Configure DNS in Linux

Domain Name Server (DNS) configuration using Bind version 8 or 9 Two of the most popular ways to configure the program Bind to perform DNS services is in the role of (1) ISP or (2) Web Host. 1. In an ISP configuration the DNS server must resolve IP addresses for any URL the user wishes to visit. ( DNS caching server) 2. In a purely web hosting configuration, Bind will only resolve for the IP addresses of the domains which are being hosted. This is the configuration which will be discussed and is often called an "Authoritative-only Nameserver". When resolving IP addresses for a domain, Internic is expecting a "Primary" and a "Secondary" DNS name server. (Sometimes called Master and Slave) Each DNS name server requires the file /etc/named.conf and the files it points to. This is typically two separate computer systems hosted on two different IP addresses. It is not necesary that the Linux servers be dedicated to DNS as they may run a web server, mail server, etc. Note on Bind versions: Red Hat versions 6.x used Bind version 8. Release 7.1 of Red Hat began using Bind version 9 and the GUI configuration tool bindconf was introduced for those of you that like a pretty point and click interface for configuration. Packages: • • Red Hat / Fedora Core / CentOS: bind Ubuntu (dapper 6.06) / Debian: bind9 Primary server (master): File: named.conf Red Hat / Fedora Core / CentOS: /etc/named.conf Ubuntu / Debian: /etc/bind/named.conf Place local definitions in /etc/bind/named.conf.local options { version "Bind"; - Don't disclose real version to hackers directory "/var/named"; allow-transfer { XXX.XXX.XXX.XXX; }; - IP address of secondary DNS recursion no; fetch-glue no; - Bind 8 only! Not used by version 9 }; zone "your-domain.com"{ type master; file "named.your-domain.com"; notify yes; }; zone "0.0.127.in-addr.arpa"{ type master; file "named.local"; allow-update { none; }; }; Note the omission of zone "." Page 1 of 13    File: /var/named/named.your-domain.com Red Hat 9 / CentOS 3: /var/named/named.your-domain.com Red Hat EL4 / Fedora Core / CentOS 4: [Chrooted] /var/named/chroot/var/named/data/named.your-domain.com Red Hat EL4 / Fedora Core / CentOS 4: /var/named/data/named.your-domain.com Ubuntu / Debian: /etc/bind/data/named.your-domain.com $TTL 604800 - Bind 9 (and some of the later versions of Bind 8) requires $TTL statement. Measured in seconds. This value is 7 days. your-domain.com. IN SOA ns1.your-domain.com. hostmaster.yourdomain.com. ( 2000021600 ; serial - Many people use year+month+day+integer as a system. Never greater than 2147483647 for a 32 bit processor. 86400 ; refresh - How often secondary servers (in seconds) should check in for changes in serial number. (86400 sec = 24 hrs) 7200 ; retry - How long secondary server should wait for a retry if contact failed. 1209600 ; expire - Secondary server to purge info after this length of time. 604800 ) ; default_ttl - How long data is held in cache by remote servers. IN A XXX.XXX.XXX.XXX - Note that this is the default IP address of the domain. I put the web server IP address here so that domain.com points to the same servers as www.domain.com ; ; Name servers for the domain ; IN NS ns1.your-domain.com. IN NS ns2.your-domain.com. ; ; Mail server for domain ; IN MX 5 mail - Identify "mail" as the node handling mail for the domain. Do NOT specify an IP address! ; ; Nodes in domain ; node1 IN A XXX.XXX.XXX.XXX - Note that this is the IP address of node1 ns1 IN A XXX.XXX.XXX.XXX - Optional: For hosting your own primary name server. Note that this is the IP address of ns1 ns2 IN A XXX.XXX.XXX.XXX - Optional: For hosting your own secondary name server. Note that this is the IP address of ns2 mail IN A XXX.XXX.XXX.XXX - Identify the IP address for node mail. IN MX 5 XXX.XXX.XXX.XXX - Identify the IP address for mail server named "mail". ; ; Aliases to existing nodes in domain ; www IN CNAME node1 - Define the webserver "www" to be node1. ftp IN CNAME node1 - Define the ftp server to be node1. Page 2 of 13    MX records for 3rd party off-site mail servers: your-domain.com. your-domain.com. IN MX IN MX 10 mail1.offsitemail.com. 20 mail2.offsitemail.com. Append to the above file. Secondary server (slave): File: named.conf Red Hat / Fedora Core / CentOS: /etc/named.conf Ubuntu / Debian: /etc/bind/named.conf options { version "Bind"; hackers directory "/var/named"; allow-transfer { none; }; recursion no; fetch-glue no; }; zone "your-domain.com"{ type slave; file "named.your-domain.com"; domain.com for RHEL4 chrooted bind masters { XXX.XXX.XXX.XXX; }; }; zone "0.0.127.in-addr.arpa"{ type master; file "named.local"; }; - Don't disclose real version to - Bind 8 only! Not used by version 9 - Specify slaves/named.your- IP address of primary DNS Note: RHEL4, CentOS 4, Fedora Core 3+ use chrooted directory structure permissions which require the use of the slaves subdirectory /var/named/slaves Man page on named.conf - Best source of information!!! [Potential Pitfall]: Ubuntu dapper - Create log file and set ownership and permission for file not created by installation: • • • touch /var/log/bindlog chown root.bind /var/log/bindlog chmod 664 /var/log/bindlog [Potential Pitfall]: Error in /var/log/messages: transfer of 'yolinux.com/IN' from XXX.XXX.XXX.XXX#53: failed while receiving responses: permission denied Named needs write permission on the directory containing the file. This condition often occurs for a new "slave" or "secondary" name server where the zone files do Page 3 of 13    not yet exist. The default (RHEL4, CentOS 4, Fedora Core 3, ...): • • drwxr-x--- 4 root named 4096 Aug 25 2004 named drwxrwx--- 2 named named 4096 Sep 17 20:37 slaves Fix: In named.conf specify that the slaves to go to slaves directory /var/named/chroot/var/named/slaves with the directive: file "slaves/named.your-domain.com"; Bind Defaults: • • Uses port 53 if none is specified with the listen-on port statement. Bind will use random ports above port 1024 for queries. For use with firewalls expecting all DNS traffic on port 53, specify the following option statement in /etc/named.conf query-source address * port 53; • Logging is to /var/log/messages After the configuration files have been edited, restart the name daemon. /etc/rc.d/init.d/named restart (Note: Debian uses the directory: /etc/init.d/) File: /var/named/named.your-domain.com This is created for you by Bind on the slave (secondary) server when it replicates from Primary server. DNS GUI configuration: • • Fedora Core 2/3: /usr/bin/system-config-bind Red Hat 8/9, Fedora Core 1: /usr/bin/redhat-config-bind Page 4 of 13    Page 5 of 13    Test DNS: Must install packages: • • Red Hat / Fedora Core / SuSE: bind-utils Ubuntu (dapper 6.06) / Debian: bind9-host Test the name server with the host command in interactive mode: host node.domain-to-test.com your-nameserver-to-test.domain.com Note: The name server may also be specified by IP address. or Test the name server with the nslookup command in interactive mode: Page 6 of 13    nslookup > server your-nameserver-to-test.domain.com > node.domain-to-test.com > exit Test the MX record if appropriate: nslookup -querytype=mx domain-to-test.com OR host -t mx domain-to-test.com Test using the dig command: dig @name-server domain-to-query OR dig @IP-address-of-name-server domain-to-query Test your DNS with the following DNS diagnostics web site: DnsStuff.com Extra logging to monitor Bind: Add the following to your /etc/named.conf file. logging { channel bindlog { file "/var/log/bindlog" versions 5 size 1m; Keep five old versions of the log-file (rotates logs) print-time yes; print-category yes; print-severity yes; }; category xfer-out { bindlog; }; - Zone transfers category xfer-in { bindlog; }; - Zone transfers category security { bindlog; }; - Approved/unapproved requests // The following logging statements, panic, insist and response-checks are valid for Bind 8 only. Do not user for version 9. category panic { bindlog; }; - System shutdowns category insist { bindlog; }; - Internal consistency check failures category response-checks { bindlog; }; - Messages }; - Page 7 of 13    Chroot Bind for extra security: Note: Most modern Linux distributions default to a "chrooted" installation. This technique runs the Bind name service with a view of the filesystem which changes the definition of the root directory "/" to a directory in which Bind will operate. i.e. /var/named/chroot. The following example uses the Red Hat RPM bind-8.2.3-0.6.x.i386.rpm. Applies to Bind version 9 as well. The latest RedHat bind updates run the named as user "named" to avoid a lot of earlier hacker exploits. To chroot the process is to create an even more secure environment by limiting the view of the system that the process can access. The process is limited to the chrooted directory assigned. The chroot of the named process to a directory under a given user will prevent the possibility of an exploit which at one time would result in root access. The original default RedHat configuration (6.2) ran the named process as root, thus if an exploit was found, the named process will allow the hacker to use the privileges of the root user. (no longer true) Named Command Sytax: named -u user -g group -t directory-to-chroot-to Example: named -u named -g named -t /opt/named When chrooted, the process does not have access to system libraries thus a local lib directory is required with the appropriate library files - theoretically. This does not seem to be the case here and as noted above in chrooted FTP. It's a mystery to me but it works???? Another method to handle libraries is to re-compile the named binary with everything statically linked. Add -static to the compile options. The chrooted process should also require a local /etc/named.conf etc... but doesn't seem to??? Script to create a chrooted bind environment: #!/bin/sh cd /opt mkdir named cd named mkdir etc mkdir bin mkdir var cd var mkdir named mkdir run cd .. chown -R named.named bin etc var Page 8 of 13    You can probably stop here. If your system acts like a chrooted system should, then continue with the following: cp -p /etc/named.conf etc cp -p /etc/localtime etc cp -p /bin/false bin echo "named:x:25:25:Named:/var/named:/bin/false" > etc/passwd echo "named:x:25:" > etc/group touch var/run/named.pid if [ -f /etc/namedb ] then cp -p /etc/namedb etc/namedb fi mkdir dev cd dev # Create a character unbuffered file. mknod -m ugo+rw null c 1 3 cd .. chown -R named.named bin etc var Add changes to the init script: /etc/rc.d/init.d/named #!/bin/bash # # named This shell script takes care of starting and stopping # named (BIND DNS server). # # chkconfig: - 55 45 # description: named (BIND) is a Domain Name Server (DNS) \ # that is used to resolve host names to IP addresses. # probe: true # Source function library. . /etc/rc.d/init.d/functions # Source networking configuration. . /etc/sysconfig/network # Check that networking is up. [ ${NETWORKING} = "no" ] && exit 0 [ -f /etc/sysconfig/named ] && . /etc/sysconfig/named version 7.1 [ -f /usr/sbin/named ] || exit 0 [ -f /etc/named.conf ] || exit 0 RETVAL=0 - Added in Red Hat Page 9 of 13    start() { # Start daemons. echo -n "Starting named: " daemon named -u named -g named -t /opt/named - Change made here RETVAL=$? [ $RETVAL -eq 0 ] && touch /var/lock/subsys/named echo return $RETVAL } stop() { # Stop daemons. echo -n "Shutting down named: " killproc named RETVAL=$? [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/named echo return $RETVAL } rhstatus() { /usr/sbin/ndc status return $? } restart() { stop start } reload() { /usr/sbin/ndc reload return $? } probe() { # named knows how to reload intelligently; we don't want linuxconf # to offer to restart every time /usr/sbin/ndc reload >/dev/null 2>&1 || echo start return $? } # See how we were called. case "$1" in start) start ;; stop) stop ;; status) rhstatus ;; restart) restart ;; condrestart) [ -f /var/lock/subsys/named ] && restart || : ;; Page 10 of 13    reload) reload ;; probe) probe ;; *) echo "Usage: named {start|stop|status|restart|condrestart|reload|probe}" exit 1 esac exit $? Note: The current version of bind from the RedHat errata updates and security fixes (http://www.redhat.com/support/errata/) runs the named process as user "named" in the home (not chrooted) directory /var/named with no shell available. (named -u named) This should be secure enough. Proceed with a chrooted installation if your are paranoid. Chrooted DNS configuration: Modern releases of Linux (i.e. Fedore Core 3, Red Hat Enterprise Linux 4) come preconfigured to use "chrooted" bind. This security feature forces even an exploited version of bind to only operate within the "chrooted" jail /var/named/chroot which contains the familiar directories: • • /var/named/chroot/etc: Configuration files /var/named/chroot/dev: devices used by bind: o /dev/null o /dev/random o /dev/zero (Real devices created with the mknod command.) • /var/named/chroot/var: Zone files and configuration information. These directories are generated and configured by the Red Hat/Fedora RPM package "bindchroot". If building from source you will have to generate this configuration manually: • • • • • mkdir mkdir mknod mknod mknod -p /var/named/chroot /var/named/chroot/dev /var/named/chroot/dev/null c 1 3 /var/named/chroot/dev/zero c 1 5 /var/named/chroot/dev/random c 1 8 Page 11 of 13    • • • • • • • • • • • • • chmod mkdir ln -s mkdir ln -s ln -s 666 -R /var/named/chroot/dev -p /var/named/chroot/etc /var/named/chroot/etc/named.conf /etc/named.conf -p /var/named/chroot/var/named /var/named/chroot/var/named/named.XXXX /var/named/named.XXXX /var/named/chroot/var/named/named.YYYY /var/named/named.YYYY -p -p -p -p -R -R /var/named/chroot/var/named/slaves /var/named/chroot/var/named/data /var/named/chroot/var/run /var/named/chroot/var/tmp named:named /var/named/chroot root:named /var/named/chroot/var/named ... mkdir mkdir mkdir mkdir chown chown Load Balancing of servers using Bind: DNS Round-Robin This will populate name servers around the world with different IP addresses for your web server www.your-domain.com www0 www1 www2 www3 www4 www5 www IN IN IN IN IN IN IN IN IN IN IN IN IN A A A A A A CNAME CNAME CNAME CNAME CNAME CNAME CNAME XXX.XXX.XXX.1 XXX.XXX.XXX.2 XXX.XXX.XXX.3 XXX.XXX.XXX.4 XXX.XXX.XXX.5 XXX.XXX.XXX.6 www0.your-domain.com. www1.your-domain.com. www2.your-domain.com. www3.your-domain.com. www4.your-domain.com. www5.your-domain.com. www6.your-domain.com. Bind/DNS Links: • • • • • • • • • • • • • Internet Software Consortium (ISC) Home Page - ISC Bind Home Bind FAQ, pitfalls and answers Zytrax Bind 9 manual - Bind for rocket scientists comp.protocols.tcp-ip.domains FAQ - HTML version More on load balancing and round robin schemes LDP DNS-HOWTO ACME: DNS resources DNS Security presentation - Cricket Liu (coauthor of DNS and Bind) DNS Security Paper - Craig Rowland GraniteCanyon.com: Free DNS hosting - If you don't want to set it up, have someone do it for you. EveryDNS.net - Free DNS DNS2GO - Domain hosting for DHCP clients. Secondary.com - Free secondary names server hosting (five or fewer domains) Page 12 of 13    • • • • TZO.com - Dynamic, secondary DNS services. UltraDNS.com - Outsourced DNS management and service DynDNS.org Command: ipcheck.py -i eth0 DynDNS-user-id password node.dnsalias.net Then add script update.dyndns.ip to directory /etc/cron.daily/ to update IP. This host must also be allowed access through any firewall rules. DynDNS/TODD - Dynamic DNS for those with dynamic IP addresses. (i.e. dial-up game servers etc.) Domain name registration: • Domain Name Registrars: o NetworkSolutions.com o Register.com o Registrar.GoDaddy.com - Domain name registration for only $8.95/year!!! o Dotster.com - Domain name registration for only $14.95/year o DomainsNext.com - $11.95/year o EasyDNS.com - $25.00/year o Aplus.net - Domain Registration $7.95/year - Not good o Gandi.net - European AfterNic.com - Domain name exchange and auction. BuyDomains.com - Buy a domain name that a squatter is holding. • • Note that the Name registrations policies for the registrars are stated at ICANN.org. • • You must renew with the same registrar within five days BEFORE the expiration date. There is no rule for afterwards. Most free a domain name 30 days after it expires.   Page 13 of 13