[HowTo][Linux/Debian] Setting up a DNS server

DON'T post new tutorials here! Please use the "Pending Submissions" board so the staff can review them first.
Post Reply
User avatar
ayu
Staff
Staff
Posts: 8109
Joined: 27 Aug 2005, 16:00
18
Contact:

[HowTo][Linux/Debian] Setting up a DNS server

Post by ayu »

This tutorial will cover the basics of setting up a DNS server in a Linux/Debian enviornment (works with Ubuntu just as well). The examples will be based on my own configuration.

What is DNS?

DNS stands for "Domain Name System" (server) and is a service that translates domain names to IP addresses and back. Everytime you write google.com in your browser, the request is sent to your main DNS server and translated. The answer, which contains the IP address, is then sent back to your computer so that you can reach your destination. If your main DNS server can't resolve the query (request), it will send it to one of it's forwarding DNS servers to attempt to solve the request. If the next server can't solve it, it will send it to the next one, and so on and so forth.



Installing the DNS server

In this tutorial I will use bind9. Therefore, invoke the following command:
(Don't forget you have to be root to do this, sudo su)
apt-get install bind9


Configuring the server

First of all, you have to edit the config file named "named.conf.local". There is a file called "named.conf", but since it's already pre-configured in most cases, you can leave it be. if it, however, is not configured, you will have to edit that one instead (named.conf that is).

Anyway, here we go....

If the named.conf is already configured, it should look something like this:
// prime the server with knowledge of the root servers
zone "." {
type hint;
file "/etc/bind/db.root";
};

// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912

zone "localhost" {
type master;
file "/etc/bind/db.local";
};

zone "127.in-addr.arpa" {
type master;
file "/etc/bind/db.127";
};

zone "0.in-addr.arpa" {
type master;
file "/etc/bind/db.0";
};

zone "255.in-addr.arpa" {
type master;
file "/etc/bind/db.255";
};

include "/etc/bind/named.conf.local";
If it doesn't look like this, then do editing in the named.conf from here on. If it however looks like this, then you should edit named.conf.local, easy to follow ey?

Anyway, now you have to edit the file called named.conf.local:
nano /etc/bind/named.conf.local
zone "teresa" {
type master;
file "/etc/bind/zones/teresa.db";
};

zone "0.0.168.192.in-addr.arpa" {
type master;
file "/etc/bind/zones/rev.0.168.192.in-addr.arpa";
};
zone: This is the zone that the server will refer to for the domains, basically put in your domain name where it says "teresa" (teresa is my server). The second zone is for the reverse lookup. There is a lot to read about zones. This tutorial will not cover much about zones, but if you want to know more then you can refer to the following page:


type: It's either master or slave. The master is the first DNS that will be used, and in case it breaks down or "something" happens for some reason, then the slave server would still be there to server it. We will only create the master server in this tutorial though.

file: zone definition file. This is where all the zone information is held, with all the domain info, addresses and so on.

0.0.168.192.in-addr.arpa: is the reverse address, and in this case my network address is 192.168.0.0, which means that I should write 0.0.168.192 as the zone name for the reverse lookup.

Now, save the file with "CTRL + O" and then exit to bash with "CTRL + X". Now you have to edit the file called named.conf.options in the same folder, and to do so, invoke the following command:
nano /etc/bind/named.conf.options
options {
directory "/var/cache/bind";

// If there is a firewall between you and nameservers you want
// to talk to, you might need to uncomment the query-source
// directive below. Previous versions of BIND always asked
// questions using port 53, but BIND 8.1 and later use an unprivileged
// port by default.

//query-source address * port 53;

// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.

forwarders {
193.111.152.2;
};

auth-nxdomain no; # conform to RFC1035
listen-on-v6 { any; };
};
Note that the line "query-source address * port 53;" is commented in this config, which means that if you have a firewall on the server, you will have to uncomment it since it will use random ports without it.

forwarders: a DNS server that you forward requests to, for example if you setup this DNS as your main home DNS server, you would want a forwarding DNS to your ISP for example, so that if your DNS can't solve a DNS request (like google.com), it will send it to the next server, which is the forwarding address.

There, now save the file and exit to bash. Now it's time to create the zone definition files.

mkdir /etc/bind/zones
nano /etc/bind/zones/teresa.db
create the directory and edit the file.
teresa. IN SOA ns1.teresa. admin.teresa. (
// Do not modify the following lines!
2006081401
28800
3600
604800
38400
)

// Replace the following line as necessary:
// ns1 = DNS Server name
// mta = mail server name
// example.com = domain name
teresa. IN NS ns1.teresa.
teresa. IN MX 10 mta.teresa.

// Replace the IP address with the right IP addresses.
www IN A 192.168.0.6
mta IN A 192.168.0.6
ns1 IN A 192.168.0.6
ns1: Stands for "name server 1", which is the DNS server.

mta: Stands for mail transfer agent, which basically is another name for SMTPD (Simple Mail Transfer protocol Deamon).

www: world wide web third-level domain name. Yeah you should know what that is and what it's used for.

MX: The MX record stands for "mail exchange" and is a special domain record for routing mail.

A: Stands for "Address Record", and is a record that simply returns a 32-bit IPv4 address.

SOA: Contains information about the DNS zone, the primary ma,e server, email of the domain administrator, the domain serial number, and timers that are meant for zone refreshing.

If you want to read more about the different record types, then go here: http://en.wikipedia.org/wiki/A_record#A

www IN A 192.168.0.6
can basically be described as follows:
domain IN record address
now, when you are done, save the file and exit to bash. Now you have to edit the create and edit the file.

nano /etc/bind/zones/rev.0.168.192.in-addr.arpa
@ IN SOA ns1.teresa. admin.teresa. (
2006081401;
28800;
604800;
604800;
86400
)

IN NS ns1.teresa.
1 IN PTR teresa
PTR: Points towards the hostname, and is often used in reverse lookups. as in, you ask for an IP's hostname, instead of the other way around.

Now, all you have to do is save the file and exit to bash, and restart bind to make the new changes load.
/etc/init.d/bind9 restart

Slow resolutions?

Sometimes your server might resolve the requests slowly. To fix this you can try to disable IPv6 by editing the following file:
nano /etc/default/bind9
OPTIONS="-4 -u bind"
RESOLVCONF=yes
There, save and exit to bash...

That is all, hope you learned something. Have fun! :wink:
Last edited by ayu on 01 Sep 2008, 14:02, edited 2 times in total.
"The best place to hide a tree, is in a forest"

User avatar
bad_brain
Site Owner
Site Owner
Posts: 11636
Joined: 06 Apr 2005, 16:00
19
Location: In your eye floaters.
Contact:

Post by bad_brain »

well done mr. cats... =D>

just wanted to add that daily updating/upgrading is a must when running bind (signing up to the Debian mailing list is also a very good way to stay up to date with the latest updates), because there have been some nasty flaws in the past....so applying the latest patches asap is very important.

the mailing lists can be found here: http://lists.debian.org/

:wink:

User avatar
Lyecdevf
cyber Idi Amin
cyber Idi Amin
Posts: 1222
Joined: 16 Mar 2006, 17:00
18
Location: In between life and death.
Contact:

Post by Lyecdevf »

Why would some one want to have a DNS server at home? Would I need a separate computer for that?

Any way I went to google to look up this. Fact is my ISP has a DNS server. Actually they must have multiple ones so why not use them. Unless this would some how limit there ability to spy on me and my internet activity! If I resolve my own DNS requests that would mean I would not use there DNS servers and so it would limit there ability to see what I am doing. Am I right? At least they would not have any logs of my internet activity in there DNS servers!

Another thing that you could use a DNS server is if you have a dynamic IP and you wanted to connect to your computer from a remote location. In that case a DNS server would be recomended.

by Jason Bodnar

With the proliferation of broadband technologies such as cable modems and DSL, more and more people have systems "permanently" connected to the Internet. While many Internet Service Providers forbid users from providing services such as HTTP or FTP from their broadband-connected machines, eventually, you may find yourself away from home, needing access to your personal computer. But, unless you're one of the lucky few who received a static IP address from your ISP, your home machine may not be that easy to find. That is, if you are not using dynamic DNS.


Now I have a static IP so I would not need it for that but lets say that I wanted to set up my DNS server so that I would not use the ones from my ISP. Would that really limit there ability to see what I am doing on the net. Would they even care or notice is I have my own DNS server. Would they be afraid of me? :lol:

Any way good post cats. Keep up the good work!
We will either find a way, or make one.
- Hannibal

User avatar
ayu
Staff
Staff
Posts: 8109
Joined: 27 Aug 2005, 16:00
18
Contact:

Post by ayu »

@Lyecdevf: Even if you have a DNS server at home, you would need it to forward requests to another DNS to solve requests that it can't solve itself. For example, on my DNS I only have one domain at the moment, which is "teresa", which is the name of my server, and if I want to visit google.com for example, then my DNS would have to redirect that request to my ISP's DNS since my server only contains one record, and thus, can't solve the request.

A DNS at home can be good to setup to learn about it, since reading isn't enough always when learning. You have to do it practically as well, and "see it getting done", rather then reading it and just accepting the fact that the text says it will work.

Conclusion? Even if you setup a DNS server at home, you would still have to use an outside DNS to solve requests if you want to surf like you normally do ^^
"The best place to hide a tree, is in a forest"

User avatar
bad_brain
Site Owner
Site Owner
Posts: 11636
Joined: 06 Apr 2005, 16:00
19
Location: In your eye floaters.
Contact:

Post by bad_brain »

knowing how to set up a DNS service can also help you saving money and being more flexible when running your own server and hosting websites.
when transfering (already existing) customer sites to my servers I had to deal with some really crappy registrars that don't offer the option to set an A-Record (IP of the server), in such cases you have to submit DNS records....right now I am using an external DNS provider for such cases because it happened not too often yet.
but in the long run I will also run my own DNS server, simply because the money for the external DNS service goes off MY money (I usually make prices for a full hosting package, so I can't tell the customers to transfer 5 bucks extra for the DNS service, the time needed to explain what a DNS service actually is would be not worth it :lol: ).

User avatar
ayu
Staff
Staff
Posts: 8109
Joined: 27 Aug 2005, 16:00
18
Contact:

Post by ayu »

The tutorial has been checked and everything works, it does however, have a few issues in Ubuntu 8.04 Server, so I tried it in Debian Lenny Beta2 and worked like a charm ;)
"The best place to hide a tree, is in a forest"

Post Reply