8    Domain Name System

To configure a slave server, invoke the SysMan Menu as documented in Section 1.1.1 and do the following:

1. From the SysMan Menu, select Networking-->Additional Network Services-->Domain Name Service (DNS(BIND))-->Configure system as a DNS server to display the DNS Server Configuration dialog box.

   Alternatively, enter the following command on a command line:

   # /usr/bin/sysman dns_server
   

2. Enter your local domain name in the Local Domain field.

3. Select SLAVE in the DNS Server Type pull-down menu.

4. Indicate the order in which to resolve host name queries in the Host Name Resolution Order field. Open the pull-down menu and choose from the list of options. Administrators usually use either the DNS Database, Local Host File, NIS option or the Local Host File, DNS Database, NIS option; the latter is recommended. Your choice is recorded in the /etc/svc.conf file.

   Alternatively, you can run the svcsetup script to customize service order selection. See Section 8.8 and svcsetup(8) for information about modifying the svc.conf file.

5. Select the Advanced DNS Options button to display the Advanced Options dialog box, which allows you to choose a different directory and files in which to save DNS server configuration information and cache data. Make changes, if necessary, then select OK to close the dialog box.

6. Select Next to display the Zones Served list.

   1. Select Add to display the Add Zone dialog box.

   2. Select the Slave radio button in the Authority field and enter the name of the zone (domain) for which this server will have secondary authority.

   3. Enter the name of the local file in which to store a copy of the database of zone information from the master server. Also, enter the IP address of the master server.

   4. Select OK to accept the entry. Repeat steps 6a through 6d for additional entries. At the very least, you must add a forward lookup entry and reverse lookup entry for each zone.

      Given the following /etc/namedb/named.conf file on the master server, you would add entries in the slave's Zones Served list for the domain.suffix and nn.nnn.in-addr.arpa zones:

      zone domain.suffix {
           type master;
           file "hosts.db";
           };
       
      zone nn.nnn.in-addr.arpa {
           type master;
           file "hosts.rev";
           };
       
       
      

7. Select Next to display the Local Name Server list.

   1. Select Add to display the Add Name Server dialog box.

   2. Enter the host name and IP address for a name server that your slave server will query for addresses that it cannot resolve by itself.

   3. Select OK to accept the entry. If the server is not a known host, select Yes to add it to the /etc/hosts file.

      Repeat steps 7a through 7c, if necessary. It is best to specify two or three name servers.

   4. Select Next to accept the list of name servers. The addresses are later recorded in the /etc/resolv.conf file.

8. Select the appropriate check box to start the named daemon and select Next to continue. The utility prompts you to change the host name of the system.

9. Select the appropriate check box to change the host name, if necessary. If you choose to change the host name, you are prompted to add localhost to the access control list. Select Yes to allow graphical user interfaces to be displayed properly on your newly renamed system.

10. Select Next to continue, then select Finish to save the configuration and start the named daemon.

    You are informed that you successfully configured the system as a DNS server. Select OK to close the DNS Server Configuration dialog box.

You can also modify your server configuration after the initial setup. See the online help for more information.

8.5.3    Configuring a Caching-Only Server

To configure a caching-only server, invoke the SysMan Menu as documented in Section 1.1.1 and do the following:

1. From the SysMan Menu, select Networking-->Additional Network Services-->Domain Name Service (DNS(BIND))-->Configure system as a DNS server to display the DNS Server Configuration dialog box.

   Alternatively, enter the following command on a command line:

   # /usr/bin/sysman dns_server
   

2. Enter your local domain name in the Local Domain field.

3. Select CACHING in the DNS Server Type pull-down menu.

4. Indicate the order in which to resolve host name queries in the Host Name Resolution Order field. Open the pull-down menu and choose from the list of options. Administrators usually use either the DNS Database, Local Host File, NIS option or the Local Host File, DNS Database, NIS option; the latter is recommended. Your choice is recorded in the /etc/svc.conf file.

   Alternatively, you can run the svcsetup script to customize service order selection. See Section 8.8 and svcsetup(8) for information about modifying the svc.conf file.

5. Select the Advanced DNS Options button to display the Advanced Options dialog box, which allows you to choose a different directory and files in which to save DNS server configuration information and cache data. Make changes, if necessary, then select OK to close the dialog box.

6. Select Next to display the Local Name Server list.

   1. Select Add to display the Add Name Server dialog box.

   2. Enter the host name and IP address for a name server that your caching-only server will query for addresses that it cannot resolve by itself.

   3. Select OK to accept the entry. If the server is not a known host, select Yes to add it to the /etc/hosts file.

      Repeat steps 6a through 6c, if necessary. It is best to specify two or three name servers.

   4. Select Next to accept the list of name servers. The addresses are later recorded in the /etc/resolv.conf file.

7. Select the appropriate check box to start the named daemon and select Next to continue. The utility prompts you to change the host name of the system.

8. Select the appropriate check box to change the host name, if necessary. If you choose to change the host name, you are prompted to add localhost to the access control list. Select Yes to allow graphical user interfaces to be displayed properly on your newly renamed system.

9. Select Next to continue, then select Finish to save the configuration and start the named daemon.

   You are informed that you successfully configured the system as a DNS server. Select OK to close the DNS Server Configuration dialog box.

You can also modify your server configuration after the initial setup. See the online help for more information.

8.5.4    Configuring a Forward-Only Server

To configure a forward-only server, invoke the SysMan Menu as documented in Section 1.1.1 and do the following:

1. From the SysMan Menu, select Networking-->Additional Network Services-->Domain Name Service (DNS(BIND))-->Configure system as a DNS server to display the DNS Server Configuration dialog box.

   Alternatively, enter the following command on a command line:

   # /usr/bin/sysman dns_server
   

2. Enter your local domain name in the Local Domain field.

3. Select FORWARDER in the DNS Server Type pull-down menu.

4. Indicate the order in which to resolve host name queries in the Host Name Resolution Order field. Open the pull-down menu and choose from the list of options. Administrators usually use either the DNS Database, Local Host File, NIS option or the Local Host File, DNS Database, NIS option; the latter is recommended. Your choice is recorded in the /etc/svc.conf file.

   Alternatively, you can run the svcsetup script to customize service order selection. See Section 8.8 and svcsetup(8) for information about modifying the svc.conf file.

5. Select the Advanced DNS Options button to display the Advanced Options dialog box, which allows you to choose a different directory and files in which to save DNS server configuration information and cache data. Make changes, if necessary, then select OK to close the dialog box.

6. Select Next to display the Forwarders list.

   1. Select the appropriate check box to indicate that you want to configure the system as a forward-only server.

   2. Select Add to display the Add Forwarder dialog box.

   3. Enter the IP address for a forwarder, a name server that your forward-only server will query for addresses on remote networks (like the Internet).

   4. Select OK to accept the entry. If the server is not a known host, select Yes to add it to the /etc/hosts file.

      Repeat steps 6b through 6d, if necessary. It is best to specify two or three forwarders.

   5. Select Next to accept the list of forwarders. The addresses are later recorded in the /etc/resolv.conf file.

7. Select Next to display the Local Name Server list.

   1. Select Add to display the Add Name Server dialog box.

   2. Enter the host name and IP address for a name server that your forward-only server will query for addresses on the local network.

   3. Select OK to accept the entry. If the server is not a known host, select Yes to add it to the /etc/hosts file.

      Repeat steps 7a through 7c, if necessary. It is best to specify two or three name servers.

   4. Select Next to accept the list of name servers. The addresses are later recorded in the /etc/resolv.conf file.

8. Select the appropriate check box to start the named daemon and select Next to continue. The utility prompts you to change the host name of the system.

9. Select the appropriate check box to change the host name, if necessary. If you choose to change the host name, you are prompted to add localhost to the access control list. Select Yes to allow graphical user interfaces to be displayed properly on your newly renamed system.

10. Select Next to continue, then select Finish to save the configuration and start the named daemon.

    You are informed that you successfully configured the system as a DNS server. Select OK to close the DNS Server Configuration dialog box.

You can also modify your server configuration after the initial setup. See the online help for more information.

8.5.5    Configuring a Stub Server

To configure a stub server, invoke the SysMan Menu as documented in Section 1.1.1 and do the following:

Note

When configuring stub service, run the SysMan Menu application on the server that will have authority for the subzone, not on the master server. See the definition for a stub server in Section 8.1 for more information.

1. From the SysMan Menu, select Networking-->Additional Network Services-->Domain Name Service (DNS(BIND))-->Configure system as a DNS server to display the DNS Server Configuration dialog box.

   Alternatively, enter the following command on a command line:

   # /usr/bin/sysman dns_server
   

2. Enter your local domain name in the Local Domain field.

3. Select STUB in the DNS Server Type pull-down menu.

4. Indicate the order in which to resolve host name queries in the Host Name Resolution Order field. Open the pull-down menu and choose from the list of options. Administrators usually use either the DNS Database, Local Host File, NIS option or the Local Host File, DNS Database, NIS option; the latter is recommended. Your choice is recorded in the /etc/svc.conf file.

   Alternatively, you can run the svcsetup script to customize service order selection. See Section 8.8 and svcsetup(8) for information about modifying the svc.conf file.

5. Select the Advanced DNS Options button to display the Advanced Options dialog box, which allows you to choose a different directory and files in which to save DNS server configuration information and cache data. Make changes, if necessary, then select OK to close the dialog box.

6. Select Next to display the Zones Served list.

   1. Select Add to display the Add Zone dialog box.

   2. Select the Stub radio button in the Authority field. Enter the name of the stub zone (domain).

   3. Enter the name of the local file in which to store a copy of the database of zone information from the master server. Also, enter the IP address of the master server.

   4. Select OK to accept the entry. Repeat steps 6a through 6d for additional entries. At the very least, you must add a forward lookup entry and a reverse lookup entry for each zone.

      Given the following /etc/namedb/named.conf file on the master server, you would add entries in the slave's Zones Served list for the domain.suffix and nn.nnn.in-addr.arpa zones:

      zone domain.suffix {
           type master;
           file "hosts.db";
           };
       
      zone nn.nnn.in-addr.arpa {
           type master;
           file "hosts.rev";
           };
       
       
      

7. Select Next to display the Local Name Server list.

   1. Select Add to display the Add Name Server dialog box.

   2. Enter the host name and IP address for a name server that your stub server will query for addresses that it cannot resolve by itself.

   3. Select OK to accept the entry. If the server is not a known host, select Yes to add it to the /etc/hosts file.

      Repeat steps 7a through 7c, if necessary. It is best to specify two or three name servers.

   4. Select Next to accept the list of name servers. The addresses are later recorded in the /etc/resolv.conf file.

8. Select the appropriate check box to start the named daemon and select Next to continue. The utility prompts you to change the host name of the system.

9. Select the appropriate check box to change the host name, if necessary. If you choose to change the host name, you are prompted to add localhost to the access control list. Select Yes to allow graphical user interfaces to be displayed properly on your newly renamed system.

10. Select Next to continue, then select Finish to save the configuration and start the named daemon.

    You are informed that you successfully configured the system as a DNS server. Select OK to close the DNS Server Configuration dialog box.

You can also modify your server configuration after the initial setup. See the online help for more information.

8.5.6    Configuring a DNS Client

To configure a DNS client, invoke the SysMan Menu as documented in Section 1.1.1 and do the following:

1. From the SysMan Menu, select Networking-->Additional Network Services-->Domain Name Service (DNS(BIND))-->Configure system as a DNS client to display the Configure DNS Client dialog box.

   Alternatively, enter the following command on a command line:

   # /usr/bin/sysman dns_client
   

2. Enter your local domain name in the Local Domain field.

3. Select Add to add a name server.

4. Enter the host name and the IP address for the name server.

   The addresses are recorded in the /etc/resolv.conf file, where the resolver uses them to determine the IP addresses of name servers it will query.

5. Select OK to add the host name to the list of name servers. If the specified host is not listed in the /etc/hosts file, the script prompts you to add it to that file. Select Yes or No.

   To add other name servers, repeat steps 3 through 5. You can specify up to three name servers.

6. Indicate the order in which to resolve host name queries in the Host Name Resolution Order field. Open the pull-down menu and choose from the list of options. Administrators usually use either the DNS Database, Local Host File, NIS option or the Local Host File, DNS Database, NIS option; the latter is recommended. Your choice is recorded in the /etc/svc.conf file.

   Alternatively, you can run the svcsetup script to customize service order selection. See Section 8.8 and svcsetup(8) for information about modifying the svc.conf file.

7. Configure your system to search alternate domains for address resolution by doing the following:

   1. Select Domains Searched to display the associated dialog box.

   2. Select Add to display the Add/Modify dialog box.

   3. Enter the name of a domain to search. Your local domain is searched by default; you do not need to enter it.

   4. Select OK to accept the entry. Repeat steps 7b through 7d, if necessary. You can specify up to six domains.

   5. Select OK to accept the list of domains to be searched.

8. Select OK to accept the configuration. The script prompts you to change the host name of the system.

9. Select Yes or No as appropriate. If you choose Yes to change the host name, you are prompted to add localhost to the access control list. Select Yes to allow graphical user interfaces to be displayed properly on your newly renamed system.

10. Select OK to close the Configure DNS Client dialog box.

You can also modify your client configuration after the initial setup. See the online help for more information.

For IPv6 network environments, to enable dynamic updates for a DNS client, do the following:

1. Run the ip6_setup script and enable dynamic updates of IPv6 addresses by answering y and provide a fully qualified domain name for the IPv6 host. See Section 3.4.2 and Section 3.5.1 for more information.

2. Configure the DNS/BIND server to allow the updates (see Section 8.5.1.2).

If you do not want to enable dynamic updates, you must still run the ip6_setup script, but no special DNS configuration is necessary.

8.6    Configuring Authentication

The following sections describe how to configure authentication on DNS servers for the following purposes:

• Secure dynamic updates

• Secure zone transfers

Authentication serves a purpose only when the private key remains a secret between the servers; therefore, it is prudent to change this key frequently and save the key file as specified in the following sections to prevent the key from being compromised.

8.6.1    Configuring Secure Dynamic Updates

If you plan to use the nd6hostd daemon to dynamically update IPv6 zones, do not enable authentication for these zones. The nd6hostd daemon does not support authentication.

To configure a master server to authenticate dynamic updates it receives from new DNS clients (Microsoft Windows systems), do the following:

Caution

Each time you reconfigure your DNS master server with the SysMan Menu, you must reenable secure client updates by repeating these steps because your named.conf file will be rewritten.

1. Generate a private key using the dnskeygen command, as follows:

   # dnskeygen -H size -h -c -n key-name
   

   Valid key sizes are 512, 576, 640, 704, 768, 832, 896, 960, and 1024. Larger keys are more cumbersome, but they are more secure.

   You can supply any name for a key, but it is best to give the keys canonical names so they are easy to distinguish. For example, if hosts from the xyz.corp.com zone send dynamic updates to your master server, marlin.xyz.corp.com, you might want to name your key xyznet-marlin_update.

   The dnskeygen command produces two files:

   • K<key-name><proto-id><key-id>.key

   • K<key-name><proto-id><key-id>.private

   Hereafter, these files are referred to as the .key and .private files.

   For more information about generating keys, see the dnskeygen(1) reference page.

2. Create a file, possibly named.keys, to contain the key configuration statement for the update. This file must be read/writeable only by superuser to prevent the private key from being compromised. For example:

   # cd /etc/namedb
   # touch key-config-file
   # chmod 600 key-config-file
   

3. Incorporate the key information from the .private file into the key-config-file by adding the following key statement:

   key key-name {
       algorithm hmac-md5;
       secret "generated-key";
   };
   

   In the key statement, replace key-name with the name of the key and generated-key with the entire private key as it appears in the .private file. It is best to enter the key by opening the .private file in another window, copying the necessary key text, and pasting the text into the text editor window. There must be no line feeds or spaces between the quotes that contain the key; if even one character is entered incorrectly, authentication fails.

4. Add the following include statement to the top of the /etc/namedb/named.conf file:

   include "/etc/namedb/key-config-file";
    
   

   Replace key-config-file with the name of the key configuration file you created in steps 2 and 3.

   When the named daemon starts and reads the DNS data file, it calls the key-config-file and parses its contents.

5. Enable secure dynamic updates for the master zone by adding the allow-update substatement to the master zone statements (for forward and reverse lookups) in the named.conf file :

   zone "zone-name" {
           type master;
           file "file-name";
           allow-update {
                key key-name;
           }; 
   };
    
   zone  "rev-ip.in-addr.arpa" { 
           type  master; 
           file "hosts.rev"; 
           allow-update { 
                key key-name;
           }; 
   }; 
    
    
   

   Replace key-name with the name of the file you created in steps 2 and 3.

   Specifying a key in this statement ensures that updates are successful only if they are signed with the private key.

6. Restart the named daemon by issuing the following command:

   # /sbin/init.d/named restart
   

Once you have configured the master server to support secure dynamic DNS updates from new hosts, you can distribute the private key as necessary to administrators who need to add these hosts to the network. It is best to physically distribute the key on magnetic or optical media as opposed to sending it over the network where it can be compromised.

You can format a floppy for this purpose. See mtools(1) for information about formatting and reading Microsoft Windows-compatible floppy disks on a Tru64 UNIX system. If the described tools are not available, you need to install the OSFDOSTOOLS subset.

For information about configuring Microsoft Windows 2000 systems on a network with Tru64 UNIX DNS servers, see the Best Practice for Integrating Windows 2000 DNS Clients with Tru64 UNIX DNS Services at the following URL:

http://www.tru64unix.compaq.com/faqs/publications/best_practices

Note that when clients send updates to the master server, the named daemon does not immediately update the master database files. It creates temporary database.ixfr and database.log files where it logs the changes until they can be incorporated into the database. However, the daemon does become aware of the updates almost immediately in memory. You can verify them with the nslookup command as explained in Section 8.10.1.

8.6.2    Configuring Secure Zone Transfers

key oceannet-client_update {[1]
        algorithm hmac-md5;[2]
        secret "lSYbJjbTOLH2DB+kRpf0fcTJk0mOca90GDGdn5R7L2vPhyCx
daGhHp0o2pDU+PSzclE3Yk6Xg8jOkpRExx+2yw==";[3]
};
 
key oceannet-marlin-minnow_transfer {[4]
        algorithm hmac-md5;
        secret "648NyJi33LMhf00iavHjbkgqcTMJ7lZD4/r0DF9wgIQ2WH2b
peHLYjz2qYMrx1dMYw9E9gDp6F6LTMDHHCvFlw==";

include "/etc/namedb/named.keys";[1]
 
options {
        directory  "/etc/namedb/";
};
 
zone  "0.0.127.in-addr.arpa" {
        type  master;
        file  "named.local";
};
 
zone  "ocean.corp.com" {
        type  master;
        file  "hosts.db";
        allow-update {
                key oceannet-client_update;[2]
        };
        allow-transfer {
                key oceannet-marlin-minnow_transfer;[3]
        };
};
 
zone  "6.134.20.in-addr.arpa" {
        type  master;
        file  "hosts.rev";
        allow-update {
                key oceannet-client_update;[2]
        };
        allow-transfer {
                key oceannet-marlin-minnow_transfer;[3]
        };
};
 
zone  "." {
        type  hint;
        file  "named.ca";
};

include "/etc/namedb/named.keys";
 
server 20.134.6.2 {
        keys { oceannet-marlin-minnow_transfer };[1]
};
 
options {
        directory  "/etc/namedb/";
};
 
zone  "0.0.127.in-addr.arpa" {
        type  master;
        file  "named.local";
};
 
zone  "pubs.zk3.dec.com" {
        type  slave;
        file  "/etc/namedb/hosts.db";
        masters  {
                20.134.6.2[2];
        };
};
 
zone  "6.134.20.in-addr.arpa" {
        type  slave;
        file  "/etc/namedb/hosts.rev";
        masters  {
                20.134.6.2;[2]
        };
};
 
zone  "." {
        type  hint;
        file  "named.ca";
};
 
 

# /usr/sbin/svcsetup

# nslookup
Default Server:  localhost
Address:  127.0.0.1
 
> set querytype=mx
> corp.com
Server:  localhost
Address:  127.0.0.1
findmx.corp.com      preference = 100, mail exchanger = gateway.corp.com
gateway.corp.com     inet address = 128.54.54.79
> [Ctrl/D]
# 

# whois compaq.com
Registrant:
Compaq Computer Corporation (COMPAQ-DOM)
   P.O. Box 692000
   Houston, TX 77269
 
   Domain Name: COMPAQ.COM

.
.
.
The InterNIC Registration Services database contains ONLY
non-military and non-US Government Domains and contacts.
Other associated whois servers:
   American Registry for Internet Numbers - whois.arin.net
   European IP Address Allocations        - whois.ripe.net
   Asia Pacific IP Address Allocations    - whois.apnic.net
   US Military                            - whois.nic.mil
   US Government                          - whois.nic.gov

# whois -h whois.nic.gov whitehouse.gov
 Whitehouse Public Access (WHITEHOUSE-DOM)
   725 17th Street NW Room NEOB 4208
   Washington, DC 20503
 
   Domain Name: WHITEHOUSE.GOV
   Status: ACTIVE
   Domain Type: Federal

.
.
.