Franske ITC-2480 DNS Lab: Difference between revisions

From ITCwiki
Jump to navigation Jump to search
(9 intermediate revisions by the same user not shown)
Line 4: Line 4:
== Prerequisites ==
== Prerequisites ==
# Open an SSH console to your Linux system using the PuTTY software, login with your standard user account.
# Open an SSH console to your Linux system using the PuTTY software, login with your standard user account.
# Make sure that webmin is installed on your system.  
# Make sure that Webmin is installed on your system.  
== Install BIND & Enable Caching ==
== Install BIND & Enable Caching ==
# First you will need to install bind. Bind is one of the few available DNS server applications for linux. To install it, use your favorite package manager to install bind9.
<ol>
# Now we will need to enable DNS caching and forwarding on the bind server. This will allow us to use it for DNS resolving locally, as well as speed up frequent DNS requests. To do this, open up /etc/bind/named.conf.options with your favorite text editor.
<li>First you will need to install BIND. BIND (Berkeley Internet Name Domain) is one of the available DNS server applications for Linux and the most well known and used nameserver on the Internet. To install it, use the package manager to install '''bind9'''. In order to use the '''nslookup''' and '''dig''' programs for DNS testing and troubleshooting you will also want to install the '''dnsutils''' package.</li>
# You are now in the local options file for bind. You will need to uncomment out the following lines:
<li>Now we will need to enable DNS caching and forwarding on the BIND server. This will allow us to use it for DNS resolving locally, as well as speed up frequent DNS requests. To do this, open up ''/etc/bind/named.conf.options'' with your favorite text editor.</li>
<li>You are now in the local options file for BIND. You will need to uncomment (remove the // from the front of) the following lines:
<pre>// forwarders {
<pre>// forwarders {
//    0.0.0.0;
//    0.0.0.0;
// };</pre>
// };</pre>
* Note that you will need to replace 0.0.0.0 with 172.17.139.10 for outside DNS lookups to function.
* Note that you will also need to replace 0.0.0.0 with 172.17.139.11 for outside DNS lookups to function correctly.</li>
# The reason we setup a forwarder address is so that domain requests that are not on our system are passed to another DNS server instead of being searched against the root nameservers. You may want to do this in domain or enterprise environments as most large networks have internal domain names setup that only redirect inside of a local LAN. By using a forwarder, as long as the DNS server you push requests to is able to access those internal records, you will be able to access local content from internal domain names instead of needing to rely on IP addresses.  
<li>The reason we setup a forwarder address is so that domain requests that are not on our system are passed to another DNS server instead of being searched against the root nameservers. You may want to do this in domain or enterprise environments as most large networks have internal domain names setup that only redirect inside of a local LAN. By using a forwarder, as long as the DNS server you push requests to is able to access those internal records, you will be able to access local content from internal domain names instead of needing to rely on IP addresses.</li>
# To apply this change, you will need to restart the Bind DNS serice. to do this run "sudo service bind9 restart". This will restart the Bind DNS service.
<li>To apply this change, you will need to restart the BIND server. to do this run '''service bind9 restart''' with administrative permissions.</li>
# Next we will need to change our DNS server set in /etc/network/interfaces so our eth0 interfaces uses our local system for DNS lookups. To do this, open up your interfaces file with your favorite file editor, and change the dns server to 127.0.0.1.  
<li>Next, we will need to change the DNS server set in ''/etc/network/interfaces'' so our network interface uses our local system for DNS lookups. To do this, open up your interfaces file with your favorite file editor, and change the dns server for the primary network interface to ''127.0.0.1''.</li>
# The change to /etc/network/interfaces will take effect if you restart your system. To avoid doing that you'll want to edit the /etc/resolv.conf file so that it has only one nameserver line with "nameserver 127.0.0.1" Note that unless you reboot the system it will eventually get reset back to it's prior setting by a background system process so at some point you will want to reboot your system to make the change permanent.
<li>The change to ''/etc/network/interfaces'' will take effect if you restart your system. To avoid doing that right now you can edit the ''/etc/resolv.conf'' file so that it has only one nameserver line like ''nameserver 127.0.0.1'' Note that unless you reboot the system it will eventually get reset back to it's prior setting by a background system process so at some point you will want to reboot your system to make the change permanent.</li>
# To test if its working, run the command "nslookup inverhills.edu". If bind is working, you should now see the following output:
<li>To test if its working, run the command '''nslookup inverhills.edu'''. If BIND is working, you should now see the following output:
<pre>Server: 127.0.0.1
<pre>Server: 127.0.0.1
Address: 127.0.0.1#53
Address: 127.0.0.1#53
Line 23: Line 24:
Non-authoritative answer:
Non-authoritative answer:
Name: inverhills.edu
Name: inverhills.edu
Address: 134.29.183.71
Address: 134.29.182.42
</pre>
</pre>
* Notice how it shows it is using 127.0.0.1 as the server. If you do not see this, then your interface file or resolv.conf file is not set to use the local machine for DNS lookups.
* Notice how it shows it is using 127.0.0.1 as the server. If you do not see this, then your interface file or resolv.conf file is not set to use the local machine for DNS lookups. Note also that the IP address returned for this domain may vary from the one shown in the output above.</li>
<li>Experiment using the '''dig''' utility to check DNS name resolution which can provide more detailed output than '''nslookup'''. Run '''dig inverhills.edu''' and see if you can find where the IP address for the domain is reported in the output as well as where the server IP address is reported in the output.</li>
<li>Now would be a good time to reboot your server to ensure the DNS server network interface configuration changes remain permanent. Use the appropriate '''shutdown''' command to reboot the system. If you've forgotten how to reboot you could check the ''man'' page for the '''shutdown''' command.</li>
<li>Once the system reboots log back in and use '''nslookup''' or '''dig''' to verify the default nameserver being used is ''127.0.0.1''.</li>
</ol>


== Create a Domain using Webmin ==
== Create a Domain using Webmin ==
# Now we are going to use webmin to create a few different type of domain records. We will go over A (Host), AAAA (IPv6 host), MX (Mail Exchange), and CNAME (Canonical Name).
<ol>
# Open up your Webmin panel and sign in. Now that we have bind9 installed, you will need to click the Refresh Modules option on the left sidebar to have Webmin recheck the system for installed packages and services.
<li>Now we are going to use Webmin to create a few different type of domain records and have our system serve as a DNS server for a domain. We will utilize A (Host), AAAA (IPv6 host), MX (Mail Exchange), and CNAME (Canonical Name) records.</li>
# Now under the Servers tab, open up BIND DNS Server. Now under Existing DNS Zones, click Create master zone. From here we will create a new domain name for our server to host.
<li>Open up your Webmin panel and sign in. Now that we have BIND installed, you will need to click the Refresh Modules option on the left sidebar to have Webmin recheck the system for installed packages and services so that it will show up as an option in the ''Servers'' tab.</li>
# Now use the following options, '''where * is replaced by your System ID''' that was defined in [[Franske ITC-2480 Lab 5|Lab 5]] (just the letter of your system).
<li>Under the ''Servers'' tab, open up ''BIND DNS Server'', under ''Existing DNS Zones'' click ''Create master zone''. From here we will create a new domain name for our server to respond to DNS queries for.</li>
<li>Use the following options, '''where * is replaced by your System ID''' that was defined in [[Franske ITC-2480 Lab 5|Lab 5]] (just the letter of your system, for example the domain name would be ''debserv-A.test'' if you had System ID "A").
<pre>Zone type: Forward (Names to Addresses)
<pre>Zone type: Forward (Names to Addresses)
Domain name / Network: debserv-*.test
Domain name / Network: debserv-*.test
Records file: Automatic
Records file: Automatic
Master server: Leave as your hostname
Master server: Leave as your hostname
Email address: root@debserv-*.test</pre>
Email address: root@debserv-*.test</pre></li>
# Now click the create button to add our domain. As this point you should now be on the Edit Master Zone page. From here you can add and edit domain record settings.
<li>Click the ''create'' button to add the domain. As this point you should now be on the ''Edit Master Zone'' page. From here you can add and edit domain records for this domain name.</li>
# To create our A record which will point your domain to a IP address, click the Address button. For the Name enter @. the @ symbol in DNS Zones defines the parent domain. Now under address, enter your VM's static IP we set back in [[Franske ITC-2480 Lab 5|Lab 5]] and click Create. Now return back to the main BIND DNS Server page again. When there, click the Apply Configuration option in the top right corner.
<li>To create our ''A record'' which points your domain to an IP address, click the ''Address'' button. For the ''Name'' enter ''@''. The ''@'' symbol in DNS Zones defines the parent domain (alternatively you could re-enter the parent domain ''debserv-*.test.'' with the period at the end). In the ''address'' field enter your VM's static IP set in [[Franske ITC-2480 Lab 5|Lab 5]] and click ''Create''. Return to the main BIND DNS Server page. Click the ''Apply Configuration'' link (which looks like two arrows chasing each other) in the top right corner. You'll see the "Apply Configuration" text if you hover your mouse over the button.</li>
# Now we will test the A record we just created. .use nslookup to lookup the domain you just created, which should be debserv-*.test by entering "nslookup debserv-*.test"
<li> To test the record use '''nslookup''' or '''dig''' to lookup the domain you just created, which should be ''debserv-*.test'' by entering '''nslookup debserv-*.test''' or '''dig debserv-*.test''' (don't forget to replace the * with your System ID letter).
* '''Remember, * is used to represent the hostname letter assigned to your IP per the table in lab 5.''' Also, if you have issues looking up the domain, make sure that nslookup is still set to use 127.0.0.1 as the Server. If not, check your /etc/resolv.conf file.
* If you have issues looking up the domain, make sure that the system is still using 127.0.0.1 as the DNS server. If not, check your ''/etc/resolv.conf'' file.</li>
</ol>


== Adding additional record types ==
== Additional DNS Record Types ==
# Now we are going to add a few more record types to our Domain. This will include a MX (Mail Exchange) and CNAME (Canonical Name) record.  
<ol>
# We will start with the MX record. MX records are used by email servers to look up where to forward email for a specific domain.
<li>Now we are going to add a few more record types to our Domain. This will include an ''MX'' (Mail Exchange) and ''CNAME'' (Canonical Name) record.</li>
# So to create a MX record we will use Webmin again. In Webmin on the BIND DNS Server page, click the domain on the bottom named debserv-*.test and then click the Mail Server button. Under name, enter @ again, and for mail server enter mail.debserv-*.test. (with the final period). Now for Priority, enter 10. The Priority entry allows people to define more than 1 MX record for a domain, and the Priority defines which one should be used before the rest.
<li>We will start with the MX record. MX records are used by email servers to look up where to forward email for a specific domain.</li>
# Now go back to the domain zone overview page. Add an A record for mail.debserv-*.test which uses the IP of your system.
</li>To create a MX record we will use Webmin again. In Webmin on the ''BIND DNS Server'' page, click the domain on the bottom named ''debserv-*.test'' and then click the ''Mail Server'' button. Under ''name'', enter ''@'' again, and for ''mail server'' enter ''mail.debserv-*.test.'' (with the period at the end). For ''Priority'', enter ''10''.
# Now go back to the domain zone overview page. We are now going to create a CNAME record. CNAME records are useful as they allow you to create virtual A records, but point them to a domain name instead of a host. This is most helpful in situations where you have a dynamic IP address on a system that always has a common DNS name.
* This entry has said we want other servers trying to send mail to ''users@debserv-*.test'' to actually send it to the server at ''mail.debserv-*.test'' which allows us to use a different server for email than we use fore web serving, etc.
# Now on the Edit Master Zone page for your domain, click the Name Alias button. For the Name, enter "blog" and for the Real Name, enter your domain "debserv-*.test." but remember to put a period at the end of the domain as this is an absolute name. Then press create to add the record.
* The Priority entry allows people to define more than one MX record for a name, and the order which the sending service will try to use for contacting the various mail servers at your domain.</li>
# Now press the Apply Configuration option in the top right of the page again. This will apply the records you have created. Now back in putty, run "nslookup blog.debserv-*.test". You should get a response similar to:
<li>Go back to the domain zone overview page. Because we don't currently have an "A" (address) record for ''mail.debserv-*.test'' the mail would currently go undelivered. Add an ''A'' record for ''mail.debserv-*.test'' which points to the IP of your system.</li>
<li> To test an ''MX'' record we need to make multiple queries and ask '''nslookup''' or '''dig''' to fist check for MX records for the domain like '''nslookup -type=MX debserv-*.test''' or '''dig debserv-*.test MX''' which will return the names of the mail servers for that domain. We then need to do a regular '''nslookup''' or '''dig''' on those names to determine what IP addresses those are pointed to. Of course, for mail to actually work we'd also need to insure mail server software is installed and configured on that server as well.</li>
<li>Again return to the domain zone overview page. We are now going to create a CNAME record. CNAME records are useful as they allow you to create virtual A records (aliases), but point them to another domain or host name instead of to a specific IP address. This allows you to have many hostnames all pointed to the same A record which contains the actual IP address so if the IP address changes you only need to change a single A record and all the hostnames will change. It can also be used to redirect a hostname at one domain to an entirely different domain.</li>
<li>On the ''Edit Master Zone'' page for your domain, click the ''Name Alias'' button. For the ''Name'', enter ''blog'' and for the ''Real Name'', enter your domain ''debserv-*.test.'' but remember to put a period at the end of the domain as this is an ''absolute name''. Press ''create'' to add the record.</li>
<li>Click the ''Apply Configuration'' link at the top right of the page again. This will apply the records you have created. Now back in PuTTY, run '''nslookup blog.debserv-*.test''' or the equivalent '''dig''' command. You should get a response similar to:
<pre>Server: 127.0.0.1
<pre>Server: 127.0.0.1
Address: 127.0.0.1#53
Address: 127.0.0.1#53
Line 56: Line 67:
Name: debserv-*.test
Name: debserv-*.test
Address: 172.17.50.XXX
Address: 172.17.50.XXX
</pre>
</pre></li>
# Now we are going to create a virtual web host in apache that listens for the domain blog.debserv-*.test, and then forwards you directly to your blog folder.  
<li>One thing we can use CNAMEs for is to create virtual web hosts in Apache that listens for the domain blog.debserv-*.test, and then forwards you directly to your blog folder instead of to our main web page. </li>
# In Webmin under the servers tab, select Apache Webserver. Then on the top, click the Create virtual host button and use the following Configuration:
<li>In Webmin under the ''Servers'' tab, select ''Apache Webserver''. Then on the top, click the ''Create virtual host'' button and use the following configuration:
<pre>Handle Connections to Address: any address
<pre>Handle Connections to Address: any address
Port: 80
Port: 80
Line 66: Line 77:
Copy directives from: nowhere
Copy directives from: nowhere
</pre>
</pre>
# When done, press Create Now. When you are back at the Apache Webserver page, then click Apply Changes in the top right.
When done, press ''Create Now''.
# Now in a SSH session, open up your favorite command line web browser like w3m and visit blog.debserv-*.test. Notice how you are now visiting the blog directly, instead of your modified index.html file. This is because we setup a virtual host in apache that listens for requests directly from the CNAME we created.  
<li> When you are back at the ''Apache Webserver'' page, then click ''Apply Changes'' in the top right.</li>
# Congrats, at this point you have a basic domain working with a MX, CNAME, and A record.
<li>Now in a SSH session, open up your favorite command line web browser like '''links''' and visit ''blog.debserv-*.test.'' make special note that when you enter the URL in Links you need to include the extra period at the end. This is because the .test domain is not a regular TLD like .com .org etc. and the Links browser doesn't know how to handle it unless we force it as a domain name by adding the period at the end. This is not related to it being a CNAME or our Apache configuration and with a regular domain name would not be required. Notice how you are now visiting the blog directly, instead of your modified index.html file. This is because we setup a virtual host in Apache that listens for requests to the CNAME we created and points to the document root where the Wordpress software is installed.
* Note that you will not be able to use this URL to access the blog from your local PC yet because your local PC isn't using your Linux server as it's DNS server and the .test domain isn't registered to your DNS server.</li>
<li>Congrats, at this point you have a basic domain working with a MX, CNAME, and A record.</li>
</ol>


== Adding a AAAA record ==
== Adding a AAAA record ==
# Now we are going to add an AAAA (IPv6 host) record to our domain. To do this, we will first need to make sure that IPv6 networking is setup in our virtual machine.
<ol>
# In putty, using your favorite text editor, open up /etc/network/interfaces. We are going to enable IPv6 autoconfiguration to make sure that IPv6 is running on our VM. Add "iface eth0 inet6 auto" to the end if the eth0 configuration to do this if it's not already there. Your interface should now look similar to this:
<li> Now we are going to add an ''AAAA'' (IPv6 host) record to our domain. To do this, we will first need to make sure that IPv6 networking is setup in our virtual machine.</li>
<pre>auto eth0
<li> Use '''ip address show''' to check the ''inet6'' address (IPv6 Address) on the primary network interface. You should have an address starting with ''2607:f930:1c00:50:''. If you do not please check with your instructor. You will need to write down or remember this full address as we will use it in Webmin to create our AAAA record.</li>
iface eth0 inet static
<li> Back in Webmin, under the ''BIND DNS Server'' tab, select your ''debserv-*.test'' domain from the bottom and then click the ''IPv6 Address'' button. For the name, enter ''@'' and for the ''address'' enter your IPv6 address WITHOUT the subnet prefix (No /64 on the end). It should look similar to this: ''2607:f930:1c00:50:xxxx:xxxx:xxxx:xxxx''.</li>
address 172.17.50.xxx
<li>When done click ''create''. Remember to click the ''apply configuration'' link in the top right to apply the changes. In order to verify the AAAA record is working we need to modify the '''nslookup''' or '''dig''' command to check for AAAA records instead of the default of A records. Try '''nslookup -type=AAAA debserv-*.test''' and '''dig debserv-*.test AAAA''' to see the output from AAAA records.
netmask 255.255.255.0
<li>Congratulations, you have now setup a dual-stack DNS records for your Debian server. This means your server is accessible from both IPv4 and IPv6 at the same name because both the A and AAAA records we created have the same host name).</li>
gateway 172.17.50.1
</ol>
dns-nameservers 127.0.0.1
iface eth0 inet6 auto</pre>
# Afterwords, restart the eth0 interface by using "ifdown eth0 && ifup eth0". Remember that you need to run both of these commands (hint there are two commands on this line) as root otherwise it will not work.
# Now use ifconfig to find your IPv6 address. Remember this as we will use it in webmin to create our AAAA record.
# Back in webmin, under servers and BIND DNS Server, select your debserv-*.test domain from the bottom and then click the IPv6 Address button. For the name, enter @ and for the address enter your IPv6 address WITHOUT the subnet prefix. It should look similar to this. 2607:f930:1c00:50:xxxx:xxxx:xxxx:xxxx
# When done press create. Remember to press the apply configuration button in the top right to make these changes applied. Now use nslookup to lookup your domain, and notice how you now have a IPv6 and IPv4 record for your domain.
# Congratulations, you have now setup a dual-stack DNS server for your debian server.


== Adding a Delegated Domain ==
== Adding a Delegated Domain ==
# Now we are going to add another domain to the system, but this domain is a delegated domain. Luckily we can add this to BIND the same way we added our first domain.
<ol>
# So in Webmin, go to Servers, then BIND DNS Server. Then under Existing DNS Zones, Click on Create Master Zone and use the following settings:
<li>The problem with the name we have been using so far is that it only works on the DNS server itself. This is because we didn't purchase the name and so no other nameservers know to send requests for it to our server. Normally if you purchase a domain or someone else gives you control of a subdomain it is ''delegated'' to your server meaning that other DNS servers will query your server for addresses related to that name. In order to practice this we are going to add another domain to the system, but this domain will be a delegated domain which is a subdomain of ''itc2480.campus.ihitc.net''. Luckily we can add this to BIND the same way we added our original domain.</li>
<li>In Webmin, go to ''Servers'', then ''BIND DNS Server''. Under ''Existing DNS Zones'' click on ''Create Master Zone'' and use the following settings:
<pre>Zone type: Forward (Names to Addresses)
<pre>Zone type: Forward (Names to Addresses)
Domain name / Network: *.itc2480.campus.ihitc.net
Domain name / Network: *.itc2480.campus.ihitc.net
Line 94: Line 102:
Master server: *.itc2480.campus.ihitc.net.
Master server: *.itc2480.campus.ihitc.net.
Email address: root@ *.itc2480.campus.ihitc.net</pre>
Email address: root@ *.itc2480.campus.ihitc.net</pre>
* '''NOTE: the * stands for your hostname letter, the same as you used for the other domain we created.'''
* '''NOTE: the * stands for your System ID letter, the same as you used for the previous domain we created.'''</li>
# Now using webmin, create an A record for @ the same way as we did for the last domain. If you need help with this step, you can review the process we did earlier. Make sure to apply your changes after adding the record.
<li> Using webmin, create an ''A'' record for ''@'' the same way as we did for the last domain. If you need help with this step, you can review the process we did earlier. Make sure to apply your changes after adding the record.</li>
#* Test that the record and delegation are working correctly. From your host computer try doing an nslookup on *.itc2480.campus.ihitc.net does the correct address come back?
<li>Test that the record and delegation are working correctly. This time you should be able to check from your host computer too! Windows does not include the '''dig''' command so you'll need to use '''nslookup''' on ''*.itc2480.campus.ihitc.net'' (replace the * with your System ID). Does the correct address come back?</li>
# Create an MX record for the domain which directs mail for your delegated domain to your system as well.
<li> Test your setup using a web browser on your local computer, can you access your webserver by going to http://*.itc2480.campus.ihitc.net (where * is your hostname letter)?</li>
# Test your setup using a web browser on your local computer, can you access your webserver by going to http://*.itc2480.campus.ihitc.net (where * is your hostname letter)?
<li>Create an ''MX'' record for the domain which directs mail for your delegated domain to your system as well just like we did with the test domain (this will involve creating another A record for ''mail.*.itc2480.campus.ihitc.net'' as well).</li>
# Create a CNAME record for the blog just like in the previous example and create a new Apache virtual server just like in the previous example as well
<li>Test that the MX record and associated A record are working correctly. This time you should be able to check from your host computer too! Windows does not include the '''dig''' command so you'll need to use '''nslookup'''. Does the correct mail server name and address come back?</li>
# Test your setup using a web browser on your local computer, can you access your blog directly by going to http://blog.*.itc2480.campus.ihitc.net (where * is your hostname letter)?
<li>Create a ''CNAME'' record for the blog just like in the previous example (''blog.*.itc2480.campus.ihitc.net''' though) and create a new Apache virtual server just like in the previous example as well.</li>
<li>Test your setup using a web browser on your local computer, can you access your blog directly by going to http://blog.*.itc2480.campus.ihitc.net (where * is your hostname letter)?</li>
</ol>


== Manually editing a zone file ==
== Manually editing a zone file ==
# Lastly we are going to look at the domain zone file. While webmin provides a nice interface to add records, all it is doing is manually adding our records to our zone file. When you use BIND for DNS, every domain created gets its own record file which is called the zone file. In this file all subdomains and records are stored for said domain.
<ol>
# By default, the location for these records will be in /var/lib/bind, so cd into that folder and ls the contents.
<li>Lastly we are going to look at the domain zone file. While Webmin provides a nice interface to add records, all it is doing is manually adding our records to our text based zone file. When you use BIND for DNS, every domain created gets its own record file which is called the zone file. In this file all subdomains and records are stored for said domain.</li>
# Now, with your favorite text editor, open up the file. It should look similar to this:
<li>By default, the location for these records on Debian will be in ''/var/lib/bind'', so go to that directory and list the contents.</li>
<li>Now, with your favorite text editor, open up the file which corresponds to the ''debserv-*.test'' domain. It should look similar to this:
<pre>$ttl 38400
<pre>$ttl 38400
debserv-A.test. IN SOA VMHostname. root.debserv-A.test. (
debserv-Z.test. IN     SOA     2480-Z.itc2480.campus.ihitc.net. root.debserv-Z.test. (
1395013947
                        1519434495
10800
                        10800
3600
                        3600
604800
                        604800
38400 )
                        38400 )
debserv-A.test. IN NS VMHostname.
debserv-Z.test. IN     NS     2480-Z.itc2480.campus.ihitc.net.
debserv-A.test. IN A 172.17.50.XXX
debserv-Z.test. IN     A       172.17.50.36
debserv-A.test. IN MX 1 172.17.50.XXX
debserv-Z.test. IN     MX     10 mail.debserv-Z.test.
cname.debserv-A.test. IN CNAME debserv-A.test.</pre>
mail.debserv-Z.test.    IN      A      172.17.50.36
# Notice the formatting for domain records. Each record is defined by the domain or subdomain, IN, then the record type, followed by what the record is pointed to.
blog.debserv-Z.test.   IN     CNAME   debserv-z.test.
# For this example, we want to change the MX priority from 1 to 10, so change the MX record settings using your text editor.
debserv-Z.test. IN      AAAA    2607:f930:1c00:50:250:56ff:feb1:8756
# When you are done, restart the bind9 service to reload the changes. We will now use a new command, dig, to lookup the record to make sure the changes were applied correctly.
mail.debserv-Z.test.   IN      AAAA    2607:f930:1c00:50:250:56ff:feb1:8756</pre></li>
* Note: when restarting bind, if you have any errors restarting the service this normally means you have a typo in one of your zone files. If this is the case, go through the file again in a text editor to make sure you did not add anything extra.
<li>Notice the formatting for domain records. Each record is defined by the domain or subdomain name, ''IN'', then the record type (like A, AAAA, NS, or MX), followed by what the record is pointed to.</li>
# dig is a very powerful DNS tool that allows you to lookup specific records for DNS domains, as well as many other things such as PTR, or reverse records. For our reasons though, we will use it to lookup the edited MX record. To do this, run "dig MX debserv-*.test".
<li>For this example, we want to change the MX priority from 10 to 15, so change the MX record settings using your text editor.</li>
* Note: If you are having issues, add @127.0.0.1 to the end of the dig command to force dig to use the local DNS server.
<li>When you are done, restart the bind9 service to reload the changes.
# You should see the following response:
* Note: when restarting bind, if you have any errors restarting the service this normally means you have a typo in one of your zone files. If this is the case, go through the file again in a text editor to make sure you did not add anything extra or remove anything else.</li>
<pre>; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> MX debserv-*.test @127.0.0.1
<li>Use the '''dig''' tool to check the MX record and see that the new priority is active. You should see something similar to the following response:
<pre>; <<>> DiG 9.10.3-P4-Debian <<>> debserv-z.test MX
;; global options: +cmd
;; global options: +cmd
;; Got answer:
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59875
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40128
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 3


;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;; QUESTION SECTION:
;debserv-*.test. IN MX
;debserv-z.test.                       IN     MX


;; ANSWER SECTION:
;; ANSWER SECTION:
debserv-*.test. 38400 IN MX 10 172.17.50.XXX.debserv-*.test.
debserv-Z.test.         38400   IN     MX     15 mail.debserv-Z.test.


;; AUTHORITY SECTION:
;; AUTHORITY SECTION:
debserv-*.test. 38400 IN NS VMHostname.
debserv-Z.test.         38400   IN     NS     2480-Z.itc2480.campus.ihitc.net.
 
;; ADDITIONAL SECTION:
mail.debserv-Z.test.    38400  IN      A      172.17.50.36
mail.debserv-Z.test.    38400  IN      AAAA    2607:f930:1c00:50:250:56ff:feb1:8756


;; Query time: 4 msec
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sun Mar 16 20:40:02 2014
;; WHEN: Fri Feb 23 20:15:48 CST 2018
;; MSG SIZE  rcvd: 78</pre>
;; MSG SIZE  rcvd: 163</pre></li>
# Notice how the Answer Section shows the MX record is pointed to the IP of the domain, and that the priority is set to 10.
<li>Notice how the Answer Section shows the MX record is pointed to the IP of the domain, and that the priority is set to 15.</li>
# Congrats, you have now setup a functional DNS server.
<li>Congratulations, you have now setup a functional DNS server.</li>

Revision as of 14:04, 25 March 2020

Introduction

Lab Procedure

Prerequisites

  1. Open an SSH console to your Linux system using the PuTTY software, login with your standard user account.
  2. Make sure that Webmin is installed on your system.

Install BIND & Enable Caching

  1. First you will need to install BIND. BIND (Berkeley Internet Name Domain) is one of the available DNS server applications for Linux and the most well known and used nameserver on the Internet. To install it, use the package manager to install bind9. In order to use the nslookup and dig programs for DNS testing and troubleshooting you will also want to install the dnsutils package.
  2. Now we will need to enable DNS caching and forwarding on the BIND server. This will allow us to use it for DNS resolving locally, as well as speed up frequent DNS requests. To do this, open up /etc/bind/named.conf.options with your favorite text editor.
  3. You are now in the local options file for BIND. You will need to uncomment (remove the // from the front of) the following lines:
    // forwarders {
    //     0.0.0.0;
    // };
    • Note that you will also need to replace 0.0.0.0 with 172.17.139.11 for outside DNS lookups to function correctly.
  4. The reason we setup a forwarder address is so that domain requests that are not on our system are passed to another DNS server instead of being searched against the root nameservers. You may want to do this in domain or enterprise environments as most large networks have internal domain names setup that only redirect inside of a local LAN. By using a forwarder, as long as the DNS server you push requests to is able to access those internal records, you will be able to access local content from internal domain names instead of needing to rely on IP addresses.
  5. To apply this change, you will need to restart the BIND server. to do this run service bind9 restart with administrative permissions.
  6. Next, we will need to change the DNS server set in /etc/network/interfaces so our network interface uses our local system for DNS lookups. To do this, open up your interfaces file with your favorite file editor, and change the dns server for the primary network interface to 127.0.0.1.
  7. The change to /etc/network/interfaces will take effect if you restart your system. To avoid doing that right now you can edit the /etc/resolv.conf file so that it has only one nameserver line like nameserver 127.0.0.1 Note that unless you reboot the system it will eventually get reset back to it's prior setting by a background system process so at some point you will want to reboot your system to make the change permanent.
  8. To test if its working, run the command nslookup inverhills.edu. If BIND is working, you should now see the following output:
    Server:		127.0.0.1
    Address:	127.0.0.1#53
    
    Non-authoritative answer:
    Name:	inverhills.edu
    Address: 134.29.182.42
    
    • Notice how it shows it is using 127.0.0.1 as the server. If you do not see this, then your interface file or resolv.conf file is not set to use the local machine for DNS lookups. Note also that the IP address returned for this domain may vary from the one shown in the output above.
  9. Experiment using the dig utility to check DNS name resolution which can provide more detailed output than nslookup. Run dig inverhills.edu and see if you can find where the IP address for the domain is reported in the output as well as where the server IP address is reported in the output.
  10. Now would be a good time to reboot your server to ensure the DNS server network interface configuration changes remain permanent. Use the appropriate shutdown command to reboot the system. If you've forgotten how to reboot you could check the man page for the shutdown command.
  11. Once the system reboots log back in and use nslookup or dig to verify the default nameserver being used is 127.0.0.1.

Create a Domain using Webmin

  1. Now we are going to use Webmin to create a few different type of domain records and have our system serve as a DNS server for a domain. We will utilize A (Host), AAAA (IPv6 host), MX (Mail Exchange), and CNAME (Canonical Name) records.
  2. Open up your Webmin panel and sign in. Now that we have BIND installed, you will need to click the Refresh Modules option on the left sidebar to have Webmin recheck the system for installed packages and services so that it will show up as an option in the Servers tab.
  3. Under the Servers tab, open up BIND DNS Server, under Existing DNS Zones click Create master zone. From here we will create a new domain name for our server to respond to DNS queries for.
  4. Use the following options, where * is replaced by your System ID that was defined in Lab 5 (just the letter of your system, for example the domain name would be debserv-A.test if you had System ID "A").
    Zone type: Forward (Names to Addresses)
    Domain name / Network: debserv-*.test
    Records file: Automatic
    Master server: Leave as your hostname
    Email address: root@debserv-*.test
  5. Click the create button to add the domain. As this point you should now be on the Edit Master Zone page. From here you can add and edit domain records for this domain name.
  6. To create our A record which points your domain to an IP address, click the Address button. For the Name enter @. The @ symbol in DNS Zones defines the parent domain (alternatively you could re-enter the parent domain debserv-*.test. with the period at the end). In the address field enter your VM's static IP set in Lab 5 and click Create. Return to the main BIND DNS Server page. Click the Apply Configuration link (which looks like two arrows chasing each other) in the top right corner. You'll see the "Apply Configuration" text if you hover your mouse over the button.
  7. To test the record use nslookup or dig to lookup the domain you just created, which should be debserv-*.test by entering nslookup debserv-*.test or dig debserv-*.test (don't forget to replace the * with your System ID letter).
    • If you have issues looking up the domain, make sure that the system is still using 127.0.0.1 as the DNS server. If not, check your /etc/resolv.conf file.

Additional DNS Record Types

  1. Now we are going to add a few more record types to our Domain. This will include an MX (Mail Exchange) and CNAME (Canonical Name) record.
  2. We will start with the MX record. MX records are used by email servers to look up where to forward email for a specific domain.
  3. To create a MX record we will use Webmin again. In Webmin on the BIND DNS Server page, click the domain on the bottom named debserv-*.test and then click the Mail Server button. Under name, enter @ again, and for mail server enter mail.debserv-*.test. (with the period at the end). For Priority, enter 10.
    • This entry has said we want other servers trying to send mail to users@debserv-*.test to actually send it to the server at mail.debserv-*.test which allows us to use a different server for email than we use fore web serving, etc.
    • The Priority entry allows people to define more than one MX record for a name, and the order which the sending service will try to use for contacting the various mail servers at your domain.
  4. Go back to the domain zone overview page. Because we don't currently have an "A" (address) record for mail.debserv-*.test the mail would currently go undelivered. Add an A record for mail.debserv-*.test which points to the IP of your system.
  5. To test an MX record we need to make multiple queries and ask nslookup or dig to fist check for MX records for the domain like nslookup -type=MX debserv-*.test or dig debserv-*.test MX which will return the names of the mail servers for that domain. We then need to do a regular nslookup or dig on those names to determine what IP addresses those are pointed to. Of course, for mail to actually work we'd also need to insure mail server software is installed and configured on that server as well.
  6. Again return to the domain zone overview page. We are now going to create a CNAME record. CNAME records are useful as they allow you to create virtual A records (aliases), but point them to another domain or host name instead of to a specific IP address. This allows you to have many hostnames all pointed to the same A record which contains the actual IP address so if the IP address changes you only need to change a single A record and all the hostnames will change. It can also be used to redirect a hostname at one domain to an entirely different domain.
  7. On the Edit Master Zone page for your domain, click the Name Alias button. For the Name, enter blog and for the Real Name, enter your domain debserv-*.test. but remember to put a period at the end of the domain as this is an absolute name. Press create to add the record.
  8. Click the Apply Configuration link at the top right of the page again. This will apply the records you have created. Now back in PuTTY, run nslookup blog.debserv-*.test or the equivalent dig command. You should get a response similar to:
    Server:		127.0.0.1
    Address:	127.0.0.1#53
    
    blog.debserv-*.test	canonical name = debserv-*.test.
    Name:	debserv-*.test
    Address: 172.17.50.XXX
    
  9. One thing we can use CNAMEs for is to create virtual web hosts in Apache that listens for the domain blog.debserv-*.test, and then forwards you directly to your blog folder instead of to our main web page.
  10. In Webmin under the Servers tab, select Apache Webserver. Then on the top, click the Create virtual host button and use the following configuration:
    Handle Connections to Address: any address
    Port: 80
    Document Root: /var/www/html/blog/
    Server Name: blog.debserv-*.test
    Add virtual server to file: new file under virtual servers directory
    Copy directives from: nowhere
    

    When done, press Create Now.

  11. When you are back at the Apache Webserver page, then click Apply Changes in the top right.
  12. Now in a SSH session, open up your favorite command line web browser like links and visit blog.debserv-*.test. make special note that when you enter the URL in Links you need to include the extra period at the end. This is because the .test domain is not a regular TLD like .com .org etc. and the Links browser doesn't know how to handle it unless we force it as a domain name by adding the period at the end. This is not related to it being a CNAME or our Apache configuration and with a regular domain name would not be required. Notice how you are now visiting the blog directly, instead of your modified index.html file. This is because we setup a virtual host in Apache that listens for requests to the CNAME we created and points to the document root where the Wordpress software is installed.
    • Note that you will not be able to use this URL to access the blog from your local PC yet because your local PC isn't using your Linux server as it's DNS server and the .test domain isn't registered to your DNS server.
  13. Congrats, at this point you have a basic domain working with a MX, CNAME, and A record.

Adding a AAAA record

  1. Now we are going to add an AAAA (IPv6 host) record to our domain. To do this, we will first need to make sure that IPv6 networking is setup in our virtual machine.
  2. Use ip address show to check the inet6 address (IPv6 Address) on the primary network interface. You should have an address starting with 2607:f930:1c00:50:. If you do not please check with your instructor. You will need to write down or remember this full address as we will use it in Webmin to create our AAAA record.
  3. Back in Webmin, under the BIND DNS Server tab, select your debserv-*.test domain from the bottom and then click the IPv6 Address button. For the name, enter @ and for the address enter your IPv6 address WITHOUT the subnet prefix (No /64 on the end). It should look similar to this: 2607:f930:1c00:50:xxxx:xxxx:xxxx:xxxx.
  4. When done click create. Remember to click the apply configuration link in the top right to apply the changes. In order to verify the AAAA record is working we need to modify the nslookup or dig command to check for AAAA records instead of the default of A records. Try nslookup -type=AAAA debserv-*.test and dig debserv-*.test AAAA to see the output from AAAA records.
  5. Congratulations, you have now setup a dual-stack DNS records for your Debian server. This means your server is accessible from both IPv4 and IPv6 at the same name because both the A and AAAA records we created have the same host name).

Adding a Delegated Domain

  1. The problem with the name we have been using so far is that it only works on the DNS server itself. This is because we didn't purchase the name and so no other nameservers know to send requests for it to our server. Normally if you purchase a domain or someone else gives you control of a subdomain it is delegated to your server meaning that other DNS servers will query your server for addresses related to that name. In order to practice this we are going to add another domain to the system, but this domain will be a delegated domain which is a subdomain of itc2480.campus.ihitc.net. Luckily we can add this to BIND the same way we added our original domain.
  2. In Webmin, go to Servers, then BIND DNS Server. Under Existing DNS Zones click on Create Master Zone and use the following settings:
    Zone type: Forward (Names to Addresses)
    Domain name / Network: *.itc2480.campus.ihitc.net
    Records file: Automatic
    Master server: *.itc2480.campus.ihitc.net.
    Email address: root@ *.itc2480.campus.ihitc.net
    • NOTE: the * stands for your System ID letter, the same as you used for the previous domain we created.
  3. Using webmin, create an A record for @ the same way as we did for the last domain. If you need help with this step, you can review the process we did earlier. Make sure to apply your changes after adding the record.
  4. Test that the record and delegation are working correctly. This time you should be able to check from your host computer too! Windows does not include the dig command so you'll need to use nslookup on *.itc2480.campus.ihitc.net (replace the * with your System ID). Does the correct address come back?
  5. Test your setup using a web browser on your local computer, can you access your webserver by going to http://*.itc2480.campus.ihitc.net (where * is your hostname letter)?
  6. Create an MX record for the domain which directs mail for your delegated domain to your system as well just like we did with the test domain (this will involve creating another A record for mail.*.itc2480.campus.ihitc.net as well).
  7. Test that the MX record and associated A record are working correctly. This time you should be able to check from your host computer too! Windows does not include the dig command so you'll need to use nslookup. Does the correct mail server name and address come back?
  8. Create a CNAME record for the blog just like in the previous example (blog.*.itc2480.campus.ihitc.net' though) and create a new Apache virtual server just like in the previous example as well.
  9. Test your setup using a web browser on your local computer, can you access your blog directly by going to http://blog.*.itc2480.campus.ihitc.net (where * is your hostname letter)?

Manually editing a zone file

  1. Lastly we are going to look at the domain zone file. While Webmin provides a nice interface to add records, all it is doing is manually adding our records to our text based zone file. When you use BIND for DNS, every domain created gets its own record file which is called the zone file. In this file all subdomains and records are stored for said domain.
  2. By default, the location for these records on Debian will be in /var/lib/bind, so go to that directory and list the contents.
  3. Now, with your favorite text editor, open up the file which corresponds to the debserv-*.test domain. It should look similar to this:
    $ttl 38400
    debserv-Z.test. IN      SOA     2480-Z.itc2480.campus.ihitc.net. root.debserv-Z.test. (
                            1519434495
                            10800
                            3600
                            604800
                            38400 )
    debserv-Z.test. IN      NS      2480-Z.itc2480.campus.ihitc.net.
    debserv-Z.test. IN      A       172.17.50.36
    debserv-Z.test. IN      MX      10 mail.debserv-Z.test.
    mail.debserv-Z.test.    IN      A       172.17.50.36
    blog.debserv-Z.test.    IN      CNAME   debserv-z.test.
    debserv-Z.test. IN      AAAA    2607:f930:1c00:50:250:56ff:feb1:8756
    mail.debserv-Z.test.    IN      AAAA    2607:f930:1c00:50:250:56ff:feb1:8756
  4. Notice the formatting for domain records. Each record is defined by the domain or subdomain name, IN, then the record type (like A, AAAA, NS, or MX), followed by what the record is pointed to.
  5. For this example, we want to change the MX priority from 10 to 15, so change the MX record settings using your text editor.
  6. When you are done, restart the bind9 service to reload the changes.
    • Note: when restarting bind, if you have any errors restarting the service this normally means you have a typo in one of your zone files. If this is the case, go through the file again in a text editor to make sure you did not add anything extra or remove anything else.
  7. Use the dig tool to check the MX record and see that the new priority is active. You should see something similar to the following response:
    ; <<>> DiG 9.10.3-P4-Debian <<>> debserv-z.test MX
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40128
    ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 3
    
    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ;; QUESTION SECTION:
    ;debserv-z.test.                        IN      MX
    
    ;; ANSWER SECTION:
    debserv-Z.test.         38400   IN      MX      15 mail.debserv-Z.test.
    
    ;; AUTHORITY SECTION:
    debserv-Z.test.         38400   IN      NS      2480-Z.itc2480.campus.ihitc.net.
    
    ;; ADDITIONAL SECTION:
    mail.debserv-Z.test.    38400   IN      A       172.17.50.36
    mail.debserv-Z.test.    38400   IN      AAAA    2607:f930:1c00:50:250:56ff:feb1:8756
    
    ;; Query time: 0 msec
    ;; SERVER: 127.0.0.1#53(127.0.0.1)
    ;; WHEN: Fri Feb 23 20:15:48 CST 2018
    ;; MSG SIZE  rcvd: 163
  8. Notice how the Answer Section shows the MX record is pointed to the IP of the domain, and that the priority is set to 15.
  9. Congratulations, you have now setup a functional DNS server.