| blob | d693c7edf60e8d46ec21a2e0a35dcef7b177efb8 |
1 <?xml version="1.0" encoding="iso-8859-1"?>
2 <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
3 <chapter id="DNSDHCP">
4 <chapterinfo>
5 &author.jht;
6 </chapterinfo>
8 <title>DNS and DHCP Configuration Guide</title>
10 <sect1>
11 <title>Features and Benefits</title>
13 <para>
14 There are few subjects in the UNIX world that might raise as much contention as
15 Domain Name System (DNS) and Dynamic Host Configuration Protocol (DHCP).
16 Not all opinions held for or against particular implementations of DNS and DHCP
17 are valid.
18 </para>
20 <para>
21 We live in a modern age where many information technology users demand mobility
22 and freedom. Microsoft Windows users in particular expect to be able to plug their
23 notebook computer into a network port and have things <quote>just work.</quote>
24 </para>
26 <para>
27 UNIX administrators have a point. Many of the normative practices in the Microsoft
28 Windows world at best border on bad practice from a security perspective.
29 Microsoft Windows networking protocols allow workstations to arbitrarily register
30 themselves on a network. Windows 2000 Active Directory registers entries in the DNS name space
31 that are equally perplexing to UNIX administrators. Welcome to the new world!
32 </para>
35 <para>
36 <indexterm><primary>ISC</primary><secondary>DNS</secondary></indexterm>
37 <indexterm><primary>ISC</primary><secondary>DHCP</secondary></indexterm>
38 The purpose of this chapter is to demonstrate the configuration of the Internet
39 Software Consortium (ISC) DNS and DHCP servers to provide dynamic services that are
40 compatible with their equivalents in the Microsoft Windows 2000 Server products.
41 </para>
43 <para>
44 The purpose of this chapter is to provide no more than a working example of
45 configuration files for both DNS and DHCP servers. The examples used match
46 configuration examples used elsewhere in this document.
47 </para>
49 <para>
50 This chapter explicitly does not provide a tutorial, nor does it pretend to be
51 a reference guide on DNS and DHCP, as this is well beyond the scope and intent
52 of this document as a whole. Anyone who wants more detailed reference materials
53 on DNS or DHCP should visit the ISC Web sites at <ulink noescape="1" url="http://www.isc.org">
54 http://www.isc.org</ulink>. Those wanting a written text might also be interested
55 in the O'Reilly publications on these two subjects.
56 </para>
58 </sect1>
60 <sect1>
61 <title>Example Configuration</title>
63 <para>
64 The domain name system is to the Internet what water is to life. By it nearly all
65 information resources (host names) are resolved to their Internet protocol (IP) address.
66 Windows networking tried hard to avoid the complexities of DNS, but alas, DNS won.
67 <indexterm><primary>WINS</primary></indexterm>
68 The alternative to DNS, the Windows Internet Name Service (WINS) an artifact of
69 NetBIOS networking over the TCP/IP protocols, has demonstrated scalability problems as
70 well as a flat non-hierarchical name space that became unmanageable as the size and
71 complexity of information technology networks grew.
72 </para>
74 <para>
75 WINS is a Microsoft implementation of the RFC1001/1002 NetBIOS Name Service (NBNS).
76 It allows NetBIOS clients (like Microsoft Windows Machines) to register an arbitrary
77 machine name that the administrator or user has chosen together with the IP
78 address that the machine has been given. Through the use of WINS, network client machines
79 could resolve machine names to their IP address.
80 </para>
82 <para>
83 The demand for an alternative to the limitations of NetBIOS networking finally drove
84 Microsoft to use DNS and Active Directory. Microsoft's new implementation attempts
85 to use DNS in a manner similar to the way that WINS is used for NetBIOS networking.
86 Both WINS and Microsoft DNS rely on dynamic name registration.
87 </para>
89 <para>
90 Microsoft Windows clients can perform dynamic name registration to the DNS server
91 on start-up. Alternately, where DHCP is used to assign workstation IP addresses,
92 it is possible to register host names and their IP address by the DHCP server as
93 soon as a client acknowledges an IP address lease. Lastly, Microsoft DNS can resolve
94 hostnames via Microsoft WINS.
95 </para>
97 <para>
98 The following configurations demonstrate a simple insecure Dynamic DNS server and
99 a simple DHCP server that matches the DNS configuration.
100 </para>
102 <sect2>
103 <title>Dynamic DNS</title>
105 <para>
106 <indexterm><primary>DNS</primary><secondary>Dynamic</secondary></indexterm>
107 The example DNS configuration is for a private network in the IP address
108 space for network 192.168.1.0/24. The private class network address space
109 is set forth in RFC1918.
110 </para>
113 <para>
114 <indexterm><primary>BIND</primary></indexterm>
115 It is assumed that this network will be situated behind a secure firewall.
116 The files that follow work with ISC BIND version 9. BIND is the Berkeley
117 Internet Name Daemon. The following configuration files are offered:
118 </para>
120 <para>
121 The master configuration file <filename>/etc/named.conf</filename>
122 determines the location of all further configuration files used.
123 The location and name of this file is specified in the start-up script
124 that is part of the operating system.
125 <smbfile name="named.conf">
126 <programlisting>
127 # Quenya.Org configuration file
129 acl mynet {
130 192.168.1.0/24;
131 127.0.0.1;
132 };
134 options {
136 directory "/var/named";
137 listen-on-v6 { any; };
138 notify no;
139 forward first;
140 forwarders {
141 192.168.1.1;
142 };
143 auth-nxdomain yes;
144 multiple-cnames yes;
145 listen-on {
146 mynet;
147 };
148 };
150 # The following three zone definitions do not need any modification.
151 # The first one defines localhost while the second defines the
152 # reverse lookup for localhost. The last zone "." is the
153 # definition of the root name servers.
155 zone "localhost" in {
156 type master;
157 file "localhost.zone";
158 };
160 zone "0.0.127.in-addr.arpa" in {
161 type master;
162 file "127.0.0.zone";
163 };
165 zone "." in {
166 type hint;
167 file "root.hint";
168 };
170 # You can insert further zone records for your own domains below.
172 zone "quenya.org" {
173 type master;
174 file "/var/named/quenya.org.hosts";
175 allow-query {
176 mynet;
177 };
178 allow-transfer {
179 mynet;
180 };
181 allow-update {
182 mynet;
183 };
184 };
186 zone "1.168.192.in-addr.arpa" {
187 type master;
188 file "/var/named/192.168.1.0.rev";
189 allow-query {
190 mynet;
191 };
192 allow-transfer {
193 mynet;
194 };
195 allow-update {
196 mynet;
197 };
198 };
199 </programlisting>
200 </smbfile>
201 </para>
203 <para>
204 The following files are all located in the directory <filename>/var/named</filename>.
205 This is the <filename>/var/named/localhost.zone</filename> file:
206 <smbfile name="localhost.zone">
207 <programlisting>
208 $TTL 1W
209 @ IN SOA @ root (
210 42 ; serial (d. adams)
211 2D ; refresh
212 4H ; retry
213 6W ; expiry
214 1W ) ; minimum
216 IN NS @
217 IN A 127.0.0.1
218 </programlisting>
219 </smbfile>
220 </para>
222 <para>
223 The <filename>/var/named/127.0.0.zone</filename> file:
224 <smbfile name="127.0.0.0.zone">
225 <programlisting>
226 $TTL 1W
227 @ IN SOA localhost. root.localhost. (
228 42 ; serial (d. adams)
229 2D ; refresh
230 4H ; retry
231 6W ; expiry
232 1W ) ; minimum
234 IN NS localhost.
235 1 IN PTR localhost.
236 </programlisting>
237 </smbfile>
238 </para>
240 <para>
241 The <filename>/var/named/quenya.org.host</filename> file:
242 <smbfile name="quenya.org.host">
243 <programlisting>
244 $ORIGIN .
245 $TTL 38400 ; 10 hours 40 minutes
246 quenya.org IN SOA marvel.quenya.org. root.quenya.org. (
247 2003021832 ; serial
248 10800 ; refresh (3 hours)
249 3600 ; retry (1 hour)
250 604800 ; expire (1 week)
251 38400 ; minimum (10 hours 40 minutes)
252 )
253 NS marvel.quenya.org.
254 MX 10 mail.quenya.org.
255 $ORIGIN quenya.org.
256 frodo A 192.168.1.1
257 marvel A 192.168.1.2
258 ;
259 mail CNAME marvel
260 www CNAME marvel
261 </programlisting>
262 </smbfile>
263 </para>
265 <para>
266 The <filename>/var/named/192.168.1.0.rev</filename> file:
267 <smbfile name="192.168.1.0.rev">
268 <programlisting>
269 $ORIGIN .
270 $TTL 38400 ; 10 hours 40 minutes
271 1.168.192.in-addr.arpa IN SOA marvel.quenya.org. root.quenya.org. (
272 2003021824 ; serial
273 10800 ; refresh (3 hours)
274 3600 ; retry (1 hour)
275 604800 ; expire (1 week)
276 38400 ; minimum (10 hours 40 minutes)
277 )
278 NS marvel.quenya.org.
279 $ORIGIN 1.168.192.in-addr.arpa.
280 1 PTR frodo.quenya.org.
281 2 PTR marvel.quenya.org.
282 </programlisting>
283 </smbfile>
284 </para>
286 <para>
287 The above were copied from a fully working system. All dynamically registered
288 entries have been removed. In addition to these files, BIND version 9 will
289 create for each of the dynamic registration files a file that has a
290 <filename>.jnl</filename> extension. Do not edit or tamper with the configuration
291 files or with the <filename>.jnl</filename> files that are created.
292 </para>
294 </sect2>
296 <sect2 id="DHCP">
297 <title>DHCP Server</title>
299 <para>
300 The following file is used with the ISC DHCP Server version 3.
301 The file is located in <filename>/etc/dhcpd.conf</filename>:
302 </para>
304 <para>
305 <smbfile name="dhcpd.conf">
306 <programlisting>
307 ddns-updates on;
308 ddns-domainname "quenya.org";
309 option ntp-servers 192.168.1.2;
310 ddns-update-style ad-hoc;
311 allow unknown-clients;
312 default-lease-time 86400;
313 max-lease-time 172800;
315 option domain-name "quenya.org";
316 option domain-name-servers 192.168.1.2;
317 option netbios-name-servers 192.168.1.2;
318 option netbios-dd-server 192.168.1.2;
319 option netbios-node-type 8;
321 subnet 192.168.1.0 netmask 255.255.255.0 {
322 range dynamic-bootp 192.168.1.60 192.168.1.254;
323 option subnet-mask 255.255.255.0;
324 option routers 192.168.1.2;
325 allow unknown-clients;
326 }
327 </programlisting>
328 </smbfile>
329 </para>
331 <para>
332 In the above example, IP addresses between 192.168.1.1 and 192.168.1.59 are
333 reserved for fixed address (commonly called <constant>hard-wired</constant>) IP addresses. The
334 addresses between 192.168.1.60 and 192.168.1.254 are allocated for dynamic use.
335 </para>
337 </sect2>
339 </sect1>
340 </chapter>