Primary DNS Configuration in CentOS 6 (with chroot)

This tutorial is based on a previous article. The configuration of the DNS Servers using chroot and not using chroot are almost identical. Here's how it's done -

 

Objective

We would be configuring the primary DNS Server for the domain testdom.inv (yes, the top level domain is inv i.e. 'invalid').  The FQDN (Fully Qualified Domain Name) of the server is ns1.testdom.inv. This is a simulation, so you better get your Server off the Internet-

1. make sure the Server does not have any real IP
2. make sure that the file /etc/resolv.conf does not contain any IP address of a valid DNS Server.

Here is the IP Database

• DNS Server 192.168.1.13
• Web Server 192.168.1.12
• FTP Server 192.168.1.11

Procedure

Phase1:

The first thing when it comes to configuring any Server is setting up the hostname of the Server properly. We have to modify the following lines in the mentioned files -

[root@centu ~]# vim /etc/sysconfig/network

HOSTNAME=ns1.testdom.inv

[root@centu ~]# vim /etc/hosts

192.168.1.13    ns1.testdom.inv   ns1

Changing hostname like this sometimes takes effect after a Server reboot. To avoid that, we also set the hostname as ns1.testdom.inv temporarily until the next reboot.

[root@centu ~]# hostname ns1.testdom.inv
[root@centu ~]# hostname
ns1.testdom.inv 

Finally, we set the resolver IP

[root@ns1 ~]# vim /etc/resolv.conf

nameserver 192.168.1.13

Phase 2:

We would be setting up the package bind to provide DNS service.The package can be easily installed using yum. First we remove any previous version of bind, bind-chroot and then we install the required packages.

[root@ns1 ~]# yum install bind bind-chroot
Loaded plugins: fastestmirror, presto
Determining fastest mirrors
 * base: ossm.utm.my
 * extras: ossm.utm.my
 * rpmforge: mirror.oscc.org.my
 * updates: ossm.utm.my
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package bind.i686 32:9.7.3-8.P3.el6_2.3 set to be updated
--> Processing Dependency: bind-libs = 32:9.7.3-8.P3.el6_2.3 for package: 32:bin                                             d-9.7.3-8.P3.el6_2.3.i686
--> Processing Dependency: liblwres.so.60 for package: 32:bind-9.7.3-8.P3.el6_2.                                             3.i686
--> Processing Dependency: libisccfg.so.62 for package: 32:bind-9.7.3-8.P3.el6_2                                             .3.i686
--> Processing Dependency: libisccc.so.60 for package: 32:bind-9.7.3-8.P3.el6_2.                                             3.i686
--> Processing Dependency: libisc.so.62 for package: 32:bind-9.7.3-8.P3.el6_2.3.                                             i686
--> Processing Dependency: libdns.so.69 for package: 32:bind-9.7.3-8.P3.el6_2.3.                                             i686
--> Processing Dependency: libbind9.so.60 for package: 32:bind-9.7.3-8.P3.el6_2.                                             3.i686
---> Package bind-chroot.i686 32:9.7.3-8.P3.el6_2.3 set to be updated
--> Running transaction check
---> Package bind-libs.i686 32:9.7.3-8.P3.el6_2.3 set to be updated
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
 Package           Arch       Version                       Repository     Size
================================================================================
Installing:
 bind              i686       32:9.7.3-8.P3.el6_2.3         updates       3.9 M
 bind-chroot       i686       32:9.7.3-8.P3.el6_2.3         updates        68 k
Installing for dependencies:
 bind-libs         i686       32:9.7.3-8.P3.el6_2.3         updates       851 k

Transaction Summary
================================================================================
Install       3 Package(s)
Upgrade       0 Package(s)

Total download size: 4.8 M
Installed size: 9.2 M
Is this ok [y/N]: y
Downloading Packages:
Setting up and reading Presto delta metadata
updates/prestodelta                                                                                   | 394 kB     00:13
Processing delta metadata
Package(s) data still to download: 4.8 M
(1/3): bind-9.7.3-8.P3.el6_2.3.i686.rpm                                                               | 3.9 MB     02:25
(2/3): bind-chroot-9.7.3-8.P3.el6_2.3.i686.rpm                                                        |  68 kB     00:01
(3/3): bind-libs-9.7.3-8.P3.el6_2.3.i686.rpm                                                          | 851 kB     00:27
-----------------------------------------------------------------------------------------------------------------------------
Total                                                                                         28 kB/s | 4.8 MB     02:56
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
Warning: RPMDB altered outside of yum.
  Installing     : 32:bind-libs-9.7.3-8.P3.el6_2.3.i686                                                                  1/3
  Installing     : 32:bind-9.7.3-8.P3.el6_2.3.i686                                                                       2/3
  Installing     : 32:bind-chroot-9.7.3-8.P3.el6_2.3.i686                                                                3/3

Installed:
  bind.i686 32:9.7.3-8.P3.el6_2.3                           bind-chroot.i686 32:9.7.3-8.P3.el6_2.3

Dependency Installed:
  bind-libs.i686 32:9.7.3-8.P3.el6_2.3

Complete!

Phase 3:

 Now we prepare the configuration file /var/named/chroot/etc/named.conf

[root@ns1 ~]# cp /usr/share/doc/bind-9.7.0/sample/etc/named.rfc1912.zones /var/named/chroot/etc/named.conf

[root@ns1 ~]# vim /var/named/chroot/etc/named.conf

#### Please add/modify the following lines ####

options {
        directory "/var/named"; // the path of the zone files
        forwarders {4.2.2.1; }; // in case of DNS query failure, the IP of the next DNS Server where the queries would be forwarded
};


// declaration of the forward zone
zone "testdom.inv" IN {
        type master;
        file "testdom-fz"; //forward zone file stored in /var/named
        allow-update { none; };
};

// declaration of reverse zone
zone "1.168.192.in-addr.arpa" IN {
        type master;
        file "testdom-rz"; // reverse zone file stored in /var/named
        allow-update { none; };
};

Phase 4:

Now it's time to prepare the zone files. The zone files are stored in /var/named/chroot/var/named. The character '@' denotes a 'NULL' value in these files. Please be careful while writing as syntax errors in these files can easily occur. 
IMPORTANT: Every FQDN declared in the zone files has a '.' in the end.

Forward Zone

[root@ns1 ~]# cd /var/named/chroot/var/named
[root@ns1 named]# cp named.localhost testdom-fz
[root@ns1 named]# vim testdom-fz 

;Comment: this is the forward zone file

; IMPORTANT every FQDN has a trailing dot '.'

$TTL 1D
;Comment: FORMAT
;Comment: @      IN SOA  FQDN email (user.domain.tld) (

@       IN SOA  ns1.testdom.inv. admin.testdom.inv. (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        IN NS      ns1.testdom.inv.
        IN A       192.168.1.13
ns1     IN A       192.168.1.13
www     IN A       192.168.1.12
ftp     IN A       192.168.1.11

Reverse Zone

[root@ns1 ~]# cd /var/named/chroot/var/named
[root@ns1 named]# cp testdom-fz testdom-rz
[root@ns1 named]# vim testdom-rz 

;this is the reverse zone file

; IMPORTANT every FQDN has a trailing dot '.'

$TTL 1D
;FORMAT
;@      IN SOA  FQDN email (user.domain.tld) (

@       IN SOA  ns1.testdom.inv. admin.testdom.inv. (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      ns1.testdom.inv.
13      IN PTR  ns1.testdom.inv.
12      IN PTR  www.testdom.inv.
11      IN PTR  ftp.testdom.inv.

Now, we have to change the ownership of the zone files to match the permission of the other files in the directory.

[root@ns1 named]# cd /var/named/chroot/var/named
[root@ns1 named]# chgrp named testdom-*

[root@ns1 named]# ls -l test*
total 48
-rw-r----- 1 root  named  325 May 31 11:16 testdom-fz
-rw-r----- 1 root  named  318 May 31 11:12 testdom-rz

Finally it's time to start the DNS Service.

[root@ns1 named]# service named restart
Stopping named:                             [  OK  ]
Starting named:                             [  OK  ]
[root@ns1 named]# chkconfig named on

Phase 5:

Finally it's time for testing.

[root@ns1 named]# yum install bind-utils
Loaded plugins: fastestmirror, presto
Loading mirror speeds from cached hostfile
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package bind-utils.i686 32:9.7.0-5.P2.el6 set to be updated
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
 Package            Arch         Version                    Repository     Size
================================================================================
Installing:
 bind-utils         i686         32:9.7.0-5.P2.el6          myyum         173 k

Transaction Summary
================================================================================
Install       1 Package(s)
Upgrade       0 Package(s)

Total download size: 173 k
Installed size: 419 k
Is this ok [y/N]: y
Downloading Packages:
Setting up and reading Presto delta metadata
Processing delta metadata
Package(s) data still to download: 173 k
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Installing     : 32:bind-utils-9.7.0-5.P2.el6.i686                        1/1 

Installed:
  bind-utils.i686 32:9.7.0-5.P2.el6                                             

Complete!
[root@ns1 named]# 

We would be using the command dig for testing DNS configuration. The command dig sends a query and waits for answers. Here is a demo -

IMPORTANT: The first thing to look for is in the status NOERROR . If the value is anything other, then there is a problem i.e. NXDOMAIN - Non eXisting DOMAIN, SERVFAIL - SERVer FAILure

[root@ns1 named]# dig ns1.testdom.inv

; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6 <<>> ns1.testdom.inv
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37595
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;ns1.testdom.inv.        IN    A

;; ANSWER SECTION:
ns1.testdom.inv.    86400    IN    A    192.168.1.13

;; AUTHORITY SECTION:
testdom.inv.        86400    IN    NS    ns1.testdom.inv.

;; Query time: 1 msec
;; SERVER: 192.168.1.13#53(192.168.1.13)
;; WHEN: Thu May 31 11:39:52 2012
;; MSG SIZE  rcvd: 63

As we can see from the output, the ANSWER SECTION states that the A Record i.e. IP address of ns1.testdom.inv. is 192.168.1.13

[root@ns1 named]# dig -x 192.168.1.13

; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6 <<>> -x 192.168.1.13
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6969
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;13.1.168.192.in-addr.arpa.    IN    PTR

;; ANSWER SECTION:
13.1.168.192.in-addr.arpa. 86400 IN    PTR    ns1.testdom.inv.

;; AUTHORITY SECTION:
1.168.192.in-addr.arpa.    86400    IN    NS    ns1.testdom.inv.

;; ADDITIONAL SECTION:
ns1.testdom.inv.    86400    IN    A    192.168.1.13

;; Query time: 2 msec
;; SERVER: 192.168.1.13#53(192.168.1.13)
;; WHEN: Thu May 31 11:41:27 2012
;; MSG SIZE  rcvd: 102

Again, as we can see from the output, the ANSWER SECTION states that the IP address 192.168.1.13 points to i.e. PTR Record ns1.testdom.inv.

The DNS Server should also work for www or ftp servers in testdom.inv. You can also check using nslookup and ping.

Hope this helps.