How to setup Local Authoritative DNS

2012-08-14T02:59:53Z

Tux-box1:

[[category: Tutorials]]
=How to setup Local Authoritative DNS=

I was wanting an authoritative name server for my local intranet. I also wanted any dynamic IP's to be visible to the name server. The name server included with linuxmce is configured as a recursive name server. Here's the changes I did to configure my core's name server to be authoritative and support dynamic IPs. Note, the machines on my intranet are private, i.e., not known to the outside world.

3 Feb 2008 - Developed and tested on LinuxMCE 0710 Beta 3 amd64.

I named my intranet "wright.local". Using a "local" top level domain (TLD) is recommended for private intranets. Some may prefer to use "lan". You do not want to use any of the standard TLDs like "com", "net", "org",...

I used the core's default intranet addresses, 192.168.80.0/24 with the core at 192.168.80.1.

I've attempted to verbosely document each config file. :)

The directions for adapting the config files are included in the named.conf file.

==Installation==

If you want to try this, I would suggest building the config in new directories then swapping with the originals when you are ready (I had a little mess when my core hung and I had to restart with only half the configs ready) :)

So start with creating two directories:

sudo mkdir /etc/bind.new
sudo mkdir /etc/dhcp3.new

Now copy the contents of the original directories:

sudo cp -arp /etc/bind/* /etc/bind.new
sudo cp -arp /etc/dhcp3/* /etc/dhcp3.new

Also create a new resolv.conf file:

sudo touch /etc/resolv.conf.new

You will be creating or editing the following config files in these new directories:

/etc/bind.new/named.conf
/etc/bind.new/named.conf.options
/etc/bind.new/logging.conf
/etc/bind.new/rndc.conf
/etc/bind.new/rndc.key
/etc/bind.new/db.wright.local.zone
/etc/bind.new/db.wright.local.rev
/etc/dhcp3.new/dhcpd.conf
/etc/resolv.conf.new

The full text of the files you will be editing is at the foot of this page. The original author named his network "wright"; you should replace all instances of "wright" with the name of your network.

==Notes on Editing Files==

===rndc.key and dhcpd.conf key values===

To create a key for use in rndc.key and dhcpd.conf:

sudo dnssec-keygen -a HMAC-MD5 -b 256 -n user rndc

Now get the key from the private file:

sudo cat Krndc.*.private
Private-key-format: v1.2
Algorithm: 157 (HMAC_MD5)
Key: 3+GnSWV5FKxcUu57k7QFxbpvv/xr4fXj2wBVGtdGifI=
Bits: AAA=

Now cut the key which is to the right of "Key: " and paste where needed (replace "<paste your key here>" with the key in the config files). So an example using the above key would look like:

key "linuxmce-dhcp" {
algorithm hmac-md5;
secret "<paste your key here>";
};

becomes:

key "linuxmce-dhcp" {
algorithm hmac-md5;
secret "3+GnSWV5FKxcUu57k7QFxbpvv/xr4fXj2wBVGtdGifI=";
};

===Check directory ownership===
Make the logging directory:

sudo mkdir /var/log/named
sudo chown bind:bind /var/log/named
sudo chmod 755 /var/log/named

===Setting default domain===
You probably ought to check and change the defaultdomain:

domainname

will probably show

pluto

if so, then set it by:
sudo domainname yourdomain.local

where "yourdomain.local" is your domain. :-)

===File Permissions===
Change all the file permissions per instructions in named.conf:

File permissions:
// /etc/bind/named.conf root:root 644
// /etc/bind/rndc.key root:bind 640
// /etc/bind/rndc.conf root:root 600
// /etc/resolv.conf root:root 644
// /etc/bind root:bind 775, chmod g+s => drwxrwsr-x
// /etc/dhcp3 root:root 755
// /etc/dhcp3/dhcpd.conf root:root 644
//

===Double check. Everything===
Double check everything. Roll Eyes

==Wrapping up==
When and if you are feeling lucky, rename the original directories and then rename the new directories to take their place:

sudo mv /etc/bind /etc/bind.original
sudo mv /etc/bind.new /etc/bind
sudo mv /etc/dhcp3 /etc/dhcp3.original
sudo mv /etc/dhcp3.new /etc/dhcp3
sudo mv /etc/resolv.conf /etc/resolv.conf.original
sudo mv /etc/resolv.conf.new /etc/resolv.conf

Finally restart the bind and dhcpd services:

sudo rndc reload
sudo /etc/init.d/dhcp3-server restart

Check the syslog for any errors:

grep named /var/log/syslog
grep dhcpd /var/log/syslog

==Config Files==

===/etc/bind/named.conf===
<pre>
// This is the primary configuration file for the BIND DNS server named.
//
// This configuration supports an authoritative local zone (wright.local on
// 192.168.80.0/24) and allows DHCP to update the local zone.
// To customize to your setup:
// 1) replace "wright.local" with your internal domain name.
// 2) edit db.wright.local.zone and db.wright.local.rev and replace
// my static names/addresses with your network's static names/addresses.
// Make sure to increment the serial number of any file edited.
// Note, format of serial number is: YYYYMMDDNN where YYYY is year,
// MM is month, DD is day, NN is update number for that day (i.e., 01,
// 02, 03,...)
// 3) rename db.wright.local.zone to match your domain name.
// 4) rename db.wright.local.rev to match your domain name.
// 5) If you changed the internal network IP from the LinuxMCE default of
// 192.168.80.0/24, then replace "192.168.80" with your network
// ip and replace it's reverse "80.168.192" wity your network ip's
// reverse.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the
// structure of BIND configuration files in Debian, *BEFORE* you customize
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local
//
// references:
// http://www.arda.homeunix.net/dnssetup.html
// http://www.madboa.com/geek/soho-bind/
//
// notes:
// 1) The following command should be ran about twice a year to keep
// the root servers current:
// dig @a.root-servers.net . ns > /etc/bin/db.root
// Root name servers don’t change very often so updating this file more
// than twice a year is probably overkill. Frequent updates also put undo
// load on the root name servers; they have enough to do as it is.
//
// 2) File permissions:
// /etc/bind/named.conf root:root 644
// /etc/bind/rndc.key root:bind 640
// /etc/bind/rndc.conf root:root 600
// /etc/resolv.conf root:root 644
// /etc/bind root:bind 775, chmod g+s => drwxrwsr-x
// /etc/dhcp3 root:root 755
// /etc/dhcp3/dhcpd.conf root:root 644
//
// Manually Updating Zone Files
// 1. Use rndc to stop BIND.
// sudo rndc stop
// 2. Remove any .jnl files from the zone file directory.
// sudo rm /etc/bind/*.jnl
// 3. Edit the zone files as necessary. Make sure to increment the serial
// number of any file edited. Note, format of serial number is:
// YYYYMMDDNN where YYYY is year, MM is month, DD is day, NN is update
// number for that day (i.e., 01, 02, 03,...)
// 4. Start BIND using its startup script.
// sudo /etc/init.d/bind9 start

// secret must be the same as in /etc/bind/rndc.conf
include "/etc/bind/rndc.key";

// access control list used to limit queries to local net
acl "internal-net" { 192.168.80/24; 127.0.0.1; };

controls {
inet 127.0.0.1 allow { any; } keys { "rndc-key"; };
};

include "/etc/bind/named.conf.options";

// The single dot (.) is the root of all DNS namespace, so
// this zone tells named where to start looking for any
// name on the Internet
zone "." IN {
type hint;
file "/etc/bind/db.root";
};

// local intranet zones and reverse zones
// intranet is wright.local and 192.168.80.0/24
// the DHCP servers is on linuxmce-dhcp
// an optional second nameserver would be on linuxmce-ns2

zone "wright.local" IN {
type master;
file "/etc/bind/db.wright.local.zone";
// both allow-update and update-policy can enable DHCP updates,
// but update-policy allows more control over what kinds of
// updates DHCP can perform on a zone.
// allow-update { none; };
update-policy { grant linuxmce-dhcp subdomain wright.local. A TXT; };
// allow-transfer { key "linuxmce-ns2"; };
// notify on zone transfers
notify yes;
};

zone "80.168.192.in-addr.arpa" IN {
type master;
file "/etc/bind/db.wright.local.rev";
// allow-update { none; };
update-policy { grant linuxmce-dhcp subdomain 80.168.192.in-addr.arpa. PTR TXT; };
// allow-transfer { key "linuxmce-ns2"; };
notify yes;
};

// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912 (http://www.ietf.org/rfc/rfc1912.txt)

// Where the localhost hostname is defined
zone "localhost" IN {
// a master type means that this server needn't look
// anywhere else for information; the localhost buck
// stops here.
type master;
file "/etc/bind/db.local";
// don't allow dynamic DNS clients to update info
// about the localhost zone
allow-update { none; };
};

// Where the 127.0.0.0 network is defined
zone "127.in-addr.arpa" IN {
type master;
file "/etc/bind/db.127";
allow-update { none; };
};

zone "0.in-addr.arpa" IN {
type master;
file "/etc/bind/db.0";
allow-update { none; };
};

zone "255.in-addr.arpa" IN {
type master;
file "/etc/bind/db.255";
allow-update { none; };
};

// Include logging config file
include "/etc/bind/logging.conf";

// zone "com" { type delegation-only; };
// zone "net" { type delegation-only; };

// From the release notes:
// Because many of our users are uncomfortable receiving undelegated answers
// from root or top level domains, other than a few for whom that behaviour
// has been trusted and expected for quite some length of time, we have now
// introduced the "root-delegations-only" feature which applies delegation-only
// logic to all top level domains, and to the root domain. An exception list
// should be specified, including "MUSEUM" and "DE", and any other top level
// domains from whom undelegated responses are expected and trusted.
// root-delegation-only exclude { "DE"; "MUSEUM"; };

include "/etc/bind/named.conf.local";
</pre>

===/etc/bind/named.conf.options===
<pre>
options {
// tell named where to find files mentioned below
directory "/var/cache/bind";

// file that contains the process id when bind is running
pid-file "/var/run/bind/run/named.pid";

// enable statistics
statistics-file "/var/named/named.stats";
zone-statistics yes;

dump-file "/var/named/named.dump";

// If there is a firewall between you and nameservers you want
// to talk to, you might need to uncomment the query-source
// directive below. Previous versions of BIND always asked
// questions using port 53, but BIND 8.1 and later use an unprivileged
// port by default.
// query-source address * port 53;

// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.

// The forwarders option tells BIND to not use iterative queries itself
// for information it doesn’t already know about but to forward a
// recursive query to the name servers specified instead.
include "/etc/bind/named.conf.forwarders";

// conform to RFC1035
auth-nxdomain no;

// on a multi-homed host, you might want to tell named
// to listen for queries only on certain interfaces
listen-on-v6 { any; };
listen-on { "internal-net"; };

// to allow only specific hosts to use the DNS server:
allow-query { "internal-net"; };

// sets BIND’s default behaviour to refuse all zone transfers.
// Without setting this option, anyone can transfer any zone.
allow-transfer { none; };

// do not generate notify messages for all zones on a restart.
// override for authorative zones
notify no;
};
</pre>

===/etc/bind/logging.conf===
<pre>
logging {

channel default_file {
file "/var/log/named/default.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel general_file {
file "/var/log/named/general.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel database_file {
file "/var/log/named/database.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel security_file {
file "/var/log/named/security.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel config_file {
file "/var/log/named/config.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel resolver_file {
file "/var/log/named/resolver.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel xfer-in_file {
file "/var/log/named/xfer-in.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel xfer-out_file {
file "/var/log/named/xfer-out.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel notify_file {
file "/var/log/named/notify.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel client_file {
file "/var/log/named/client.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel unmatched_file {
file "/var/log/named/unmatched.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel queries_file {
file "/var/log/named/queries.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel network_file {
file "/var/log/named/network.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel update_file {
file "/var/log/named/update.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel dispatch_file {
file "/var/log/named/dispatch.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel dnssec_file {
file "/var/log/named/dnssec.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel lame-servers_file {
file "/var/log/named/lame-servers.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};

category lame-servers {
lame-servers_file;
};
category dnssec {
dnssec_file;
};
category dispatch {
dispatch_file;
};
category update {
update_file;
};
category network {
network_file;
};
category queries {
queries_file;
};
category unmatched {
unmatched_file;
};
category client {
client_file;
};
category notify {
notify_file;
};
category xfer-out {
xfer-out_file;
};
category xfer-in {
xfer-in_file;
};
category resolver {
resolver_file;
};
category config {
config_file;
};
category security {
security_file;
};
category database {
database_file;
};
category general {
general_file;
};
category default {
default_file;
};
};
</pre>

===/etc/bind/rndc.conf===
<pre>
options {
default-server localhost;
default-key "rndc-key";
default-port 953;
};

server localhost {
key "rndc-key";
};

key "rndc-key" {
algorithm hmac-md5;
secret "<paste your key here>";
};
</pre>

===/etc/bind/rndc.key===
<pre>
key "rndc-key" {
algorithm hmac-md5;
secret "<paste your key here>";
};

key "linuxmce-dhcp" {
algorithm hmac-md5;
secret "<paste your key here>";
};

key "linuxmce-ns2" {
algorithm hmac-md5;
secret "<paste your key here>";
};
</pre>

===/etc/bind/db.wright.local.zone===
<pre>
;
; BIND data file for wright.local
; ref. http://www.redhat.com/docs/manuals/linux/RHL-9-Manual/ref-guide/s1-bind-zone.html
;
$TTL 86400 ; time to live : 86400s = 1 day
; Start Of Authority record, proclaims important authoritative information
; about a namespace to the nameserver.
@ IN SOA dcerouter.wright.local roy@wright.org (
2008013101 ;serial (YYYYMMDDNN where N = 01,02,03,...)
10800 ;refresh (3 hours)
7200 ;retry (2 hours)
36000000 ;expire (10,000 hours = 416 2/3 days)
86400) ;default minimum ttl
;
; NameServer record, which announces the authoritative nameservers for a particular zone.
;
IN NS dcerouter.wright.local.
;
; Address records specify an IP address to assign to a name
;
dcerouter IN A 192.168.80.1
thenameofamachine IN A 192.168.80.21
thenameofanothermachine IN A 192.168.80.20
;
; Canonical name records, maps one name to another.
;
linuxmce IN CNAME dcerouter
</pre>

===/etc/bind/db.wright.local.rev===
<pre>

;
; BIND reverse data file for wright.local
; ref. http://www.redhat.com/docs/manuals/linux/RHL-9-Manual/ref-guide/s1-bind-zone.html
;
$ORIGIN 80.168.192.in-addr.arpa.
$TTL 86400 ; time to live : 86400s = 1 day
; Start Of Authority record, proclaims important authoritative information
; about a namespace to the nameserver.
@ IN SOA dcerouter.wright.local roy@wright.org (
2008013101 ;serial (YYYYMMDDNN where N = 01,02,03,...)
10800 ;refresh (3 hours)
7200 ;retry (2 hours)
36000000 ;expire (10,000 hours = 416 2/3 days)
86400) ;default minimum ttl
;
; NameServer record, which announces the authoritative nameservers for a particular zone.
;
IN NS dcerouter.wright.local.
;
; PTR — PoinTeR record, designed to point to another part of the namespace.
;
1 IN PTR dcerouter.wright.local.
21 IN PTR dad-kubuntu.wright.local.
20 IN PTR royw-gentoo.wright.local.
</pre>

===/etc/dhcp3/dhcpd.conf===
<pre>
option domain-name-servers 192.168.80.1;
authoritative;

option routers 192.168.80.1;
option subnet-mask 255.255.255.0;

# lease IPs for 1 day, maximum 1 week
default-lease-time 86400;
max-lease-time 604800;

# dynamic DNS updates
ddns-updates on;
ddns-update-style interim;
ddns-domainname "wright.local.";
ddns-rev-domainname "in-addr.arpa.";
ddns-ttl 14400;

# don't let clients modify their own A records
ignore client-updates;

key "linuxmce-dhcp" {
algorithm hmac-md5;
secret "<paste your key here>";
};

zone wright.local {
primary 192.168.80.1;
key "linuxmce-dhcp";
}

zone 80.168.192.in-addr.arpa {
primary 192.168.80.1;
key "linuxmce-dhcp";
}

option space pxelinux;
option pxelinux.magic code 208 = string;
option pxelinux.configfile code 209 = text;
option pxelinux.pathprefix code 210 = text;
option pxelinux.reboottime code 211 = unsigned integer 32;

subnet 192.168.80.0 netmask 255.255.255.0 {
next-server 192.168.80.1;
filename "/tftpboot/pxelinux.0";
option pxelinux.reboottime = 30;

option domain-name "wright.local";
option domain-name-servers 192.168.80.1;
option routers 192.168.80.1;

default-lease-time 86400;
max-lease-time 604800;
pool {
allow unknown-clients;
range 192.168.80.129 192.168.80.254;
}
}

# PXE booting machines
group {
next-server 192.168.80.1;
filename "/tftpboot/pxelinux.0";
option pxelinux.reboottime = 30;

}

# regular machines
group {
}

# CORE (1) has bad mac address:

</pre>

===/etc/resolv.conf===
<pre>
domain wright.local
nameserver localhost
</pre>

LinuxMCE - User contributions [en]

How to setup Local Authoritative DNS