Secure your DNS - replace BIND
Scott Lowe
Published: 05 Feb 2003 10:32 GMT
Configuring the software
After installing the software, you need to configure the various components to get a DNS server running. Note that I will be setting up only one simple DNS server in this article. For more complex installations and instructions for setting up a redundant DNS server, refer to the djbdns documentation.
Setting up the DNS cache
Use the following commands to create two UNIX users that will be used to run the services:
/usr/sbin/useradd -s /bin/false -c dnscache dnscache
/usr/sbin/useradd -s /bin/false -c dnslog dnslog
The -s /bin/false sets these accounts up so that they can't log in. This helps to protect the security of the system.
The next step is to configure the cache so that it knows the IP address it should be using. The first IP address of my Linux server is 192.168.1.106. To configure the cache, I will use the following command for my installation:
dnscache-conf dnscache dnslog /etc/dnscache 192.168.1.106
The final step in setting up the DNS cache is starting the service. One of the utilities installed previously -- svscan -- will handle this after you give it the following command:
ln -s /etc/dnscache /service
After a few seconds, the service will start. You can verify that it has started by typing ps -ef | grep dns at the command line. For my installation, I get the following results:
root 4969 2776 0 15:05 ? 00:00:00 supervise dnscache
dnscache 4971 4969 0 15:05 ? 00:00:00 /usr/local/bin/dnscache
dnslog 4972 4970 0 15:05 ? 00:00:00 multilog t ./main
As you can see, the dnscache service is running as the dnscache user, while the logging component is running as the dnslog user. The dnscache service is now running and able to accept local requests.
Configuring and starting the TinyDNS component
For the TinyDNS component, an additional user named tinydns is required. Create that user with this command:
/usr/sbin/useradd -s /bin/false -c tinydns tinydns
Next, the TinyDNS configuration needs to be told on what IP address it should listen for requests. Note that this IP address cannot be the same one that the cache is listening on. So I have configured the network adapter on my Red Hat Linux 8 machine to have a second IP address of 192.168.1.217 and can configure TinyDNS with the following command:
tinydns-conf tinydns dnslog /etc/tinydns 192.168.1.217
Like the cache, the TinyDNS daemon can be started by putting it in a place where svscan will find it:
ln -s /etc/tinydns /service
Using ps -ef | grep dns, I can make sure that TinyDNS has started. I get the following results:
root 5177 2776 0 15:27 ? 00:00:00 supervise tinydns
tinydns 5179 5177 0 15:27 ? 00:00:00 /usr/local/bin/tinydns
dnslog 5180 5178 0 15:27 ? 00:00:00 multilog t ./main
The next step in the process is to give TinyDNS something to do by providing it with a list of hosts to work with. This information is defined in /etc/tinydns/root/data and can be modified with a text editor. I like to use pico. In my configuration file, I have place the following sample data:
#define the authoritative nameserver
.slowe.com::ns1.slowe.com
#mail exchanger
@slowe.com::mail.slowe.com
#IP addresses for hosts
=host1.slowe.com:192.168.1.101
=host2.slowe.com:192.168.1.112
=rh8.slowe.com:192.168.1.217
#rh8 is also known as ns1
+ns1.slowe.com:192.168.1.217
#machine1 is our mailserver
+mail.slowe.com:192.168.1.101
#and our webserver
+www.slowe.com:192.168.1.112
Once this information is in the configuration file, you can compile it by typing make in the /etc/tinydns/root directory, which will create a file named data.cdb that TinyDNS will read.
Testing it
Testing this is simple. Go to another machine, look up a name that was entered into the data file, and see if an IP address comes back. I happen to have a Windows XP machine on the same network and can use nslookup as a test. For example:
C:\>nslookup www.slowe.com 192.168.1.217
Server: rh8.slowe.com
Address: 192.168.1.217
Name: www.slowe.com
Address: 192.168.1.112
As you can see, an IP address was resolved correctly, which shows that the DNS service is working.
Summary
Getting the components of djbdns set up and running for a simple configuration is not really a lot of work. However, to support more complex configurations, some work and research will be required. The documentation on the djbdns Web site is a great place to start.
For a weekly round-up of the enterprise IT news, sign up for the
Enterpise newsletter.
Find out what's where in the new Tech Update with our
Guided Tour.
Tell us what you think in the
Enterprise Mailroom.
Previous
Did you find this article useful?
68 out of 122 people found this useful
- Share this article:
