|
|
| (89 intermediate revisions by 3 users not shown) |
| Line 1: |
Line 1: |
| − | [[Category:OPS335]][[Category:OPS335 Labs]] | + | #REDIRECT [[OPS335_Lab_3]] |
| − | ==Domain Name System==
| |
| − | In this lab you will configure a Linux host to be a DNS server for the rest of the machines in your intranet. You'll use your learn ID as your domain with IP addresses in the range 192.168.X.1 - 192.168.X.254. The server will handle all queries for names in the <learnid>.org domain and all reverse lookups for addresses in the given range of local IP numbers. The server will pass DNS queries for other names and addresses out to the Internet (i.e. to Seneca's DNS server).
| |
| − | ===Instructions===
| |
| − | | |
| − | You're going to populate your server with the following records:
| |
| − | | |
| − | Fully Qualified Domain Name IP Address
| |
| − | f17.<learnid>.org 192.168.X.1
| |
| − | vm01.<learnid>.org 192.168.X.2
| |
| − | vm02.<learnid>.org 192.168.X.3
| |
| − | vm03.<learnid>.org 192.168.X.4
| |
| − | | |
| − | <br />
| |
| − | Here's what your network will look like:<br />[[Image:lab03.png|738|px| ]]
| |
| − | | |
| − | ===Perform these steps on your gateway/firewall/DNS machine===
| |
| − | | |
| − | *Start up your host machine, open a terminal window and "su -" to root. This PC will be named "f17". It will be your gateway/firewall as well as the domain name server for your intranet.
| |
| − | *Ensure you are connected to the Internet. Use Firefox to authenticate yourself so you can surf the web outside of the Seneca domain.
| |
| − | *Use yum to update your system if necessary.
| |
| − | yum update
| |
| − | *Use yum to install the DNS server.
| |
| − | yum install bind
| |
| − | *If you have not already done so, permanently set the host name of the 'host' machine to "f17.<learnid>.org" (without the < and >, they are just there to tell you put your learnid there instead of the literal word learnid).
| |
| − | | |
| − | ===Edit /etc/named.conf===
| |
| − | *Create a back up of the existing '/etc/named.conf', delete the existing contents and add the following: But use your own X value where applicable.
| |
| − | options {
| |
| − | directory "/var/named/";
| |
| − | allow-query {127.0.0.1; 192.168.X.0/24;};
| |
| − | forwarders { 142.204.1.2; 142.204.43.43;};
| |
| − | };
| |
| − | zone "localhost" {
| |
| − | type master;
| |
| − | file "localhost.zone";
| |
| − | notify NO;
| |
| − | };
| |
| − | zone "X.168.192.in-addr.arpa" {
| |
| − | type master;
| |
| − | file "mydb-for-192-168-X";
| |
| − | notify NO;
| |
| − | };
| |
| − | zone "<learnid>.org" {
| |
| − | type master;
| |
| − | file "mydb-for-<learnid>-org";
| |
| − | notify NO;
| |
| − | };
| |
| − | | |
| − | * Set the filesystem permissions for the above file to 644
| |
| − | * Create the file /var/named/localhost.zone and enter the following (note: if you copy-paste this code, there should be NO leading spaces before the "@" or the "$"):
| |
| − | $TTL 3D
| |
| − | @ IN SOA f17.<learnid>.org. <learnid>.<learnid>.org. (
| |
| − | 1 ; Serial
| |
| − | 8H ; Refresh
| |
| − | 2H ; Retry
| |
| − | 1W ; Expire
| |
| − | 1D ; Negative Cache TTL
| |
| − | );
| |
| − | @ IN NS localhost.
| |
| − | IN A 127.0.0.1
| |
| − | | |
| − | *Now edit /var/named/mydb-for-<learnid>-org and enter the following: But use your own X value where applicable.
| |
| − | | |
| − | $TTL 3D
| |
| − | @ IN SOA f17.<learnid>.org. <learnid>.<learnid>.org.(
| |
| − | 1 ; Serial
| |
| − | 8H ; Refresh
| |
| − | 2H ; Retry
| |
| − | 1W ; Expire
| |
| − | 1D ; Negative Cache TTL
| |
| − | );
| |
| − | @ IN NS f17.<learnid>.org.
| |
| − | f17 IN A 192.168.X.1
| |
| − | vm01 IN A 192.168.X.2
| |
| − | vm02 IN A 192.168.X.3
| |
| − | vm03 IN A 192.168.X.4
| |
| − | | |
| − | *Next, edit /var/named/mydb-for-192-168-X and enter the following:
| |
| − | | |
| − | $TTL 3D
| |
| − | @ IN SOA f17.<learnid>.org. <learnid>.<learnid>.org. (
| |
| − | 1 ; Serial
| |
| − | 8H ; Refresh
| |
| − | 2H ; Retry
| |
| − | 1W ; Expire
| |
| − | 1D ; Negative Cache TTL
| |
| − | );
| |
| − | @ IN NS f17.<learnid>.org.
| |
| − | 1 IN PTR f17.<learnid>.org.
| |
| − | 2 IN PTR vm01.<learnid>.org.
| |
| − | 3 IN PTR vm02.<learnid>.org.
| |
| − | 4 IN PTR vm03.<learnid>.org.
| |
| − | | |
| − | *Now set up your resolver to point to itself. Edit /etc/resolv.conf, delete what's there and enter this data instead. Remember to use your value for X.
| |
| − | | |
| − | nameserver 192.168.X.1
| |
| − | search <learnid>.org
| |
| − | | |
| − | *Start your DNS server with the command
| |
| − | systemctl start named.service
| |
| − | | |
| − | *Check that your name server is running
| |
| − | ps ax | grep named
| |
| − | *or
| |
| − | systemctl status named.service
| |
| − | | |
| − | *When starting or restarting your name server view the log file (/var/log/messages) to ensure it started without error.
| |
| − | *Try a few lookups:
| |
| − | host f17.<learnid>.org
| |
| − | host vm01.<learnid>.org
| |
| − | host vm02.<learnid>.org
| |
| − | host vm03.<learnid>.org
| |
| − | host cbc.ca
| |
| − | *Now try a few reverse lookups:
| |
| − | | |
| − | host 192.168.X.1
| |
| − | host 192.168.X.2
| |
| − | host 192.168.X.3
| |
| − | host 192.168.X.4
| |
| − | | |
| − | ===Perform these steps on your Intranet machine===
| |
| − | Use virt-manager on Fedora 17 and open vm01.
| |
| − | | |
| − | *On this machine edit the /etc/resolv.conf file and enter the following:
| |
| − | | |
| − | nameserver 192.168.X.1
| |
| − | domain <learnid>.org
| |
| − | *Now try the commands
| |
| − | host f17.<learnid>.org
| |
| − | host vm01.<learnid>.org
| |
| − | host vm02.<learnid>.org
| |
| − | host vm03.<learnid>.org
| |
| − | host yahoo.ca
| |
| − | *And the commands
| |
| − | host 192.168.X.1
| |
| − | host 192.168.X.2
| |
| − | host 192.168.X.3
| |
| − | host 192.168.X.4
| |
| − |
| |
| − | *Now, still on the second machine, use a text browser such as lynx to access the Web.
| |
| − | (NOTE: you do not need to authenticate yourself through SeneNet on this machine, as it connects through the f17 host which is authenticated)
| |
| − | | |
| − | *On all machines in your network, experiment with the following commands. Be sure to use several different command options to learn and understand how they work.
| |
| − | | |
| − | host
| |
| − | dig
| |
| − | nslookup
| |
| − | | |
| − | | |
| − | {{Admon/important| This final step is important. | Failure to complete this will cause problems with future labs.}}
| |
| − | *Finally, configure each machine to use a static IP address and hostname that matches what the DNS server now claims it uses. Double check that this address, and the ability to search using your DNS server, persist after reboot.
| |
| − | *Ensure that your machines can ping and SSH to each other by IP address and by name (hostname only, and hostname with domain).
| |
| − | *Add PEERDNS=no to the ifcfg file on your host. This tells it to ignore the DNS information given to it by the DHCP server, so it will use the domain and DNS information you provide it.
| |
| − | | |
| − | ==Completing the Lab==
| |
| − | Answer the following questions in your lab book:
| |
| − | | |
| − | #What iptables rules apply to DNS?
| |
| − | #Under what circumstances does DNS use TCP vs UDP?
| |
| − | #What is a zone file and what is it used for?
| |
| − | #Name the zone files used in this lab, and their purpose.
| |
| − | #What file did you edit to set a static IP address?
| |
| − | #What parameter did you set in that file to tell the machine to refer to your own DNS server?
| |
| − | #What is the purpose of /etc/resolv.conf?
| |
| − | #What is meant by the term "negative cache"?
| |
| − | #What are MX records used for? Add the needed entry to point the MX record to VM02.
| |
| − | #What security features are available for DNS?
| |
