572
edits
Changes
m
= DOMAIN NAME SYSTEM (DNS) =
== Objective of this Lab ==
== How DNS resolution works == We will review in class how the Domain Name Service works. You should also read in your own time the [https://en.wikipedia.org/wiki/Domain_Name_System#Address_resolution_mechanism the DNS article on Wikipedia] for an overview of a DNS query - especially the Address resolution mechanism] section (including the '''Recursive''' and '''caching name server''' subsections) on '''Wikipedia for an overview of a DNS query'''. The diagram shown in the WIKI is also quite simple and easy to understand. Domain Name Service is a LARGE topic but this lab provides the basic principles and essentials for this course and DNS set-up for other courses. We will <u>not</u> be setting up our server to do [https://en.wikipedia.org/wiki/Reverse_DNS_lookup Reverse DNS Lookups] but you are expected to understand the difference. In particular, you should understand that::* Your registrar (whomever you pay for your domain, even if you run your own DNS server) is responsible for '''normal (forward) DNS resolution''' of your domain.:* Your ISP (whomever you pay for your internet connection, i.e. the company that assigned a public IP to your server) is responsible for '''reverse DNS lookups''' for your IP.
#Switch to your Install '''vm1bind''' machine.#We will be installing the DNS server called on your '''Bindhost''', which is considered to be the most popular DNS server on the planetmachine.#Issue the following command to install '''bind''':<br><br><pre>yum install bind</pre>
);@ IN NS vm1host.yoursenecaid.orgops.vm1 host IN A 192.168.XXX.21
== Firewall rules update ==Remember that you are supposed to have a working firewall on your '''host''' (and every other machine), but we will focus on our '''host''' machine for now. A <u>working</u> firewall will block requests to ports that you didn't explicitly allow. This means that at this point, your DNS server, even though it's perfectly configured, is <u>'''inaccessible'''</u> to any other machine because iptables won't allow the requests to come in (the machine can communicate with itself using the rule that allows all traffic on the '''lo''' interface).
Remember that you are supposed to have a working firewall on your '''vm1''' (and every other machine), but we will focus on our vm1 machine for now. A <u>working</u> firewall will block requests to ports that you didnPerform the Following Steps:'t explicitly allow. This means that at this point, your DNS server, even though it's perfectly configured, is <u>'''inaccessible'''</u> because iptables won't allow the requests to come in.
The '''bind-utilsPerform the Following Steps:''' package provides tools in order to query your DNS server. By default, this package does not come automatically when you install the bind package.
'''Perform <ol><li>Issue the Following Stepsfollowing commands to verify that you set-up your DNS server correctly on all of your VMs and google and your host machine:'''<source>host vm1.yoursenecaid.opshost vm2.yoursenecaid.opshost vm3.yoursenecaid.opshost host.yoursenecaid.opshost google.ca</source></li>
#Issue the following command to install the bind-utils package:<br><br>'''yum install bind-utils'''<brli><br>#Issue Also try the following commands to verify that you set-up your DNS server correctly for all of your VMs:<source lang="bash">host host.yoursenecaid.orghost vm1.yoursenecaid.orghost vm2.yoursenecaid.orghost vm3.yoursenecaid.orghost google.cahost
{{Admon/important |Run vm1 (for = INVESTIGATION 3: CONFIGURING THE DNS server) for Future labs|Due to the changes made in this lab, you will now need your vm1 running in order for any of your virtual machines to be able to use the internet.}}SERVER FOR REVERSE LOOKUPS =
== COMPLETING THE LAB ==
'''Arrange evidence (command output) for each You may choose to:* Submit screenshots of these items your work on your screenBlackboard, then ask your instructor in which case you don't need to come to the lab.* Or come to review them and sign off on the lab, show me your work, and talk to me about it. I want to hear what you's completion:'''ve learned and answer any questions you have.
==EXPLORATION QUESTIONS==
→Installation
[[Category:OPS335]][[Category:OPS335 Labs]]
== OBJECTIVE & PREPARATION==In this lab, you will configure a Linux machine to be a DNS server for the rest of the machines in your Intranet. You will '''use <u>your</u> MySeneca ID (the one based on your name, not your student number) as your domain'''. The server will handle all queries for names in the '''yoursenecaid.orgops''' domain. The server will also pass DNS queries for other names and addresses out to the Internet (i.e. to Seneca's DNS server). === Online Resources=== * [https://en.wikipedia.org/wiki/Domain_Name_System#Address_resolution_mechanism Address resolution mechanism]* [https://en.wikipedia.org/wiki/Reverse_DNS_lookup Reverse DNS lookups] === Current Configuration ===
This is the current state of our internal network when your harddrive is plugged into a lab machine. Please note that if any of the listed services aren't working for you, you should then fix them (especially your iptables which may block DNS traffic needed for this lab):
After you have completed this lab, your '''vm1host''' VM will be running a full-featured DNS server (which is how you're going to get the '''yoursenecaid.orgops''' domain without paying for it). Unfortunately, you will be the only one using your DNS server so no-one else will be able to resolve hosts under '''yoursenecaid.orgops'''
=== How DNS resolution works ===
= INVESTIGATION 1: CONFIGURING THE DNS SERVER =
We will now be '''installing, configuring and running a DNS server on our vm1host'''. In most networks, the gateway would '''not''' also be a DNS server,but if we placed ours on a separate virtual machine we would need that VM to always be running in order for the other VMs to retrieve updates, install software, or even communicate with each other.
== Preparation ==
First, ensure that the '''host''' and '''vms''' are running, and set the '''domain name''' on each that none of your four machines (have entries for the host and three or any of the VMs via '''in /etc/hosts'''): * '''host.yoursenecaid.org'''* '''vm1.yoursenecaid.org'''* '''vm2.yoursenecaid.org'''* '''vm3.yoursenecaid.org''' You should notice that these host and domain names are settings that are <u>local< In previous courses you may have relied on the contents of /etc/u> to each machine, e.g. hosts but you will still not be able to contact '''vm1.yoursenecaid.org''' from '''vm3'''. That occurs since use them in this course so that you are currently using the '''Seneca''' and other public can see how vital a properly functioning DNS servers which know nothing about domain name: ''yoursenecaid.org'' This preparation step server is actually unnecessary for this lab's purpose (do you know why it is unnecessary?). On the other hand, by performing the above operations, it will make things appear more consistent, and may make your life a little easier.
== Installation ==
== Configuration ==
=== /etc/named.conf ===
When you install Bind you'll get a default '''/etc/named.conf'''. Move Copy this file over to a backup location, we and empty the original (If you have SELinux enabled - do not delete or move the file as that will cause SELinux not to trust it). We will be writing one from scratch with only the following contents, but use your own X XX value where applicable.
<pre>
options {
directory "/var/named/";
allow-query {127.0.0.1; 192.168.XXX.0/24;}; forwarders { 142208.20467.1222.2222; };# This one works at home #forwarders { 10.102.100.21; }; # This one works at Seneca
};
zone "localhost" {
file "named.localhost";
};
zone "yoursenecaid.orgops" {
type master;
file "mydb-for-yoursenecaid-orgops";
};
</pre>
* '''type'''
* '''file'''
Note: If you are using a drive an a removable bay, you will need to set the forwarders address differently. Pick any one of the DNS servers that are provided through DHCP.
=== Zone file ===
Now edit '''/var/named/mydb-for-yoursenecaid-orgops''' and enter the following (use your own X XX value and domain where applicable).
<pre>
$TTL 3D
@ IN SOA vm1host.yoursenecaid.orgops. hostmaster.yoursenecaid.orgops.( 2016010301 2018042901 ; Serial
8H ; Refresh
2H ; Retry
1W ; Expire
1D ; Negative Cache TTL
</pre>
# Check that the ''named'' service is running using the '''ps ax''' command (perhaps combined with '''grep'''), and separately, the '''systemctl''' command (if necessary), or check the '''/var/log/messages''' file for troubleshooting purposes.
# Once you are certain that the ''named'' service had started and runs without errors, then set it to '''start automatically''' (i.e. enable the named service) when this virtual machine boots.
# You also need to set vm1 it self '''(127.0.0.1)''' as the primary domain name server ('''DNS1''') for your '''vm1host''' machine to your '''vm1 host machine's IPADDRifcfg file'''<br/># If your host's external facing interface (ens33) is on DHCP, you will need to also add PEERDNS=NO to ifcfg file to prevent DHCP server from assigning the original DNS server (i.e. 192.168.40.2 which is used as forwarder instead by the DNS server you are setting up) <br /><br/>'''NOTE:''' You should know how to do that, but if you forgot the procedure, refer to [http://zenit.senecac.on.ca/wiki/index.php/OPS335_Lab_1#Making_Persistent_.28Permanent.29_Network_Setting_Changes Lab 1].<br><br># Now that you know the service works, '''add the resource records necessary for it to provide forward lookups of the other machines in your virtual network''' (hint: You should only need three more records) and restart the service.
== Firewall rules update ==
# Note: Since you are going to save your firewall at the end of this step, you may wish to '''stop libvirtd''' and '''restart iptables''' now in order to avoid saving the rules the libvirtd automatically adds to your INPUT, FORWARD, and POSTROUTING chains.# You will need to update the firewall on '''vm1host''' to allow <u>incoming</u> connections in to '''UDP port 53for both UDP and TCP''' (i.e. the protocol and port that DNS uses). # After you have updated your firewall, then save your iptables rules using whatever means worked for .# <b>Once you in the iptables labs rules are saved, restart libvirtd to ensure NAT and add it to a shell scriptforwarding rules are re-added.</b>
'''NOTE:''' You could just disable the firewall '''but that is a poor workaround! ''' You are expected to be able to handle configuration (such as this) at this point in this course.
'''Record steps, commands, and your observations in INVESTIGATION 1 in your OPS335 lab log-book'''
= INVESTIGATION 2: CONFIGURING THE DNS CLIENT =
Before proceeding, we need to install and configure '''bind''' on the other virtual machines ('''vm2''' and '''vm3'''), as well as specifying set the primary domain DNS server ('''DNS1''') in your '''ifcfg-eth0''' (or ''ifcfg-en0'') file for your network interface cards for your virtual machines. This will allow us Also it is a good idea to install the '''bind-utils''' package on those VMs as well in order to perform DNS queries on all of our VMsyour host domain name server.
'''Perform the following Steps:'''
#Repeat Install the procedures to install '''bind-utils''' , <u>edit</u> the appropriate configuration and data files package for your '''vm2''' and '''vm3''' machines<br><br>'''TIP:''' Use the '''scp''' command to copy the existing named.conf and zone records from your vm1 to your other VMs<br>(although you may need to "tweak" the values in some of those data files).<br><br>#Make certain that you correctly start and enable the '''named''' service on those virtual machines.#You will need to configure your VMs to use your host's IPADDR as the ''vm2'default DNS server'' and '(DNS1) in your ''vm3'ifcfg-eth0'' to use that as the '(or ''default DNS server'ifcfg-en0'') file for your network interface card.<br>You should know how to do that, but if you forgot the procedure, refer to [http://zenit.senecac.on.ca/wiki/index.php/OPS335_Lab_1#Making_Persistent_.28Permanent.29_Network_Setting_Changes Lab 1]. You can, but you shouldn#Modify the hostname of 't, set your Host Machine to use ''each machine'vm1''' as (host and all three VMs) to match what the DNS server. DNS says it is a critical component of your network setup and if it's not working right - you won't even be able to look for a solution online (or get to this wiki pageincluding the domain) on your host. Also your host is configured to This will be a DHCP client and it gets its DNS server assigned automaticallyimportant for services we configure in later labs.
== Testing ==
</source>
{{Admon/important |Host Command Doesn't Work|Your machines do not know what domain to automatically add to the end of hostnames (or believe they are still in the seneca domain). The '''SEARCH''' (or DOMAIN) parameter in the '''ifcfg-eth0''' file is used to specify your own domain (eg. '''yoursenecaid.ops''' ).<br><br>}}<li> Add the '''SEARCH''' (or DOMAIN) parameter for your '''ifcfg-eth0''' file as shown above for your '''host''' machine.<ol/li><li> Issue the '''host''' command for all vm names and host name to make certain that is works.</li><li value="3">Also on all of the VMs, install and use a text-based browser called '''lynx''' to access the Web, and test-out to see if it works by issuing the command '''lynx''' with the URL as an argument.</li><li>Experiment with the following commands:<br><br><source lang="bash">
nslookup
dig</source><br><br>Use the '''dig''' command to query your DNS server for specific records (up to this point you only have NS , A, and A SOA records).</li></ol>
'''Record steps, commands, and your observations in INVESTIGATION 2 in your OPS335 lab log-book'''
As it stands now, your server will only handle forward resolution (converting names into addresses), but it is also sometimes necessary to convert addresses back into human readable names. For public IP addresses only your ISP can provide this service for you. For private networks you can set it up for your own organisation. But even if you're setting up reverse DNS on the public internet - you need to understand what information the ISP would require.
Issue the following commands on any of your VMs (once again replacing XX with your network octet): <source>host 192.168.XX.1host 192.168.XX.2host 192.168.XX.3host 192.168.XX.4</source> Each one should have failed because there is currently nothing that will handle this reverse lookup for you. This requires another zone on your server. Add the following entry to your '''/etc/named.conf'''Record steps, commands, and (once again replacing XX with your observations own octet): <pre>zone "XX.168.192.in INVESTIGATION 2 in your OPS335 lab log-bookaddr.arpa." { type master; file "mydb-for-192.168.XX";};</pre> And create the following zone file: <pre>$TTL 3D@ IN SOA host.yoursenecaid.ops. hostmaster.yoursenecaid.ops.( 2018042901 ; Serial 8H ; Refresh 2H ; Retry 1W ; Expire 1D ; Negative Cache TTL);@ IN NS host.yoursenecaid.ops.1 IN PTR host.yoursenecaid.ops.</pre> <ol><li>Refer to the [http://www.zytrax.com/books/dns/ch8/ptr.html reference documentation] for '''PTR''' records.</li><li>Add the extra records needed to complete this zone (again, you should only need three more).</li><li>Restart the service and test these records to make sure they work.</li></ol>
{{Admon/important |Backup your VMs!|You MUST perform a '''full backup''' of ALL of your VMs whenever you complete your '''OPS335 labs''' or when working on your '''OPS335 assignments'''. You should be using the dump or rsync command, and you should use the Bash shell script that you were adviced to create in order to backup all of your VMs.}}
Upon completion of this lab you have a DNS server in your network and every virtual machine is using it to resolve internal and external hostnames.
You have now gained experience with some common configuration settings for named, as well as common resource records.
===Online Submission===
Follow the instructions for lab 3 on blackboard.
<!--
===Andrew's sections===
You'll get the same grade regardless of how you choose to submit your work. Expected results of this lab are:::<span style="color:green;font-size:1.5em;">✓</span>Comment out the hostname resolution (/etc/hosts) files for ALL vms, and use '''host''' command to query from a VM, the IPADDR for:<br><blockquote>'''host.yoursenecaid.ops''' , '''vm1.yoursenecaid.ops''' , '''vm2.yoursenecaid.ops''' , and '''vm3.yoursenecaid.ops'''</blockquote>::<span style="color:green;font-size:1.5em;">✓</span>'''nslookup''' information ('''A''', '''NS''', '''MX''' records) for :<br><blockquote>'''host.yoursenecaid.ops''', '''vm1.yoursenecaid.orgops''' , ''' from both vm2 and .yoursenecaid.ops''' , '''vm3.yoursenecaid.ops'''.</blockquote>::<span style="color:green;font-size:1.5em;">✓</span>'''dig + trace ''' for :<br><blockquote>'''host.yoursenecaid.orgops''' , '''vm1.yoursenecaid.ops''' , ''' from both vm2 .yoursenecaid.ops''' , '''vm3.yoursenecaid.ops'''.</blockquote>::<span style="color:green;font-size:1.5em;">✓</span>Download and vm3run '''https://ict.senecacollege.ca/~andrew.smith/ops335/labcheck3.bash'''
::<span style="color:green;font-size:1.5em;">✓</span>Completed Lab3 log-book notes.
-->
#What iptables rules apply to DNS?
#Under what circumstances does DNS use TCP vs UDP?
#What file did you edit to set a static IP address?
#What parameter did you set in that file to tell the machine to refer to your own DNS server?
#What is the purpose of the '''/etc/resolv.conf?#What is meant by the term "negative cache"''' file?#What are MX type '''A''' records used for?
#What security features are available for DNS?
