1 | DNS Exercise 3.1: Setting up a domain |
---|
2 | ===================================== |
---|
3 | |
---|
4 | In this exercise, you will create a new domain, _something_.ws3.conference.sanog.org. |
---|
5 | You will create master nameservice on your own machine, and someone else will |
---|
6 | setup their machine to be a slave server for your domain. Then you will ask |
---|
7 | the administrator for the domain above you (ws3.conference.sanog.org) to delegate your |
---|
8 | domain to you. |
---|
9 | |
---|
10 | Firstly, note that each machine in the classroom has been given a working |
---|
11 | DNS name: wsX.ws3.conference.sanog.org. Check that it is configured correctly by |
---|
12 | using the `hostname` command - e.g. on ws13 you should see |
---|
13 | |
---|
14 | > # hostname |
---|
15 | > ws13.ws3.conference.sanog.org |
---|
16 | |
---|
17 | If not, then configure your server with its name: e.g. for ws13 |
---|
18 | |
---|
19 | > # hostname ws13.ws3.conference.sanog.org |
---|
20 | > # vi /etc/rc.conf |
---|
21 | > ... |
---|
22 | > hostname="ws13.ws3.conference.sanog.org" |
---|
23 | > # vi /etc/hosts |
---|
24 | > ... |
---|
25 | > 119.2.100.239 ws13.ws3.conference.sanog.org |
---|
26 | |
---|
27 | You should also be able to see your machine's hostname at the login screen |
---|
28 | on the console: |
---|
29 | |
---|
30 | > FreeBSD/i386 (ws13.ws3.conference.sanog.org) (ttyv0) |
---|
31 | > |
---|
32 | > login: |
---|
33 | |
---|
34 | Exercise |
---|
35 | -------- |
---|
36 | |
---|
37 | * Choose a new domain, write it here: `___________________.ws3.conference.sanog.org` |
---|
38 | (Do NOT choose any of the ws names, e.g. `ws13`, as your subdomain) |
---|
39 | |
---|
40 | * Find someone who will agree to be slave for your domain. You must choose |
---|
41 | someone on a DIFFERENT table to you. (Remember RFC2182: secondaries must |
---|
42 | be on remote networks). You can have more than one slave if you wish. |
---|
43 | |
---|
44 | * Create your zone file in `/etc/namedb/master/xxxxx.ws3.conference.sanog.org` |
---|
45 | (where xxxxxx is your chosen domain). Here's a sample zone file to help: |
---|
46 | |
---|
47 | |
---|
48 | |
---|
49 | $TTL 10m |
---|
50 | @ IN SOA wsX.ws3.conference.sanog.org. yourname.example.com. ( |
---|
51 | 2010071601 ; Serial |
---|
52 | 10m ; Refresh |
---|
53 | 10m ; Retry |
---|
54 | 4w ; Expire |
---|
55 | 10m ) ; Negative |
---|
56 | |
---|
57 | IN NS wsX.ws3.conference.sanog.org. ; master |
---|
58 | IN NS wsY.ws3.conference.sanog.org. ; slave |
---|
59 | |
---|
60 | www IN A 119.2.100.X ; your own IP |
---|
61 | |
---|
62 | |
---|
63 | |
---|
64 | Replace `yourname.example.com.` with your home E-mail address, changing |
---|
65 | "@" to "." and adding a "." to the end. |
---|
66 | |
---|
67 | We have chosen purposely low values for TTL, refresh, and retry to make |
---|
68 | it easier to fix problems in the classroom. For a production domain you |
---|
69 | would use higher values, e.g. `$TTL 1d` |
---|
70 | |
---|
71 | * Edit `/etc/namedb/named.conf` to configure your machine as master for your |
---|
72 | domain (see slides for information how to do this - |
---|
73 | reminder: |
---|
74 | |
---|
75 | zone "xxxxx.ws3.conference.sanog.org" { |
---|
76 | file "/etc/namedb/master/xxxxx.ws3.conference.sanog.org"; |
---|
77 | type master; |
---|
78 | }; |
---|
79 | |
---|
80 | * Check that your config file and zone file are valid, and then reload |
---|
81 | the nameserver daemon: |
---|
82 | |
---|
83 | # named-checkconf |
---|
84 | # named-checkzone xxxxx.ws3.conference.sanog.org /etc/namedb/master/xxxxx.ws3.conference.sanog.org |
---|
85 | |
---|
86 | * If there are any errors, correct them* |
---|
87 | |
---|
88 | # rndc reconfig |
---|
89 | # tail /var/log/messages |
---|
90 | |
---|
91 | * If there are any errors, correct them*. Some configuration errors can |
---|
92 | cause the daemon to die completely, in which case you may have to |
---|
93 | start it again: |
---|
94 | |
---|
95 | # /etc/rc.d/named restart |
---|
96 | |
---|
97 | * Assist your slaves to configure themselves as slave for your domain, |
---|
98 | and configure yourself as a slave if asked to do so by another table. |
---|
99 | Again, the instructions for how to do this are on the slides. If you |
---|
100 | have changed your `named.conf` so that you are a slave for someone |
---|
101 | else, make sure there are no errors in `/var/log/messages` after you |
---|
102 | do `rndc reload`. |
---|
103 | |
---|
104 | * Check that you and your slaves are giving authoritative answers for |
---|
105 | your domain: |
---|
106 | |
---|
107 | # dig +norec @119.2.100.X xxxxx.ws3.conference.sanog.org. soa |
---|
108 | # dig +norec @119.2.100.Y xxxxx.ws3.conference.sanog.org. soa |
---|
109 | |
---|
110 | Check that you get an AA (authoritative answer) from both, and that |
---|
111 | the serial numbers match. |
---|
112 | |
---|
113 | * Now you are ready to request delegation. Bring the following information |
---|
114 | to the classroom instructor (on paper) |
---|
115 | |
---|
116 | Domain name: ___________________.ws3.conference.sanog.org |
---|
117 | |
---|
118 | Master nameserver: ws____.ws3.conference.sanog.org |
---|
119 | |
---|
120 | Slave nameserver: ws____.ws3.conference.sanog.org |
---|
121 | |
---|
122 | OPTIONAL: |
---|
123 | |
---|
124 | Slave nameserver: ws____.ws3.conference.sanog.org (optional) |
---|
125 | |
---|
126 | Slave nameserver: ws____.ws3.conference.sanog.org (optional) |
---|
127 | |
---|
128 | |
---|
129 | * You will not get delegation until the instructor has checked: |
---|
130 | |
---|
131 | - Your nameservers are all authoritative for your domain |
---|
132 | - They all have the same SOA serial number |
---|
133 | - The NS records within the zone match the list of servers you are |
---|
134 | requesting delegation for |
---|
135 | - The slave(s) are not on the same desk as you |
---|
136 | |
---|
137 | * Once you have delegation, try to resolve www.xxxxx.ws3.conference.sanog.org: |
---|
138 | |
---|
139 | - From your own machine |
---|
140 | - From someone else's machine (who is not slave for you) |
---|
141 | - From a machine elsewhere on the Internet, if you have access to one |
---|
142 | |
---|
143 | * Add a new resource record to your zone file. Remember to update the |
---|
144 | serial number. Check that your slaves have updated. Try resolving this |
---|
145 | new name from elsewhere. |
---|