0

I am using amazon free tier with RHEL 7and configuring master and slave dns server. From master everything is ok, but slave I couldn't find result. Also I would like to know how can I secure my dns server.

In slave server, /etc/named.conf file:

options {
listen-on port 53 { 127.0.0.1; 52.34.228.106; 0.0.0.0/0; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; 0.0.0.0/0; };
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recurs ion.
- If you are building a RECURSIVE (caching) DNS server, you need to ena ble
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so w ill
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
#options{
recursion yes;
# allow-recursion { trusted;};
#};

dnssec-enable yes;
dnssec-validation yes;

/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";

managed-keys-directory "/var/named/dynamic";

pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
};

logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};

zone "." IN {
type hint;
file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

and /etc/rfc1912.zones file:

zone "iftibd.com" IN {
type slave;
file "slaves/seobd.fz";
masters { 52.37.252.202;};
allow-notify {52.37.252.202; };
};

zone "228.34.52.in-addr.arpa" IN {
type slave;
file "slaves/seobd.rz";
masters { 52.37.252.202;};
allow-notify {52.37.252.202;};
};



   [root@ip-172-31-17-202 slaves]# nslookup iftibd.com
    Server: 52.34.228.106
    Address: 52.34.228.106#53

Name: iftibd.com
Address: 52.37.252.202
Name: iftibd.com
Address: 52.34.228.106

[root@ip-172-31-17-202 slaves]# nslookup 52.34.228.106
Server: 52.34.228.106
Address: 52.34.228.106#53

** server can't find 106.228.34.52.in-addr.arpa: SERVFAIL

I found only seobd.fz created but not created reverse zone.

  • Welcome to unix&linux. I would advise two different posts; one about securing the DNS server, another about not having reverses; I would risk to say asking "how do I secure my DNS services without doing some background work and reporting what you have done has a high probability of being closed as a too broad question by our moderators. – Rui F Ribeiro Apr 20 '16 at 9:21
0

You do now own your reverse zone - e.g. 228.34.52.in-addr.arpa, Amazon is the owner, so you are only able to setup your forward DNS zone and not the reverse zone.

whois  52.34.228.106
NetRange:       52.32.0.0 - 52.63.255.255
Organization:   Amazon Technologies Inc. (AT-88-Z)

You can also find it doing a dig or nslookup:

Authoritative answers can be found from:
34.52.in-addr.arpa
    origin = dns-external-master.amazon.com
    mail addr = root.amazon.com
    serial = 1218
    refresh = 3600
    retry = 900
    expire = 604800
    minimum = 900

As far as I am aware, in the past you could get away declaring zones you do not own, nowadays BIND is more smart at it, even without bringing DNSSEC into the picture.

DNSSEC also signs zones, and prevent people from "impersonating" them. You also have DNSSEC

BIND DNSSEC Guide

0

I found it using DNS=52.37.252.202 in my pc.

C:\Users\USER>nslookup 52.37.252.202 
Server: www.iftibd.com 
Address: 52.37.252.202 
Name: www.iftibd.com 
Address: 52.37.252.202 
C:\Users\USER>nslookup 52.34.228.106 
Server: ns1.iftibd.com 
Address: 52.37.252.202 
Name: ec2-52-34-228-106.us-west-2.compute.amazonaws.com 
Address: 52.34.228.106 

and I found it using DNS=52.34.228.106 in my pc.

  C:\Users\USER>nslookup 52.34.228.106
Server:  UnKnown
Address:  52.34.228.106

*** UnKnown can't find 52.34.228.106: Server failed

C:\Users\USER>nslookup 52.37.252.202
Server:  UnKnown
Address:  52.34.228.106

Name:    ec2-52-37-252-202.us-west-2.compute.amazonaws.com
Address:  52.37.252.202

Also kindly check if my conf is correct?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.