Exercise 2.3: Building a DNS cache ================================== 1. Check the version of BIND which is installed ----------------------------------------------- $ named -v BIND 9.6.-ESV-R3 2. Start the cache and check it is running ------------------------------------------ Firstly, edit `/etc/rc.conf` and add a line saying `named_enable="YES"` Then run these commands: # cd /var/named/etc/namedb/master # /etc/rc.d/named start # ps auxwww | grep named # tail /var/log/messages Check for successful startup with no error messages (you can ignore errors about missing `master/localhost.rev` and `master/localhost-v6.rev` for now) 3. Reconfigure your resolver to use your own cache only ------------------------------------------------------- Edit `/etc/resolv.conf` as follows: search sse.ws.afnog.org nameserver 127.0.0.1 Remove any existing 'nameserver' lines, or comment them out by inserting '#' at the front. 127.0.0.1 is the loopback address; that is, an IP address which means 'send the packet to myself'. 4. Opening BIND to external requests ------------------------------------- # vi /etc/namedb/named.conf In the file add the following lines under the options recursion yes; allow-recursion { any; }; Modify the following line; listen-on { 127.0.0.1; }; to listen-on { any; }; Save the file and restart named # /etc/rc.d/named stop # /etc/rc.d/named start 5. Send some queries -------------------- Issue a query. Make a note of whether the response has the 'aa' flag set. Look at the answer section and note the TTL of the answer. Also note how long the query took to process. Then repeat the _exact same_ query, and note the information again. $ dig www.tiscali.co.uk. Does it have the 'aa' flag? ______ What is the TTL of the answer? ______ seconds How long is the Query Time? ______ milliseconds $ dig www.tiscali.co.uk. Does it have the 'aa' flag? ______ What is the TTL of the answer? ______ seconds How long is the Query Time? ______ milliseconds Repeat it a third time. Can you explain the differences? If your neighbour has got their cache working, then try sending some queries to their cache (remember `dig @x.x.x.x ...`) 6. Watch the cache in operation ------------------------------- You can take a snapshot of the cache contents like this: # /usr/sbin/rndc dumpdb # less /var/named/var/dump/named_dump.db (Don't do this on a busy cache - you will generate a huge dump file!) You can watch the cache making queries to the outside world using `tcpdump` in a different window # tcpdump -n -s1500 -i em0 udp port 53 Replace `em0` with the name of your ethernet interface - e.g. `bge0`. While tcpdump is running, in the first window flush your cache (so it forgets all existing data) and then issue some queries. # rndc flush # dig www.tiscali.co.uk. -- and watch tcpdump output. What do you see? # dig www.tiscali.co.uk. -- watch tcpdump again. This time? 7. Tightening up the configuration (optional) --------------------------------------------- Following the examples on the presentation, create zonefiles which map localhost to 127.0.0.1 and 127.0.0.1 to localhost, and test. Following the examples on the presentation, create an acl which restricts access to your cache to your machine only. Get someone else to try to resolve names using your cache. Remember: rndc reload # to make your modified configuration active tail /var/log/messages # to check for errors in your configuration