572
edits
Changes
→Andrew's sections
=== How DNS resolution works ===
We will review in class how the Domain Name Service works. You should also read in your own time the [https://en.wikipedia.org/wiki/Domain_Name_System#Address_resolution_mechanism the DNS article on Wikipedia] for an overview of a DNS query - especially the Address resolution mechanism] section (including the '''Recursive''' and '''caching name server''' subsections) on '''Wikipedia for an overview of a DNS query'''. The diagram shown in the WIKI is also quite simple and easy to understand. Domain Name Service is a LARGE topic but this lab provides the basic principles and essentials for this course and DNS set-up for other courses.
= INVESTIGATION 1: CONFIGURING THE DNS SERVER =
We will now be '''installing, configuring and running a DNS server on our host'''. In most networks, the gateway would '''not''' also be a DNS server,
but if we places placed ours on a separate virtual machine we would need that VM to always be running in order for the other VMs to retrieve updates, install software, or even communicate with each other.
== Preparation ==
=== /etc/named.conf ===
When you install Bind you'll get a default '''/etc/named.conf'''. Copy this file over to a backup location and empty the original (If you have SELinux enabled - do not delete or move it the file as that will cause SELinux not to trust it). We will be writing one from scratch with only the following contents, but use your own X value where applicable.
<pre>
directory "/var/named/";
allow-query {127.0.0.1; 192.168.X.0/24;};
#forwarders { 192208.16867.48222.2222; };# This one works at home forwarders { 10.102.100.21; }; # This one works at Seneca
};
zone "localhost" {
# Check that the ''named'' service is running using the '''ps ax''' command (perhaps combined with '''grep'''), and separately, the '''systemctl''' command (if necessary), or check the '''/var/log/messages''' file for troubleshooting purposes.
# Once you are certain that the ''named'' service had started and runs without errors, then set it to '''start automatically''' (i.e. enable the named service) when this virtual machine boots.
# You also need to set '''host''' as the primary domain name server ('''DNS1''') for your '''host''' machine to your '''host machine's ifcfg file'''<br /># If your host's external facing interface (ens33) is on DHCP, you will need to also add PEERDNS=NO to ifcfg file to prevent DHCP server from assigning the original DNS server (i.e. 192.168.40.2 which is used as forwarder instead by the DNS server you are setting up) <br /><br />'''NOTE:''' You should know how to do that, but if you forgot the procedure, refer to [http://zenit.senecac.on.ca/wiki/index.php/OPS335_Lab_1#Making_Persistent_.28Permanent.29_Network_Setting_Changes Lab 1].<br><br>
# Now that you know the service works, '''add the resource records necessary for it to provide forward lookups of the other machines in your virtual network''' (hint: You should only need three more records) and restart the service.
# You will need to update the firewall on '''host''' to allow <u>incoming</u> connections to '''port 53 for both UDP and TCP''' (i.e. the protocol and port that DNS uses).
# After you have updated your firewall, save your iptables rules.
# <b>Once you rules are saved, restart libvirtd to ensure NAT and forwarding rules are re-added.</b>
'''NOTE:''' You could just disable the firewall '''but that is a poor workaround!''' You are expected to be able to handle configuration (such as this) at this point in this course.
= INVESTIGATION 3: CONFIGURING THE DNS SERVER FOR REVERSE LOOKUPS =
As it stands now, your server will only handle forward resolution (converting names into addresses), but it is also common to need sometimes necessary to convert addresses back into human readable names. In some situations an For public IP addresses only your ISP will can provide this service for you, but most organizations at least need to handle their . For private networks you can set it up for your own internal addressesorganisation. You also But even if you're setting up reverse DNS on the public internet - you need to understand what information the ISP would require.
Issue the following commands on any of your VMs (once again replacing X with your network octet):
<ol><li>Refer to the [http://www.zytrax.com/books/dns/ch8/ ptr.html reference documentation] for '''PTR''' records.</li>
<li>Add the extra records needed to complete this zone (again, you should only need three more).</li>
<li>Restart the service and test these records to make sure they work.</li>
Follow the instructions for lab 3 on blackboard.
===In Class Submission (Murray SaulAndrew's Classes only)sections==='''Arrange evidence (command output) for each You may choose to:* Submit screenshots of these items your work on your screenBlackboard, then ask your instructor in which case you don't need to come to the lab.* Or come to review them and sign off on the lab, show me your work, and talk to me about it. I want to hear what you's completion:''ve learned and answer any questions you have. You'll get the same grade regardless of how you choose to submit your work.
Expected results of this lab are:::<span style="color:green;font-size:1.5em;">✓</span>Comment out the hostname resolution (/etc/hosts) files for ALL vms, and use '''host''' command to query from a VM, the IPADDR for:<br><blockquote>'''host.yoursenecaid.ops''' , '''vm1.yoursenecaid.ops''' , '''vm2.yoursenecaid.ops''' , and '''vm3.yoursenecaid.ops'''<br/blockquote>::<span style="color:green;font-size:1.5em;">✓</span>'''nslookup''' information ('''A''', '''NS''', '''MX''' records) for :<br><blockquote>'''host.yoursenecaid.ops''' , '''vm1.yoursenecaid.ops''' , '''vm2.yoursenecaid.ops''' , '''vm3.yoursenecaid.ops'''.</blockquote>::<span style="color:green;font-size:1.5em;">✓</span>'''dig +trace''' for :<br><blockquote>'''host.yoursenecaid.ops''' , '''vm1.yoursenecaid.ops''' , '''vm2.yoursenecaid.ops''' , '''vm3.yoursenecaid.ops'''.</blockquote>::<span style="color:green;font-size:1.5em;">✓</span>Download the labcheck3.bash checking bash shell script by issuing the command:<br><br>and run '''wget httphttps://matrix.senecacict.onsenecacollege.ca/~peterandrew.callaghan/filessmith/OPS335ops335/labcheck3.bash'''<br><br>set execute permission and run the shell script on your '''host''' machine. ::*For '''Peter's classes''', follow his Online Submission instructions in Moodle.::*For '''Murray's classes''', run command (piping to the '''more''' command) and show output to instructor.
::<span style="color:green;font-size:1.5em;">✓</span>Completed Lab3 log-book notes.
#What parameter did you set in that file to tell the machine to refer to your own DNS server?
#What is the purpose of the '''/etc/resolv.conf''' file?
#What are type '''A''' records used for?
#What security features are available for DNS?
