DNS: dns4-exercise2.2.txt

File dns4-exercise2.2.txt, 5.6 KB (added by scg, 9 years ago)

Reverse DNS exercise

Line 
1DNS Exercise 4.2: Setting up Reverse DNS (in-addr.arpa.) for a /24 IP Block
2===========================================================================
3
4Since we don't have an entire /24 for the class, we'll pretend we have
5one for each student.
6
7We'll use 192.168.0.0/16 for reverse DNS (in-addr.arpa.) exercises
8in this workshop.
9
10Each student will be allocated a /24 for this exercise. Each student will
11setup reverse DNS for the /24 allocated to them. The allocation will be
12done based on the students PCs number so if your PC is `ws1.ws3.conference.sanog.org`,
13and your IP address is `119.2.100.1`, then the /24 assigned to you will be
14`192.168.1.0/24`.
15
16In this exercise, you will setup reverse DNS for 192.168.X.0/24, where X
17is your PCs number. You will create master nameservice on your own machine,
18and someone else will setup their machine to be a slave server for your
19X.222.196.in-addr.arpa. domain. Then you will ask the administrator for the
20domain (your RIR in real life) above you (222.196.in-addr.arpa) to delegate
21the /24 to you.
22
23Please refer to DNS Exercise 3.1 on Setting up a domain
24
25
26Exercise
27--------
28
29*   Write the domain allocated to you here:  `____.222.196.in-addr.arpa.`
30    (e.g. ws12 will write 12.222.196.in-addr.arpa.)
31
32*   Find someone who will agree to be slave for your domain. You must choose
33    someone on a DIFFERENT table to you. (Remember RFC2182: secondaries must
34    be on remote networks). You can have more than one slave if you wish.
35
36*   Create your zone file in `/var/named/etc/namedb/master/X.222.196.in-addr.arpa`
37    (where X is your PCs number)
38
39    >     $TTL 10m
40    >     @             IN      SOA     wsX.ws3.conference.sanog.org.  yourname.example.com. (
41    >                                           2006051000    ; Serial
42    >                                           10m           ; Refresh
43    >                                           10m           ; Retry
44    >                                           4w            ; Expire
45    >                                           10m )         ; Negative
46    >
47    >                   IN      NS      wsX.ws3.conference.sanog.org.   ; master
48    >                   IN      NS      wsY.ws3.conference.sanog.org.   ; slave
49    >
50    >     1             IN      PTR     dhcp1.xxxxx.ws3.conference.sanog.org.
51    >
52    >     $GENERATE 11-254 $    IN      PTR     ppp$.xxxxx.ws3.conference.sanog.org.
53
54    Replace `yourname.example.com.` with your home E-mail address, changing
55    "@" to "." and adding a "." to the end.
56
57    Replace xxxxx.ws3.conference.sanog.org with the domain you setup in
58    DNS Exercise 3.1: Setting up a domain
59
60    We have chosen purposely low values for TTL, refresh, and retry to make
61    it easier to fix problems in the classroom. For a production domain you
62    would use higher values, e.g. `$TTL 1d`
63
64*   Edit `/var/named/etc/namedb/named.conf` to configure your machine as
65    master for your domain (see slides for information how to do this)
66
67*   Check that your config file and zone file are valid, and then reload the
68    nameserver daemon:
69
70        # named-checkconf
71        # named-checkzone X.222.196.in-addr.arpa \
72                  /var/named/etc/namedb/master/X.222.196.in-addr.arpa
73
74    *If there are any errors, correct them*
75
76        # rndc reload
77        # tail /var/log/messages
78
79    *If there are any errors, correct them*. Some configuration errors can
80    cause the daemon to die completely, in which case you may have to
81    start it again:
82
83        # /etc/rc.d/named restart
84
85*   Assist your slaves to configure themselves as slave for your domain, and
86    configure yourself as a slave if asked to do so by another table.
87    Again, the instructions for how to do this are on the slides. If you
88    have changed your `named.conf` so that you are a slave for someone
89    else, make sure there are no errors in `/var/log/messages` after you
90    do `rndc reload`.
91
92*   Check that you and your slaves are giving authoritative answers for
93    your domain:
94
95        # dig +norec @119.2.100.X X.222.196.in-addr.arpa. soa
96        # dig +norec @192.200.219.Y X.222.196.in-addr.arpa. soa
97
98    Check that you get an AA (authoritative answer) from both, and that
99    the serial numbers match.
100
101*   Now you are ready to request delegation. Bring the following form to the
102    classroom instructor:
103
104        Domain name:          __.222.196.in-addr.arpa.
105
106        Master nameserver:    ws____.ws3.conference.sanog.org
107
108        Slave nameserver:     ws____.ws3.conference.sanog.org
109
110        Slave nameserver:     ws____.ws3.conference.sanog.org (optional)
111
112        Slave nameserver:     ws____.ws3.conference.sanog.org (optional)
113
114*   You will not get delegation until the instructor has checked:
115
116    - Your nameservers are all authoritative for your domain
117    - They all have the same SOA serial number
118    - The NS records within the zone match the list of servers you are
119      requesting delegation for
120    - The slave(s) are not on the same desk as you
121
122*   Once you have delegation, find the names associated with
123    192.168.X.1 and 192.168.X.12:
124
125    Try this:
126    - On your own machine
127
128        # dig +norec @119.2.100.X -x 192.168.X.1
129        # dig +norec @119.2.100.X -x 192.168.X.12
130
131    - On someone else's machine (who is not slave for you)
132    - On a machine elsewhere on the Internet, if you have access to one
133      (www.dnsstuff.com)
134
135*   Ensure that the forward and reverse DNS entries match. You will have to
136    edit your xxxxx.ws3.conference.sanog.org zonefiles and add the following records. Don't
137    forget to increase the serial number in the zone file.
138
139>       dhcp1           IN      A       192.168.X.1
140>
141>       $GENERATE 11-254 ppp$   IN      A       192.168.X.$