Configurazione del servizio DNS

Il servizio DNS รจ fondamentale per il funzionamento di Kerberos. Vedremo qui come configurare Bind versione 9.

Cominciamo modificando /etc/bind/named.conf.options

options {
        directory "/var/cache/bind";

        // If there is a firewall between you and nameservers you want
        // to talk to, you might need to uncomment the query-source
        // directive below.  Previous versions of BIND always asked
        // questions using port 53, but BIND 8.1 and later use an unprivileged
        // port by default.

        // query-source address * port 53;

        // If your ISP provided one or more IP addresses for stable
        // nameservers, you probably want to use them as forwarders.
        // Uncomment the following block, and insert the addresses replacing
        // the all-0's placeholder.

        // forwarders {
        //      0.0.0.0;
        // };

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };

        version "Version X";

        allow-query {
             192.168.0.0/24;
             127/8;
        };

};

poi /etc/bind/named.conf.local

zone "esempio.lan" in {
        file "/etc/bind/esempio.lan";
        type master;
};

zone "0.168.192.in-addr.arpa" in {
        file "/etc/bind/0.168.192.in-addr.arpa.zone";
        type master;
};

/etc/bind/esempio.lan

$TTL 2d
@               IN SOA          pdc.esempio.lan.  root.pdc.esempio.lan. (
                                2009041601      ; serial
                                3h              ; refresh
                                1h              ; retry
                                1w              ; expiry
                                1d )            ; minimum

esempio.lan.            IN NS             pdc.esempio.lan.

$ORIGIN esempio.lan.
esempio.lan.            IN A              192.168.0.1

; server PDC
pdc                     IN A              192.168.0.1
s-pdc                   IN CNAME          pdc.esempio.lan.
ns1                     IN CNAME          pdc.esempio.lan.
kerberos                IN CNAME          pdc.esempio.lan.
ldap                    IN CNAME          pdc.esempio.lan.

; server aggiuntivi
s-lnx-001               IN A              192.168.0.11
                        IN TXT            "os=RHEL5.0;srv=web+ftp (test);loc=ServRoom1/Rack2"
web-1                   IN CNAME          s-lnx-001.esempio.lan.
s-lnx-002               IN A              192.168.0.12
                        IN TXT            "os=Ubuntu 8.04LTS;srv=smtp+imap+webmail+groupware;loc=ServRoom1/Rack2"
mail-1                  IN CNAME          s-lnx-002.esempio.lan.
groupware               IN CNAME          s-lnx-002.esempio.lan.
s-win-001               IN A              192.168.0.51
                        IN TXT            "os=Win2k3;srv=web+ftp (test);loc=ServRoom1/Rack2"
web-2                   IN CNAME          s-win-001.esempio.lan.

; clients
c-lnx-001               IN A              192.168.0.101
                        IN TXT            "os=Fedora 10;loc=Room3"
c-lnx-002               IN A              192.168.0.102
                        IN TXT            "os=Ubuntu 9.04;loc=Room3"
c-lnx-003               IN A              192.168.0.103
                        IN TXT            "os=Ubuntu 9.04;loc=Room3"
c-lnx-004               IN A              192.168.0.104
                        IN TXT            "os=Ubuntu 9.04;loc=Room4"
c-lnx-005               IN A              192.168.0.105
                        IN TXT            "os=Ubuntu 9.04;loc=Room4"
c-lnx-006               IN A              192.168.0.106
                        IN TXT            "os=Fedora 10;loc=Room5"
c-lnx-007               IN A              192.168.0.107
                        IN TXT            "os=Fedora 10;loc=Room6"
c-lnx-008               IN A              192.168.0.108
                        IN TXT            "os=Fedora 10;loc=Room7"
c-lnx-009               IN A              192.168.0.109
                        IN TXT            "os=OpenSUSE 11;loc=Room7"

c-win-001               IN A              192.168.0.201
                        IN TXT            "os=WinXP Pro SP2;loc=Room1"
c-win-002               IN A              192.168.0.202
                        IN TXT            "os=WinXP Pro SP2;loc=Room2"
c-win-003               IN A              192.168.0.203
                        IN TXT            "os=WinXP Pro SP2;loc=Room2"
c-win-004               IN A              192.168.0.204
                        IN TXT            "os=WinXP Pro SP2;loc=Room2"
c-win-005               IN A              192.168.0.205
                        IN TXT            "os=WinXP Pro SP2;loc=Room8"
; routers
r-main                  IN A              192.168.0.254
                        IN TXT            "os=OBSD4.0;loc=ServRoom1/Rack1"
r-vpngw                 IN A              192.168.0.253
                        IN TXT            "os=OBSD4.3;loc=ServRoom1/Rack1"
; switch
w-sw1                   IN A              192.168.0.250
                        IN TXT            "vlan=12;os=CCatalyst;loc=ServRoom1/Rack1"

; The Kerberos realm
_kerberos               IN TXT            "esempio.lan"
_kerberos.it            IN TXT            "esempio.lan"
_kerberos.srv           IN TXT            "esempio.lan"
_kerberos._tcp          IN SRV 10 1 88    pdc.esempio.lan.
_kerberos._udp          IN SRV 10 1 88    pdc.esempio.lan.
_kerberos-adm._tcp      IN SRV 10 1 749   pdc.esempio.lan.
_kerberos-master._udp   IN SRV 0  0 88    pdc.esempio.lan.
_kpasswd._udp           IN SRV 10 1 464   pdc.esempio.lan.
_ldap._tcp              IN SRV 10 1 389   pdc.esempio.lan.

; Information Search
_ldap_dc                IN TXT            "dc=esempio,dc=lan"
_samba_pdc_domain       IN TXT            "ESEMPIO"
_samba_pdc_ip_address   IN TXT            "192.168.0.1"

e infine /etc/bind/0.168.192.in-addr.arpa.zone

$TTL 2d
@               IN SOA          pdc.esempio.lan.     root.pdc.esempio.lan. (
                                2009041601      ; serial
                                3h              ; refresh
                                1h              ; retry
                                1w              ; expiry
                                1d )            ; minimum

@        IN NS       pdc.esempio.lan.

1        IN PTR      pdc.esempio.lan.

11       IN PTR      s-lnx-001.esempio.lan.
12       IN PTR      s-lnx-002.esempio.lan.
51       IN PTR      s-win-001.esempio.lan.

101      IN PTR      c-lnx-001.esempio.lan.
102      IN PTR      c-lnx-002.esempio.lan.
103      IN PTR      c-lnx-003.esempio.lan.
104      IN PTR      c-lnx-004.esempio.lan.
105      IN PTR      c-lnx-005.esempio.lan.
106      IN PTR      c-lnx-006.esempio.lan.
107      IN PTR      c-lnx-007.esempio.lan.
108      IN PTR      c-lnx-008.esempio.lan.
109      IN PTR      c-lnx-009.esempio.lan.

201      IN PTR      c-win-001.esempio.lan.
202      IN PTR      c-win-002.esempio.lan.
203      IN PTR      c-win-003.esempio.lan.
204      IN PTR      c-win-004.esempio.lan.
205      IN PTR      c-win-005.esempio.lan.

250      IN PTR      w-sw1.esempio.lan.
253      IN PTR      r-vpngw.esempio.lan.
254      IN PTR      r-main.esempio.lan.

modifichiamo quindi /etc/resolv.conf

search esempio.lan
nameserver 192.168.0.1
riavviamo bind
# /etc/init.d/bind9 restart
e testiamo la configurazione
# nslookup
> server 192.168.0.1
Default server: 192.168.0.1
Address: 192.168.0.1#53
> set q=ns
> esempio.lan
Server:         192.168.0.1
Address:        192.168.0.1#53

esempio.lan     nameserver = pdc.esempio.lan.
>

Stefano Sasso 2009-04-16