Primary DNS Server in CentOS 6 (without chroot)
Objective
We would be configuring the primary DNS Server for the domain testdom.inv (yes, the top level domain is inv i.e. 'invalid'). The FQDN (Fully Qualified Domain Name) of the server is ns1.testdom.inv. This is a simulation, so you better get your Server off the Internet-- make sure the Server does not have any real IP
- make sure that the file /etc/resolv.conf does not contain any IP address of a valid DNS Server.
Here is the IP Database
- DNS Server 192.168.1.13
- Web Server 192.168.1.12
- FTP Server 192.168.1.11
Procedure
Phase1:
The first thing when it comes to configuring any Server is setting up the hostname of the Server properly. We have to modify the following lines in the mentioned files -[root@centu ~]# vim /etc/sysconfig/network
HOSTNAME=ns1.testdom.inv
[root@centu ~]# vim /etc/hosts
192.168.1.13 ns1.testdom.inv ns1
Changing hostname like this sometimes takes effect after a Server reboot. To avoid that, we also set the hostname as ns1.testdom.com temporarily until the next reboot.
[root@centu ~]# hostname ns1.testdom.inv
[root@centu ~]# hostname
ns1.testdom.inv Finally, we set the resolver IP
[root@ns1 ~]# vim /etc/resolv.conf
nameserver 192.168.1.13
Phase 2:
We would be setting up the package bind to provide DNS service.The package can be easily installed using yum. First we remove any previous version of bind, bind-chroot and then we install the required packages.[root@ns1 ~]# yum erase bind bind-chroot
[root@ns1 ~]# yum install bind
Loaded plugins: fastestmirror, presto
Loading mirror speeds from cached hostfile
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package bind.i686 32:9.7.0-5.P2.el6 set to be updated
--> Finished Dependency Resolution
Dependencies Resolved
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
bind i686 32:9.7.0-5.P2.el6 myyum 3.5 M
Transaction Summary
================================================================================
Install 1 Package(s)
Upgrade 0 Package(s)
Total download size: 3.5 M
Installed size: 6.4 M
Is this ok [y/N]: y
Downloading Packages:
Setting up and reading Presto delta metadata
Processing delta metadata
Package(s) data still to download: 3.5 M
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
Installing : 32:bind-9.7.0-5.P2.el6.i686 1/1
Installed:
bind.i686 32:9.7.0-5.P2.el6
Complete!
Phase 3:
Now we prepare the configuration file /etc/named.conf[root@ns1 ~]# cp /usr/share/doc/bind-9.7.0/sample/etc/named.rfc1912.zones /etc/named.conf
cp: overwrite `/etc/named.conf'? y
[root@ns1 ~]# vim /etc/named.conf
#### Please add/modify the following lines ####
options {
directory "/var/named"; // the path of the zone files
forwarders {4.2.2.1; }; // in case of DNS query failure, the IP of the next DNS Server where the queries would be forwarded
};
// declaration of the forward zone
zone "testdom.inv" IN {
type master;
file "testdom-fz"; //forward zone file stored in /var/named
allow-update { none; };
};
// declaration of reverse zone
zone "1.168.192.in-addr.arpa" IN {
type master;
file "testdom-rz"; // reverse zone file stored in /var/named
allow-update { none; };
};
Phase 4:
Now it's time to prepare the zone files. The zone files are stored in /var/named. The character '@' denotes a 'NULL' value in these files. Please be careful while writing as syntax errors in these files can easily occur.IMPORTANT: Every FQDN declared in the zone files has a '.' in the end.
Forward Zone
[root@ns1 ~]# cd /var/named
[root@ns1 named]# cp named.localhost testdom-fz
[root@ns1 named]# vim testdom-fz
;Comment: this is the forward zone file
; IMPORTANT every FQDN has a trailing dot '.'
$TTL 1D
;Comment: FORMAT
;Comment: @ IN SOA FQDN email (user.domain.tld) (
@ IN SOA ns1.testdom.inv. user.testdom.inv. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
IN NS ns1.testdom.inv.
IN A 192.168.1.13
ns1 IN A 192.168.1.13
www IN A 192.168.1.12
ftp IN A 192.168.1.11
Reverse Zone
[root@ns1 ~]# cd /var/named
[root@ns1 named]# cp testdom-fz testdom-rz
[root@ns1 named]# vim testdom-rz
;this is the reverse zone file
; IMPORTANT every FQDN has a trailing dot '.'
$TTL 1D
;FORMAT
;@ IN SOA FQDN email (user.domain.tld) (
@ IN SOA ns1.testdom.inv. user.testdom.inv. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
IN NS ns1.testdom.inv.
13 IN PTR ns1.testdom.inv.
12 IN PTR www.testdom.inv.
11 IN PTR ftp.testdom.inv.
Now, we have to change the ownership of the zone files to match the permission of the other files in the directory.
[root@ns1 named]# cd /var/named
[root@ns1 named]# chgrp named testdom-*
[root@ns1 named]# ls -l test*
total 48
-rw-r----- 1 root named 325 May 31 11:16 testdom-fz
-rw-r----- 1 root named 318 May 31 11:12 testdom-rz
Finally it's time to start the DNS Service.
[root@ns1 named]# service named restart
Stopping named: [ OK ]
Starting named: [ OK ]
[root@ns1 named]# chkconfig named on
Phase 5:
Finally it's time for testing.[root@ns1 named]# yum install bind-utils
Loaded plugins: fastestmirror, presto
Loading mirror speeds from cached hostfile
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package bind-utils.i686 32:9.7.0-5.P2.el6 set to be updated
--> Finished Dependency Resolution
Dependencies Resolved
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
bind-utils i686 32:9.7.0-5.P2.el6 myyum 173 k
Transaction Summary
================================================================================
Install 1 Package(s)
Upgrade 0 Package(s)
Total download size: 173 k
Installed size: 419 k
Is this ok [y/N]: y
Downloading Packages:
Setting up and reading Presto delta metadata
Processing delta metadata
Package(s) data still to download: 173 k
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
Installing : 32:bind-utils-9.7.0-5.P2.el6.i686 1/1
Installed:
bind-utils.i686 32:9.7.0-5.P2.el6
Complete!
[root@ns1 named]#
We would be using the command dig for testing DNS configuration. The command dig sends a query and waits for answers. Here is a demo -
IMPORTANT: The first thing to look for is in the status NOERROR . If the value is anything other, then there is a problem i.e. NXDOMAIN - Non eXisting DOMAIN, SERVFAIL - SERVer FAILure
[root@ns1 named]# dig ns1.testdom.inv
; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6 <<>> ns1.testdom.inv
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37595
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;ns1.testdom.inv. IN A
;; ANSWER SECTION:
ns1.testdom.inv. 86400 IN A 192.168.1.13
;; AUTHORITY SECTION:
testdom.inv. 86400 IN NS ns1.testdom.inv.
;; Query time: 1 msec
;; SERVER: 192.168.1.13#53(192.168.1.13)
;; WHEN: Thu May 31 11:39:52 2012
;; MSG SIZE rcvd: 63
As we can see from the output, the ANSWER SECTION states that the A Record i.e. IP address of ns1.testdom.inv. is 192.168.1.13
[root@ns1 named]# dig -x 192.168.1.13
; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6 <<>> -x 192.168.1.13
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6969
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
;; QUESTION SECTION:
;13.1.168.192.in-addr.arpa. IN PTR
;; ANSWER SECTION:
13.1.168.192.in-addr.arpa. 86400 IN PTR ns1.testdom.inv.
;; AUTHORITY SECTION:
1.168.192.in-addr.arpa. 86400 IN NS ns1.testdom.inv.
;; ADDITIONAL SECTION:
ns1.testdom.inv. 86400 IN A 192.168.1.13
;; Query time: 2 msec
;; SERVER: 192.168.1.13#53(192.168.1.13)
;; WHEN: Thu May 31 11:41:27 2012
;; MSG SIZE rcvd: 102
Again, as we can see from the output, the ANSWER SECTION states that the IP address 192.168.1.13 points to i.e. PTR Record ns1.testdom.inv.
The DNS Server should also work for www or ftp servers in testdom.inv. You can also check using nslookup and ping.
Hope this helps.
Comments
Post a Comment