More about DNS and Security in Zone sharing

More about DNS

Bogus servers which give wrong information can be blocked or to make our server not to accept any information from them

server IP {bogus yes ;};

we can also create blackhole in dns where the server will not even acknowledge the other ip

blackhole {ips;};

version bind
this can be used to make the details of dns version IE bind version safe from the outsider

version "INFORMATION ....";

chrooting the bind

By installing the bind-chroot the dns configuration file will be moved to space where only root and named group has permission to edit those files

Making DNS Zone sharing safe

we could share a key between slave and master to make sure that update are send to only correct slaves.
This method in called TSIG transaction signature configuration

1.first start from client making the key
----->dnssec-keygen -a hmac-md5 -b 128 -n HOST virtual_key

----->cat Kvirtual_key.+157+56451.private

Private-key-format: v1.3
Algorithm: 157 (HMAC_MD5)
Key: yzkKqIIa4sUPXm+Oz7VNgg==
Bits: AAA=
Created: 20121022004959
Publish: 20121022004959
Activate: 20121022004959

**copy the key part and create a key file as follows
------->vim /etc/rndc.key
key "virtual_key"
{
algorithm HMAC-MD5;
secret "yzkKqIIa4sUPXm+Oz7VNgg==";
};

------->chgrp named /etc/rndc.key

**inside /etc/named.conf add

include "/etc/rndc.key" ;

server 192.168.100.1 {
keys { virtual_key ; };
};

**and
allow-transfer { key virtul_key ;};

this forces the client to use the key we generate..

Now copy the rndc.key file to server

change the group to named at server

and include the file to /etc/named.conf and give allow-transfer at needed zones to make it more secure

at server /etc/named.conf

include "/etc/rndc.key" ;

allow-transfer { key virtual_key ;};

----------------------------------------------------------------------
master configuration

----------------------------------------------------------------------

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
acl "example" { 192.168.122.0/24 ; 127/8 ; };
acl "virtual" { 192.168.100.0/24 ; 127/8 ; };

include "/etc/rndc.key" ;

options {
listen-on port 53 { 127.0.0.1; example ; virtual ;};
# listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; example; virtual; };
allow-transfer { key virtual_key ;};
recursion yes;
# dnssec-enable yes;
# dnssec-validation yes;
# dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
};

logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};

view mixed {
match-clients { 192.168.122.2; 192.168.100.1; };

zone "example.com" IN {
type master;
file "forward.zone";
allow-update { none; };

};
zone "122.168.192.in-addr.arpa" IN {
type master;
file "reverse.zone";
allow-update { none; };
};

zone "virtual.com" IN {
type master;
file "forwardvir.zone";

allow-update { none; };
};
zone "100.168.192.in-addr.arpa" IN {
type master;
file "reversevir.zone";
allow-update { none; };
};

};

view internal {
match-clients { example; };
zone "example.com" IN {
type master;
file "forward.zone";
allow-update { none; };
};
zone "122.168.192.in-addr.arpa" IN {
type master;
file "reverse.zone";
allow-update { none; };
};
};

view external {
match-clients { virtual; };
zone "virtual.com" IN {
type master;
file "forwardvir.zone";
allow-update {none; };

};
zone "100.168.192.in-addr.arpa" IN {
type master;
file "reversevir.zone";
allow-update {none ;};
};

};

#include "/etc/named.rfc1912.zones";

----------------------------------------------------------------------------
slave configuration
----------------------------------------------------------------------------
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

include "/etc/rndc.key" ;

server 192.168.100.1 {
keys { virtual_key ; };
};

options {
listen-on port 53 { 127.0.0.1; 192.168.100.0/24 ;};
# listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost;192.168.100.0/24; };
allow-transfer { key virtul_key ;};
recursion yes;
# dnssec-enable yes;
# dnssec-validation yes;
# dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
};

logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};

view external {
match-clients { 192.168.100.0/24; };
allow-transfer { key virtual_key ;};
zone "virtual.com" IN {
type slave;
file "slaves/forwardvir.zone";
masters {192.168.100.1 ; };
#allow-update {none;};
};
zone "100.168.192.in-addr.arpa" IN {
type slave;

file "slaves/reversevir.zone";
masters {192.168.100.1 ; };
#allow-update {none;};
};

};

DNS Master Slave Configuration

1.Master and slave configuration
2.acl setting
3.view setting

For making the Dns a Master dns server we give the type master and for making that slave we give type slaves. And by defaults in slaves the files will be copied from master to slaves defautl /var/named/slaves/ directory.
 
Acl setting acl setting is used to group a set of networks or individual ip's under a single name.

View setting is used to isolate the dns zones for a specific network as per acl or given ip's.we could give the ip's or network or acl which has access to the view in match-client {;}; option inside the view option .


-----------------------------------------------------------------------------
MASTERS-configuration file
-----------------------------------------------------------------------------
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
acl "example" { 192.168.122.0/24 ; 127/8 ;  };
acl "virtual" { 192.168.100.0/24 ; 127/8 ;  };
options {
    listen-on port 53 { 127.0.0.1; example ; virtual ;};
#    listen-on-v6 port 53 { ::1; };
    directory     "/var/named";
    dump-file     "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
    allow-query     { localhost; example; virtual; };
    recursion yes;

#    dnssec-enable yes;
#    dnssec-validation yes;
#    dnssec-lookaside auto;

    /* Path to ISC DLV key */
    bindkeys-file "/etc/named.iscdlv.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};


view mixed {
match-clients { 192.168.122.2; 192.168.100.1; };
zone "example.com" IN {
        type master;
        file "forward.zone";
        allow-update { none; };
    
};
 zone "122.168.192.in-addr.arpa" IN {
        type master;
        file "reverse.zone";
        allow-update { none; };
};

zone "virtual.com" IN {
        type master;
        file "forwardvir.zone";
        allow-update { none; };
};
 zone "100.168.192.in-addr.arpa" IN {
        type master;
        file "reversevir.zone";
        allow-update { none; };
};

};

view internal {
match-clients { example; };
zone "example.com" IN {
        type master;
        file "forward.zone";
        allow-update { none; };
};
 zone "122.168.192.in-addr.arpa" IN {
        type master;
        file "reverse.zone";
        allow-update { none; };
};
};

view external {
match-clients { virtual; };
zone "virtual.com" IN {
        type master;
        file "forwardvir.zone";
        allow-update { none; };
};
 zone "100.168.192.in-addr.arpa" IN {
        type master;
        file "reversevir.zone";
        allow-update { none; };
};

};

#i:nclude "/etc/named.rfc1912.zones";



-----------------------------------------------------------------------------
SLAVES-configuration file

In salves the zones will have the entry
-----------------------------------------------------------------------------

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
        listen-on port 53 { 127.0.0.1; 192.168.100.0/24 ;};
#       listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { localhost; 192.168.100.0/24 ; };
        recursion yes;

#       dnssec-enable yes;
#       dnssec-validation yes;
#       dnssec-lookaside auto;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

view external {
match-clients { 192.168.100.0/24; };
zone "virtual.com" IN {
        type slave;
        masters { 192.168.100.1 ; };
        file "slaves/forwardvir.zone";
        allow-update { none; };
};
 zone "100.168.192.in-addr.arpa" IN {
        type slave;
        masters { 192.168.100.1 ; };
        file "slaves/reversevir.zone";
        allow-update { none; };
};

};

Setting sendmail as default

alternatives --display mta
yum install sendmail
service postfix stop
chkconfig postfix off
vim /etc/mail/sendmail.mc
disable the line starting with DEAMON like below
dnl # DEAMON
make -C /etc/mail
alternatives --set Mta /usr/sbin/sendmail
service sendmail start
service sendmail restart
chkconfig sendmail on