DNS server Setup using bind in Ubuntu

The BIND DNS Server is used on the vast majority of name serving machines on the Internet, providing a robust and stable architecture on top of which an organization’s naming architecture can be built. The resolver library included in the BIND distribution provides the standard APIs for translation between domain names and Internet addresses and is intended to be linked with applications requiring name service.

Firewall Config

Bind listens on port 53 UDP and TCP. TCP is normally only used during zone transfers so it would appear that you could filter it if you have no slaves. However If the response to a query is greater than 1024 bytes, the server sends a partial response, and client and server will try to redo the transaction with TCP.

Responses that big do not happen often, but they happen. And people do quite often block 53/tcp without their world coming to an end. But this is where one usually inserts the story about the Great DNS Meltdown when more root servers were added. This made queries for the root list greater than 1024 and the whole DNS system started to break down from people violating the DNS spec (RFC1035) and blocking TCP.

Differences in BIND8 and BIND9

Apart from being multi-threaded, and a complete code rewrite - which should provide better stability and security in the long term, there are other differences

If there is a syntax error in named.conf, BIND9 will log errors and not reload the named server. BIND8 will log errors and the daemon will die!

Extensive support of TSIGs (shared keys) for access control, for example, “update-policy” can be used for fine grained access control of dynamic updates.

The tool for starting/stopping/reloading etc., rndc is different from the v8 ndc - different communications, authentication and features.

Syntax in zone files is more rigorously checked (e.g. a TTL line must exist)

In named.conf

v8 options ‘check-names’ and ’statistics-interval’ are not yet implemented in V9.

the default for the option ‘auth-nxdomain’ is now ‘no’, if you don’t set this manually, BIND 9 logs a corresponding message on startup.

The root server list, often called named.root or root.hints in BIND8 is not necessary in BIND 9, as it is included within the server.

Installing Bind in Ubuntu

sudo apt-get install bind9 dnsutils

This will install all the required packages for bind9

Configuring Bind

If you install Bind from the source code, you will have to edit the file named.conf. However, Ubuntu provides you with a pre-configured Bind, so we will edit named.conf.local file

sudo vi /etc/bind/named.conf.local

This is where we will insert our zones.If you want to know what is zone in DNs check this

DNS zone is a portion of the global DNS namespace. This namespace is defined by RFC 1034, “Domain Names - Concepts and Facilities” and RFC 1035, “”Domain Names - Implementation and Specification”, and is laid out in a tree structure from right to left, such that divisions of the namespace are performed by prepending a series of characters followed by period (’.'), to the upper namespace

You need to add the following lines in named.conf.local file

# This is the zone definition. replace example.com with your domain name

zone “example.com” {
type master;
file “/etc/bind/zones/example.com.db”;
};

# This is the zone definition for reverse DNS. replace 0.168.192 with your network address in reverse notation - e.g my network address is 192.168.0

zone “0.168.192.in-addr.arpa” {
type master;
file “/etc/bind/zones/rev.0.168.192.in-addr.arpa”;
};

Now you need to edit the options file

sudo vi /etc/bind/named.conf.options

We need to modify the forwarder. This is the DNS server to which your own DNS will forward the requests he cannot process.

forwarders {
# Replace the address below with the address of your provider’s DNS server
123.123.123.123;
};

add the zone definition files (replace example.com with your domain name

sudo mkdir /etc/bind/zones

sudo vi /etc/bind/zones/example.com.db

The zone definition file is where we will put all the addresses / machine names that our DNS server will know.Example zone file as follows

// replace example.com with your domain name. do not forget the . after the domain name!
// Also, replace ns1 with the name of your DNS server
example.com. IN SOA ns1.example.com. admin.example.com. (
// Do not modify the following lines!
2007031001
28800
3600
604800
38400
)

// Replace the following line as necessary:
// ns1 = DNS Server name
// mail = mail server name
// example.com = domain name
example.com. IN NS ns1.example.com.
example.com. IN MX 10 mail.example.com.

// Replace the IP address with the right IP addresses.
www IN A 192.168.0.2
mta IN A 192.168.0.3
ns1 IN A 192.168.0.1

Create Reverse DNS Zone file

A normal DNS query would be of the form ‘what is the IP of host=www in domain=mydomain.com’. There are times however when we want to be able to find out the name of the host whose IP address = x.x.x.x. Sometimes this is required for diagnostic purposes more frequently these days it is used for security purposes to trace a hacker or spammer, indeed many modern mailing systems use reverse mapping to provide simple authentication using dual look-up, IP to name and name to IP.

In order to perform Reverse Mapping and to support normal recursive and Iterative (non-recursive) queries the DNS designers defined a special (reserved) Domain Name called IN-ADDR.ARPA. This domain allows for all supported Internet IPv4 addresses (and now IPv6).

sudo vi /etc/bind/zones/rev.0.168.192.in-addr.arpa

copy and paste the following sample file

//replace example.com with yoour domain name, ns1 with your DNS server name.
// The number before IN PTR example.com is the machine address of the DNS server. in my case, it’s 1, as my IP address is 192.168.0.1.
@ IN SOA ns1.example.com. admin.example.com. (
2007031001;
28800;
604800;
604800;
86400
)

IN NS ns1.example.com.
1 IN PTR example.com

Restart Bind server using the following command

sudo /etc/init.d/bind9 restart

Testing Your DNS Server

Modify the file resolv.conf with the following settings

sudo vi /etc/resolv.conf

Enter the following details save and exit the file

// replace example.com with your domain name, and 192.168.0.1 with the address of your new DNS server.

search example.com
nameserver 192.168.0.1

Test your DNS Using the following command

dig example.com