DNS 7
Application: Name Resulation
Name => IP (www.btcl.gov.bd => 180.211.129.60)
IP => Name (180.211.129.60=> www.btcl.gov.bd)
Resolver:
---------
=> Global (DNS) - Automatically
=> Local (hosts) - Manually
Types of DNS Server:
--------------------
=> Recursive DNS Servers
=> Authoritative DNS Servers
=> Caching DNS Server
Daemon: named
Packages: bind,bind-utils
Port: 53
Protocol: TCP and UdP
Configuration file:
=> /etc/sysconfig/network-scripts/ifcfg-eth0
=> /etc/hosts
=> /etc/hostname
=> /etc/named.conf
=> /etc/named.rfc1912.zones
=> /var/named/named.localhost (Forward Zone)
=> /var/named/named.looback (Reverse Zone)
Step 01: Set Static Host Name and Reboot:
----------------------------------------
[root@serverX ~]# hostname
[root@serverX ~]# vim /etc/hostname
mail.worldcm.net
[root@serverX ~]# logout
[root@mail ~]# hostname
Step 02: Set Static IP Address and DNS:
-------------------------------------------------------
# hostnamectl set-hostname mail
# echo "192.168.0.14 mail.worldcm.net mail " >> /etc/hosts
# cat /etc/hosts
-----------------------------------------------------
[root@mail ~]# ifconfig
or
[root@mail ~]# ip addr
[root@mail ~]# cd /etc/sysconfig/network-scripts/
[root@mail network-scripts]# ls
[root@mail network-scripts]# vim ifcfg-eth0 ; your Interface name
DEVICE=eth0
HWADDR=AA:BB:CC:DD:EE:FF
TYPE=Ethernet
BOOTPROTO=none
IPADDR=192.168.80.82+X
NETMASK=255.255.255.0
GATEWAY=192.168.8.1
ONBOOT=yes
DNS1=192.168.80.1+X
[root@mail network-scripts]# systemctl stop NetworkManager.service
[root@mail network-scripts]# systemctl disable NetworkManager.service
[root@mail network-scripts]# systemctl restart network.service
[root@mail network-scripts]# ip addr
[root@mail network-scripts]# ping 192.168.80.82
[root@mail network-scripts]# ping 8.8.8.8
[root@mail network-scripts]# cat /etc/resolv.conf ;verify
nameserver 192.168.80.82+X
search worldcm.net
Step 02: Local resolver entry:
------------------------------
[root@serverX ~]# vim /etc/hosts
1 127.0.0.0 localhost.localdomain localhost.localdomain
2 ::1
==================== New Entry ========================
3 192.168.80.82+X mail.worldcm.net mail
4 192.168.80.81+x desktopX.worldcm.net desktopX
5 192.168.80.80 gw.worldcm.net gw
***save and exit
[root@serverX ~]# ping mail
[root@serverX ~]# ping gw
[root@serverX ~]# ping desktopX
Step 03: Install Required RPM:
------------------------------
[root@mail ~]# yum install bind* -y
# yum install bind bind-utils
Step 04: Allow DNS Server IP and Network:
----------------------------------------
[root@mail ~]# vim /etc/named.conf
11 listen-on port 53 { 127.0.0.1; 192.168.80.82; };
12 # listen-on-v6 port 53 { ::1; };
17 allow-query { localhost; 192.168.80.0/24; };
Step 06: Set Forward and Reverse Zones:
---------------------------------------
[root@mail ~]# vim /etc/named.rfc1912.zones
:set nu
19 zone "worldcm.net" IN {
20 type master;
21 file "worldcm.net.for";
22 allow-update { none; };
23 };
31 zone "80.168.192.in-addr.arpa" IN {
32 type master;
33 file "worldcm.net.rev";
34 allow-update { none; };
35 };
Step 07: Create Forward and Reverse Zone Files:
-----------------------------------------------
[root@mail ~]# cd /var/named/
[root@mail named]# ls
[root@mail named]# cp named.localhost worldcm.net.for
[root@mail named]# cp named.loopback worldcm.net.rev
OR
#cp /var/named/named.localhost /var/named/chroot/var/named/worldcm.net.for
#cp /var/named/named.loopback /var/named/chroot/var/named/worldcm.net.rev
[root@mail named]# ls -l
Step 08: Set Ownership to Forward and Reverse Zone Files:
---------------------------------------------------------
[root@mail named]# ll worldcm.net.*
-rw-r-----. 1 root root 152 Mar 21 13:59 worldcm.net.for
-rw-r-----. 1 root root 168 Mar 21 13:59 worldcm.net.rev
[root@mail named]# chgrp named worldcm.net.*
[root@mail named]# ll worldcm.net.*
-rw-r-----. 1 root named 152 Mar 21 13:59 worldcm.net.for
-rw-r-----. 1 root named 168 Mar 21 13:59 worldcm.net.rev
Step 09: Edit Forward Zone File:
--------------------------------
[root@mail named]# vim worldcm.net.for
$TTL 1D
@ IN SOA mail.worldcm.net. root.worldcm.net. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
IN NS mail.worldcm.net.
IN A 172.25.11.200+X
mail IN A 172.25.11.200+X
www IN A 172.25.11.202 ;(optional)
ftp IN A 172.25.11.203 ;(optional)
blog IN CNAME mail.worldcm.net. ;(optional)
webmail IN CNAME mail.worldcm.net. ;(optional)
----------------------------OR----------------------------------------
[root@mail ~]# vi /var/named/worldcm.net.for
$TTL 1D
@ IN SOA mail.worldcm.net. root.worldcm.net. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
@ IN NS mail.worldcm.net.
mail IN A 192.168.80.82
@ IN MX 10 mail.worldcm.net.
worldcm.net. IN MX 10 mail.worldcm.net.
www IN CNAME mail
ftp IN CNAME mail
-------------------------------------------------------------
$TTL 1D
@ IN SOA mail.worldcm.net. root.worldcm.net. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
@ IN NS mail.worldcm.net.
mail IN A 192.168.1.17
@ IN MX 10 mail.worldcm.net.
worldcm.net. IN MX 10 mail.worldcm.net.
www IN CNAME mail
ftp IN CNAME mail
--------------------------------------------------------------
Note:
-----
SOA - Start of Authority
IN - Internet
NS - Name Server (DNS Server)
A - Host Record (IP Address)
AAAA - Host Record (IPv6 Address)
root - email admin (root@worldcm.net)
PTR - Pointer (Reverse Lookup)
CNAME - Canonical Name
MX - Mail Exchanger Record
Step 10: Edit Reverse Zone File:
--------------------------------
[root@mail named]# vim worldcm.net.rev
$TTL 1D
@ IN SOA mail.worldcm.net. root.worldcm.net. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
IN NS mail.worldcm.net.
200+X IN PTR mail.worldcm.net.
----------------------------OR----------------------------------------
[root@mail ~]# vi /var/named/worldcm.net.rev
$TTL 1D
@ IN SOA mail.worldcm.net. root.worldcm.net. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
@ IN NS mail.worldcm.net.
@ IN PTR worldcm.net
82 IN PTR mail.worldcm.net
mail IN A 192.168.80.82
--------------------------------------------------------------
Step 11: Service restart and configured active at boot time:
------------------------------------------------------------
[root@mail named]# systemctl restart named.service
[root@mail named]# systemctl enable named.service
Check Status:
-------------
[root@mail named]# systemctl status named.service
Allow DNS Through Firewall:
---------------------------
[root@mail named]# systemctl enable firewalld.service
[root@mail named]# systemctl restart firewalld.service
[root@mail named]# systemctl stop firewalld.service
[root@mail named]# firewall-cmd --permanent --add-service=dns
[root@mail named]# firewall-cmd --reload
Step 12: Checking DNS
---------------------
[root@mail named]# nslookup mail.worldcm.net
Server: 192.168.80.82
Address: 192.168.80.82
Name: mail.worldcm.net
Address: 172.25.11.200+X
[root@mail named]# dig -x 192.168.80.82 ; here -X is option
status: NOERROR
[root@mail named]# dig mail.worldcm.net
status: NOERROR
[root@mail named]# ping www.google.com
======================= Thank you ======================\
###############################################################################################
[root@nsX named]# vim example.com.for $TTL 1D @ IN SOA nsX.example.com. root.example.com. ( 0 ; serial 1D ; refresh 1H ; retry 1W ; expire 3H ) ; minimum IN NS nsX.example.com. IN A 172.25.11.200+X nsX IN A 172.25.11.200+X www IN A 172.25.11.202 ;(optional) ftp IN A 172.25.11.203 ;(optional) blog IN CNAME nsX.example.com. ;(optional) webmail IN CNAME nsX.example.com. ;(optional) Note: ----- SOA - Start of Authority IN - Internet NS - Name Server (DNS Server) A - Host Record (IP Address) AAAA - Host Record (IPv6 Address) root - email admin (root@example.com) PTR - Pointer (Reverse Lookup) CNAME - Canonical Name MX - Mail Exchanger Record Step 10: Edit Reverse Zone File: -------------------------------- [root@nsX named]# vim example.com.rev $TTL 1D @ IN SOA nsX.example.com. root.example.com. ( 0 ; serial 1D ; refresh 1H ; retry 1W ; expire 3H ) ; minimum IN NS nsX.example.com. 200+X IN PTR nsX.example.com. 202 IN PTR www.example.com. ;(optional) 203 IN PTR ftp.example.com. ;(optional) Step 11: Service restart and configured active at boot time: ------------------------------------------------------------ [root@nsX named]# systemctl restart named.service [root@nsX named]# systemctl enable named.service
######################################################################################
Quick Start: Setup CentOS 7 as a DNS Server
In this tutorial, I'll be showing you simply steps using which you can create and configure a functional DNS Server on your CentOS 7 system.
System Details:
Base OS: CentOS 7 64 Bit (Minimal ISO)
HOSTNAME: master.cloud.com
IPADDRESS: 192.168.0.15
Steps:
First of all, make sure your system has a static IP address assigned to it and a fully qualified domain name.
Next, install the DNS packages:
# yum install bind bind-utils
Edit the "named.conf" file and edit the content as shown below:
# vi /etc/named.conf
# Replace the content in RED with your values
options {
listen-on port 53 { 127.0.0.1; 192.168.0.15;}; ## DNS Server IP
# listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; 192.168.0.0/24;}; # IP Subnet
# Add the following lines before the include statement as shown
zone "cloud.com" IN {
type master;
file "forward.cloud";
allow-update { none; };
};
zone "0.168.192.in-addr.arpa" IN {
type master;
file "reverse.cloud";
allow-update { none; };
};
Save the file and exit the editor.
Next, we create the Zone files. There will be two files created, one for the forward lookup and one for the reverse lookup. These files are created in the /var/named directory and their names should be same as mentioned in the named.conf file (Earlier steps)
Forward Zone Lookup File:
# vi /var/named/forward.cloud
Add the following content as shown. Replace the content marked in RED with your matching requirements.
$TTL 86400
@ IN SOA master.cloud.com. root.cloud.com. (
2011071001 ;Serial
3600 ;Refresh
1800 ;Retry
604800 ;Expire
86400 ;Minimum TTL
)
@ IN NS master.cloud.com.
@ IN A 192.168.0.15
@ IN A 192.168.0.102
@ IN A 192.168.0.103
master IN A 192.168.0.15
client1 IN A 192.168.0.101
client2 IN A 192.168.0.102
Save and exit the editor.
Reverse Zone Lookup File:
# vi /var/named/reverse.cloud
$TTL 86400
@ IN SOA master.cloud.com. root.cloud.com. (
2011071001 ;Serial
3600 ;Refresh
1800 ;Retry
604800 ;Expire
86400 ;Minimum TTL
)
@ IN NS master.cloud.com.
@ IN PTR cloud.com
master IN A 192.168.0.15
client1 IN A 192.168.0.101
client2 IN A 192.168.0.102
15 IN PTR master.cloud.com
101 IN PTR client1.cloud.com
102 IN PTR client2.cloud.com
Save and exit the editor.
Enable and start the DNS service:
# systemctl enable named
# systemctl start named
Enable the ports on the Firewall and reload the firewall
# firewall-cmd --permanent --add-port=53/tcp
# firewall-cmd --reload
Verify your DNS:
Check DNS default configuration file for errors:
# named-checkconf /etc/named.conf
Next, check both the forward and reverse lookup files for any errors as well.
# named-checkzone cloud.com /var/named/forward.cloud
# named-checkzone cloud.com /var/named/reverse.cloud
Once checked, modify the network interface file and add the DNS details as shown below:
DNS1=192.168.0.15
NOTE: In my case, I am using multiple DNSs. You can assign multiple DNS values using as shown in the image below.
Alternatively, you can even add the DNS entry in the /etc/resolv.conf file as well for name resolution.
# vi /etc/resolv.conf
nameserver 192.168.0.15
Restart your network to apply the changes
# systemctl restart network
Test the DNS:
Run the following commands to verify whether the DNS can resolve the hostnames correctly or not.
# dig master.cloud.com
You can alternatively run nslookup to verify your Zones
# nslookup cloud.com
DONE
################################################################################################
DNS Server On CentOS 7
DNS Server Installation
Scenario
For the purpose of this tutorial, I will be using three nodes. One will be acting as Master DNS server, the second system will be acting as Secondary DNS, and the third will be our DNS client. Here are my three systems details.
Primary (Master) DNS Server Details:
Operating System : CentOS 7 minimal server Hostname : masterdns.unixmen.local IP Address : 192.168.1.101/24
Secondary (Slave) DNS Server Details:
Operating System : CentOS 7 minimal server Hostname : secondarydns.unixmen.local IP Address : 192.168.1.102/24
Client Details:
Operating System : CentOS 6.5 Desktop Hostname : client.unixmen.local IP Address : 192.168.1.103/24
Setup Primary (Master) DNS Server
Install bind9 packages on your server.
yum install bind bind-utils -y
1. Configure DNS Server
Edit ‘/etc/named.conf’ file.
vi /etc/named.conf
Add the lines as shown in bold:
// // named.conf // // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS // server as a caching only nameserver (as a localhost DNS resolver only). // // See /usr/share/doc/bind*/sample/ for example named configuration files. // options { listen-on port 53 { 127.0.0.1; 192.168.1.101;}; ### Master DNS IP ### # listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; allow-query { localhost; 192.168.1.0/24;}; ### IP Range ### allow-transfer{ localhost; 192.168.1.102; }; ### Slave DNS IP ### /* - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. - If you are building a RECURSIVE (caching) DNS server, you need to enable recursion. - If your recursive DNS server has a public IP address, you MUST enable access control to limit queries to your legitimate users. Failing to do so will cause your server to become part of large scale DNS amplification attacks. Implementing BCP38 within your network would greatly reduce such attack surface */ recursion yes; dnssec-enable yes; dnssec-validation yes; dnssec-lookaside auto; /* Path to ISC DLV key */ bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic"; pid-file "/run/named/named.pid"; session-keyfile "/run/named/session.key"; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "." IN { type hint; file "named.ca"; }; zone "unixmen.local" IN { type master; file "forward.unixmen"; allow-update { none; }; }; zone "1.168.192.in-addr.arpa" IN { type master; file "reverse.unixmen"; allow-update { none; }; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key";
2. Create Zone files
Create forward and reverse zone files which we mentioned in the ‘/etc/named.conf’ file.
2.1 Create Forward Zone
Create forward.unixmen file in the ‘/var/named’ directory.
vi /var/named/forward.unixmen
Add the following lines:
$TTL 86400 @ IN SOA masterdns.unixmen.local. root.unixmen.local. ( 2011071001 ;Serial 3600 ;Refresh 1800 ;Retry 604800 ;Expire 86400 ;Minimum TTL ) @ IN NS masterdns.unixmen.local. @ IN NS secondarydns.unixmen.local. @ IN A 192.168.1.101 @ IN A 192.168.1.102 @ IN A 192.168.1.103 masterdns IN A 192.168.1.101 secondarydns IN A 192.168.1.102 client IN A 192.168.1.103
2.2 Create Reverse Zone
Create reverse.unixmen file in the ‘/var/named’ directory.
vi /var/named/reverse.unixmen
Add the following lines:
$TTL 86400 @ IN SOA masterdns.unixmen.local. root.unixmen.local. ( 2011071001 ;Serial 3600 ;Refresh 1800 ;Retry 604800 ;Expire 86400 ;Minimum TTL ) @ IN NS masterdns.unixmen.local. @ IN NS secondarydns.unixmen.local. @ IN PTR unixmen.local. masterdns IN A 192.168.1.101 secondarydns IN A 192.168.1.102 client IN A 192.168.1.103 101 IN PTR masterdns.unixmen.local. 102 IN PTR secondarydns.unixmen.local. 103 IN PTR client.unixmen.local.
3. Start the DNS service
Enable and start DNS service:
systemctl enable named systemctl start named
4. Firewall Configuration
We must allow the DNS service default port 53 through firewall.
firewall-cmd --permanent --add-port=53/tcp
firewall-cmd --permanent --add-port=53/udp
5. Restart Firewall
firewall-cmd --reload
6. Configuring Permissions, Ownership, and SELinux
Run the following commands one by one:
chgrp named -R /var/namedchown -v root:named /etc/named.conf restorecon -rv /var/named restorecon /etc/named.conf
7. Test DNS configuration and zone files for any syntax errors
Check DNS default configuration file:
named-checkconf /etc/named.conf
If it returns nothing, your configuration file is valid.
Check Forward zone:
named-checkzone unixmen.local /var/named/forward.unixmen
Sample output:
zone unixmen.local/IN: loaded serial 2011071001 OK
Check reverse zone:
named-checkzone unixmen.local /var/named/reverse.unixmen
Sample Output:
zone unixmen.local/IN: loaded serial 2011071001 OK
Add the DNS Server details in your network interface config file.
vi /etc/sysconfig/network-scripts/ifcfg-enp0s3
TYPE="Ethernet" BOOTPROTO="none" DEFROUTE="yes" IPV4_FAILURE_FATAL="no" IPV6INIT="yes" IPV6_AUTOCONF="yes" IPV6_DEFROUTE="yes" IPV6_FAILURE_FATAL="no" NAME="enp0s3" UUID="5d0428b3-6af2-4f6b-9fe3-4250cd839efa" ONBOOT="yes" HWADDR="08:00:27:19:68:73" IPADDR0="192.168.1.101" PREFIX0="24" GATEWAY0="192.168.1.1" DNS="192.168.1.101" IPV6_PEERDNS="yes" IPV6_PEERROUTES="yes"
Edit file /etc/resolv.conf,
vi /etc/resolv.conf
Add the name server ip address:
nameserver 192.168.1.101
Save and close the file.
Restart network service:
systemctl restart network
8. Test DNS Server
dig masterdns.unixmen.local
Sample Output:
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> masterdns.unixmen.local ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25179 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;masterdns.unixmen.local. IN A ;; ANSWER SECTION: masterdns.unixmen.local. 86400 IN A 192.168.1.101 ;; AUTHORITY SECTION: unixmen.local. 86400 IN NS secondarydns.unixmen.local. unixmen.local. 86400 IN NS masterdns.unixmen.local. ;; ADDITIONAL SECTION: secondarydns.unixmen.local. 86400 IN A 192.168.1.102 ;; Query time: 0 msec ;; SERVER: 192.168.1.101#53(192.168.1.101) ;; WHEN: Wed Aug 20 16:20:46 IST 2014 ;; MSG SIZE rcvd: 125
nslookup unixmen.local
Sample Output:
Server: 192.168.1.101 Address: 192.168.1.101#53 Name: unixmen.local Address: 192.168.1.103 Name: unixmen.local Address: 192.168.1.101 Name: unixmen.local Address: 192.168.1.102
Now the Primary DNS server is ready to use.
It is time to configure our Secondary DNS server.
Setup Secondary(Slave) DNS Server
Install bind packages using the following command:
yum install bind bind-utils -y
1. Configure Slave DNS Server
Edit file ‘/etc/named.conf’:
vi /etc/named.conf
Make the changes as shown in bold.
// // named.conf // // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS // server as a caching only nameserver (as a localhost DNS resolver only). // // See /usr/share/doc/bind*/sample/ for example named configuration files. // options { listen-on port 53 { 127.0.0.1; 192.168.1.102; }; listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; allow-query { localhost; 192.168.1.0/24; }; . . . . zone "." IN { type hint; file "named.ca"; }; zone "unixmen.local" IN { type slave; file "slaves/unixmen.fwd"; masters { 192.168.1.101; }; }; zone "1.168.192.in-addr.arpa" IN { type slave; file "slaves/unixmen.rev"; masters { 192.168.1.101; }; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key";
2. Start the DNS Service
systemctl enable named systemctl start named
Now the forward and reverse zones are automatically replicated from Master DNS server to ‘/var/named/slaves/’ in Secondary DNS server.
ls /var/named/slaves/
Sample Output:
unixmen.fwd unixmen.rev
3. Add the DNS Server details
Add the DNS Server details in your network interface config file.
vi /etc/sysconfig/network-scripts/ifcfg-enp0s3
TYPE="Ethernet" BOOTPROTO="none" DEFROUTE="yes" IPV4_FAILURE_FATAL="no" IPV6INIT="yes" IPV6_AUTOCONF="yes" IPV6_DEFROUTE="yes" IPV6_FAILURE_FATAL="no" NAME="enp0s3" UUID="5d0428b3-6af2-4f6b-9fe3-4250cd839efa" ONBOOT="yes" HWADDR="08:00:27:19:68:73" IPADDR0="192.168.1.102" PREFIX0="24" GATEWAY0="192.168.1.1" DNS1="192.168.1.101" DNS2="192.168.1.102" IPV6_PEERDNS="yes" IPV6_PEERROUTES="yes"
Edit file /etc/resolv.conf,
vi /etc/resolv.conf
Add the name server ip address:
nameserver 192.168.1.101 nameserver 192.168.1.102
Save and close the file.
Restart network service:
systemctl restart network
4. Firewall Configuration
We must allow the DNS service default port 53 through firewall.
firewall-cmd --permanent --add-port=53/tcp
5. Restart Firewall
firewall-cmd --reload
6. Configuring Permissions, Ownership, and SELinux
chgrp named -R /var/namedchown -v root:named /etc/named.conf restorecon -rv /var/named restorecon /etc/named.conf
7. Test DNS Server
dig masterdns.unixmen.local
Sample Output:
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> masterdns.unixmen.local ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18204 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;masterdns.unixmen.local. IN A ;; ANSWER SECTION: masterdns.unixmen.local. 86400 IN A 192.168.1.101 ;; AUTHORITY SECTION: unixmen.local. 86400 IN NS masterdns.unixmen.local. unixmen.local. 86400 IN NS secondarydns.unixmen.local. ;; ADDITIONAL SECTION: secondarydns.unixmen.local. 86400 IN A 192.168.1.102 ;; Query time: 0 msec ;; SERVER: 192.168.1.102#53(192.168.1.102) ;; WHEN: Wed Aug 20 17:04:30 IST 2014 ;; MSG SIZE rcvd: 125
dig secondarydns.unixmen.local
Sample Output:
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> secondarydns.unixmen.local ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60819 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;secondarydns.unixmen.local. IN A ;; ANSWER SECTION: secondarydns.unixmen.local. 86400 IN A 192.168.1.102 ;; AUTHORITY SECTION: unixmen.local. 86400 IN NS masterdns.unixmen.local. unixmen.local. 86400 IN NS secondarydns.unixmen.local. ;; ADDITIONAL SECTION: masterdns.unixmen.local. 86400 IN A 192.168.1.101 ;; Query time: 0 msec ;; SERVER: 192.168.1.102#53(192.168.1.102) ;; WHEN: Wed Aug 20 17:05:50 IST 2014 ;; MSG SIZE rcvd: 125
nslookup unixmen.local
Sample Output:
Server: 192.168.1.102 Address: 192.168.1.102#53 Name: unixmen.local Address: 192.168.1.101 Name: unixmen.local Address: 192.168.1.103 Name: unixmen.local Address: 192.168.1.102
Client Side Configuration
Add the DNS server details in ‘/etc/resolv.conf’ file in all client systems
vi /etc/resolv.conf
# Generated by NetworkManager search unixmen.local nameserver 192.168.1.101 nameserver 192.168.1.102
Restart network service or reboot the system.
Test DNS Server
Now, you can test the DNS server using any one of the following commands:
dig masterdns.unixmen.local
dig secondarydns.unixmen.local
dig client.unixmen.local
nslookup unixmen.local
That’s all about now. The primary and secondary DNS servers are ready to use.
-------------------------------
nstall and Configure Caching-Only DNS Server in RHEL/CentOS 7
My Testing Environment
DNS server : dns.tecmintlocal.com (Red Hat Enterprise Linux 7.1) Server IP Address : 192.168.0.18 Client : node1.tecmintlocal.com (CentOS 7.1) Client IP Address : 192.168.0.29
Step 1: Installing Cache-Only DNS Server in RHEL/CentOS 7
1. The Cache-Only DNS server, can be installed via the bind package. If you don’t remember the package name, you can do a quick search for the package name using the command below.
# yum search bind
Search DNS Bind Package
2. In the above result, you will see several packages. From those, we need to choose and install only bind and bind-utils packages using following yum command.
# yum install bind bind-utils -y
Install DNS Bind in RHEL/CentOS 7
Step 2: Configure Cache-Only DNS in RHEL/CentOS 7
3. Once DNS packages are installed we can go ahead and configure DNS. Open and edit /etc/named.conf using your preferred text editor. Make the changes suggested below (or you can use your settings as per your requirements).
listen-on port 53 { 127.0.0.1; any; }; allow-query { localhost; any; }; allow-query-cache { localhost; any; };
Configure Cache-Only DNS in CentOS and RHEL 7
These directives instruct the DNS server to listen on UDP port 53, and to allow queries and caches responses from localhost and any other machine that reaches the server.
4. It is important to note that the ownership of this file must be set to root:named and also if SELinux is enabled, after editing the configuration file we need to make sure that its context is set to named_conf_t as shown in Fig. 4 (same thing for the auxiliary file /etc/named.rfc1912.zones):
# ls -lZ /etc/named.conf # ls -lZ /etc/named.rfc1912.zones
Otherwise, configure the SELinux context before proceeding:
# semanage fcontext -a -t named_conf_t /etc/named.conf # semanage fcontext -a -t named_conf_t /etc/named.rfc1912.zones
5. Additionally, we need to test the DNS configuration now for some syntax error before starting the bind service:
# named-checkconf /etc/named.conf
6. After the syntax verification results seems perfect, restart the named service to take new changes into effect and also make the service to auto start across system boots, and then check its status:
# systemctl restart named # systemctl enable named # systemctl status named
Configure and Start DNS Named Service
7. Next, open the port 53 on the firewall.
# firewall-cmd --add-port=53/udp # firewall-cmd --add-port=53/udp --permanent
Open DNS Port 53 on Firewall
Step 3: Chroot Cache-Only DNS Server in RHEL and CentOS 7
8. If you wish to deploy the Cache-only DNS server within chroot environment, you need to have the package chroot installed on the system and no further configuration is needed as it by default hard-link to chroot.
# yum install bind-chroot -y
Once chroot package has been installed, you can restart named to take the new changes into effect:
# systemctl restart named
9. Next, create a symbolic link (also named /etc/named.conf) inside /var/named/chroot/etc/:
# ln -s /etc/named.conf /var/named/chroot/etc/named.conf
Step 4: Configure DNS on Client Machine
10. Add the DNS Cache servers IP 192.168.0.18 as resolver to the client machine. Edit /etc/sysconfig/network-scripts/ifcfg-enp0s3 as shown in the following figure:
DNS=192.168.0.18
Configure DNS on Client Machine
And /etc/resolv.conf as follows:
nameserver 192.168.0.18
11. Finally it’s time to check our cache server. To do this, you can use dig utility or nslookup command.
Choose any website and query it twice (we will use facebook.com as an example). Note that with dig the second time the query is completed much faster because it is being served from the cache.
# dig facebook.com
Check Cache only DNS Queries
You can also use nslookup to verify that the DNS server is working as expected.
# nslookup facebook.com
Checking DNS Query with nslookup
-----------------------------------------------------------------