Franske ITC-2480 DNS Lab

From ITCwiki
Revision as of 22:57, 23 February 2018 by BenFranske (talk | contribs)
Jump to navigation Jump to search

Introduction

Lab Procedure

Prerequisites

  1. Open an SSH console to your Linux system using the PuTTY software, login with your standard user account.
  2. Make sure that Webmin is installed on your system.

Install BIND & Enable Caching

  1. First you will need to install BIND. BIND (Berkeley Internet Name Domain) is one of the available DNS server applications for Linux and the most well known and used nameserver on the Internet. To install it, use the package manager to install bind9. In order to use the nslookup and dig programs for DNS testing and troubleshooting you will also want to install the dnsutils package.
  2. Now we will need to enable DNS caching and forwarding on the BIND server. This will allow us to use it for DNS resolving locally, as well as speed up frequent DNS requests. To do this, open up /etc/bind/named.conf.options with your favorite text editor.
  3. You are now in the local options file for BIND. You will need to uncomment (remove the // from the front of) the following lines: 
    // forwarders {
//     0.0.0.0;
// };
    • Note that you will also need to replace 0.0.0.0 with 172.17.139.10 for outside DNS lookups to function correctly.
  4. The reason we setup a forwarder address is so that domain requests that are not on our system are passed to another DNS server instead of being searched against the root nameservers. You may want to do this in domain or enterprise environments as most large networks have internal domain names setup that only redirect inside of a local LAN. By using a forwarder, as long as the DNS server you push requests to is able to access those internal records, you will be able to access local content from internal domain names instead of needing to rely on IP addresses.
  5. To apply this change, you will need to restart the BIND server. to do this run service bind9 restart with administrative permissions.
  6. Next, we will need to change the DNS server set in /etc/network/interfaces so our network interface uses our local system for DNS lookups. To do this, open up your interfaces file with your favorite file editor, and change the dns server for the primary network interface to 127.0.0.1.
  7. The change to /etc/network/interfaces will take effect if you restart your system. To avoid doing that right now you can edit the /etc/resolv.conf file so that it has only one nameserver line like nameserver 127.0.0.1 Note that unless you reboot the system it will eventually get reset back to it's prior setting by a background system process so at some point you will want to reboot your system to make the change permanent.
  8. To test if its working, run the command nslookup inverhills.edu. If BIND is working, you should now see the following output: 
    Server:		127.0.0.1
Address:	127.0.0.1#53

Non-authoritative answer:
Name:	inverhills.edu
Address: 134.29.182.42
    • Notice how it shows it is using 127.0.0.1 as the server. If you do not see this, then your interface file or resolv.conf file is not set to use the local machine for DNS lookups. Note also that the IP address returned for this domain may vary from the one shown in the output above.
  9. Experiment using the dig utility to check DNS name resolution which can provide more detailed output than nslookup. Run dig inverhills.edu and see if you can find where the IP address for the domain is reported in the output as well as where the server IP address is reported in the output.

Create a Domain using Webmin

  1. Now we are going to use Webmin to create a few different type of domain records and have our system serve as a DNS server for a domain. We will utilize A (Host), AAAA (IPv6 host), MX (Mail Exchange), and CNAME (Canonical Name) records.
  2. Open up your Webmin panel and sign in. Now that we have BIND installed, you will need to click the Refresh Modules option on the left sidebar to have Webmin recheck the system for installed packages and services so that it will show up as an option in the Servers tab.
  3. Under the Servers tab, open up BIND DNS Server, under Existing DNS Zones click Create master zone. From here we will create a new domain name for our server to respond to DNS queries for.
  4. Use the following options, where * is replaced by your System ID that was defined in Lab 5 (just the letter of your system, for example the domain name would be debserv-A.test if you had System ID "A"). 
    Zone type: Forward (Names to Addresses)
Domain name / Network: debserv-*.test
Records file: Automatic
Master server: Leave as your hostname
Email address: root@debserv-*.test
  5. Click the create button to add the domain. As this point you should now be on the Edit Master Zone page. From here you can add and edit domain records for this domain name.
  6. To create our A record which points your domain to an IP address, click the Address button. For the Name enter @. The @ symbol in DNS Zones defines the parent domain (alternatively you could re-enter the parent domain debserv-*.test. with the period at the end). In the address field enter your VM's static IP set in Lab 5 and click Create. Return to the main BIND DNS Server page. Click the Apply Configuration link in the top right corner.
  7. To test the record use nslookup or dig to lookup the domain you just created, which should be debserv-*.test by entering nslookup debserv-*.test or dig debserv-*.test (don't forget to replace the * with your System ID letter).
    • If you have issues looking up the domain, make sure that the system is still using 127.0.0.1 as the DNS server. If not, check your /etc/resolv.conf file.

Additional DNS Record Types

  1. Now we are going to add a few more record types to our Domain. This will include an MX (Mail Exchange) and CNAME (Canonical Name) record.
  2. We will start with the MX record. MX records are used by email servers to look up where to forward email for a specific domain.
    3. To create a MX record we will use Webmin again. In Webmin on the BIND DNS Server page, click the domain on the bottom named debserv-*.test and then click the Mail Server button. Under name, enter @ again, and for mail server enter mail.debserv-*.test. (with the period at the end). For Priority, enter 10.
    • This entry has said we want other servers trying to send mail to users@debserv-*.test to actually send it to the server at mail.debserv-*.test which allows us to use a different server for email than we use fore web serving, etc.
    • The Priority entry allows people to define more than 1 MX record for a name, and the order which the sending service will try to use for contacting the various mail servers at your domain.
  3. Go back to the domain zone overview page. Because we don't currently have an "A" (address) record for mail.debserv-*.test the mail would currently go undelivered. Add an A record for mail.debserv-*.test which points to the IP of your system.
  4. To test an MX record we need to make multiple queries and ask nslookup or dig to fist check for MX records for the domain like nslookup -type=MX debserv-*.test or dig debserv-*.test MX which will return the names of the mail servers for that domain. We then need to do a regular nslookup or dig on those names to determine what IP addresses those are pointed to. Of course, for mail to actually work we'd also need to insure mail server software is installed and configured on that server as well.
  5. Again return to the domain zone overview page. We are now going to create a CNAME record. CNAME records are useful as they allow you to create virtual A records (aliases), but point them to another domain or host name instead of to a specific IP address. This allows you to have many hostnames all pointed to the same A record which contains the actual IP address so if the IP address changes you only need to change a single A record and all the hostnames will change. It can also be used to redirect a hostname at one domain to an entirely different domain.
  6. On the Edit Master Zone page for your domain, click the Name Alias button. For the Name, enter blog and for the Real Name, enter your domain debserv-*.test. but remember to put a period at the end of the domain as this is an absolute name. Press create to add the record.
  7. Click the Apply Configuration link at the top right of the page again. This will apply the records you have created. Now back in PuTTY, run nslookup blog.debserv-*.test or the equivalent dig command. You should get a response similar to: 
    Server:		127.0.0.1
Address:	127.0.0.1#53

blog.debserv-*.test	canonical name = debserv-*.test.
Name:	debserv-*.test
Address: 172.17.50.XXX
  8. One thing we can use CNAMEs for is to create virtual web hosts in Apache that listens for the domain blog.debserv-*.test, and then forwards you directly to your blog folder instead of to our main web page.
  9. In Webmin under the Servers tab, select Apache Webserver. Then on the top, click the Create virtual host button and use the following configuration: 
    Handle Connections to Address: any address
Port: 80
Document Root: /var/www/html/blog/
Server Name: blog.debserv-*.test
Add virtual server to file: new file under virtual servers directory
Copy directives from: nowhere

    When done, press Create Now.

  10. When you are back at the Apache Webserver page, then click Apply Changes in the top right.
  11. Now in a SSH session, open up your favorite command line web browser like links and visit blog.debserv-*.test. Notice how you are now visiting the blog directly, instead of your modified index.html file. This is because we setup a virtual host in Apache that listens for requests to the CNAME we created and points to the document root where the Wordpress software is installed.
    • Note that you will not be able to use this URL to access the blog from your local PC yet because your local PC isn't using your Linux server as it's DNS server and the .test domain isn't registered to your DNS server.
  12. Congrats, at this point you have a basic domain working with a MX, CNAME, and A record.

Adding a AAAA record

  1. Now we are going to add an AAAA (IPv6 host) record to our domain. To do this, we will first need to make sure that IPv6 networking is setup in our virtual machine.
  2. Use ip address show to check the inet6 address (IPv6 Address) on the primary network interface. You should have an address starting with 2607:f930:1c00:50:. If you do not please check with your instructor. You will need to write down or remember this full address as we will use it in Webmin to create our AAAA record.
  3. Back in Webmin, under the BIND DNS Server tab, select your debserv-*.test domain from the bottom and then click the IPv6 Address button. For the name, enter @ and for the address enter your IPv6 address WITHOUT the subnet prefix (No /64 on the end). It should look similar to this: 2607:f930:1c00:50:xxxx:xxxx:xxxx:xxxx.
  4. When done click create. Remember to click the apply configuration link in the top right to apply the changes. In order to verify the AAAA record is working we need to modify the nslookup or dig command to check for AAAA records instead of the default of A records. Try nslookup -type=AAAA debserv-*.test and dig debserv-*.test AAAA to see the output from AAAA records.
  5. Congratulations, you have now setup a dual-stack DNS records for your Debian server. This means your server is accessible from both IPv4 and IPv6 at the same name because both the A and AAAA records we created have the same host name).

Adding a Delegated Domain

  1. The problem with the name we have been using so far is that it only works on the DNS server itself. This is because we didn't purchase the name and so no other nameservers know to send requests for it to our server. Normally if you purchase a domain or someone else gives you control of a subdomain it is delegated to your server meaning that other DNS servers will query your server for addresses related to that name. In order to practice this we are going to add another domain to the system, but this domain will be a delegated domain which is a subdomain of itc2480.campus.ihitc.net. Luckily we can add this to BIND the same way we added our original domain.
  2. In Webmin, go to Servers, then BIND DNS Server. Under Existing DNS Zones click on Create Master Zone and use the following settings: 
    Zone type: Forward (Names to Addresses)
Domain name / Network: *.itc2480.campus.ihitc.net
Records file: Automatic
Master server: *.itc2480.campus.ihitc.net.
Email address: root@ *.itc2480.campus.ihitc.net
    • NOTE: the * stands for your System ID letter, the same as you used for the previous domain we created.
  3. Using webmin, create an A record for @ the same way as we did for the last domain. If you need help with this step, you can review the process we did earlier. Make sure to apply your changes after adding the record.
  4. Test that the record and delegation are working correctly. This time you should be able to check from your host computer too! Windows does not include the dig command so you'll need to use nslookup on *.itc2480.campus.ihitc.net (replace the * with your System ID). Does the correct address come back?
  5. Test your setup using a web browser on your local computer, can you access your webserver by going to http://*.itc2480.campus.ihitc.net (where * is your hostname letter)?
  6. Create an MX record for the domain which directs mail for your delegated domain to your system as well just like we did with the test domain (this will involve creating another A record for mail.*.itc2480.campus.ihitc.net as well).
  7. Test that the MX record and associated A record are working correctly. This time you should be able to check from your host computer too! Windows does not include the dig command so you'll need to use nslookup. Does the correct mail server name and address come back?
  8. Create a CNAME record for the blog just like in the previous example (blog.*.itc2480.campus.ihitc.net' though) and create a new Apache virtual server just like in the previous example as well.
  9. Test your setup using a web browser on your local computer, can you access your blog directly by going to http://blog.*.itc2480.campus.ihitc.net (where * is your hostname letter)?

Manually editing a zone file

  1. Lastly we are going to look at the domain zone file. While webmin provides a nice interface to add records, all it is doing is manually adding our records to our zone file. When you use BIND for DNS, every domain created gets its own record file which is called the zone file. In this file all subdomains and records are stored for said domain.
  2. By default, the location for these records will be in /var/lib/bind, so cd into that folder and ls the contents.
  3. Now, with your favorite text editor, open up the file. It should look similar to this:
$ttl 38400
debserv-A.test.	IN	SOA	VMHostname. root.debserv-A.test. (
			1395013947
			10800
			3600
			604800
			38400 )
debserv-A.test.	IN	NS	VMHostname.
debserv-A.test.	IN	A	172.17.50.XXX
debserv-A.test.	IN	MX	1 172.17.50.XXX
cname.debserv-A.test.	IN	CNAME	debserv-A.test.
  1. Notice the formatting for domain records. Each record is defined by the domain or subdomain, IN, then the record type, followed by what the record is pointed to.
  2. For this example, we want to change the MX priority from 1 to 10, so change the MX record settings using your text editor.
  3. When you are done, restart the bind9 service to reload the changes. We will now use a new command, dig, to lookup the record to make sure the changes were applied correctly.
  • Note: when restarting bind, if you have any errors restarting the service this normally means you have a typo in one of your zone files. If this is the case, go through the file again in a text editor to make sure you did not add anything extra.
  1. dig is a very powerful DNS tool that allows you to lookup specific records for DNS domains, as well as many other things such as PTR, or reverse records. For our reasons though, we will use it to lookup the edited MX record. To do this, run "dig MX debserv-*.test".
  • Note: If you are having issues, add @127.0.0.1 to the end of the dig command to force dig to use the local DNS server.
  1. You should see the following response:
; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> MX debserv-*.test @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59875
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;debserv-*.test.			IN	MX

;; ANSWER SECTION:
debserv-*.test.		38400	IN	MX	10 172.17.50.XXX.debserv-*.test.

;; AUTHORITY SECTION:
debserv-*.test.		38400	IN	NS	VMHostname.

;; Query time: 4 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sun Mar 16 20:40:02 2014
;; MSG SIZE  rcvd: 78
  1. Notice how the Answer Section shows the MX record is pointed to the IP of the domain, and that the priority is set to 10.
  2. Congrats, you have now setup a functional DNS server.
Retrieved from "https://wiki.ihitc.net/mediawiki/index.php?title=Franske_ITC-2480_DNS_Lab&oldid=7298"