1

NB This is a repost of my previous question, which was put on hold, and asked to be reworded for better clarity (hope this makes more sense)


I have a single DNS server with bind installed, which I am trying to setup to host a parent domain (example.org) and two sub domains (cnc.example.org and report.example.org) so that devices within any of the domains can have DNS queries serviced by the single DNS Server.

My first question is this possible ?

If so why would I do I receive the the following errors ?

When I do nslookup host1 from the report.example.org domain I receive

server can't find host1: SERVFAIL

When I do nslookup host2 from the cnc.example.org domain I receive

server can't find host1: SERVFAIL

network topology

Setup as follows:

host1:

  • IP 192.168.252.21/24
  • DNS 192.168.252.22
  • /etc/hosts contains host1.cnc.example.org

host2:

  • IP 192.168.252.20/24
  • DNS 192.168.252.22
  • /etc/hosts contains host2.report.example.org

DNSServer:

  • IP 192.168.252.22/24
  • DNS 127.0.0.1
  • /etc/hosts contains DNSServer.example.org

named.conf.local configuration

/
// Do any local configuration here
//

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";

zone "example.org" {
    type master;
    file "/etc/bind/zones/example.org";
#    allow-transfer { 192.168.252.22; };
};

zone "cnc.example.org" {
    type master;
    file "/etc/bind/zones/cnc.example.org";
#    allow-transfer { 192.168.252.22; };
};

zone "report.example.org" {
    type master;
    file "/etc/bind/zones/report.example.org";
#    allow-transfer { 192.168.252.22; };
};

zone "252.168.192.in-appr.arpa" {
     type master;
     file "/etc/bind/zones/reverse/rev.252.168.192";
     allow-transfer { 192.168.252.22; };
};

example.org configuration

;
; BIND data for example.org or report.example.org
;
$TTL 3h
@           IN  SOA DNSServer.example.org.  root.example.org. (
                        1       ; serial
                        3h      ; refresh
                        1h      ; retry
                        1w      ; expire
                        1h )    ; minimum
;
; main domain name servers - NS records
                    IN  NS  DNSServer.example.org.


; main domain name servers - A records
DNSServer               IN  A   192.168.252.22


;delegated zones
cnc.example.org.                IN  NS  DNSServer.example.org.
report.example.org.         IN  NS  DNSServer.example.org.

* output from /etc/resolv.conf on DNSServer *

  # Generated by NetworkManager
    search example.org
    nameserver 127.0.0.1

* output from /etc/resolv.conf on host1 *

 # Generated by NetworkManager
    search report.example.org
    nameserver 192.168.252.22

* output from /etc/resolv.conf on host2 *

  # Generated by NetworkManager
    search cnc.example.org
    nameserver 192.168.252.22

* output from dig DNSServer on the DNSServer *

root@DNSServer:/etc/bind/zones/reverse# dig DNSServer

; <<>> DiG 9.10.3-P4-Debian <<>> DNSServer
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 45573
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;DNSServer.         IN  A

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Nov 27 10:47:23 GMT 2017
;; MSG SIZE  rcvd: 38

* output using dig DNSServer.example.org *

   root@DNSServer:/home/osboxes# dig DNSServer.example.org

    ; <<>> DiG 9.10.3-P4-Debian <<>> DNSServer.example.org
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12335
    ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ;; QUESTION SECTION:
    ;DNSServer.example.org.     IN  A

    ;; ANSWER SECTION:
    DNSServer.example.org.  10800   IN  A   192.168.252.22

    ;; AUTHORITY SECTION:
    example.org.        10800   IN  NS  DNSServer.example.org.

    ;; Query time: 0 msec
    ;; SERVER: 127.0.0.1#53(127.0.0.1)
    ;; WHEN: Mon Nov 27 11:01:19 GMT 2017
    ;; MSG SIZE  rcvd: 79

* output from dig host1 on DNSServer *

root@DNSServer:/etc/bind/zones/reverse# dig host1

; <<>> DiG 9.10.3-P4-Debian <<>> host1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 19414
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;host1.         IN  A

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Nov 27 10:48:15 GMT 2017
;; MSG SIZE  rcvd: 40

cnc.example.org configuration

;
; BIND data for example.org or report.example.org
;
$TTL 3h
@           IN  SOA DNSServer.example.org.  root.example.org. (
                        1       ; serial
                        3h      ; refresh
                        1h      ; retry
                        1w      ; expire
                        1h )    ; minimum
;
; main domain name servers - NS records
@                   IN  NS  DNSServer.example.org.


; main domain name servers - A records
;DNSServer              IN  A   192.168.252.22


;192.168.252.0/24 - A Records
host1.cnc.example.org.      IN  A   192.168.252.21

report.example.org configuration

;
; BIND data for example.org or report.example.org
;
$TTL 3h
@           IN  SOA DNSServer.example.org.  root.example.org. (
                        1       ; serial
                        3h      ; refresh
                        1h      ; retry
                        1w      ; expire
                        1h )    ; minimum
;
; main domain name servers - NS records
@                   IN  NS  DNSServer.example.org.

; main domain name servers - A records
DNSServer               IN  A   192.168.252.22

;192.168.252.0/24 - A Records
host2.report.example.org.   IN  A   192.168.252.20

thanks

  • roaima i did, but was also then asked not post images, so thought it easier to delete the question and start again, after I knew about the {} formatting – Bat Nov 26 '17 at 21:31
  • roaima I have deleted the older one. – Bat Nov 26 '17 at 21:34
  • @roaima i'd be happy with any configuration to be honest, this was just me first stab at configuring it. All i need is for new devices to be able to query two domains (cnc.exampe.org and report.example.org) so that when they want to dial back to the network, if they connet back for command and control messages they query dns and directed to host1.cnc.example.org and when they want to send repports back they query dns and are directed to host2.report.example.org - does that make sense ? – Bat Nov 26 '17 at 21:39
  • @roaima and @ Abhik Bose I made the suggested changes but I still get the same message. On the DNSServer when I do nslookup host1 I get: root@host1:/home/osbixes# nslookup host2 Server: 127.0.0.1 Address 127.0.0.1#53 ** server can’t find host2: SERVFAIL – Bat Nov 26 '17 at 22:13
  • from host1 or host2 I get root@host1:/home/osbixes# nslookup host2 Server: 192.168.252.22 Address 192.168.252.22#53 ** server can’t find host2: SERVFAIL – Bat Nov 26 '17 at 22:15
2

You can use delegation, but unless you really need it I would suggest that you keep things simple and use one zone that contains example.org, cnc.example.org, and report.example.org.

;
; BIND data for example.org
;
$TTL 3h
@           IN  SOA DNSServer.example.org.  root.example.org. (
                        1       ; serial
                        3h      ; refresh
                        1h      ; retry
                        1w      ; expire
                        1h )    ; minimum
;
; main domain name servers - NS records
                    IN  NS  DNSServer.example.org.

; main domain name servers - A records
DNSServer           IN  A  192.168.252.22

; public targets
cnc                 IN  CNAME  host1.cnc
report              IN  CNAME  host2.report

; hosts delivering services
host1.cnc           IN  A   192.168.252.21
host2.report        IN  A   192.168.252.20

Quoting from comments:

On the DNSServer when I do nslookup host1 I get

root@host1:/home/osbixes# nslookup host2
Server: 127.0.0.1
Address 127.0.0.1#53
** server can’t find host2: SERVFAIL

There is no search path on DNSServer, but the domain is example.org, which means that all unqualified names must be in that domain. There is no host2.example.org so nslookup is correctly failing to return you an answer. In this case you would either need to replace the domain example.org in your /etc/resolv.conf with search example.org report.example.org or else look up nslookup host2.report.

From host1 or host2 I get

root@host1:/home/osbixes# nslookup host2
Server: 192.168.252.22
Address 192.168.252.22#53
** server can’t find host2: SERVFAIL

Same reason. Your domain (search path) in /etc/resolv.conf does not include the component that holds host2 so nslookup can't see the unqualified name host2 anywhere.

I assume the /etc/hosts and /etc/hostname files on host1 and host2 should still be host1.cnc.example.org and host2.report.example.org

I've no real idea what you mean when you say that /etc/hosts should be host1.cnc.example.org. The /etc/hosts file is an alternative way of mapping between host names and IP addresses. If you've only got two or three hostname you might as well avoid the complexity of internal DNS and just put those entries in /etc/hosts. On the other hand if you have a reasonable number of hosts then DNS is a good centralised solution for a local network. (Bear in mind, though, that nslookup intentionally ignores /etc/hosts.)

From either of the hosts when I do nslookup host1.cnc.example.org or nslookup host2.report.example.org it correctly resolves the IP address

Yes. You've provided a fully qualified name, which nslookup (and bind) can resolve corectly. This proves that either DNS is working well.

I need a single DNS Server to handle any queries for example.org and cnc.example.org and report.example.org so that when a new device communicates back to the network to ask for new commands to execute, it queries cnc.example.org and is directed to host1.cnc.example.org (192.168.252.21) but when it wants to send reports back to the network it queries the report.example.org domain and is directed to host2.report.example.org (192.168.252.20)

To do this you would use a CNAME (alias) record in the DNS, so that a query for report.example.org is mapped to the host host2.report.example.org. Note that there's no technical reason in your question why host2 shouldn't be called host2.example.org. CNAME records can point anywhere, not just to hosts in the current (sub)domain.

  • thanks for the advice. I am going to spin up a few VMs and try these suggestions and will report back ! thanks again ! Also not snooping but great charity you have ! – Bat Nov 26 '17 at 21:47
  • @Bat answer updated to address some of your apparent confusion – roaima Nov 27 '17 at 11:06
  • I have responded to your last comments - really appreciate your help with this and you taking the time to reply ! – Bat Nov 27 '17 at 11:29
  • 1
    @Bat not sure what else you're asking, apart from now you're using dig instead of nslookup. By default dig does NOT use the search and domain values in /etc/resolv.conf. Try dig +search +noadditional ... instead of just dig ... to enable that function. – roaima Nov 27 '17 at 11:47
  • I edited your respone and included some questions in there. I basically need a single DNS Server to handle any queries for example.org and cnc.example.org and report.example.org so that when a new device communicates back to the network to ask for new commands to execute, it queries cnc.example.org and is directed to host1.cnc.example.org (192.168.252.21) but when it wants to send reports back to the network it queries the report.example.org domain and is directed to host2.report.example.org (192.168.252.20) – Bat Nov 27 '17 at 11:57
1

Yes. But no need to create sperate configurtion for subdomain.

A . at end means a full domain name and without a . it means a subdomain of the original domain.

Add entry like this for cnc.example.com in example.com configuration only.

host1.cnc      IN  A   192.168.252.21    

So, you need the following updates

  1. Remove cnc.example.org and report.example.com from named.conf.local
  2. Add all entries corresponding to the subdomain without a . at end in the parent domain's configuration. You can also mention them explicitly in parent's zone like

    host1.cnc.example.com.  IN A  192.168.252.21
    
  3. Remove zone files corresponding to cnc.example.com and report.example.com and restart BIND server.
  • i knew that "." was important but didn't know what impact it had, thanks for clearing that up ! I am going to spin up a couple of VMs and give your suggestio a go ! will report back thanks for the swift help my friend ! – Bat Nov 26 '17 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.