Skip to content

Latest commit

 

History

History
156 lines (108 loc) · 3.95 KB

dns.md

File metadata and controls

156 lines (108 loc) · 3.95 KB

DNS - Domain Name System

Resolves hostnames and fully qualified domain names (FQDNs) to IP addresses.

Ports

TCP / UDP Port Description
UDP 53 - DNS client requests
- DNS server replies
TCP 53 - Dynamic DNS
- Zone transfers between DNS servers for replication

DNS Server Software

  • ISC Bind - the classic unix DNS - still runs most of the internet
  • DjbDNS / TinyDNS - smaller faster DNS server
  • DNSmasq - simple, serves /etc/hosts as DNS records
    • good for local labs or small local networks
  • InfoBlox - enterprise DDI (DNS, DHCP, IPAM - IP Address Management) and threat protection - see infoblox.md TODO

Lab DNS - Create FQDNs with embedded IP addresses

https://sslip.io/ - maps anything <anything>[.-]<IP Address>.sslip.io in either 'dot' or 'dash' notation to the embedded IP address.

https://nip.io - maps <anything>[.-]<IP Address>.nip.io in either 'dot' or 'dash' notation to the embedded IP address.

Commonly used for labs and demos where you need to put hostnames / FQDNs in software configuration instead of IP addresses.

Public DNS Servers for Clients

Public DNS servers available for clients to use:

  • 1.1.1.1 - Cloudflare - privacy first DNS
  • 8.8.8.8 - Google DNS servers (as if they don't track you enough)
  • 8.8.4.4 - Google DNS servers
  • 208.67.222.222 - OpenDNS
  • 208.67.220.220 - OpenDNS

Misc

TSIG key - shared key for one-way hash auth for DDNS and zone transfers

DNS Security - see security.md

Linux Packages for DNS Clients

Contains the host and dig commands:

sudo yum install -y bind-utils

DNSmasq on macOS

brew install dnsmasq

To configure dnsmasq, copy the example configuration to /usr/local/etc/dnsmasq.conf and edit.

cp /usr/local/opt/dnsmasq/dnsmasq.conf.example /usr/local/etc/dnsmasq.conf
vim /usr/local/etc/dnsmasq.conf

Sample config I used to use in labs to only serve local VirtualBox VMs - only listens on vboxnet0 interface and contains *.local lookups:

local=/dev/
local=/local/
local=/localdomain/
local=//
interface=vboxnet0
bind-interfaces

To have launchd start dnsmasq at startup:

sudo cp -fv /usr/local/opt/dnsmasq/*.plist /Library/LaunchDaemons

Then to load dnsmasq now:

sudo launchctl load /Library/LaunchDaemons/homebrew.mxcl.dnsmasq.plist

DNSMasq on RHEL7

sudo yum install -y dnsmasq
dnsmasq --test
sudo systemctl enable dnsmasq
sudo systemctl start dnsmasq

Test DHCP response:

sudo yum install -y dhcping
sudo dhcping -s localhost

DDNS - Dynamic DNS

Requires TCP port 53

http://www.semicomplete.com/articles/dynamic-dns-with-dhcp/

http://www.debian-administration.org/articles/591

nsupdate -v -k /etc/bind/admin-updater.key
> update delete www.example.com cname
> send

> update add www1.example.com 86400 a 172.16.1.1
> update add www.example.com 600 cname www1.example.com.
> send

Ported from private Knowledge Base page 2010+ - should have had notes going back to 2003 but young guys don't document enough