Linux Server tutorial 6--dns Server Configuration

Introduction:
Don't forget that computers are all digital circuit operations. With the rapid development of computer technology, all these digital operations are extracted and humanized. The same is true for the network, so they are all replaced with some user-friendly representation methods. Second, how to locate each user unit also has its own rules. Just like finding a friend in a strange place, we must first have an address.
In reality, this address is called first. For another example, if you need to find a company location, you must first find a yellow page, then, search for the company's contact information and make the appointment. In a computer network, all data exchanges are exchanged through specific information carriers. To reduce the difficulty and complexity of finding results, it is necessary to develop a common rule. For example, if a company in the United States is located in China, it is enough to delegate the address to the statistics layer in China.
The DNS server is based on such a replacement and search method. In reality, DNS servers are widely used and can be used in every small area. For example, the company name can be the same (but the registered trademark cannot be the same), which is flexible. For example, in an enterprise's internal network, you want to customize your own name, you can also give your internal network server site is also set to http://www.microsoft.com, as long as you enter this address within the enterprise, will immediately go to the home page of your company. This is a private application, but you cannot register as a trademark, because after all, your company is not Microsoft, and you just get the same name as it. What is more flexible is that the company's internal network can define any of these addresses, but when accessing other addresses, it does not overwrite other addresses, for example, if you enter a http://www.google.com, the Google address is displayed. But if you are not in the company's internal network, then you can not follow these to cover access, enter the http://www.microsoft.com or Microsoft address, this is also designed to trademark copyright issues.
The current DNS server frequently used in Unix/Linux is bind. The current version is bind9.3.
Here I recommend a detailed tutorial for you (link address of the tutorial). Here I will officially complete my Linux Server tutorial series. The following is an example I have selected from the Tutorial:
7. A real domain example

Where we list someRealZone files

Users have suggested that I include a real example of a working domain as well as the Tutorial example.

I use this example with permission from David Bullock of land-5. these files were current 24th of September 1996, and were then edited to fit BIND 8 restrictions and use extensions by me. so, what you see here differs a bit from what you find if you query land-5's name servers now.

7.1/etc/named. conf (or/var/named. conf)

Here we find Master zone sections for the two reverse zones needed: the 127.0.0 net, as well as land-5's206.6.177Subnet, and a primary line for Land-5's forward zoneland-5.com. Also note that instead of stuffing the files in a directory calledpz, As I do in this howto, he puts them in a directory calledzone.

// Boot file for LAND-5 name server

options {
        directory "/var/named";
};

controls {
        inet 127.0.0.1 allow { localhost; } keys { rndc_key; };
};

key "rndc_key" {
        algorithm hmac-md5;
        secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
};

zone "." {
        type hint;
        file "root.hints";
};

zone "0.0.127.in-addr.arpa" {
        type master;
        file "zone/127.0.0";
};

zone "land-5.com" {
        type master;
        file "zone/land-5.com";
};

zone "177.6.206.in-addr.arpa" {
        type master;
        file "zone/206.6.177";
};

If you put this in your named. conf file to playPleasePut''notify no;''In the zone sections for the twoland-5Zones so as to avoid accidents.

7.2/var/named/root. Hints

Keep in mind that this file is dynamic, and the one listed here is old. You're better off using a new one as explained earlier.

; <<>> DiG 8.1 <<>> @A.ROOT-SERVERS.NET. 
; (1 server found)
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10
;; flags: qr aa rd; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 13
;; QUERY SECTION:
;;      ., type = NS, class = IN

;; ANSWER SECTION:
.                       6D IN NS        G.ROOT-SERVERS.NET.
.                       6D IN NS        J.ROOT-SERVERS.NET.
.                       6D IN NS        K.ROOT-SERVERS.NET.
.                       6D IN NS        L.ROOT-SERVERS.NET.
.                       6D IN NS        M.ROOT-SERVERS.NET.
.                       6D IN NS        A.ROOT-SERVERS.NET.
.                       6D IN NS        H.ROOT-SERVERS.NET.
.                       6D IN NS        B.ROOT-SERVERS.NET.
.                       6D IN NS        C.ROOT-SERVERS.NET.
.                       6D IN NS        D.ROOT-SERVERS.NET.
.                       6D IN NS        E.ROOT-SERVERS.NET.
.                       6D IN NS        I.ROOT-SERVERS.NET.
.                       6D IN NS        F.ROOT-SERVERS.NET.

;; ADDITIONAL SECTION:
G.ROOT-SERVERS.NET.     5w6d16h IN A    192.112.36.4
J.ROOT-SERVERS.NET.     5w6d16h IN A    198.41.0.10
K.ROOT-SERVERS.NET.     5w6d16h IN A    193.0.14.129
L.ROOT-SERVERS.NET.     5w6d16h IN A    198.32.64.12
M.ROOT-SERVERS.NET.     5w6d16h IN A    202.12.27.33
A.ROOT-SERVERS.NET.     5w6d16h IN A    198.41.0.4
H.ROOT-SERVERS.NET.     5w6d16h IN A    128.63.2.53
B.ROOT-SERVERS.NET.     5w6d16h IN A    128.9.0.107
C.ROOT-SERVERS.NET.     5w6d16h IN A    192.33.4.12
D.ROOT-SERVERS.NET.     5w6d16h IN A    128.8.10.90
E.ROOT-SERVERS.NET.     5w6d16h IN A    192.203.230.10
I.ROOT-SERVERS.NET.     5w6d16h IN A    192.36.148.17
F.ROOT-SERVERS.NET.     5w6d16h IN A    192.5.5.241

;; Total query time: 215 msec
;; FROM: roke.uio.no to SERVER: A.ROOT-SERVERS.NET.  198.41.0.4
;; WHEN: Sun Feb 15 01:22:51 1998
;; MSG SIZE  sent: 17  rcvd: 436

7.3/var/named/zone/127.0.0

Just the basics, the obligatory SOA record, and a record that maps 127.0.0.1localhost. Both are required. No more shoshould be in this file. It will probably never need to be updated, unless your nameserver or hostmaster address changes.

$TTL 3D
@               IN      SOA     land-5.com. root.land-5.com. (
                                199609203       ; Serial
                                28800   ; Refresh
                                7200    ; Retry
                                604800  ; Expire
                                86400)  ; Minimum TTL
                        NS      land-5.com.

1                       PTR     localhost.

If you look at a random bind installation you will probably find that$TTLLine is missing as it is here. It was not used before, and only version 8.2 of BIND has started to warn about its absence. BIND 9RequiresThe$TTL.

7.4/var/named/zone/land-5.com

Here we see the mandatory SOA record, the needed NS records. We can see that he has a secondary name serverns2.psi.net. This is as it shoshould be,AlwaysHave a off site secondary server as backup. We can also see that he has a master host calledland-5Which takes care of the different Internet services, and that he's done it with cnames (a alternative is using a records ).

As you see from the SOA record, the zone file originatesland-5.com, The contact person isroot@land-5.com.hostmasterIs another oft used address for the contact person. the serial number is in the customary yyyymmdd format with todays serial number appended; this is probably the sixth version of Zone file on the 20th of September 1996. remember that the serial numberMustIncrease monotonically, here there is onlyOneDigit for todays serial #, so after 9 edits he has to wait until tomorrow before he can edit the file again. Consider using two digits.

$TTL 3D
@       IN      SOA     land-5.com. root.land-5.com. (
                        199609206       ; serial, todays date + todays serial #
                        8H              ; refresh, seconds
                        2H              ; retry, seconds
                        4W              ; expire, seconds
                        1D )            ; minimum, seconds
                NS      land-5.com.
                NS      ns2.psi.net.
                MX      10 land-5.com.  ; Primary Mail Exchanger
                TXT     "LAND-5 Corporation"

localhost       A       127.0.0.1

router          A       206.6.177.1

land-5.com.     A       206.6.177.2
ns              A       206.6.177.3
www             A       207.159.141.192

ftp             CNAME   land-5.com.
mail            CNAME   land-5.com.
news            CNAME   land-5.com.

funn            A       206.6.177.2

;
;       Workstations
;
ws-177200       A       206.6.177.200
                MX      10 land-5.com.   ; Primary Mail Host
ws-177201       A       206.6.177.201
                MX      10 land-5.com.   ; Primary Mail Host
ws-177202       A       206.6.177.202
                MX      10 land-5.com.   ; Primary Mail Host
ws-177203       A       206.6.177.203
                MX      10 land-5.com.   ; Primary Mail Host
ws-177204       A       206.6.177.204
                MX      10 land-5.com.   ; Primary Mail Host
ws-177205       A       206.6.177.205
                MX      10 land-5.com.   ; Primary Mail Host
; {Many repetitive definitions deleted - SNIP}
ws-177250       A       206.6.177.250
                MX      10 land-5.com.   ; Primary Mail Host
ws-177251       A       206.6.177.251
                MX      10 land-5.com.   ; Primary Mail Host
ws-177252       A       206.6.177.252
                MX      10 land-5.com.   ; Primary Mail Host
ws-177253       A       206.6.177.253
                MX      10 land-5.com.   ; Primary Mail Host
ws-177254       A       206.6.177.254
                MX      10 land-5.com.   ; Primary Mail Host

If you examine land-5s nameserver you will find that the host names are of the formws_Number. As of late BIND 4 versions named started enforcing the restrictions on what characters may be used in host names. so that does not work with BIND 8 at all, and I substituted '-' (DASH) for '_' (underline) for use in this howto. but, as mentioned earlier, BIND 9 no longer enforces this restriction.

Another thing to note is that the workstations don't have individual names, but rather a prefix followed by the two last parts of the IP numbers. using such a convention can simplify maintenance significantly, but can be a bit impersonal, and, in fact, be a source of irritation among your MERs.

We also see thatfunn.land-5.comIs an aliasland-5.com, But using an a record, not a cname record.

7.5/var/named/zone/206.6.177

I'll comment on this file below

$TTL 3D
@               IN      SOA     land-5.com. root.land-5.com. (
                                199609206       ; Serial
                                28800   ; Refresh
                                7200    ; Retry
                                604800  ; Expire
                                86400)  ; Minimum TTL
                        NS      land-5.com.
                        NS      ns2.psi.net.
;
;       Servers
;
1       PTR     router.land-5.com.
2       PTR     land-5.com.
2       PTR     funn.land-5.com.
;
;       Workstations
;
200     PTR     ws-177200.land-5.com.
201     PTR     ws-177201.land-5.com.
202     PTR     ws-177202.land-5.com.
203     PTR     ws-177203.land-5.com.
204     PTR     ws-177204.land-5.com.
205     PTR     ws-177205.land-5.com.
; {Many repetitive definitions deleted - SNIP}
250     PTR     ws-177250.land-5.com.
251     PTR     ws-177251.land-5.com.
252     PTR     ws-177252.land-5.com.
253     PTR     ws-177253.land-5.com.
254     PTR     ws-177254.land-5.com.

The reverse zone is the bit of the setup that seems to cause the most grief. it is used to find the host name if you have the IP number of a machine. example: You are an FTP server and accept connections from FTP clients. as you are a Norwegian FTP server you want to accept more connections from clients in Norway and other Scandinavian countries and less from the rest of the world. when you get a connection from a client the C library is able to tell you the IP number of the connecting machine because the IP number of the client is contained in all the packets that are passed over the Network. now you can call a function called gethostbyaddr that looks up the name of a host given the IP number. gethostbyaddr will ask a DNS server, which will then traverse the DNS looking for the machine. supposing the client connection is from ws-177200.land-5.com. the IP number the C Library provides to the FTP server is 206.6.177.200. to find out the name of that machine we need to find200.177.6.206.in-addr.arpa. The DNS server will first findarpa.Servers, then findin-addr.arpa.Servers, following the reverse trail through 206, then 6 and at last finding the server for177.6.206.in-addr.arpaZone at land-5. from which it will finally get the answer that200.177.6.206.in-addr.arpaWe have''PTR ws-177200.land-5.com''Record, meaning that the name that goes206.6.177.200Isws-177200.land-5.com.

The FTP server prioritizes connections from the Scandinavian countries, I. e .,*.no,*.se,*.dk, The namews-177200.land-5.comClearly does not match any of those, and the server will put the connection in a connection class with less bandwidth and fewer clients allowed. If there wasNoReverse Mapping206.2.177.200Throughin-addr.arpaZone the server wowould have been unable to find the name at all and wowould have to settle to comparing206.2.177.200With*.no,*.seAnd*.dk, None of which will match at all, it may even deny the connection for lack of classification.

Some people will tell you that reverse lookup mappings are only important for servers, or not important at all. Not so: Unknown FTP, news, IRC and even some HTTP (WWW) servers willNotAccept connections from machines of which they are not able to find the name. So reverse mappings for machines are in factMandatory.

Thank you for reading this article!
If you have any questions about this article, contact the author. Author address: Sidney.J.Yellow@gmail.com