A caching-only name server Redux

I must say that I was not very satisfied with this post about a caching-only name server. I had to faff about with the named.ca file and disable dnssec, all in all it just left a very dissatisfied me. Thus, I thought I would had a go with a VM running from my laptop, so that I would have access to internet.

I installed bind:

yum install bind -y

This is the /etc/named.conf file:

options {
        listen-on port 53 { any; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { any; };
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;
        dnssec-lookaside auto;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";

Note changes to default file in bold.

Made sure about the usual suspects:

chkconfig named on

iptables -I INPUT -p udp --dport 53 -j ACCEPT; iptables -I INPUT -p tcp --dport 53 -j ACCEPT;service iptables save

service named start

And these are the results of two dig queries:

dig www.fuji.jp
;; Query time: 953 msec
;; SERVER: 192.168.1.65#53(192.168.1.65)
;; WHEN: Fri Jul 01 17:36:16 2011
;; MSG SIZE  rcvd: 112

dig www.fuji.jp
;; Query time: 0 msec
;; SERVER: 192.168.1.65#53(192.168.1.65)
;; WHEN: Fri Jul 01 17:36:19 2011
;; MSG SIZE  rcvd: 112

This feels a lot more satisfying. In this world of fast internet connections even a name query across several thousand miles takes less than a second, which makes me doubt the usefulness of a caching name server. I'm not saying that I cannot be useful, I'm just saying that it is of no use to me now

DNS -- Configure a caching-only name server to forward DNS queries

Hot on the heels of my previous post comes this one. Assuming that you have followed the previous post simply, add the following lines to your /etc/named.conf file in the options section (change the ip address to whatever you dns server is):

forwarders {10.168.20.233;};
forward only;

Restart the bind daemon and off you go.

Note that since we are actually forwarding name queries, there is no need to modify the /var/named/named.ca file, like I had to do in the previous post.

DNS -- Configure a caching-only name server

I must confess, yet again, that I'm not 100% sure what this objective refers to. My understanding is as follows: A caching server is, as its name indicates, used to cache queries, therefore an authoritative server is needed to first provide the actual answer that will be cached by this server, so far so good. I think this is geared towards having a single DNS server within an organization, so that internet name queries are cached on this server.

My RHEL6 boxes don't have internet access, so this has been a little bit awkward for me to test. I essentially set up a master DNS server and then modified the /var/named/named.ca file in the caching name server, where I changed the ip address of one the servers to be my master dns server, like this:

M.ROOT-SERVERS.NET.     3600000 IN      A       10.168.20.233

I think I might be getting a little bit ahead of myself. Let's start from the beginning and install Bind:

yum install bind -y

You'll now need to edit the bind configuration file /etc/named.conf and make a few changes:

listen-on port 53 { any; };
allow-query     { any; };

Given the fact that I had not configured DNSSec properly I also commented the dnssec lines out.

/*      dnssec-enable yes;
        dnssec-validation yes;
        dnssec-lookaside auto;
*/

Ensure that the Bind daemon is set to run at boot time:

chkconfig named on

Open up the firewall and save the changes:

iptables -I INPUT -p udp --dport 53 -j ACCEPT; iptables -I INPUT -p tcp --dport 53 -j ACCEPT;service iptables save

You can now start named:

service named start

The best way to test this is to use dig and look at the times it takes to run a query. In my case, I can just turn off the master dns server and if the results are cached, then I will get a response, e.g.:

dig myserver.domain.com
;; Query time: 2 msec
;; SERVER: 10.168.20.234#53(10.168.20.234)

dig myserver.domain.com
;; Query time: 0 msec
;; SERVER: 10.168.20.234#53(10.168.20.234)

This feels a little bit unsatisfying, so I used the tc command to add a 200 milisecond delay to all traffic on eth0 (note that this is done in the master dns server)

tc qdisc add dev eth0 root netem delay 200ms

I bounced the caching server and tried again with dig:

dig myserver.domain.com
;; Query time: 202 msec
;; SERVER: 10.168.20.234#53(10.168.20.234)

dig myserver.domain.com
;; Query time: 0 msec
;; SERVER: 10.168.20.234#53(10.168.20.234)

A lot better this time :). It now makes a bit more sense to have a caching name server.

Note that the cache is stored in memory and therefore will disappear after a reboot of the server or of named itself, see here.

Also note, that there are no SELinux settings related to this objective and that in order to prevent hosts from accessing the service you should use an iptables rule.