Hey guys and welcome back. Now previously we've been going through some of the basics
of how DNS operates as well as how we as clients can receive information from DNS servers.
We also talked about different DNS records that were available. Now what I want to do
is I want to really dig in and go through the actual configuration of a DNS server itself.
Now what we're going to be doing here as per the exam objectives is we're going to be
configuring something called a BIND DNS server. Now BIND happens to be a very common DNS
server. This is the Berkeley Internet Domain Server B-I-N-D. So with respect to BIND there
actually are different versions of this. The version we're going to be focusing on is
one called BIND9. This is the one that is in the exam objectives. Now before we actually
start I just want to be clear here there actually are other DNS options we have available
to us. So one type of DNS software we can use is one called DNSMask and that is mask
with a Q. Now DNSMask can be used for DNS. It can also be used for DHCP if you can remember
what that was when we talked about our network configuration that allows us to effectively
manage IP address space whereby hosts can come in and request an IP address. DNSMask
can perform this task as well as like I say manage the task of DNS queries. Another one
is one called POWERDNS. This was a DNS solution centred around load balancing. If you don't
know what load balancing is it just means that we can ultimately have let's say one
server here, one server here. So that could be DNS1, DNS2 and we can have requests split
across these different servers so that one is not getting absolutely battered with all
the requests instead we actually split the load i.e. we balance the load and that was
really the primary purpose of POWERDNS and we also have one called DJBDNS. Again we don't
have to be too worried around this solution. This was primarily focused on security. So
now we have a general awareness of these other solutions. Let's have a look at the
bind software then. Now before we actually start I just want to make one thing clear.
Now the exam objectives actually say that we should be able to configure a DNS server,
a bind DNS server should I say that is caching only. So I do feel it is relevant that we
actually understand what a caching server is and what are the alternatives to that.
So the first type of server we can have is that authoritative server. This is the server
which has the original records for that particular domain. Now we also talked about how we could
use say for example like an ISP or something as a DNS server which can ultimately forward
requests. Well as opposed to having the authoritative records we can also have a forwarding DNS
as well as a caching DNS server. Now really we want to be focusing on the distinction
between these two solutions right here and then ultimately configuring a caching DNS
server. So let me talk to you about this then. Let's say that we have our little local machine
right here and we had some type of DNS forwarder. So on our local network we have a DNS forwarder
and then we would have our ISP say for example. Okay so let's imagine on our little network
segments within our local network we have our local client computer and we also have
this DNS forwarder okay which is on the same network here okay and then outside our network
we have our ISP and then way out there we have these root servers as well as our top
level domains as well as our authoritative servers okay. So check this out us as the
client down here if we happen to have a DNS forwarder what's going to happen is we're
going to send our DNS requests to that forwarder okay. What this DNS forwarder is going to do
is going to ultimately offload that and send the request to say for example an ISP i.e.
someone else. Now the ISP as we just talked about it can go through a recursive process
to pull back the information we need say for example we go to the root server to find out
do we need a dot com or do we need a dot edu. Once we know that we can go to the correct
top level domain server and then get the information for the authoritative server and recursively
get that information back to the ISP and then the ISP can send that back to the DNS forwarder
who can then reply to us give us a response with the information we need and suddenly
we can resolve the IP addresses we need from the domain names that we are using or attempting
to reach. This is all very well and good ultimately this DNS server is forwarding these requests
however if we happen to have a DNS caching server okay so we have a DNS cache same type
of process in that when us as the client have a particular request we send that request
to our DNS caching server. The difference being is that the DNS caching server is going
to be proactive on its own it's not going to try to lean on top of the ISP instead it's
going to generate that information itself it's going to go to the root itself it's going
to go to the TLD itself to the auth server and like I say it's going to cache and store
all of this information. Now once all of that very detailed information is stored on this
machine the next time we have to make a similar request we just send it to our DNS caching
server on our network and we get a very quick response back no need to bog down the internet
no need to wait on say for example our ISP making connections this resolution happens
very rapidly and I will just say for posterity you do not have to have the DNS cache on your
same local network you actually can route that traffic if need be but this would be
a common configuration right here. Now it is important to note that when we have a bind
server we actually can make it a forwarding server if we so choose and like I say what
we would be doing in this nugget right here is learning how to make a caching server but
just be aware we still can make it a forwarding DNS server if necessary and really one of
the benefits of being able to have this local access to our DNS like we do with this DNS
caching server well like I say it's going to keep the request local therefore we're going
to get an increase in speed and efficiency we will also use less bandwidth and it also
simplifies certain things such as firewall rulings because you don't need to worry so
much about reaching DNS traffic you can make your firewall rules much stricter because you
don't have to worry about letting through this particular traffic outbound towards the
internet and back in. So now we have an understanding of the different types of DNS software we
have as well as the different styles of DNS that we can actually implement how about we
actually walk through the installation of getting our bind 9 server up and running so
with that said let's dig in then shall we what we'll do here as I will first start with
a pseudo apt update I'll type in my password okay it's going to pull down the updates okay
now we will do a pseudo apt install and we're going to install bind 9 so I'll hit enter
perfect I'll say yes okay and now I'm going to say pseudo apt update install bind 9 utils
all one word if I hit enter now perfect with these two packages now installed what I want
to do is I want to go into the exit directory and then I want to go into this directory
here called bind okay so I'll go into bind okay here we are okay so now we're in this
directory what I want to do is I want to go into this file right here named dot conf
otherwise referred to as named dot conf so what I'll do is I'll say pseudo nano named
dot conf and if I hit enter we can see here this is the primary configuration file for
the bind DNS server now what to note here is that within this configuration file you can
actually specify all the configurations that you need however things have actually been separated
and split up here so we can actually see here the contents of this file named dot conf is actually
split into these three different files we have the named dot conf options as well as the dot
local file as well as the dot default zones file now for the purposes of the examination in
order to configure our caching server we want to go into this one called named dot conf
dot options file so what I will do is I'll just escape out here and I will go in and say
pseudo nano named dot conf dot options so if I hit enter now we can see here this particular
configuration file now one thing to note here about these particular configuration files is
that they might look a little bit intimidating they make a lot of use of these square brackets or
rather these curly braces should I say not square brackets curly braces and we also have these
semicolons which denote different values within the configuration file almost assume they're like
commas work in the English language okay so within this file we have particular configurations
we also have particular keywords here is one keyword we can see right here listen on v6 this
is really whereabouts the DNS server that we are actually running whereabouts should it actually
listen for connections i.e. what is the interface it should be listening on and what particular
port number say for example port number 53 now listen on v6 is just for ipv6 if we want to make
connections listen on ipv4 we would just use the keyword listen on without the v6 at the end so
what I could do is I could get down here and I would just say listen hyphen on and I could say
something like say you know port 53 and then if I wanted to specify an IP address I would use my
curly braces and if I wanted to use my loopback address i.e. the local logical interface I could
specify this and then at the end I would have my semicolon and then again my curly brace this
would close the configuration and then once again to denote the end of the line I would have a
semicolon and in fact let me just get a little bit of space here so this might be a little bit
intimidating the first time you happen to see this particular configuration file but the reality is
we don't have to be too concerned with all of the particular options and I will say if we wanted
to add in additional IP addresses and wish to listen let's say we had our local IP address which I
think is in my case 192.1680.65 I would just add in in fact let me add in eight there I would just
add in that value and again use that semicolon to denote the end and with respect to our ipv6
configuration we can see we're listening on any interfaces now what I will do for simplicity
I will just remove this configuration in order to be able to make this caching only server
configuration the thing that we actually have to add here is a particular keyword and that is
we're going to add the keyword recursion and then the word yes and to make it a valid configuration
we're going to have to end this with our semicolon and if we write this out and we escape that is all
we have to do to make this a caching server now we have this configured what I want to do is to be
able to check that my configuration file is in fact working i.e the configuration is using
acceptable syntax remember all those issues with the curly braces and the semicolons we can actually
auto check our configuration file by saying sudo named checkconf okay so if I enter here everything
seems to be okay whereas if I happen to go back in here and I break something let's maybe say
recursion yes and I forget to put my semicolon and I save this I run the same command and to enter
we can actually see here we are missing our semicolon to definitely make use of this command
if you're having a tough time with respect to the syntax we can actually see here it's on line 23
here so let's go back in and modify this and we shall add in that semicolon perfect so now what I
want to do here is I want to restart the bind 9 service to include this new configuration so I'll
say sudo service bind 9 and I'm going to say restart to restart it okay so I've now loaded in the new
configuration file now what I'm going to do is I'm going to use the dig command to actually make a
request so if I say dig localhost in fact that should be at localhost and I just make a particular
request let's maybe say for CBT nuggets dot com so if I enter now what we're going to do here is
we're going to make a particular request we can see here we have our answer we have CBT nuggets we
have two different options we can see the a record i.e the ipv4 address right here and same right here
we can see the time to live where it's going to cache and crucially we can see the query time
703 milliseconds almost one second now what we know now is that this server went and got all that
information it's resolved and it's now cached that so now if I make the same request and I hit enter
look at how quickly it got the information query time zero milliseconds pretty much it got it
instantaneously and we'll notice now that the time to live has deprecated down to 23 seconds so we
can see we have this caching mechanism in play and as we just use this we can see the time to live
slowly decrement but what I want to draw your attention to is that with DNS there happens to
be quite a lot of security concerns now one of the things that we want to be aware of is how we can
actually control access to our DNS via something called an allow query and this can again be configured
within that same configuration file so let's go back into our options now the very first thing
which I'm going to do is I'm going to create an access control list this is just going to be a list
of particular networks or hosts but I want to allow to make incoming requests to this DNS server
so above the options here what I'm going to do is I'm going to use the keywords ACL to specify an
access control list and then I'm going to give the access control list a name so I can call this
anything I want so I'll just call this my friends and then I'll use my curly brace okay and if I go
in with a tab indentation I can specify networks which are allowed to access this so I will say
anyone within 192.168.0.0 slash 24 I want to match on them so what I will do is I will have my semi
colon and then I will have my curly brace to end the configuration and then a semi colon once again
now that is not all what we want to do is down where our recursion is happening right here I actually
want to reference this access control list via something called an allow query basically this
is where I'm going to allow queries from so I will say allow query i.e allow queries coming from
anything that matches the access control list that is called my friends which ultimately means
allow queries from here which specifies allow queries coming from this network range i.e people
on my local network are allowed to use this DNS server so as we know we're going to use our semi
colon I'll then use my curly brace and then again a semi colon once again and just before I do this
what I will actually do is I'll also add in just specify my local host can make this request so if
I save this write it out let's check that the syntax is correct by using our name check config
it appears it is let's restart the service to make it take effect there we go so now I can
rerun my query we get our answer back from cb to nuggets 895 milliseconds let's try it once again it
should now be cached and we can see here indeed the query time is zero milliseconds now the last
thing that I just want to quickly point out is that with respect to our bind configuration so much of
that relies upon these particular configuration files now one command we want to be aware of is the
rndc command if I go in and say man rndc anti-enter we can see here this is going to be our name
server control utility so this command can actually do a whole lot much of which is beyond the scope
of the examination one of the things we want to be aware of for the purposes of the examination is
that the rndc command can actually allow us to reload every one of our configuration files and the
way we could do this is by simply saying rndc reload if I hit enter now I'm going to have to
use super user privileges of course I'll say rndc reload hit enter and we can now see we actually
were able to successfully reload the server directly via rndc now there are some additional things the
rndc command can do if you check the man page you can see you can actually generate configuration files
via this command but for the purposes of the examination you just want to be aware of this
command as well as its basic functionality so that is us for our introduction into setting up a dns
server we still have a lot more to get into with respect to dns but for now I hope this has been
informative for you and I'd like to thank you for viewing