INSTALL NSD AS PRIMARY DNS SERVER & BIND AS SECONDARY NAME SERVER (PART 2)

Tags

bind, DNS, NSD

In this part we will install BIND and secondary name server. For primary name server installation please check INSTALL NSD AS PRIMARY DNS SERVER & BIND AS SECONDARY NAME SERVER (PART 1)

1. Update package library and install BIND

sudo apt-get update
sudo apt-get install bind9 bind9utils bind9-doc

2. All the configuration files are in /etc/bind/ folder. Most of the cases the default options work fine. The only thing I did is add the TSIG key for zone transfer.

3. First create they key file
vi ssh.com.bd-key

key ssh.com.bd-key {
algorithm hmac-md5;
secret "N1aqkdyRDOOM01NYt3Vat3v+QmonX8bsNoSdBUyKNB0=";
};

Make sure you copy the secret properly

4. Add the key in named.conf file

sudo vi named.conf

#TSIG key kompella->martini
include "/etc/bind/ssh.com.bd-key";

server 192.0.2.10 {
keys { ssh.com.bd-key; };
};

5. Add the related zone in named.conf.default-zones file:

zone "ssh.com.bd" IN {
type slave;
file "/var/cache/bind/ssh.com.bd.zone";
masters { 192.0.2.10; };
};

zone "113.0.203.in-addr.arpa" IN {
type slave;
file "/var/cache/bind/203.0.113.zone";
masters { 192.0.2.10; };
};

6. Save and reload BIND service.

sudo /etc/init.d/bind9 restart

7. Test the zone transfer:
dig axfr @192.0.2.10 ssh.com.bd soa -k ssh.com.bd-key

If all are on; you can see all the zone entry.

Install NSD as Primary DNS Server & BIND as Secondary Name Server (part 1)

Tags

bind, DNS, NSD

NSD is an authoritative only, memory efficient, highly secure and simple to configure open source domain name server. In most of the cases we use BIND as our name server (authoritative/caching). But here I will show you how to configure NSD as primary name server and BIND as secondary name server; use two different flavor of DNS.

Primary DNS Server: kompella.ssh.com.bd (192.0.2.10)
Secondary DNS Server: martini.ssh.com.bd (203.0.113.10)

Make sure that hostname (/etc/hostname) has been set properly for both of the servers.

A. Install NSD as primary name server

1. NSD service expects to run as a user called nsd, but the package does not actually create this user account. To avoid an error upon installation, we will create this user before we install the software. On each of your machines, create the nsd system user by typing:

sudo useradd -r nsd

2. Update local package and install nsd.

sudo apt-get update
sudo apt-get install nsd

3. The first thing we should do is make sure all of the SSL keys and certificates that NSD uses to securely communicate between the daemon portion of the application and the controller are generated.

sudo nsd-control-setup

4. The main configuration file for NSD is a file called nsd.conf located in the /etc/nsd directory.

cd /etc/nsd
vi nsd.conf

You can use this sample nsd.conf file : http://pastebin.com/JyNyxZCu

5. Next we forward zone file. It’s the same used to have in BIND: http://pastebin.com/3xaiVkfV

6. Reverse zone file : https://pastebin.com/nFELkTZT

7. Testing the Files and Restarting the Service

Now that we have our master server configured, we can go ahead and test our configuration file and implement our changes. You can check the syntax of the main configuration file by using the included nsd-checkconf tool. Simply point the tool to your main configuration file:

sudo nsd-checkconf /etc/nsd/nsd.conf

After you are able to execute the check cleanly, you can restart the service by typing:

sudo service nsd restart

8. Check the logs to see any messages:

sudo tail -f /var/log/nsd.log

Next we will configure BIND and secondary name server. Will use TSIG to securely transfer zone file across the DNS server.

bindgraph : Monitoring DNS Queries

Tags

bind, bindgraph, ubuntu

1. Install bindgraph

# apt-get install bindgraph

2. Enabling logging in bind9
Add a config file where We’ll include logging configuration:

# vi /etc/bind/named.conf
include “/etc/bind/named.conf.log”;

Add definition logging:

# vi /etc/bind/named.conf.log

# Configure the logging options
logging {

category security { security_channel; default; };
category lame-servers { null; };
category default { default; };
category queries { querylog; };

channel security_channel {
file ”/var/log/named/security.log”;
severity debug;
print-time yes;
print-category yes;
print-severity yes;
};

channel default {
file “/var/log/named/bind.log” versions 3 size 5m;
severity warning;
print-time yes;
print-category yes;
print-severity yes;
};

channel “querylog” {
file “/var/log/named/bind-queries.log”;
print-time yes;
print-category yes;
};
};

This log configuration creates a new channel that will send all log output to the log file definition and associate this channel with the predefined category named queries, included with bind software.

3. Create named directory for logging and set correctly permissions:

# mkdir /var/log/named
# chown bind:bind /var/log/named/

4. Restart bind9 service:

# service bind9 restart

5. Configuring bindgraph

Edit bindgraph settings to set the correct file queries log:

# vi /etc/default/bindgraph
DNS_LOG=/var/log/named/bind-queries.log

6. Edit apache settings to access only to the statistics from internal network:

# vi /etc/apache2/sites-enabled/000-default

AllowOverride None

Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
Order allow,deny
Allow from 192.168.1.0/24

7. Restart bindgraph service and apache:

# service bindgraph restart
# service apache2 restart

8. Now we can access our statistics from the link: http://your-ip-address/cgi-bin/bindgraph.cgi

[source: http://opentodo.net/2012/09/monitoring-dns-queries-with-bindgraph/]