IPv6 DNS server configuration in Linux

In Linux, Bind is the preferred software for building DNS Server. It has different versions. Windows DNS is from Bind 4. in addition, Bind8.x and Bind9.x have made many improvements in terms of security and scalability. To support IPv6 DNS, Bind v9 is used, bind9.x provides DNS queries for IPv6 Sockets and supports IPv6 resource records. For details about Bind9.x, we recommend that you check the Bind Web site. The latest Bind version can be downloaded at www.isc.org/products/BIND/.

# Wget http://ftp.isc.org/isc/bind9/9.3.2/bind-9.3.2.tar.gz# tar-xzf bind-9.2.1.tar.gz # cd bind-9.2.1 #./configure-enable-ipv6-with-openssl # make & make install

After the Bind software is installed, several inherent files are generated, which are divided into two types. One is the configuration file under the/etc directory, and the other is the DNS record file under the/var/named directory. Add other related files to set up the DNS server. Named. conf is the default primary configuration file (which must be manually created). It sets the general named parameter and points to the source of the domain database information used by the server, such sources can be local disk files or remote servers.

Named. ca: pointing to the root domain name server named. 1 ocal: Used to locally convert the return address named. hosts: ing the host name to an IP address

The following uses the domain name secv6.your. domain of the pure IPv6 lab network established by the author as an example to describe how to configure an IPv6 DNS server that supports AAAA and A6 records.

File List 1/etc/named. conf

options ...{directory "/var/named";
// a caching only nameserver configzone "." IN ...{type hint;file "named.ca";};
// this defines the loopback name lookupzone "localhost" IN ...{type master;file "master/localhost.zone";allow-update ...{ none; };};
// this defines the loopback reverse name lookupzone "0.0.127.in-addr.arpa" IN ...{type master;file "master/localhost.rev";allow-update ...{ none; };};
// This defines the secv6 domain name lookup// Secure (signed) zone file is// secv6.your.domain.signed// Regular zone file is secv6.your.domainzone "secv6.your.domain" IN ...{type master;file "master/secv6.your.domain.signed";// file "master/secv6.your.domain";};
// this defines the secv6 domain reverse// name lookup (AAAA)zone "secv6.int" IN ...{type master;file "master/secv6.int";};
// this defines the secv6 domain reverse// name lookup (A6)zone "secv6.arpa" IN ...{type master;file "master/secv6.rev";};
// secret key truncated to fitkey "key" ...{algorithm hmac-md5;secret "HxbmAnSO0quVxcxBDjmAmjrmhgDUVFcFNcfmHC";};

File List 2/var/named/master/secv6.your. domain

$TTL 86400$ORIGIN secv6.your.domain.@ IN SOA secv6.your.domain. hostmaster.your.domain. (2002011442 ; Serial number (yyyymmdd-num)3H ; Refresh15M ; Retry1W ; Expire1D ) ; MinimumIN MX 10 noah.your.domain.IN NS ns.secv6.your.domain.$ORIGIN secv6.your.domain.ns 1D IN AAAA fec0::1:250:b7ff:fe14:35d01D IN A6 0 fec0::1:250:b7ff:fe14:35d0secv6.your.domain. 1D IN AAAA fec0::1:250:b7ff:fe14:35d0 1D IN A60fec0::1:250:b7ff:fe14:35d0pc2 1D IN AAAA fec0::1:250:b7ff:fe14:35d0 1D IN A6 0fec0::1:250:b7ff:fe14:35d0pc3 1D IN A6 0 fec0::1:250:b9ff:fe00:131 1D IN AAAAfec0::1:250:b9ff:fe00:131pc6 1D IN A6 0 fec0::1:250:b7ff:fe14:3617 1D IN AAAAfec0::1:250:b7ff:fe14:3617pc4 1D IN A6 0 fec0::1:250:b7ff:fe14:35c4 1D INAAAAfec0::1:250:b7ff:fe14:35c4pc5 1D IN A6 0 fec0::1:250:b7ff:fe14:361b 1D IN AAAAfec0::1:250:b7ff:fe14:361bpc7 1D IN A6 0 fec0::1:250:b7ff:fe14:365a 1D IN AAAAfec0::1:250:b7ff:fe14:365apc1 1D IN A6 0 fec0::1:250:b9ff:fe00:12e 1D IN AAAAfec0::1:250:b9ff:fe00:12epc1 1D IN A6 0 fec0:0:0:1::1 1D IN AAAA fec0:0:0:1::1$INCLUDE "/var/named/master/Ksecv6.your.domain.+003+27034.key" 

Dnssec configuration command:

Dnssec-keygen-a DSA-B 768-n ZONE secv6.your. domain dnssec-signzone-o secv6.your. domain secv6.your. domain

Note: DNSSEC primarily relies on public key technology to create a password signature for information contained in DNS. The password signature calculates the hash number of a password to provide data integrity in DNS, and encapsulates the hash number for protection. The private key in the private/public key pair is used to encapsulate the hash number, and then the hash number can be translated using the public key. If the translated hash value matches the hash tree just calculated by the receiver, the data is complete. No matter whether the translated hash number matches the calculated hash number, the authentication method of password signature is absolutely correct, because the public key is only used to decrypt the valid hash number, therefore, only the owner with the private key can encrypt the information.

File List 3 var/named/master/localhost. zone

// localhost.zone Allows for local communications// using the loopback interface$TTL 86400$ORIGIN localhost.@ 1D IN SOA @ root (42 ; serial (d. adams)3H ; refresh15M ; retry1W ; expire1D ) ; minimum1D IN NS @1D IN A 127.0.0.1

File list 4/var/named/master/localhost. rev

// localhost.rev Defines reverse DNS lookup on// loopback interface$TTL 86400$ORIGIN 0.0.127.in-addr.arpa.@ IN SOA 0.0.127.in-addr.arpa. hostmaster.secv6.your.domain. (42 ; Serial number (d. adams)3H ; Refresh15M ; Retry1W ; Expire1D ) ; MinimumNS ns.secv6.your.domain.MX 10 noah.ip6.your.domain.PTR localhost.

File List 5/var/named/master/secv6.rev

// secv6.rev Defines reverse lookup for secv6
// domain in A6 format$TTL 86400$ORIGIN secv6.arpa.@ IN SOA 
secv6.arpa. hostmaster.secv6.your.domain. 
(2002011442 ; Serial number (yyyymmdd-num)3H ; Refresh15M ; Retry1W ; Expire1D ) ; 
MinimumNS ns.secv6.your.domain.MX 10 noah.your.domain.;
fec0:0:0:1::/64$ORIGIN [xfec0000000000001/64].
secv6.arpa.[x0250b7fffe1435d0/64] 1D IN PTR 
pc2.secv6.your.domain.[x0250b9fffe000131/64] 1D IN PTR 
pc3.secv6.your.domain.[x0250b7fffe143617/64] 1D IN PTR 
pc6.secv6.your.domain.[x0250b7fffe1435c4/64] 1D IN PTR 
pc4.secv6.your.domain.[x0250b7fffe14361b/64] 1D IN PTR 
pc5.secv6.your.domain.[x0250b7fffe14365a/64] 1D IN PTR 
pc7.secv6.your.domain.[x0250b9fffe00012e/64] 1D IN PTR 
pc1.secv6.your.domain.

File List 6./var/named/master/secv6.int

// secv6.int Defines reverse lookup for secv6// domain in AAA format$TTL 86400$ORIGIN secv6.int.@ IN SOA secv6.int. hostmaster.secv6.your.domain.
(2002011442 ; Serial number (yyyymmdd-num)3H ; Refresh15M ; Retry1W ; Expire1D ) ; MinimumNS ns.secv6.your.domain.MX 10 noah.your.domain.; 
fec0:0:0:1::/64$ORIGIN 1.0.0.0.0.0.0.0.0.0.0.0.0.c.e.f.secv6.int.0.d.5.3.4.1.e.f.f.f.7.b.0.5.2.0 IN PTR pc2.secv6.your.domain.e.2.1.0.0.0.e.f.f.f.9.b.0.5.2.0 IN PTR 
pc1.secv6.your.domain.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR pc1.secv6.your.domain.1.3.1.0.0.0.e.f.f.f.9.b.0.5.2.0 IN PTR 
pc3.secv6.your.domain.7.1.6.3.4.1.e.f.f.f.7.b.0.5.2.0 IN PTR pc6.secv6.your.domain.4.c.5.3.4.1.e.f.f.f.7.b.0.5.2.0 IN PTR 
pc4.secv6.your.domain.b.1.6.3.4.1.e.f.f.f.7.b.0.5.2.0 IN PTR pc5.secv6.your.domain.

DNS Client Configuration

/Etc/hosts is a list file of the host. If the system IP address is not dynamically generated, you can use it. For simple host name resolution verbose), before requesting a DNS or NIS network name server, the/etc/hosts. conf will usually tell the parser to check it first. Search secv6.your. domain nameserver fec0: 1: 250: b7ff: fe14: 35d0

DNS server test

Run the dig command again:

A6 format DNS query

Pc2 % dig 0.0.0.0 secv6.your. domain a6; <> DiG 9.1.0 <> 0.0.0.0 secv6.your. domain A6 [...]; secv6.your. domain. IN A6; ANSWER
SECTION: secv6.your. domain. 86400 IN A6 0 fec0: 1: 250: b7ff: fe14: 35d0; authority section: secv6.your. domain. 86400 in ns ns. secv6.your. domain .;;
Additional section: ns. secv6.your. domain. 86400 IN A6 0 fec0: 1: 250: b7ff: fe14: 35d0ns. secv6.your. domain. 86400 in aaaa fec0: 1: 250: b7ff: fe14: 35d0AAAA
Type DNS query pc2 % dig 0.0.0.0 secv6.your. domain aaaa; <> DiG 9.1.0 <> 0.0.0.0 secv6.your. domain AAAA [...]; secv6.your. domain. in aaaa; ANSWER
SECTION: secv6.your. domain. 86400 in aaaa fec0: 1: 250: b7ff: fe14: 35d0; authority section: secv6.your. domain. 86400 in ns ns. secv6.your. domain .;;
Additional section: ns. secv6.your. domain. 86400 IN A6 0 fec0: 1: 250: b7ff: fe14: 35d0ns. secv6.your. domain. 86400 in aaaa fec0: 1: 250: b7ff: fe14: 35d0

So far, the IPv6 DNS server has been set up.