0

I'm trying to set up an internal dns server on a small network consisting of a dellr710 server running ubuntu server 16.04, a dell t3600 work station running ubuntu 16.04 lts and a router which happens to be an apple time capsule (also connected to a mac mini running os x but not part of the network i'm trying to establish).

I've tried to follow the various how to guides for setting up bind9 but I can't seem to get to work.

I can dig ubuntu.com no problem. I can ping both the t3600 and the router by IP but not by anything else.

If I check bind9 status this is what i get.

    nigelgardiner@dellr710:/$ /etc/init.d/bind9 status
    ● bind9.service - BIND Domain Name Server
       Loaded: loaded (/lib/systemd/system/bind9.service; enabled; vendor preset: enabled)
      Drop-In: /run/systemd/generator/bind9.service.d
               └─50-insserv.conf-$named.conf
       Active: active (running) since Sun 2017-12-17 22:26:34 NZDT; 3s ago
         Docs: man:named(8)
      Process: 5012 ExecStop=/usr/sbin/rndc stop (code=exited, status=0/SUCCESS)
     Main PID: 5019 (named)
        Tasks: 27
       Memory: 27.0M
          CPU: 75ms
       CGroup: /system.slice/bind9.service
               └─5019 /usr/sbin/named -f -u bind

    Dec 17 22:26:34 dellr710 named[5019]: zone 0.in-addr.arpa/IN: loaded serial 1
    Dec 17 22:26:34 dellr710 named[5019]: zone 255.in-addr.arpa/IN: loaded serial 1
    Dec 17 22:26:34 dellr710 named[5019]: zone 127.in-addr.arpa/IN: loaded serial 1
    Dec 17 22:26:34 dellr710 named[5019]: zone 1.168.192.in-addr.arpa/IN: loading from      masterfile etc/bind/db.192 failed: file not found
    Dec 17 22:26:34 dellr710 named[5019]: zone 1.168.192.in-addr.arpa/IN: not loaded due to errors.
    Dec 17 22:26:34 dellr710 named[5019]: zone oti.tori/IN: loading from master file etc/bind/db.oti.tori failed: file not found
    Dec 17 22:26:34 dellr710 named[5019]: zone oti.tori/IN: not loaded due to errors.
    Dec 17 22:26:34 dellr710 named[5019]: zone localhost/IN: loaded serial 2
    Dec 17 22:26:34 dellr710 named[5019]: all zones loaded
    Dec 17 22:26:34 dellr710 named[5019]: running

The following is how I have it configured currently, any advice much appreciated

thanks Nigel.

The dell r710 has a static ip as per etc/network/interfaces and hostname dellr710.

    source /etc/network/interfaces.d/*

    # The loopback network interface
    auto lo
    iface lo inet loopback

    # The primary network interface
    auto eno1
    iface eno1 inet static
    address 192.168.1.72
    netmask 255.255.255.0
    gateway 192.168.1.254
    dns-search oti.tori
    dns-nameservers 192.168.1.72

    # This is an autoconfigured IPv6 interface
    #iface eno1 inet6 auto

The dell t3600 has a static IP of 192.168.1.71 configured via the gui and a hostname user-PC.

The router has an IP of 192.168.1.254.

This is the contents of /etc/bind/named.conf.options

    options {
            directory "/var/cache/bind";

            // If there is a firewall between you and nameservers you want
           // to talk to, you may need to fix the firewall to allow multiple
            // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

            // If your ISP provided one or more IP addresses for stable
            // nameservers, you probably want to use them as forwarders.
            // Uncomment the following block, and insert the addresses replacing
            // the all-0's placeholder.

            forwarders {
                    8.8.8.8;
                    8.8.4.4;
            };

            //========================================================================
            // If BIND logs error messages about the root key being expired,
            // you will need to update your keys.  See https://www.isc.org/bind-keys
            //========================================================================
            dnssec-validation no;

            auth-nxdomain no;    # conform to RFC1035
            listen-on-v6 { any; };
    };

This is the contents of etc/bind/named.conf.local

// // Do any local configuration here //

    // Consider adding the 1918 zones here, if they are not used in your
    // organization
    //include "/etc/bind/zones.rfc1918";

    zone "oti.tori" {
            type master;
            file "etc/bind/db.oti.tori";
            };

    zone "1.168.192.in-addr.arpa" {
            type master;
            notify no;
            file "etc/bind/db.192";
            };

~

This is the contents of etc/bind/db.oti.tori

    ;
    ; BIND data file for local loopback interface
    ;
    $TTL    604800
    @       IN      SOA     oti.tori. admin.oti.tori. (
                                  6         ; Serial
                             604800         ; Refresh
                              86400         ; Retry
                            2419200         ; Expire
                             604800 )       ; Negative Cache TTL
                            IN      A       192.168.1.72
    ;
    @       IN      NS      dellr710.oti.tori.
    @       IN      A       192.168.1.72
    @       IN      AAAA    ::1
    ;
    ;
    ; below are A record addresses
    ;
    router  IN      A       192.168.1.254
    user-PC IN      A       192.168.1.71
    dellr710        IN      A       192.168.1.72
    ;
    ; below are CNAME record addresses
    ;
    r710    IN      CNAME   dellr710.oti.tori.
    t3600   IN      CNAME   user-PC.oti.tori.

This is the contents of etc/bind/db.192

    ;
    ; BIND reverse data file for local loopback interface
    ;
    $TTL    604800
    @       IN      SOA     dellr710.oti.tori. nigelgardiner.localhost. (
                                  2         ; Serial
                             604800         ; Refresh
                              86400         ; Retry
                            2419200         ; Expire
                             604800 )       ; Negative Cache TTL
    ;
    @       IN      NS      dellr710.oti.tori.
    254     IN      PTR     router.oti.tori.
    71      IN      PTR     user-PC.oti.tori.
    72      IN      PTR     dellr710.oti.tori.

This is the result of dig user-PC.oti.tori after fixing paths in zone file.

    ; <<>> DiG 9.10.3-P4-Ubuntu <<>> user-PC.oti.tori
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 30778
    ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ;; QUESTION SECTION:
    ;user-PC.oti.tori.      IN  A

    ;; AUTHORITY SECTION:
    .           74439   IN  SOA a.root-servers.net. nstld.verisign-   grs.com. 2017121701 1800 900 604800 86400

    ;; Query time: 63 msec
    ;; SERVER: 192.168.1.254#53(192.168.1.254)
    ;; WHEN: Mon Dec 18 09:28:01 NZDT 2017
    ;; MSG SIZE  rcvd: 120

    n

This is the result of dig user-PC.oti.tori@192.168.1.72

    ; <<>> DiG 9.10.3-P4-Ubuntu <<>> user-PC.oti.tori@192.168.1.72
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 50844
    ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ;; QUESTION SECTION:
    ;user-PC.oti.tori\@192.168.1.72.    IN  A

    ;; AUTHORITY SECTION:
    .           80960   IN  SOA a.root-servers.net. nstld.verisign-  grs.com. 2017121800 1800 900 604800 86400

    ;; Query time: 138 msec
    ;; SERVER: 192.168.1.254#53(192.168.1.254)
    ;; WHEN: Mon Dec 18 19:39:07 NZDT 2017
    ;; MSG SIZE  rcvd: 133
2
  • 1
    What is the full path to your zone files? – fkraiem Dec 17 '17 at 11:22
  • hi thanks fkraiem, my mistake. bind status shows zones loaded now but i can only ping dellr710 not user-PC or the router. any further thoughts? Thanks – nigelgardiner Dec 17 '17 at 19:35
2
zone "oti.tori" {
        type master;
        file "etc/bind/db.oti.tori";
        };

zone "1.168.192.in-addr.arpa" {
        type master;
        notify no;
        file "etc/bind/db.192";
        };

Change this to

zone "oti.tori" {
        type master;
        file "/etc/bind/db.oti.tori";
        };

zone "1.168.192.in-addr.arpa" {
        type master;
        notify no;
        file "/etc/bind/db.192";
        };

Please note that this is not a good setup either; typically you'd keep zone files in /var/cache/bind, as the directory and zone files have to be writable by Bind to allow dynamic updates, e.g. from DHCP server - and having the /etc/bind writable by bind is bad from a security perspective.

Having the root zones and localhost zones in /etc/ is ok, as those should by definition not be dynamically updated anyway. But for almost any other zone, dynamic updates makes life so much easier.

I see that this is the recomended setup in the tutorial, but I would suggest looking at the Debian guide, as it seems to follow what I'd consider sane security practices.

9
  • Hi Vidarlo, thanks for that. So bind status shows all the zones have loaded now and i can ping dellr710 but not user-PC or the router? Any further thoughts. I'll have a look at the debian guide thanks, I looked at about half a dozen tutorials and they all used this setup.. – nigelgardiner Dec 17 '17 at 19:32
  • What's the output of dig user-pc.oti.tori? Dig is a very useful tool when you're fiddling around with dns. – vidarlo Dec 17 '17 at 20:11
  • <<>> DiG 9.10.3-P4-Ubuntu <<>> user-PC.oti.tori ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 30778 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;user-PC.oti.tori. IN A ;; AUTHORITY SECTION: . 74439 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2017121701 1800 900 604800 86400 ;; Query time: 63 msec ;; SERVER: 192.168.1.254#53(192.168.1.254) ;; WHEN: Mon Dec 18 09:28:01 NZDT 2017 ;; MSG SIZE rcvd: 120 n – nigelgardiner Dec 17 '17 at 20:31
  • sorry, it's messed up the spacing. – nigelgardiner Dec 17 '17 at 20:31
  • Please add the output to the original question and enclose it in code block (Press the {} button) – vidarlo Dec 17 '17 at 20:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.