DNS: dns3-exercise.txt

DNS Exercise 3.1: Setting up a domain
=====================================

In this exercise, you will create a new domain, _something_.ws3.conference.sanog.org.
You will create master nameservice on your own machine, and someone else will
setup their machine to be a slave server for your domain. Then you will ask
the administrator for the domain above you (ws3.conference.sanog.org) to delegate your
domain to you.

Firstly, note that each machine in the classroom has been given a working
DNS name: wsX.ws3.conference.sanog.org. Check that it is configured correctly by
using the `hostname` command - e.g. on ws13 you should see

>     # hostname
>     ws13.ws3.conference.sanog.org

If not, then configure your server with its name: e.g. for ws13

>     # hostname ws13.ws3.conference.sanog.org
>     # vi /etc/rc.conf
>     ...
>     hostname="ws13.ws3.conference.sanog.org"
>     # vi /etc/hosts
>     ...
>     119.2.100.239     ws13.ws3.conference.sanog.org

You should also be able to see your machine's hostname at the login screen
on the console:

>     FreeBSD/i386 (ws13.ws3.conference.sanog.org) (ttyv0)
> 
>     login:

Exercise
--------

*   Choose a new domain, write it here:  `___________________.ws3.conference.sanog.org`  
    (Do NOT choose any of the ws names, e.g. `ws13`, as your subdomain)

*   Find someone who will agree to be slave for your domain. You must choose
    someone on a DIFFERENT table to you. (Remember RFC2182: secondaries must
    be on remote networks). You can have more than one slave if you wish.

*   Create your zone file in `/etc/namedb/master/xxxxx.ws3.conference.sanog.org`
    (where xxxxxx is your chosen domain).  Here's a sample zone file to help:



$TTL 10m
@       IN     SOA    wsX.ws3.conference.sanog.org.  yourname.example.com. (
                                  2010071601    ; Serial
                                  10m           ; Refresh
                                  10m           ; Retry
                                  4w            ; Expire
                                  10m )         ; Negative

            IN      NS      wsX.ws3.conference.sanog.org.   ; master
            IN      NS      wsY.ws3.conference.sanog.org.   ; slave

www         IN      A       119.2.100.X          ; your own IP



    Replace `yourname.example.com.` with your home E-mail address, changing
    "@" to "." and adding a "." to the end.

    We have chosen purposely low values for TTL, refresh, and retry to make
    it easier to fix problems in the classroom. For a production domain you
    would use higher values, e.g. `$TTL 1d`

*   Edit `/etc/namedb/named.conf` to configure your machine as master for your
    domain (see slides for information how to do this -
    reminder:

zone "xxxxx.ws3.conference.sanog.org" {
    file "/etc/namedb/master/xxxxx.ws3.conference.sanog.org";
    type master;
};

*   Check that your config file and zone file are valid, and then reload 
    the nameserver daemon:

        # named-checkconf
        # named-checkzone xxxxx.ws3.conference.sanog.org /etc/namedb/master/xxxxx.ws3.conference.sanog.org

*   If there are any errors, correct them*

        # rndc reconfig
        # tail /var/log/messages

*   If there are any errors, correct them*. Some configuration errors can
    cause the daemon to die completely, in which case you may have to
    start it again:

        # /etc/rc.d/named restart

*   Assist your slaves to configure themselves as slave for your domain, 
    and configure yourself as a slave if asked to do so by another table.
    Again, the instructions for how to do this are on the slides. If you
    have changed your `named.conf` so that you are a slave for someone
    else, make sure there are no errors in `/var/log/messages` after you
    do `rndc reload`.

*   Check that you and your slaves are giving authoritative answers for
    your domain:

        # dig +norec @119.2.100.X xxxxx.ws3.conference.sanog.org. soa
        # dig +norec @119.2.100.Y xxxxx.ws3.conference.sanog.org. soa

    Check that you get an AA (authoritative answer) from both, and that
    the serial numbers match.

*   Now you are ready to request delegation. Bring the following information
    to the classroom instructor (on paper)

        Domain name:          ___________________.ws3.conference.sanog.org

        Master nameserver:    ws____.ws3.conference.sanog.org

        Slave nameserver:     ws____.ws3.conference.sanog.org

                OPTIONAL:

        Slave nameserver:     ws____.ws3.conference.sanog.org (optional)

        Slave nameserver:     ws____.ws3.conference.sanog.org (optional)


*   You will not get delegation until the instructor has checked:

    - Your nameservers are all authoritative for your domain
    - They all have the same SOA serial number
    - The NS records within the zone match the list of servers you are
      requesting delegation for
    - The slave(s) are not on the same desk as you

*   Once you have delegation, try to resolve www.xxxxx.ws3.conference.sanog.org:

    - From your own machine
    - From someone else's machine (who is not slave for you)
    - From a machine elsewhere on the Internet, if you have access to one

*   Add a new resource record to your zone file. Remember to update the
    serial number. Check that your slaves have updated. Try resolving this
    new name from elsewhere.