Changes

In this lab, you will configure a Linux machine to be a DNS server for the rest of the machines in your Intranet. You will '''use <u>your</u> MySeneca ID (the one based on your name, not your student number) as your domain'''. The server will handle all queries for names in the '''yoursenecaid.orgops''' domain. The server will also pass DNS queries for other names and addresses out to the Internet (i.e. to Seneca's DNS server).

After you have completed this lab, your '''vm1host''' VM will be running a full-featured DNS server (which is how you're going to get the '''yoursenecaid.orgops''' domain without paying for it). Unfortunately, you will be the only one using your DNS server so no-one else will be able to resolve hosts under '''yoursenecaid.orgops''' 

We will now be '''installing, configuring and running a DNS server on our vm1host'''. In most networks, the gateway would '''not''' also be a DNS server,but if we placed ours on a separate virtual machine we would need that VM to always be running in order for the other VMs to retrieve updates, install software, or even communicate with each other.

First, ensure that the '''host''' and '''vms''' are running, and (on that none of your machines have entries for the host only) set or any of the '''domain name''' of each of your four machines via '''VMs in /etc/hosts''': * '''host.yoursenecaid.org'''* '''vm1.yoursenecaid.org'''* '''vm2.yoursenecaid.org'''* '''vm3.yoursenecaid.org'''  You should notice that these host and domain names are settings that are <u>local</u> to each machine. What In previous courses you did may have relied on the host does not affect the VMs and contents of /etc/hosts but you will still not be able to contact '''vm1.yoursenecaid.org''' from '''vm3'''. That occurs since use them in this course so that you are currently using the '''Seneca''' and other public can see how vital a properly functioning DNS servers which know nothing about domain name: ''yoursenecaid.org'' This preparation step server is actually unnecessary for this lab's purpose (do you know why it is unnecessary?). On the other hand, by performing the above operations, it will make things appear more consistent, and may make your life a little easier.

Install Bind on your '''vm1host''' machine.

forwarders { 142192.204168.140.2; };

zone "yoursenecaid.orgops" {

file "mydb-for-yoursenecaid-orgops";

Now edit '''/var/named/mydb-for-yoursenecaid-orgops''' and enter the following (use your own X value and domain where applicable).

@ IN SOA vm1host.yoursenecaid.orgops. hostmaster.yoursenecaid.orgops.( 2016010301 2018042901 ; Serial

@ IN NS vm1host.yoursenecaid.orgops.vm1 host IN A 192.168.X.21

# You also need to set vm1 '''host''' as the primary domain name server ('''DNS1''') for your '''vm1host''' machine to your '''vm1 host machine's ifcfg file'''<br /># If your host's external facing interface (ens33) is on DHCP, you will need to also add PEERDNS=NO to ifcfg file to prevent DHCP server from assigning the original DNS server (i.e. 192.168.40.2 which is used as forwarder instead by the DNS server you are setting up) <br /><br />'''NOTE:''' You should know how to do that, but if you forgot the procedure, refer to [http://zenit.senecac.on.ca/wiki/index.php/OPS335_Lab_1#Making_Persistent_.28Permanent.29_Network_Setting_Changes Lab 1].<br><br># Now that you know the service works, '''add the resource records necessary for it to provide forward lookups of the other machines in your virtual network''' (hint: You should only need three more records) and restart the service.

Now Remember that you know the service worksare supposed to have a working firewall on your '''host''' (and every other machine), add the resource records necessary but we will focus on our '''host''' machine for now. A <u>working</u> firewall will block requests to ports that you didn't explicitly allow. This means that at this point, your DNS server, even though it 's perfectly configured, is <u>'''inaccessible'''</u> to provide forward lookups of any other machine because iptables won't allow the other machines requests to come in your virtual network (hint: You should only need three morethe machine can communicate with itself using the rule that allows all traffic on the '''lo''' interface) and restart the service.

Remember that # Note: Since you are supposed going to save your firewall at the end of this step, you may wish to restart iptables now in order to avoid saving the rules the libvirtd automatically adds to have a working your INPUT, FORWARD, and POSTROUTING chains.# You will need to update the firewall on your '''vm1host''' (and every other machine), but we will focus on our vm1 machine for now. A to allow <u>workingincoming</u> firewall will block requests connections to ports that you didn't explicitly allow. This means that at this point, your DNS server, even though it's perfectly configured, is <u>''port 53 for both UDP and TCP'inaccessible'''</u> to any other machine because iptables won't allow the requests to come in (i.e. the machine can communicate with itself using the rule protocol and port that allows all traffic on the '''lo''' interfaceDNS uses).# After you have updated your firewall, save your iptables rules.# <b>Once you rules are saved, restart libvirtd to ensure NAT and forwarding rules are re-added.</b>

You will need to update the firewall on '''vm1''' to allow <u>incoming</u> connections to NOTE:'''port 53 for both UDP and TCP''' (i.e. the protocol and port that DNS uses). After you have updated your firewall, then save your iptables rules using whatever means worked for you in the iptables labs and add it to a shell script. You could just disable the firewall '''but that is a poor workaround! ''' You are expected to be able to handle configuration (such as this) at this point in this course.

Before proceeding, we need to set the primary DNS server (DNS1 ) in your '''ifcfg-eth0''' (or ''ifcfg-en0'') file for your network interface cards for your virtual machines. Also it is a good idea to install the '''bind-utils''' package on those other VMs as well in order to perform queries on your vm1 host domain name server.

#Only install Install the '''bind-utils''' package for your '''vm2''' and '''vm3''' virtual machines.#You will need to configure your '''vm2''' and '''vm3''' VMs to use vm1your host's IPADDR as the '''default DNS server''' (DNS1) in your '''ifcfg-eth0''' (or ''ifcfg-en0'') file for your network interface card.<br>You should know how to do that, but if you forgot the procedure, refer to [http://zenit.senecac.on.ca/wiki/index.php/OPS335_Lab_1#Making_Persistent_.28Permanent.29_Network_Setting_Changes Lab 1]. You can, but you shouldn#Modify the hostname of 't, set your Host Machine to use ''each machine'vm1''' as (host and all three VMs) to match what the DNS server. DNS says it is a critical component of your network setup and if it's not working right - you won't even be able to look for a solution online (or get to this wiki pageincluding the domain) on your host. Also your host is configured to This will be a DHCP client and it gets its DNS server assigned automaticallyimportant for services we configure in later labs.

<source lang="bash">host vm1.yoursenecaid.orgopshost vm2.yoursenecaid.orgopshost vm3.yoursenecaid.orgopshost host.yoursenecaid.orgops

<source lang="bash">

If those failed, your {{Admon/important |Host Command Doesn't Work|Your machines do not know what domain to automatically add to the end of hostnames (or believe they are still in the seneca domain). There is another The '''SEARCH''' (or DOMAIN) parameter to put in the '''ifcfg-eth0''' file is used to let them know they are part of specify your own domain(eg. '''yoursenecaid.ops''' ).<br><br>}}<li> Add the '''SEARCH''' (or DOMAIN) parameter for your '''ifcfg-eth0''' file as shown above for your '''host''' machine.</li><li> Issue the host command for all vm names and host name to make certain that is works.</li><li>Also on all of the VMs, install and use a text-based browser called '''lynx''' to access the Web, and test-out to see if it works by issuing the command '''lynx''' with the URL as an argument.</li><li>Experiment with the following commands:<br><source lang="bash">

<source lang="bash">

@ IN SOA vm1host.yoursenecaid.orgops. hostmaster.yoursenecaid.orgops.( 2016010301 2018042901 ; Serial

@ IN NS vm1host.yoursenecaid.orgops.vm1.yoursenecaid.org. IN A 192.168.X.22 1 IN PTR vm1host.yoursenecaid.orgops.

===Online Submission(Peter Callaghan's Classes only)===Follow the instructions for lab 3 on moodleblackboard.

===In Class Submission(Murray Saul's Classes only)===

::<span style="color:green;font-size:1.5em;">&#x2713;</span>Comment out the hostname resolution (/etc/hosts) files for ALL vms, and use '''host''' command to query from a VM, the IPADDR for:<br><blockquote>'''host.yoursenecaid.ops''' , '''vm1.yoursenecaid.orgops''' , '''vm2.yoursenecaid.orgops''' , and '''vm3.yoursenecaid.orgops'''<br/blockquote>::<span style="color:green;font-size:1.5em;">&#x2713;</span>'''nslookup''' information ('''A''', '''NS''', '''MX''' records) for :<br><blockquote>'''host.yoursenecaid.ops''' , '''vm1.yoursenecaid.orgops''' , '''vm2.yoursenecaid.orgops''' , '''vm3.yoursenecaid.orgops'''.</blockquote>::<span style="color:green;font-size:1.5em;">&#x2713;</span>'''dig +trace''' for :<br><blockquote>'''host.yoursenecaid.ops''' , '''vm1.yoursenecaid.orgops''' , '''vm2.yoursenecaid.orgops''' , '''vm3.yoursenecaid.orgops'''.</blockquote>::<span style="color:green;font-size:1.5em;">&#x2713;</span>Download the labcheck3.bash checking bash shell script by issuing the command:<br><br>'''wget http://matrix.senecac.on.ca/~peter.callaghan/files/OPS335/labcheck3.bash'''<br><br>set execute permission and run the shell script on your '''host''' machine. ::*For '''Peter's classes''', follow his Online Submission instructions in Moodle.::*For '''Murray's classes''', run command (piping to the '''more''' command) and show output to instructor.