KeNOG Workshops Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Complete the following DNS lab exercises ======

==== Step 1: Login ====


The username and password is "kenog". 

There is no root password on the lab.

We will use **sudo** to obtain temporary root authorizations. This is recommended best practice.

==== Step 2: Configure the stub resolver ====

Add the DNS google server as the recursive server for now:



<code>
 sudo rm /etc/resolv.conf
 sudo  sh -c "echo nameserver  8.8.8.8 > /etc/resolv.conf"
</code>


==== Step 3: Install BIND and dig ====

Then, install bind and dnstools


<code>
sudo apt-get update 
sudo apt-get install -y bind9 dnsutils net-tools
</code>

==== Step 4: Verify IP address ====

Then we verify the current IP address on the debian server using <code> ifconfig </code>.

<code>

sudo ifconfig

</code>

You should get output as below:

{{::screenshot_2025-04-01_at_7.44.05 am.png?400|}}


In this case, the IP address is 192.168.122.4


=== Step 5: Configure BIND ===


First we will remove the default BIND configuration
<code>
sudo mv /etc/bind/named.conf.options /etc/bind/named.conf.options.old

</code>

Then we will use a text editor to open a blank config file:

<code>
sudo nano /etc/bind/named.conf.options
</code>

Adjust the following text and replcace the IP address with what you saw from ifconfig

<code>
options {
	directory "/var/cache/bind";
	dnssec-validation auto;
	listen-on { 192.168.122.4; 127.0.0.1; }; ## match your IP address
        recursion yes;   # This tell BIND to recursively find DNS data.
        allow-query { trusted; };  ## Add security to prevent unwanted users
};

acl "trusted" {
    192.168.0.0/16;  # The trusted network
    localhost;   # Loopback interface
  
};


</code>

Save and exit the file by holding "Ctrl and X" at the same time. At the next prompt, press "y" and hit enter to save the file. 


=== Step 6: Check BIND config syntax ===

Bind has a tool to verify that the configuration has no mistakes so that BIND can work properly.

<code>
sudo named-checkconf
</code>

If there is no output from that command, BIND is ready to start.

Start BIND with the following command

<code>
sudo service bind9 start
</code>

=== Step 7: Test BIND ===

The following will use the local DNS server you have installed using "dig"


<code>

dig @192.168.122.4 twitter.com

</code>

Assess the response below and look at the Server response section:


<code>
; <<>> DiG 9.18.33-1~deb12u2-Debian <<>> @192.168.122.4 twitter.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3236
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: d037dd9d1fddd3230100000067eb72700fd63029431f046c (good)
;; QUESTION SECTION:
;twitter.com.                   IN      A

;; ANSWER SECTION:
twitter.com.            300     IN      A       162.159.140.229

;; Query time: 36 msec
;; SERVER: 192.168.122.4#53(192.168.122.4) (UDP)
;; WHEN: Tue Apr 01 04:58:24 UTC 2025
;; MSG SIZE  rcvd: 84

</code> 

Try the command again and see if there is a change in the query time. 


=== Adjust the stub resolver to use the new DNS server ===

<code> sudo  sh -c "echo nameserver  192.168.122.4 > /etc/resolv.conf" </code>

The above command will delete the previous config so use carefully in future

=== Testing DNS with dig ===

Try the following dig commands and assess the results: You can substitute with your preferred domain.

  - To see the DNS referral process: <code> dig +trace www.kenic.or.ke </code>
  - To see mail servers for a domain: <code> dig +short cnn.com </code>
  - To see the name servers for a domain: <code> dig +short angani.co ns </code>