OPS335 Lab 3

OBJECTIVE & PREPARATION

In this lab, you will configure a Linux machine to be a DNS server for the rest of the machines in your Intranet. You will use your MySeneca ID as your domain. The server will handle all queries for names in the yoursenecaid.org domain. The server will also pass DNS queries for other names and addresses out to the Internet (i.e. to Seneca's DNS server).

Online Resources

• Address resolution mechanism
• Reverse DNS lookups

Current Configuration

This is the current state of our internal network when your harddrive is plugged into a lab machine. Please note that if any of the listed services aren't working for you, you should then fix them (especially your iptables which may block DNS traffic needed for this lab):

You can see in the diagram above that when one of your VMs does a name resolution request:

• The VM contacts the host, which is running a DNS proxy (a.k.a. stub resolver), not a full DNS server
• The DNS proxy on the host contacts the Seneca DNS server, which was assigned to be used on the host via DHCP
• Depending on the type of request, the Seneca DNS server may contact other DNS servers to get an answer to the request.

After you have completed this lab, your vm1 will be running a full-featured DNS server (which is how you're going to get the yoursenecaid.org domain without paying for it). Unfortunately, you will be the only one using your DNS server so no-one else will be able to resolve hosts under yoursenecaid.org

How DNS resolution works

We will review in class how the Domain Name Service works. You should also read in your own time the Address resolution mechanism section (including the Recursive and caching name server subsections) on Wikipedia for an overview of a DNS query. The diagram shown in the WIKI is also quite simple and easy to understand. Domain Name Service is a LARGE topic but this lab provides the basic principles and essentials for this course and DNS set-up for other courses.

INVESTIGATION 1: CONFIGURING THE DNS SERVER

We will now be installing, configuring and running a DNS server on our vm1.

Preparation

First, ensure that the host and vms are running, and set the domain name on each of your four machines (host and three VMs via /etc/hosts):

• host.yoursenecaid.org
• vm1.yoursenecaid.org
• vm2.yoursenecaid.org
• vm3.yoursenecaid.org

You should notice that these host and domain names are settings that are local to each machine, e.g. you will still not be able to contact vm1.yoursenecaid.org from vm3. That occurs since you are currently using the Seneca and other public DNS servers which know nothing about domain name: yoursenecaid.org

This preparation step is actually unnecessary for this lab's purpose (do you know why it is unnecessary?). On the other hand, by performing the above operations, it will make things appear more consistent, and may make your life a little easier.

Installation

Install Bind on your vm1 machine.

Configuration

An authoritative Bind server has a global configuration file (named.conf) and at least one zone file for the zone it's authoritative for.

/etc/named.conf

When you install Bind you'll get a default /etc/named.conf. Move this file over to a backup location, we will be writing one from scratch with the following contents, but use your own X value where applicable.

options {
        directory "/var/named/";
        allow-query {127.0.0.1; 192.168.X.0/24;};
        forwarders { 142.204.1.2; };
};
zone "localhost" {
        type master;
        file "named.localhost";
};
zone "yoursenecaid.org" {
        type master;
        file "mydb-for-yoursenecaid-org";
};

You need to understand all the options in this file except the localhost zone, so that in the future (for example in a practical test) you can quickly set up a DNS server for a new zone. So look up in the reference these things and write down what they do:

• directory
• allow-query
• forwarders
• type
• file

Zone file

Now edit /var/named/mydb-for-yoursenecaid-org and enter the following (use your own X value where applicable).

$TTL    3D
@       IN      SOA     vm1.yoursenecaid.org.      hostmaster.yoursenecaid.org.(
                2016010301       ; Serial
                8H      ; Refresh
                2H      ; Retry
                1W      ; Expire
                1D      ; Negative Cache TTL
        );
@       IN      NS      vm1.yoursenecaid.org.
vm1     IN      A       192.168.X.2

Again, here's the reference documentation for records in this file. Specifically pay attention to:

• A records
• NS records
• SOA records

Now that your DNS server (bind, a.k.a. named) is configured:

1. Start the named service with the systemctl command.
2. Check that the named service is running using the ps ax command (perhaps combined with grep), and separately, the systemctl command (if necessary), or check the /var/log/messages file for troubleshooting purposes.
3. Once you are certain that the named service had started and runs without errors, then set it to start automatically (i.e. enable the named service) when this virtual machine boots.
4. You also need to set vm1 as the primary domain name server (DNS1) for your vm1 machine to your vm1 machine's IPADDR
   
   NOTE: You should know how to do that, but if you forgot the procedure, refer to Lab 1.

Now that you know the service works, add the resource records necessary for it to provide forward lookups of the other machines in your virtual network (hint: You should only need three more) and restart the service.

Firewall rules update

Remember that you are supposed to have a working firewall on your vm1 (and every other machine), but we will focus on our vm1 machine for now. A working firewall will block requests to ports that you didn't explicitly allow. This means that at this point, your DNS server, even though it's perfectly configured, is inaccessible because iptables won't allow the requests to come in.

You will need to update the firewall on vm1 to allow incoming connections in UDP port 53 (i.e. the protocol and port that DNS uses). After you have updated your firewall, then save your iptables rules using whatever means worked for you in the iptables labs and add it to a shell script.

You could just disable the firewall but that is a poor workaround! You are expected to be able to handle configuration (such as this) at this point in this course.

Record steps, commands, and your observations in INVESTIGATION 1 in your OPS335 lab log-book

INVESTIGATION 2: CONFIGURING THE DNS CLIENT

Before proceeding, we need to set the primary DNS server (DNS1 ) in your ifcfg-eth0 (or ifcfg-en0) file for your network interface cards for your virtual machines. Also it is a good idea to install the bind-utils package on those other VMs as well in order to perform queries on your vm1 domain name server.

Perform the following Steps:

1. Only install the bind-utils package for your vm2 and vm3 machines.
2. You will need to configure your vm2 and vm3 to use vm1's IPADDR as the default DNS server (DNS1) in your ifcfg-eth0 (or ifcfg-en0) file for your network interface card.
   You should know how to do that, but if you forgot the procedure, refer to Lab 1.

You can, but you shouldn't, set your Host Machine to use vm1 as the DNS server. DNS is a critical component of your network setup and if it's not working right - you won't even be able to look for a solution online (or get to this wiki page) on your host. Also your host is configured to be a DHCP client and it gets its DNS server assigned automatically.

Testing

The bind-utils package provides tools in order to query your DNS server. By default, this package does not come automatically when you install the bind package.

Perform the Following Steps:

1. On your ALL of your virtual machines, issue the following command to install the bind-utils package:
   

    yum install bind-utils

2. Make certain to install bind-utils on your other VMs as well
3. Issue the following commands to verify that you set-up your DNS server correctly on all of your VMs and google and your host machine:

   host vm1.yoursenecaid.org
   host vm2.yoursenecaid.org
   host vm3.yoursenecaid.org
   host host.yoursenecaid.org
   host google.ca

4. Also on all of the VMs, install and use a text-based browser called lynx to access the Web.
5. Experiment with the following commands:
   

   nslookup
   dig

   Use the dig command to query your DNS server for specific records (up to this point you only have NS and A records).

Run vm1 (for DNS server) for Future labs
Due to the changes made in this lab, you will now need your vm1 running in order for any of your virtual machines to be able to use the internet.

Record steps, commands, and your observations in INVESTIGATION 2 in your OPS335 lab log-book

COMPLETING THE LAB

Upon completion of this lab you have a DNS server in your network and every virtual machine is using it to resolve internal and external hostnames. You have now gained experience with some common configuration settings for named, as well as common resource records.

Depending on your professor you will either be asked to submit the lab in class, or online. Follow the appropriate set of instructions below.

Online Submission

Follow the instructions for lab 3 on moodle.

In Class Submission

Arrange evidence (command output) for each of these items on your screen, then ask your instructor to review them and sign off on the lab's completion:

✓Comment out the hostname resolution (/etc/hosts) files for ALL vms, and use host command to query from a VM, the IPADDR for:
vm1.yoursenecaid.org , vm2.yoursenecaid.org , and vm3.yoursenecaid.org

✓nslookup information (A, NS, MX records) for vm1.yoursenecaid.org , vm2.yoursenecaid.org , vm3.yoursenecaid.org.

✓dig +trace for vm1.yoursenecaid.org , vm2.yoursenecaid.org , vm3.yoursenecaid.org.

✓Completed Lab3 log-book notes.

EXPLORATION QUESTIONS

1. What iptables rules apply to DNS?
2. Under what circumstances does DNS use TCP vs UDP?
3. What is a zone file and what is it used for?
4. Name the zone files used in this lab, and their purpose.
5. What file did you edit to set a static IP address?
6. What parameter did you set in that file to tell the machine to refer to your own DNS server?
7. What is the purpose of the /etc/resolv.conf file?
8. What is meant by the term "negative cache"?
9. What are type A records used for?
10. What security features are available for DNS?