|
|
| (33 intermediate revisions by 2 users not shown) |
| Line 1: |
Line 1: |
| − | [[Category:OPS335]][[Category:OPS335 Labs]]
| + | #REDIRECT [[OPS335_Lab_3]] |
| − | ==DOMAIN NAME SYSTEM (DNS)==
| |
| − | ===Purpose===
| |
| − | | |
| − | In this lab you will configure a Linux machine to be a DNS server for the rest of the machines in your intranet. You'll '''use <u>your</u> Seneca-ID as your domain with IP addresses in the range 192.168.X.1 - 192.168.X.254'''. The server will handle all queries for names in the '''seneca-id.org''' domain and all reverse lookups for addresses in the given range of local IP numbers. The server will pass DNS queries for other names and addresses out to the Internet (i.e. to Seneca's DNS server).
| |
| − | | |
| − | | |
| − | ===DNS Resources===
| |
| − | | |
| − | | |
| − | *[[BIND&DNS Notes|BIND and DNS notes]]
| |
| − | *[http://www.tldp.org/LDP/lame/LAME/linux-admin-made-easy/domain-name-server.html DNS Setup]
| |
| − | | |
| − | | |
| − | ==PREPARATION FOR DNS LAB==
| |
| − | | |
| − | Prior to beginning this lab '''ensure that the firewall rules you created for your machines in lab 2a are loading when they boot'''. If they are not, '''REPAIR them <u>now</u>'''.<br>You will be building on those rules for the rest of the course.
| |
| − | | |
| − | You are going to populate your server with the following records for the static addresses in the '''/etc/hosts''' file for your host and vms: <br>(where "X" represents the '''last two digits of your student number for the third octet of network IP address''' )
| |
| − | | |
| − | Fully Qualified Domain Name IP Address
| |
| − | host.'''seneca-id'''.org 192.168.X.1
| |
| − | vm1.'''seneca-id'''.org 192.168.X.2
| |
| − | vm2.'''seneca-id'''.org 192.168.X.3
| |
| − | vm3.'''seneca-id'''.org 192.168.X.4
| |
| − | | |
| − | <br />
| |
| − | Here's what your network will look like:<br />[[Image:lab03.png|738|px| ]]
| |
| − | | |
| − | | |
| − | '''Record steps, commands, and your observations from this section in your OPS335 lab log-book'''
| |
| − | | |
| − | | |
| − | ==INVESTIGATION 1: CONFIGURING DNS (SERVER-SIDE - vm1)==
| |
| − | | |
| − | We will now be installing, configuring and running a DNS server on our VM1. We will be setting this up to use <u>your</u> '''Seneca college user-id''' as a '''"domain-name"''' for the purpose of this lab. Follow each of the several procedures carefully.
| |
| − | | |
| − | ===Perform these steps on your gateway/firewall===
| |
| − | | |
| − | #Start up your host machine, open a terminal window and "su -" to root. This PC will be named "host". It will be your gateway/firewall. | |
| − | #Ensure you are connected to the Internet. Use Firefox to authenticate yourself so you can surf the web outside of the Seneca domain.
| |
| − | #Use yum to update your system if necessary:<br><pre>yum update</pre>
| |
| − | #If you have not already done so, permanently set the host name of the 'host' machine to "'''host.seneca-id.org'''" (Use '''<u>your</u> seneca-id''' there instead of the literal word ''seneca-id'')!
| |
| − | | |
| − | ===Perform these steps on your VM1===
| |
| − | #Start your VM 1. This machine will be the domain name server for your intranet.
| |
| − | #On the VM, Use yum to update your system if necessary:<br><pre>yum update</pre>
| |
| − | #Use yum to install the DNS server:<br><pre>yum install bind</pre>
| |
| − | | |
| − | ===Edit /etc/named.conf===
| |
| − | #Still on the virtual machine create a back up of the existing '/etc/named.conf', delete the existing contents and add the following, but use your own X value where applicable. ([http://www.zytrax.com/books/dns/ch7/ Here is documentation] for all the available options in named.conf, look up the ones that you're using so that you know exactly what they do.
| |
| − | options {
| |
| − | directory "/var/named/";
| |
| − | allow-query {127.0.0.1; 192.168.X.0/24;};
| |
| − | forwarders { 142.204.33.54;};
| |
| − | };
| |
| − | zone "localhost" {
| |
| − | type master;
| |
| − | file "named.localhost";
| |
| − | notify NO;
| |
| − | };
| |
| − | zone "X.168.192.in-addr.arpa" {
| |
| − | type master;
| |
| − | file "mydb-for-192-168-X";
| |
| − | notify NO;
| |
| − | };
| |
| − | zone "'''seneca-id'''.org" {
| |
| − | type master;
| |
| − | file "mydb-for-'''seneca-id'''-org";
| |
| − | notify NO;
| |
| − | };
| |
| − | | |
| − | <ol><li value="2">Set the filesystem permissions for the above file to 644</li><li>Now edit '''/var/named/mydb-for-'''seneca-id'''-org''' and enter the following: But use your own X value where applicable. Note: if you copy-paste this code, there should be NO leading spaces before the first column of text (and [http://www.zytrax.com/books/dns/ch8/ here's a bit of documentation] to explain what the contents of this file are).</li></ol>
| |
| − | | |
| − | $TTL 3D
| |
| − | @ IN SOA vm1.'''seneca-id'''.org. webmaster.'''seneca-id'''.org.(
| |
| − | 1 ; Serial
| |
| − | 8H ; Refresh
| |
| − | 2H ; Retry
| |
| − | 1W ; Expire
| |
| − | 1D ; Negative Cache TTL
| |
| − | );
| |
| − | @ IN NS vm1.'''seneca-id'''.org.
| |
| − | vm1 IN A 192.168.X.2
| |
| − | | |
| − | <ol><li value="4">Next, edit /var/named/mydb-for-192-168-X and enter the following:</li></ol>
| |
| − | | |
| − | $TTL 3D
| |
| − | @ IN SOA vm1.'''seneca-id'''.org. webmaster.<seneda-id>.org. (
| |
| − | 1 ; Serial
| |
| − | 8H ; Refresh
| |
| − | 2H ; Retry
| |
| − | 1W ; Expire
| |
| − | 1D ; Negative Cache TTL
| |
| − | );
| |
| − | @ IN NS vm1.'''seneca-id'''.org.
| |
| − | 2 IN PTR vm1.<seneda-id>.org.
| |
| − | | |
| − | <ol><li value="5">Now set up your resolver to point to itself. Edit /etc/resolv.conf, delete what's there and enter this data instead. Remember to use your value for X:</li></ol>
| |
| − | | |
| − | nameserver 192.168.X.2
| |
| − | search '''seneca-id'''.org
| |
| − | | |
| − | <ol><li value="6">Note that this is only temporary, and will go away when the machine reboots. There is another step later that will make this change permanently.</li><li>Start your DNS server with the command:<br><pre>systemctl start named.service</pre></li><li>Check that your name server is running:<br><pre>ps ax | grep named</pre> or <pre>systemctl status named.service</pre></li><li>Set the service to start automatically when this virtual machine boots.</li><li>When starting or restarting your name server view the log file (/var/log/messages) to ensure it started without error.</li><li>Try a few lookups:
| |
| − | <pre>host host.'''seneca-id'''.org
| |
| − | host vm1.'''seneca-id'''.org
| |
| − | host vm2.'''seneca-id'''.org
| |
| − | host vm3.'''seneca-id'''.org
| |
| − | host cbc.ca</pre>
| |
| − | </li></ol>
| |
| − | | |
| − | | |
| − | <ol><li value="12">Now try a few reverse lookups:
| |
| − | <pre>
| |
| − | host 192.168.X.1
| |
| − | host 192.168.X.2
| |
| − | host 192.168.X.3
| |
| − | host 192.168.X.4
| |
| − | </pre>
| |
| − | </li></ol>
| |
| − | | |
| − | | |
| − | | |
| − | <ol><li value="13">You'll notice that only the queries for vm1 worked. That's because you only have the resource records for vm1. Go back to the zone files and add the appropriate records for your other machines.</li><li>Once you have done so, restart the service and try querying for those records again</li><li>Modify your firewall to allow the other machines to query your new DNS server.</li></ol>
| |
| − | | |
| − | | |
| − | '''Record troubleshooting checklist for INVESTIGATION 1 in your OPS335 lab log-book'''
| |
| − | | |
| − | | |
| − | ==INVESTIGATION 2: CONFIGURING DNS (CLIENT SIDE - Centos7 Host Machine)==
| |
| − | | |
| − | Now that we have setup a DNS server on your virtual machine (vm1), we will now switch to the host machine, and define the name server that is running on vm1 in order to resolve the seneca-id domain name to the appropriate IP address.
| |
| − | | |
| − | | |
| − | '''Perform the following steps on your Centos host:'''
| |
| − | | |
| − | #Edit the '''/etc/resolv.conf''' file and enter the following:
| |
| − | nameserver 192.168.X.2
| |
| − | domain '''seneca-id'''.org
| |
| − | <ol><li value="3">Now try the commands:</li></ol>
| |
| − | host host.'''seneca-id'''.org
| |
| − | host vm1.'''seneca-id'''.org
| |
| − | host vm2.'''seneca-id'''.org
| |
| − | host vm3.'''seneca-id'''.org
| |
| − | host yahoo.ca
| |
| − | | |
| − | | |
| − | host 192.168.X.1
| |
| − | host 192.168.X.2
| |
| − | host 192.168.X.3
| |
| − | host 192.168.X.4
| |
| − | | |
| − | <ol><li value="4">Now configure your other virtual machines to also use VM 1 as their DNS server.</li><li>Also on the VMs use a text browser such as lynx to access the Web.<br><br>(NOTE: you do not need to authenticate yourself through SeneNet on this machine, as they connects through the host which is already authenticated)</li><li>On all machines in your network, experiment with the following commands. Be sure to use several different command options to learn and understand how they work:<br><br></li></ol>
| |
| − | | |
| − | host
| |
| − | dig
| |
| − | nslookup
| |
| − | | |
| − | | |
| − | {{Admon/important| These final steps are important!| Failure to complete this will cause problems with future labs.}}
| |
| − | | |
| − | | |
| − | <ol><li value="7">Finally, ensure each machine is using the static IP address and hostname that matches what the DNS server now claims they use. Double check that this address, and the ability to search using your DNS server, persist after reboot.</li><li>On each machine add the entry to your interface configuration file that will cause it to permanently use your VM 1 as its primary DNS server.</li><li>If you have made any changes to the /etc/hosts file, undo them. Your machines must be relying on your DNS server.</li><li>Ensure that your machines can ping and SSH to each other by IP address and by name (hostname only, and hostname with domain).</li><li>Modify the ifcfg file on your host so that it will still get a DHCP address, but ignore the DNS information given to it by the DHCP server in favour of the domain and DNS information you provide it.</li></ol>
| |
| − | | |
| − | | |
| − | '''Record troubleshooting checklist for INVESTIGATION 2 in your OPS335 lab log-book'''
| |
| − | | |
| − | | |
| − | == COMPLETING THE LAB ==
| |
| − | [[Image:lab1_signoff.png|thumb|right|300px|Students should be prepared with '''all required commands (system information) displayed in a terminal (or multiple terminals) prior to calling the instructor for signoff'''.]] | |
| − | | |
| − | Upon completion of this lab you have a DNS server in your network and every machine is using it to resolve internal and external hostnames and ip addresses.
| |
| − | | |
| − | You have now gained experience with some common configuration settings for named, as well as common resource records.
| |
| − | | |
| − | Note: Due to the changes made in this lab, you will now need your VM 1 running in order for you host to be able to contact any other machines.
| |
| − | | |
| − | '''Arrange evidence (command output) for each of these items on your screen, then ask your instructor to review them and sign off on the lab's completion:'''
| |
| − | | |
| − | ::<span style="color:green;font-size:1.5em;">✓</span>x.
| |
| − | | |
| − | | |
| − | | |
| − | ==EXPLORATION QUESTIONS==
| |
| − | #What iptables rules apply to DNS?
| |
| − | #Under what circumstances does DNS use TCP vs UDP?
| |
| − | #What is a zone file and what is it used for?
| |
| − | #Name the zone files used in this lab, and their purpose.
| |
| − | #What file did you edit to set a static IP address?
| |
| − | #What parameter did you set in that file to tell the machine to refer to your own DNS server?
| |
| − | #What is the purpose of /etc/resolv.conf?
| |
| − | #What is meant by the term "negative cache"?
| |
| − | #What are MX records used for?
| |
| − | #What security features are available for DNS?
| |
