
   ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40128
   ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 3
   
   ;; OPT PSEUDOSECTION:
   ; EDNS: version: 0, flags:; udp: 4096
   ;; QUESTION SECTION:
   ;debserv-z.test.                        IN      MX
   
   ;; ANSWER SECTION:
   debserv-Z.test.         38400   IN      MX      15 mail.debserv-Z.test.
   
   ;; AUTHORITY SECTION:
   debserv-Z.test.         38400   IN      NS      2480-Z.itc2480.campus.ihitc.net.
   
   ;; ADDITIONAL SECTION:
   mail.debserv-Z.test.    38400   IN      A       172.17.50.36
   mail.debserv-Z.test.    38400   IN      AAAA    2607:f930:1c00:50:250:56ff:feb1:8756
   
   ;; Query time: 0 msec
   ;; SERVER: 127.0.0.1#53(127.0.0.1)
   ;; WHEN: Fri Feb 23 20:15:48 CST 2018
   ;; MSG SIZE  rcvd: 163

Notice how the Answer Section shows the MX record is pointed to the IP of the domain, and that the priority is set to 15.
6. Congratulations, you have now setup a functional DNS server.

Checking Your Work

1. Check the directories and files:
1. /etc/bind/named.conf.options should have the ip address 172.17.139.11 saved.
2. /etc/network/interfaces should have the ip address 127.0.0.1 saved.
3. Your /var/lib/bind/*.hosts file should have a MX, CNAME, and AAAA record.



2. Automatically check your results by running this command:
curl https://raw.githubusercontent.com/mnjk-inver/Linux-2480-Rebuild/main/lab_08_test.py | python3

Web App

You can check your progress on any of the labs in the ITC-2480 course from a webapp from this link:
webcheck.itc2480.campus.ihitc.net
You must be logged into the campus VPN to use this application.