Week 05 - DNS¶

Topic¶

Setting up a recursive DNS resolver using Knot Resolver (kresd) and an authoritative DNS server using Knot DNS (knotd). Students will configure their VM as a caching resolver on port 53, serve their own domain zone on port 5353, add subdomain records for existing web services, configure reverse DNS (ARPA), and set up zone transfer notifications to the central course server.

Company Requests¶

Ticket #501: Internal DNS Resolver

"Our VM currently relies on external DNS servers for name resolution. IT wants us to run our own caching resolver so we're not dependent on third parties. Set up a recursive resolver on port 53 that works for both local and remote queries, and configure the machine to use it."

Ticket #502: Authoritative DNS for Our Domain

"The central DNS team has delegated <vm_name>.sysadm.ee to our server. We need an authoritative DNS server on port 5353 that serves our domain. Make sure <vm_name>.sysadm.ee, blog.<vm_name>.sysadm.ee, and inventory.<vm_name>.sysadm.ee all resolve to our VM's IP."

Ticket #503: Reverse DNS

"Our mail server setup next week requires that reverse DNS lookups for our IP return our hostname. Set up a PTR record so that querying our IP address returns <vm_name>.sysadm.ee."

Ticket #504: Zone Transfer to Central Server

"The central course DNS server acts as a public secondary for all student domains. Configure your authoritative server to notify the central server when zone data changes, and allow it to perform zone transfers."

Scoring Checks¶

• Check 5.1: Port 53/tcp is open and reachable from the scoring server.
  • Method: TCP connection to your VM on port 53.
  • Expected: Connection succeeds.
• Check 5.2: Port 5353/tcp is open and reachable from the scoring server.
  • Method: TCP connection to your VM on port 5353.
  • Expected: Connection succeeds.
• Check 5.3: Recursive DNS resolution works from outside.
  • Method: The scoring server sends a DNS query for google.com to your VM's IP on port 53.
  • Expected: At least one A record is returned.
• Check 5.4: VM uses its own resolver.
  • Method: The scoring server logs in via SSH and checks /etc/resolv.conf.
  • Expected: nameserver 127.0.0.1 is present.
• Check 5.5: <vm_name>.sysadm.ee resolves on the authoritative server.
  • Method: The scoring server queries your VM on port 5353 for <vm_name>.sysadm.ee A.
  • Expected: Returns your VM's IP address.
• Check 5.6: blog.<vm_name>.sysadm.ee resolves on the authoritative server.
  • Method: The scoring server queries your VM on port 5353 for blog.<vm_name>.sysadm.ee.
  • Expected: Returns your VM's IP (A record) or a CNAME pointing to <vm_name>.sysadm.ee.
• Check 5.7: inventory.<vm_name>.sysadm.ee resolves on the authoritative server.
  • Method: Same as 5.6 but for inventory.<vm_name>.sysadm.ee.
  • Expected: Returns your VM's IP (A record) or a CNAME pointing to <vm_name>.sysadm.ee.
• Check 5.8: Reverse PTR record for your VM's IP.
  • Method: The scoring server sends a reverse lookup (dig -x <your_ip>) to your VM on port 5353.
  • Expected: Returns <vm_name>.sysadm.ee.

Tasks¶

Task 1: Install and Configure the Recursive Resolver¶

Set up Knot Resolver (kresd) as a caching recursive resolver on port 53.

Reference: Technologies: Knot Resolver, SOP: DNS Management — Set Up a Recursive Resolver

Task 2: Use Your Own Resolver¶

Configure the VM to use its own kresd instance for all DNS resolution.

Reference: SOP: DNS Management — Configure the VM to Use Its Own Resolver

Task 3: Install and Configure the Authoritative Server¶

Set up Knot DNS (knotd) as an authoritative name server on port 5353.

Reference: Technologies: Knot DNS, SOP: DNS Management — Set Up an Authoritative Server

Task 4: Create the Forward Zone¶

Create the zone file for <vm_name>.sysadm.ee with the required records.

Reference: SOP: DNS Management — Create a Forward Zone, Concepts: DNS — Key Terminology

Task 5: Create the Reverse (ARPA) Zone¶

Set up reverse DNS so that looking up your VM's IP returns its hostname.

Reference: SOP: DNS Management — Create a Reverse (ARPA) Zone, Concepts: DNS — Reverse DNS (ARPA)

Task 6: Configure Zone Transfer Notifications¶

Configure knotd to notify the central course server of zone changes and allow it to transfer your zones.

Reference: SOP: DNS Management — Configure Hidden Primary with NOTIFY, Concepts: DNS — Zone Transfers and Hidden Primary

Ansible Tips¶

This section covers tips for automating the tasks in this lab with Ansible. You are not required to automate everything this week, but starting early will save you time later.

Tags¶

Use tags to run only DNS-related roles:

- { role: dns, tags: dns }

Run only the DNS role: ansible-playbook --tags=dns playbook.yml

Handlers¶

Use handlers to restart services only when configuration changes:

# roles/dns/handlers/main.yml
- name: restart kresd
  systemd:
    name: kresd@1.service
    state: restarted
    enabled: yes

- name: reload knot
  command: knotc reload

Notify the handler from tasks that modify config files:

- name: Deploy kresd.conf
  template:
    src: kresd.conf.j2
    dest: /etc/knot-resolver/kresd.conf
  notify: restart kresd

- name: Deploy knot.conf
  template:
    src: knot.conf.j2
    dest: /etc/knot/knot.conf
  notify: reload knot

Zone File Templates¶

Use Jinja2 templates for zone files so that the VM name and IP are substituted automatically.

{# forward-zone.j2 #}
$TTL 900
@       IN  SOA  ns1.{{ hostname }}.sysadm.ee. admin.{{ hostname }}.sysadm.ee. (
                  {{ ansible_date_time.epoch }}  ; Serial (unix timestamp)
                  900           ; Refresh
                  300           ; Retry
                  7200          ; Expire
                  600 )         ; Negative Cache TTL

@              IN  NS   ns1.{{ hostname }}.sysadm.ee.
@              IN  A    {{ vm_ip }}
ns1            IN  A    {{ vm_ip }}
blog           IN  CNAME  {{ hostname }}.sysadm.ee.
inventory      IN  CNAME  {{ hostname }}.sysadm.ee.

Deploy it:

- name: Deploy forward zone file
  template:
    src: forward-zone.j2
    dest: "/var/lib/knot/zones/{{ hostname }}.sysadm.ee.zone"
    owner: knot
    group: knot
    mode: '0640'
  notify: reload knot

Useful Modules¶

• dnf — install packages (knot-resolver, knot)
• template — deploy kresd.conf, knot.conf, zone files, resolv.conf
• systemd — manage kresd@1.service and knot services
• firewalld — open ports 53 and 5353
• file — set ownership and permissions on zone directories
• command — run knotc reload or knotc zone-check for validation