287 lines
7.4 KiB
Plaintext
287 lines
7.4 KiB
Plaintext
====== Cache DNS : installer et configurer ======
|
||
|
||
OS testé : **Fedora 24**\\
|
||
Date de test : **12 novembre 2016**
|
||
|
||
===== Installer ''bind'' =====
|
||
|
||
Lancer l'installation de ''bind'' et ''bind-utils'' en utilisant le programme ''dnf''.
|
||
|
||
''bind-utils'' inclus les programmes ''nslookup'', ''dig'' and ''host''.
|
||
|
||
<code bash>
|
||
sudo dnf install bind bind-utils
|
||
</code>
|
||
|
||
Le résultat est le suivant :
|
||
|
||
<code>
|
||
Vérification de l'expiration des métadonnées effectuée il y a 1:07:23 sur Fri Nov 11 20:10:48 2016.
|
||
Le paquet bind-utils-32:9.10.4-2.P3.fc24.x86_64 est déjà installé, ignorer
|
||
Dépendances résolues.
|
||
====================================================================================================
|
||
Package Architecture Version Dépôt Taille
|
||
====================================================================================================
|
||
Installation de:
|
||
bind x86_64 32:9.10.4-2.P3.fc24 updates 1.9 M
|
||
|
||
Résumé de la transaction
|
||
====================================================================================================
|
||
Installation 1 Paquet
|
||
|
||
Taille totale des téléchargements : 1.9 M
|
||
Taille d'installation : 4.0 M
|
||
Est-ce correct [o/N] : o
|
||
Téléchargement des paquets :
|
||
bind-9.10.4-2.P3.fc24.x86_64.rpm 555 kB/s | 1.9 MB 00:03
|
||
----------------------------------------------------------------------------------------------------
|
||
Total 382 kB/s | 1.9 MB 00:05
|
||
Test de la transaction en cours
|
||
La vérification de la transaction a réussi.
|
||
Lancement de la transaction de test
|
||
Transaction de test réussie.
|
||
Exécution de la transaction
|
||
Installation de : bind-32:9.10.4-2.P3.fc24.x86_64 1/1
|
||
Vérification : bind-32:9.10.4-2.P3.fc24.x86_64 1/1
|
||
|
||
Installé:
|
||
bind.x86_64 32:9.10.4-2.P3.fc24
|
||
|
||
Terminé !
|
||
</code>
|
||
|
||
Les programmes ''bind'' et ''bind-utils'' sont installés.
|
||
===== Editer ''named.conf'' =====
|
||
|
||
**1.** Modifier le fichier de configuration ''/etc/named.conf''
|
||
|
||
<code bash>
|
||
sudo vim /etc/named.conf
|
||
</code>
|
||
|
||
**2.** Remplacer la ligne suivante (~11)
|
||
|
||
<code ini>
|
||
listen-on port 53 { 127.0.0.1; };
|
||
</code>
|
||
|
||
par le bloc suivant
|
||
|
||
<code ini>
|
||
listen-on port 53 { goodclients; };
|
||
allow-query { goodclients; };
|
||
allow-query-cache { goodclients; };
|
||
recursion yes;
|
||
</code>
|
||
|
||
**3.** Supprimer la ligne suivante
|
||
<code ini>
|
||
allow-query { localhost;};
|
||
</code>
|
||
|
||
Voilà a quoi pourrait correspondre le fichier de configuration ''named.conf''
|
||
<code ini>
|
||
acl goodclients {
|
||
192.168.100.0/24;
|
||
127.0.0.1;
|
||
localhost;
|
||
};
|
||
|
||
options {
|
||
listen-on port 53 { goodclients; };
|
||
allow-query { goodclients; };
|
||
allow-query-cache { goodclients; };
|
||
listen-on-v6 port 53 { ::1; };
|
||
directory "/var/named";
|
||
dump-file "/var/named/data/cache_dump.db";
|
||
statistics-file "/var/named/data/named_stats.txt";
|
||
memstatistics-file "/var/named/data/named_mem_stats.txt";
|
||
|
||
</code>
|
||
|
||
===== Redémarrer le service ''named'' =====
|
||
|
||
<code bash>
|
||
systemctl restart named
|
||
</code>
|
||
|
||
# systemctl enable named
|
||
# systemctl status named
|
||
|
||
===== Modifier le paramétrage DNS =====
|
||
|
||
<code bash>
|
||
sudo vim /etc/resolv.conf
|
||
</code>
|
||
|
||
<code ini>
|
||
nameserver 127.0.0.1
|
||
</code>
|
||
|
||
===== Tester l'interrogation DNS =====
|
||
|
||
Executer le code suivant
|
||
|
||
<code bash>
|
||
dig google.com
|
||
</code>
|
||
|
||
<code>
|
||
; <<>> DiG 9.10.4-P3-RedHat-9.10.4-2.P3.fc24 <<>> google.com
|
||
;; global options: +cmd
|
||
;; Got answer:
|
||
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15768
|
||
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 5
|
||
|
||
;; OPT PSEUDOSECTION:
|
||
; EDNS: version: 0, flags:; udp: 4096
|
||
;; QUESTION SECTION:
|
||
;google.com. IN A
|
||
|
||
;; ANSWER SECTION:
|
||
google.com. 300 IN A 172.217.18.238
|
||
|
||
;; AUTHORITY SECTION:
|
||
google.com. 171791 IN NS ns1.google.com.
|
||
google.com. 171791 IN NS ns2.google.com.
|
||
google.com. 171791 IN NS ns4.google.com.
|
||
google.com. 171791 IN NS ns3.google.com.
|
||
|
||
;; ADDITIONAL SECTION:
|
||
ns2.google.com. 171791 IN A 216.239.34.10
|
||
ns1.google.com. 171791 IN A 216.239.32.10
|
||
ns3.google.com. 171791 IN A 216.239.36.10
|
||
ns4.google.com. 171791 IN A 216.239.38.10
|
||
|
||
;; Query time: 116 msec
|
||
;; SERVER: 127.0.0.1#53(127.0.0.1)
|
||
;; WHEN: ven. nov. 11 21:47:14 CET 2016
|
||
;; MSG SIZE rcvd: 191
|
||
</code>
|
||
|
||
|
||
<code>
|
||
; <<>> DiG 9.10.4-P3-RedHat-9.10.4-2.P3.fc24 <<>> google.com
|
||
;; global options: +cmd
|
||
;; Got answer:
|
||
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64308
|
||
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 5
|
||
|
||
;; OPT PSEUDOSECTION:
|
||
; EDNS: version: 0, flags:; udp: 4096
|
||
;; QUESTION SECTION:
|
||
;google.com. IN A
|
||
|
||
;; ANSWER SECTION:
|
||
google.com. 248 IN A 172.217.18.238
|
||
|
||
;; AUTHORITY SECTION:
|
||
google.com. 171739 IN NS ns4.google.com.
|
||
google.com. 171739 IN NS ns3.google.com.
|
||
google.com. 171739 IN NS ns1.google.com.
|
||
google.com. 171739 IN NS ns2.google.com.
|
||
|
||
;; ADDITIONAL SECTION:
|
||
ns2.google.com. 171739 IN A 216.239.34.10
|
||
ns1.google.com. 171739 IN A 216.239.32.10
|
||
ns3.google.com. 171739 IN A 216.239.36.10
|
||
ns4.google.com. 171739 IN A 216.239.38.10
|
||
|
||
;; Query time: 0 msec
|
||
;; SERVER: 127.0.0.1#53(127.0.0.1)
|
||
;; WHEN: ven. nov. 11 21:48:06 CET 2016
|
||
;; MSG SIZE rcvd: 191
|
||
|
||
</code>
|
||
|
||
===== Activer le service au démarrage de l'OS =====
|
||
|
||
**1.** Vérifier le status
|
||
|
||
<code bash>
|
||
systemctl list-unit-files|grep named
|
||
</code>
|
||
|
||
Résultat
|
||
|
||
<code bash>
|
||
named-setup-rndc.service static
|
||
named.service disabled
|
||
systemd-hostnamed.service static
|
||
</code>
|
||
|
||
**2.** Activer le démarrage du service
|
||
<code bash>
|
||
sudo systemctl enable named
|
||
</code>
|
||
|
||
Résultat
|
||
|
||
<code bash>
|
||
Created symlink from /etc/systemd/system/multi-user.target.wants/named.service to /usr/lib/systemd/system/named.service.
|
||
</code>
|
||
|
||
**3.** Vérifier
|
||
|
||
<code bash>
|
||
systemctl list-unit-files|grep named
|
||
</code>
|
||
|
||
<code bash>
|
||
named-setup-rndc.service static
|
||
named.service enabled
|
||
systemd-hostnamed.service static
|
||
</code>
|
||
|
||
|
||
===== Modifier le parefeu =====
|
||
|
||
**1.** Activer le port
|
||
|
||
Si vous voulez utiliser le cache mis en place par d'autres machines du réseau, il sera nécessaire de lever les restrictions du parefeu.
|
||
|
||
<code>
|
||
sudo iptables -A INPUT -p tcp -m tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
|
||
|
||
sudo service iptables save
|
||
</code>
|
||
|
||
**2.** Vérifier les règles mises en place
|
||
|
||
<code bash>
|
||
sudo iptables -L|grep domain
|
||
</code>
|
||
|
||
Résultat
|
||
|
||
<code bash>
|
||
ACCEPT tcp -- anywhere anywhere tcp dpt:domain ctstate NEW
|
||
</code>
|
||
|
||
**3.** Vérifier l'accessbilité depuis un autre poste
|
||
|
||
Depuis un autre poste, effectuer une commande **nmap** sur l'adresse du serveur (192.168.100.1 dans notre cas).
|
||
|
||
<code bash>
|
||
nmap -v 192.168.100.1
|
||
</code>
|
||
|
||
Résultat
|
||
|
||
<code bash>
|
||
Starting Nmap 7.12 ( https://nmap.org ) at 2016-11-12 09:49 CET
|
||
Initiating Ping Scan at 09:49
|
||
Scanning 192.168.100.1 [2 ports]
|
||
Completed Ping Scan at 09:49, 0.00s elapsed (1 total hosts)
|
||
Initiating Connect Scan at 09:49
|
||
Scanning srv-prod (192.168.100.1) [1000 ports]
|
||
Discovered open port 53/tcp on 192.168.100.1
|
||
Completed Connect Scan at 09:49, 0.04s elapsed (1000 total ports)
|
||
Nmap scan report for srv-prod (192.168.100.1)
|
||
Host is up (0.00025s latency).
|
||
Not shown: 999 closed ports
|
||
PORT STATE SERVICE
|
||
53/tcp open domain
|
||
</code>
|
||
|