Internal(LOCAL) DNS Implementation for DR-Punjab IFMS-IWDMS Project
Internal(LOCAL) DNS Implementation for DR-Punjab IFMS-IWDMS Project
Table of Contents
Overview3
Servers3
Domain3
Master DNS Installation4
Testing of DNS14
Overview
The Domain Name System (DNS) is a set of protocols and services on a TCP/IP network that allows users of the network to utilize hierarchical user-friendly names when looking for other hosts (that is, computers) instead of having to remember and use their IP addresses. This system is used extensively on the Internet and in many private enterprises today. If you've used a Web browser, Telnet application, FTP utility, or other similar TCP/IP utilities on the Internet, then you have probably used a DNS server.
The DNS protocol's best-known function is mapping user-friendly names to IP addresses. For example, suppose the our ldap at pbifsiwdms.pjb had an IP address of 192.168.10.98. Most people would reach this computer by specifying ldap.pbifmsiwdms.pjb and not the less "friendly" IP address. Besides being easier to remember, the name is more reliable. The numeric address could change for any number of reasons, but the name can always be used.
Before the implementation of DNS, the use of user-friendly computer names was done through the use of HOSTS files, which contained a list of names and associated IP addresses. On the Internet, this file was centrally administered and each location would periodically download a new copy. As the number of machines on the Internet grew, this became an unmanageable solution. The need for something better arose. This better solution became DNS.
Server
Hostame : pbdrntp.pbifmsiwdms.pjb
IP Address : 172.22.10.60
Domains
- punjabgovt.gov.in
- pbifmsiwdms.pjb (local internal domain)
Note : This is a miror copy of Chandigarh DC Master DNS, if any changes done on DC site then rsync zone file to here then restart named and DR Local DNS is in 172.22.10.53
DNS Installation
Steps :
- First we need to install Bind9
yum install bind* -y
After installing Bind we need to configure it. Bind9 on Red provide sample configuration files in /var/named .by default, look sample file for named.conf in /etc and paste to /var/named/chroot/etc in named.conf file, zones data files directory location and zone names are specified in /var/named. Domain names like punjabgovt.gov.in and zones are synonymous. By default bind using chroot environment,
Check whether it is in chrooted environment or not
# less /etc/sysconfig/named
and check in the last line ROOTDIR=/var/named/chroot is uncommented, if it is uncommented that means your bind is in chrooted environment.
- Now copy the sample named.conf file from /usr/share/doc/bind-9.3.4/sample/etc/named.conf to /var/named/chroot/etc
# cp /usr/share/doc/bind-9.3.4/sample/etc/named.conf /var/named/chroot/etc
Configuration of master in named.conf
options {
listen-on port 53 { 127.0.0.1; 192.168.0.0/16; 172.22.0.0/16; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
// Those options should be used carefully because they disable port
// randomization
// query-source port 53;
// query-source-v6 port 53;
allow-query { localhost; 192.168.0.0/16; 172.22.0.0/16; };
allow-query-cache { localhost; 192.168.0.0/16; 172.22.0.0/16; };
};
/*
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
//Added by Navdeep
zone "." IN {
type hint;
file "root.hints";
};
//Added by Navdeep
zone "0.0.127.in-addr.arpa" IN {
type master;
file "rev.zone";
allow-update { none; };
};
zone "10.168.192.in-addr.arpa" IN {
type master;
file "domainrev.zone";
allow-update { none; };
};
zone "168.192.in-addr.arpa" IN {
type master;
file "mailrev.zone";
allow-update { none; };
};
zone "punjabgovt.gov.in" {
type master;
file "/var/named/punjabgovt.gov.in.zone";
};
zone "pbifmsiwdms.pjb" {
type master;
file "/var/named/pbifmsiwdms.pjb.zone";
};
Zones
A zone is some portion of the DNS namespace whose database records exist and are managed in a particular zone file. A single DNS server might be configured to manage one or multiple zone files. We configured two forward zones “punjabgovt.gov.in” , “pbifmsiwdms.pjb” and two reverse zones.
zone "0.0.127.in-addr.arpa" IN {
type master;
file "rev.zone";
allow-update { none; };
};
zone "10.168.192.in-addr.arpa" IN {
type master;
file "domainrev.zone";
allow-update { none; };
};
zone "168.192.in-addr.arpa" IN {
type master;
file "mailrev.zone";
allow-update { none; };
};
zone "punjabgovt.gov.in" {
type master;
file "/var/named/punjabgovt.gov.in.zone";
};
zone "pbifmsiwdms.pjb" {
type master;
file "/var/named/pbifmsiwdms.pjb.zone";
};
Note It is very important that you understand the difference between a zone and a domain. A zone is a physical file, composed of resource records, that defines a group of domains. A domain is a node in the DNS namespace and all sub domains below it.
- The ownership of named.conf for users and groups must be named
#chown named.named named.conf
- Change the permission of named.conf to 775
# chmod 775 named.conf
- Create the soft link for named.conf in /etc/named.conf
# ln –s /var/named/chroot/etc/named.conf /etc/named.conf
The Database/Zone File
A database file or "zone file" is the file that contains the resource records for that part of the domain for which the zone is responsible. Some of the common resource records are given below. This file should be edited and renamed before you use it on a production DNS server. It is generally a good idea to name this file the same as the zone it represents. This is the file that will be replicated between masters and slaves. The location of these zone files are /var/named/chroot/var/named.
Let’s explain what all this means. directory specifies the data files or zones files that Bind9 will search for. Then we have a zone “localhost ” defined which is of type “master” and the name of the zone file is “localhost.zone”. This zone is needed otherwise our DNS will send queries to the root domains even for localhost. Similarly, we have defined zone called “punjabgovt.gov.in” and “pbifmsiwdms.pjb” which is of type “master” and whose zone file, “punjabgovt.gov.in.zone” and “pbifmsiwdms.pjb.zone”, is located in /var/named/chroot/var/named.
We will just copy the sample named.localhost zone file supplied with Bind9 installation and not create it from scratch. To do that type the following:
# cp /usr/share/doc/bind-9.3.4/sample/var/named/named.localhost /var/named/chroot/var/named
named.localhost looks like this
$TTL 86400
@ IN SOA @ root (
42 ; serial (d. adams)
3H ; refresh
15M ; retry
1W ; expiry
1D ) ; minimum
IN NS @
IN A 127.0.0.1
IN AAAA ::1
Now we have to set up our “punjabgovt.gov.in” and “pbifmsiwdms.pjb”. zone. According to our /var/named/chroot/etc/named.conf file, it must be in /var/named/chroot/var/named/punjabgovt.gov.in.zone /var/named/chroot/var/named/pbifmsiwdms.pjb.zone
- Zone : “punjabgovt.gov.in.zone” in /var/named/chroot/var/named
$TTL 86400
@ IN SOA pbifmsntp1.punjabgovt.gov.in. service.tetrain.com. (
53 ; serial (d. adams)
3H ; refresh
15M ; retry
1W ; expiry
1D ) ; minimum
; IN NS .in.
;localhost IN A 127.0.0.1
@ IN NS ns1.punjabgovt.gov.in.
punjabgovt.gov.in. IN A 117.239.86.52
www IN CNAME punjabgovt.gov.in.
ns1.punjabgovt.gov.in. IN A 192.168.10.81
punjabgovt.gov.in. IN MX 10 mail.punjabgovt.gov.in.
mx.punjabgovt.gov.in. IN A 192.168.70.22
mail.punjabgovt.gov.in. IN A 192.168.70.53
pbifmsemail1.punjabgovt.gov.in. IN A 192.168.70.54
pbifmsemail2.punjabgovt.gov.in. IN A 192.168.70.55
pbifmsemailrly1.punjabgovt.gov.in. IN A 192.168.70.56
smtp1.punjabgovt.gov.in. IN A 192.168.70.56
pbifmsemailrly2.punjabgovt.gov.in. IN A 192.168.70.57
smtp2.punjabgovt.gov.in. IN A 192.168.70.57
portalproduction.punjabgovt.gov.in. IN A 192.168.20.52
sso.punjabgovt.gov.in. IN A 192.168.20.57
ifmsstg.punjabgovt.gov.in. IN A 192.168.20.63
iwdmsstg.punjabgovt.gov.in. IN A 192.168.20.64
- Zone : “pbifmsiwdms.zone” in /var/named/chroot/var/named
$TTL 86400
@ IN SOA ns1.pbifmsiwdms.pjb. service.tetrain.com. (
47 ; serial (d. adams)
3H ; refresh
15M ; retry
1W ; expiry
1D ) ; minimum
; IN NS .in.
;localhost IN A 127.0.0.1
@ IN NS ns1.pbifmsiwdms.pjb.
ns1.pbifmsiwdms.pjb. IN A192.168.10.81
ldap IN A 192.168.10.98
ldap1.pbifmsiwdms.pjb. IN A 192.168.10.91
ldap2.pbifmsiwdms.pjb. IN A 192.168.10.96
samba.pbifmsiwdms.pjb. IN A 192.168.10.93
pbifmsntp1.pbifmsiwdms.pjb. IN A 192.168.10.81
pbifmsntp2.pbifmsiwdms.pjb. IN A 192.168.10.82
aaa.pbifmsiwdms.pjb. IN A 192.168.10.104
aaa1.pbifmsiwdms.pjb. IN A 192.168.10.92
aaa2.pbifmsiwdms.pjb. IN A 192.168.10.97
squid.pbifmsiwdms.pjb. IN A 192.168.10.105
squid1.pbifmsiwdms.pjb. IN A 192.168.10.94
squid2.pbifmsiwdms.pjb. IN A 192.168.10.99
pbifmsdomain1.pbifmsiwdms.pjb. IN A 192.168.10.57
pbifmsdomain2.pbifmsiwdms.pjb. IN A 192.168.10.58
pbifmsemail1.pbifmsiwdms.pjb. IN A 192.168.70.54
email2.pbifmsiwdms.pjb. IN A 192.168.70.55
pbifmsemailrly1.pbifmsiwdms.pjb. IN A 192.168.70.56
pbifmsemailrly2.pbifmsiwdms.pjb. IN A 192.168.70.57
archivezimbra.pbifmsiwdms.pjb. IN A 192.168.70.60
archivezimbra.pbifmsiwdms.pjb. IN MX 10 archivezimbra.pbifmsiwdms.pjb.
The first line shows default TTL for records when no ttl is defined.
The @ symbol represents our zone name which is pbifmsiwdms.pjb in our case and we are saying that for pbifmsiwdms.pjb SOA (Start of authority), authoritative DNS is ns1.pbifmsiwdms.pjb and contact email is service@tetrain.com (no, that is not a typo. In Bind parlance we have “.” instead of “@” in email addresses).
The next entries are used by slave DNS servers. Whenever Serial number is incremented the slave DNSes will know that zone data has changed and will download it. Every hour slave will check with this master server to see if zone data has been changed by looking at serial number.
If, for some reasons, it cannot contact master, then it will retry every 15 minutes until 4 weeks has passed. When that happens and slave is still unable to contact master, it will expire the zone data and will stop answering name resolution queries for this zone.
Next is negative caching TTL. This is how long a remote name server can cache negative responses about the zone. These are answers that say that a particular domain name or the type of data sought for a particular domain name doesn’t exist.
Next are different record types. First is NS, name server type. Names server for our zones is defined here which we have only one here. Next we have an A record type (name to IP mapping) for our authoritative dns server. We have to set this record because if our DNS server name cannot be resolved, how come someone could contact it for name resolutions of other hosts.
Note that we have mentioned only ns1 and the zone name is appended to it because it does not end in a dot (.).
Now we will just copy the sample named.loopback zone file supplied with Bind9 installation and not create it from scratch. To do that type the following:
# cp /usr/share/doc/bind-9.3.4/sample/var/named/named.loopback /var/named/chroot/var/named
named.loopback looks like
$TTL 1D
@IN SOA@ rname.invalid. (
0; serial
1D; refresh
1H; retry
1W; expire
3H ); minimum
NS@
A127.0.0.1
AAAA::1
PTRlocalhost.
Now we have to set up our “domainrev.zone” , “mailrev.zone” and “rev.zone”. According to our /var/named/chroot/etc/named.conf file, it must be in /var/named/chroot/var/named/domainrev.zone , /var/named/chroot/var/named/mailrev.zone and /var/named/chroot/var/named/rev.zone .
- Zone : “domainrev.zone” in /var/named/chroot/var/named
$TTL 86400
@ IN SOA pbifmsntp1.punjabgovt.gov.in. root.localhost. (
1997022700 ; Serial
28800 ; Refresh
14400 ; Retry
3600000 ; Expire
86400 ) ; Minimum
IN NS ns1.punjabgovt.gov.in.
81 IN PTR pbifmsntp1.pbifmsiwdms.pjb.
98 IN PTR ldap.pbifmsiwdms.pjb.
91 IN PTR ldap1.pbifmsiwdms.pjb.
96 IN PTR ldap2.pbifmsiwdms.pjb.
93 IN PTR samba.pbifmsiwdms.pjb .
82 IN PTR pbifmsntp2.pbifmsiwdms.pjb.
104 IN PTR aaa.pbifmsiwdms.pjb.
92 IN PTR aaa1.pbifmsiwdms.pjb.
97 IN PTR aaa2.pbifmsiwdms.pjb.
105 IN PTR squid.pbifmsiwdms.pjb.
94 IN PTR squid.pbifmsiwdms.pjb.
99 IN PTR squid.pbifmsiwdms.pjb.
57 IN PTR pbifmsdomain1.pbifmsiwdms.pjb.
- IN PTR pbifmsdomain2.pbifmsiwdms.pjb.
- Zone : “mailrev.zone” in /var/named/chroot/var/named
$TTL 86400
@ IN SOA pbifmsemail1.punjabgovt.gov.in. root.localhost. (
1997022700 ; Serial
28800 ; Refresh
14400 ; Retry
3600000 ; Expire
86400 ) ; Minimum
IN NS ns1.punjabgovt.gov.in.
22.70 IN PTR mx.punjabgovt.gov.in.
53.70 IN PTR mail.punjabgovt.gov.in.
54.70 IN PTR pbifmsemail1.punjabgovt.gov.in.
55.70 IN PTR pbifmsemail2.punjabgovt.gov.in.
56.70 IN PTR pbifmsemailrly1.punjabgovt.gov.in.
57.70 IN PTR pbifmsemailrly2.punjabgovt.gov.in.
60.70 IN PTR archivezimba.pbifmsiwdms.pjb.
57.20 IN PTR sso.punjabgovt.gov.in.
52.20 IN PTR portalproduction.punjabgovt.gov.in.
63.20 IN PTR ifmsstg.punjabgovt.gov.in.
64.20 IN PTR iwdmsstg.punjabgovt.gov.in.
- Zone : “rev.zone” in /var/named/chroot/var/named
$TTL 86400
@ IN SOA localhost. root.localhost. (
1997022700 ; Serial
28800 ; Refresh
14400 ; Retry
3600000 ; Expire
86400 ) ; Minimum
IN NS localhost.
1 IN PTR localhost.
- Change the ownership to /var/named/chroot/var/named
# chown named.named /var/named/chroot/var/named/*Add the entry of master DNS in /etc/resolv.conf
- After completion of DNS Master start the named service
Restart the service
#/etc/init.d/named start ; chkconfig named on
Testing of DNS
# dig ns1.pbifmsiwdms.pjb
# host mail.punjabgovt.gov.in
#nslookup punjabgovt.gov.in
Test if it works either use dig and specify the DNS server to use for name resolution
