/var/net/sys/admin/blog
| More

The DNS server was deployed in CentOS release 4.4, ,kernel ver. 2.6.9-42.0.3.Elsmp, Intel Xeon 3.2 GHz 2G RAM

Software Requirements
Any Linux/Unix flavors

Packages needed:

a.    Daemontools  (http://cr.yp.to/daemontools.html)
b.    UCSPI-TCP (http://cr.yp.to/ucspi-tcp.html)
c.    Djbdns (http://cr.yp.to/djbdns.html)
d.    Dnscache (http://cr.yp.to/dnscache.html)
e.    Tinydns (http://tinydns.org)
f.    Vegadns ( for web interface of tinydns, optional) (http://www.vegadns.org/)
g.    MySQL server (optional)
h.    Php, gcc, apache web server, perl, patch

Before installing djbdns , install daemontools and ucspi-tcp

1.DAEMONTOOLS

a. Create a /package directory:
mkdir -p /package
chmod 1755 /package
cd /package
b. Download the package daemontools-0.76.tar.gz into /package. Unpack the daemontools package:
tar zxvf daemontools-0.76.tar.gz

c. Compile
cd admin/daemontools-0.76
package/install

d.  Verify if running, type ps –aux, you should see the “svscan” function now running

2. UCSPI-TCP

a.    Download the package ucspi-tcp-0.88.tar.gz. Unpack the package
tar zxvf ucspi-tcp-0.88.tar.gz

b.    Compile
cd ucspi-tcp-0.88
make
make setup check

3. DJBDNS  (the core of our dns server)

a.    Download the djbdns package latest djbdns-1.05.tar.gz.

b.    Unpack the djbdns package
tar zxvf djbdns-1.05.tar.gz

c.    Compile the djbdns programs: (patch first if needed)
cd djbdns-1.05
echo gcc -O2 -include /usr/include/errno.h > conf-cc
make
make setup check   (successful if you produce the ffg. Output)
./install
./instcheck

4. TINYDNS (authoritative nameserver, the DNS server itself)

a.. Create users (tinydns and dnslog)
/usr/sbin/useradd -s /sbin/nologin -d /dev/null tinydns
/usr/sbin/useradd -s /sbin/nologin -d /dev/null dnslog

b. Create the first nameserver
tinydns-conf tinydns dnslog /etc/tinydns 1.2.3.5

where 1.2.3.5 is the IP tinydns should listen on

c. Start tinydns by telling svscan about it:
ln -s /etc/tinydns /service

d.    Verify if tinydns process is running, using ps –aux
root      3719  0.0  0.0  2388  284 ?        S    Nov14   0:00 supervise tinydns
tinydns   3723  0.0  0.0  2640  348 ?        S    Nov14   0:00 /usr/local/bin/tinydns
root      3718  0.0  0.0  2388  284 ?        S    Nov14   0:00 supervise log
dnslog    3722  0.0  0.0  2400  276 ?        S    Nov14   0:00 multilog t ./main

root      3706  0.0  0.0  2376  248 ?        S    Nov14   0:00 readproctitle service errors: …
If the “readproctitle service errors” line is clear, as above, you are all set

5 .DNSCACHE (the caching nameserver for the master DNS machine)

We will be setting up internal caching nameserver

a.    Create user (dnscache)
/usr/sbin/useradd -s /sbin/nologin -d /dev/null dnscache

b.    Create internal caching nameserver to be used by the server for DNS lookups
dnscache-conf dnscache dnslog /etc/dnscache 127.0.0.1

c.    Start dnscache by telling svscan about it
ln -s /etc/dnscache /service

d.    Verify if dnscache running, using ps –aux

root      3717  0.0  0.0  2388  284 ?        S    Nov14   0:00 supervise dnscache
dnscache  3721  0.0  0.0  3924 1436 ?        S    Nov14   0:00 /usr/local/bin/dnscache

e.    Use it as our nameserver, edit /etc/resolv.conf, then save and exit
nameserver 127.0.0.1

f.    Testing using the dig command
[root@ns1]# dig yahoo.com

; <<>> DiG 9.2.4 <<>> yahoo.com
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22149
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;yahoo.com.                     IN      A

;; ANSWER SECTION:
yahoo.com.              300     IN      A       216.109.112.135
yahoo.com.              300     IN      A       66.94.234.13

;; Query time: 167 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Fri Nov 17 16:34:02 2006
;; MSG SIZE  rcvd: 59

Tips:
a.    manually refreshing or flushing the nameserver  (flush it  there’s recently made DNS change to a domain and you want your server to realize the changes quickly
svc -t /service/dnscache
b.  we can adjust the level of traffic at which your nameserver will flish it’s cache by editing the file /etc/dnscache/env/CACHESIZE

SETTING UP TINYDNS

We can now tell the tinydns the hosts it should resolve by editing /etc/tinydns/root/data then run “make” to compile the data.cdb which tindydns reads

But for easy DNS management , we can use Vegadns

a.    Download the vegadns package then unpack it on the web directory of your server     (/var/www/html)
cd /var/www/html
tar zxvf vegadns-0.9.10.tgz

b.    Rename the directory
mv vegadns-0.9.10 vegadns

c.    Create the vegadns mysql server
mysqladmin -u root create vegadns –p

d.    Create a user that will have rights on the vegadns database
mysql -u root -e “GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, ALTER ON vegadns.* TO vegadns@localhost IDENTIFIED BY ‘password'” mysql –p

e.    Setting up vegadns, create “private” directories that will store template information, config information, caching information and session information

cd /var/www/html
mkdir -p vegadns_private/templates_c
mkdir vegadns_private/configs
mkdir vegadns_private/cache
mkdir vegadns_private/sessions

chown -R apache:apache vegadns_private
chmod -R 770 vegadns_private

f.    Edit vegadns config.php, save and exit

vi vegadns/src/config.php

these are the things needed for editing:
$private_dirs = ‘/var/www/html/vegadns_private’;

// Mysql settings
$mysql_host = ‘localhost’;
$mysql_user = ‘vegadns’;
$mysql_pass = ‘password’;
$mysql_db = ‘vegadns’;
$vegadns_url = ‘http://iphere/vegadns/’;
$supportname = “OWT”;
$supportemail = “postmaster@owtel.com”;
$trusted_hosts = ‘127.0.0.1’;

g.    Login to Vegadns Inteface
http://machineip/vegadns

default login account is:
Email: test@test.com
Password: test
h.    Create your user account
i.    Configure the default domain settings
This default domain template ensures that every time you create a new domain entry on your tinydns server, it gets created with certain basic settings and records (A records, MX records, nameservers, TTL settings etc.)

j.    Create new domain entry

k.    Writing the changes out to tinydns

Vegadns comes equipped with a handy script that writes all changes out to tinydns. This script is called update-data.sh.

Setup the update-data.sh script:

cd /var/www/html/vegadns
vi update-data.sh

Change the line to:
VEGADNS=’http://machineIP/vegadns/index.php’

chmod 750 update-data.sh
cp update-data.sh /usr/local/sbin/update-data.sh

l.    Execute the script

update-data.sh

This will write the domain information entered in vegadns to our DNS server

/etc/tinydns/root/data

TESTING :

Test1.  local query (private query)
Log into any server that is able to use the “dig” utility and do the following
dig @othermachineip owtalk.com

[root@otherserver ~]# dig @10.50.0.74 owtalk.com

; <<>> DiG 9.3.1 <<>> @10.50.0.74 owtalk.com
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22866
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;owtalk.com.                    IN      A

;; ANSWER SECTION:
owtalk.com.             3600    IN      A       202.130.144.102

;; AUTHORITY SECTION:
owtalk.com.             3600    IN      NS      ns1.owtalk.com.
owtalk.com.             3600    IN      NS      ns2.owtalk.com.

;; ADDITIONAL SECTION:
ns1.owtalk.com.         3600    IN      A       202.130.144.102
ns2.owtalk.com.         3600    IN      A       202.130.144.103

;; Query time: 5 msec
;; SERVER: 10.50.0.74#53(10.50.0.74)
;; WHEN: Fri Nov 17 19:15:47 2006
;; MSG SIZE  rcvd: 112

Test 2. Remote query
Test the DNS server’ response when queried from an external location

http://domainwhitepages.com/

DNS Compliance

This will analyze and point out any inconsistencies and/or problems in our nameservers. To   do this test, we use

http://www.dnsreport.com

Replication of DNS using rsync over ssh

Prepare a script something like this:

rsync -e ssh -az /etc/tinydns/root/data $host:/etc/tinydns/root/data
ssh $host “cd /etc/tinydns/root; make”

where $host is the second tinydns server

in order for it not to prompt password in ssh communication, setup authorized keys

Share

Leave a comment

Name: (Required)

E-mail: (Required)

Website:

Comment:

 

About FLT

This site is dedicated to everyone who likes to learn and explore the beautiful world of Linux. If you have comments and suggestions, please feel free to email at freelinuxtutorials@gmail.com. I am happy to serve and share things esp. that is free and enjoyable as Linux.