--Omer Faruk Sen <[email protected]>

         
        DjbDNS is a DNS software written by Dj Bernstein who is also coder of Qmail, Ezmlm, Public File.  It is intended to be a secure replacement of BIND which is written by ISC. DjbDNS is consists of following pieces:

a) Authoritive Name Server (tinydns)
b) DNS Resolver (dnscache)
c) A set of tools to query name system (dnsq, dnsqr, dnstrace, dnsip, dnsipq, dnstxt, dnstracesort, dnsname, dnsmx, dnsfilter)
d) Zone transfer server and client ( axfrdns and axfr-get)
e) walldns: A reverse dns wall to protect your systems behind your Firewall
f) pickdns: A load-balancing dns server (obsolete).
g) rbldns IP-address-listing DNS server
h) Some scripts to create tinydns-data file.

     First it must be made clear that resolver and authoritive name servers are completely different things. A resolver asks for a domain. (for example yildiz.edu.tr) in a reverse order. It first queries who holds information for .tr. That question is asked to Root-Servers. The answer obtained by  resolver and cached in RAM. Following "tr", the root server for "tr" TLD is queried for authoritive name server of "edu.tr". This continues until last authoritive name server is queried (authoritive name server of yildiz.edu.tr). And finally "http://www.yildiz.edu.tr/" is obtained from 193.140.1.1 ( yildiz.edu.tr's authoritive name server). Briefly

RESOLVER :                             The system that queries (and caches answer) authoritive name servers
AUTHORITIVE NAME SERVER:  System that holds information for a domain

 **Authoritive Name Server and Resolver can not bind same IP address. You have to choose different IPs. Maybe an internal IP for RESOLVER and a Real Ip for Authoritive Name Server. DjbDNS uses different binaries to implement authoritive name server ( tinydns) and resolver ( dnscache ) on the same computer. This idea may seem confusing and unnecessary first. But is the first step to security!! (This is also called Split Horizon)

   To install DjbDNS you have to install daemontools and ucspi-tcp. Ucspi-tcp is required if you are going to install zone transfer server, axfrdns . To install it follow those commands.

Now we have a working daemontools package on our system. Daemontools (as its name implies) is a tool for daemons running on your system. It checks daemon if it is running or it can restart, stop or start a service. Thi services must be linked under first argument of svscan command comes with daemontools. ( # svscan /service & )

For next reboot we have to add a startup script which called through /etc/rc.local :

---------------starts here ( /etc/rc.djbdns )  ------------
#!/bin/sh
export PATH="$PATH:/usr/local/bin"
svscan /service &
------------ends here--------------

Now for axfrdns (zone transfer ) to work we install ucspi-tcp

% gunzip ucspi-tcp-0.88.tar
% tar -xf ucspi-tcp-0.88.tar
% cd ucspi-tcp-0.88

Compile the ucspi-tcp programs:
 %    make
As root, install the ucspi-tcp programs under /usr/local:
#   make setup check
 

  Now it is time to install DjbDNS with following commands

%    gunzip djbdns-1.05.tar
%    tar -xf djbdns-1.05.tar
%     cd djbdns-1.05
Compile the djbdns programs:

 %    make
As root, install the djbdns programs under /usr/local:

#     make setup check

 Now it is time to configure dnscache and tinydns:

 Now we are going to configure TINYDNS (Authoritive Name Server). All tools required for that comes with djbdns package. First we have to determine a few things.

a)The user which tinydns is going to run as
b)The user which tinydns's logs are handled by
c)IP address of tinydns
d)The directory which we store configuration files and startup scripts

After deciding and creating those users and the required IP we issue that command:

#tinydns-conf tinydns dnslog /etc/tinydns 193.140.1.1                  
#ln -s /etc/tinydns      /service                                    In 5 seconds our server will be up and running

After starting tinydns we can now ( It is important to realize we can add and update zone file while tinydns running. It will automaticly update itself to use new " data.cdb " )

You can manually add new dns records but it is best to use add-* scripts reside at /etc/tinydns/root/ . To accomplish that we issue those following commands.

 
Here is the content of data file which is modified by add-* scripts and used by tinydns-data command to create data.cdb. You have to re-run "make" to activate changes for tinydns.

 Now everything for our server is ready. We can now query our authoritive name server with " dnsq ". dnsq is designed to query authoritive name servers. If we need to query dnsqr we use " dnsqr "  or we can use other commands:

a) dnsname 193.140.1.1
http://www.yildiz.edu.tr/

b) dnsmx
0 http://www.yildiz.edu.tr/

Others are : dnsip, dnstxt, dnszone, dnstrace, dnstracesort .

   Dnscache is our resolver. It also caches answers to re-use it for the next time in a period of TTL value set in Authoritive name server that tells dnscache to cache it in memory for that given time. Again you must decide on

a)The user which dnscache is going to run as
b)The user which dnscache's logs are handled by
c)IP address of dnscache
d)The directory which we store configuration files and startup scripts

#dnscache-conf dnscache dnslog /etc/dnscachex 192.168.1.1            
#ln -s /etc/dnscachex /service               

    At above dnscachex is used to reflect that anyone whois is allowed can connect and query our dnscache. If we are installing dnscache just as a caching-server for our local machine we can use "dnscache" and 127.0.0.1 for IP.

 We have to edit some variables in /etc/dnscache. Those are

1)Who are allowed to connect my dnscache
#cd /service/dnscache/root/ip/
#touch 193.140.1
#touch 193.140.1.3
To allow 193.140.1.0 network to query cache and to host 193.140.1.3
 

2)Amount of RAM that is used for  caching
#cd /etc/dnscachex/env
#echo "10000000" >  CACHESIZE
#echo "30000000" > DATALIMIT

And we now have to restart dnscache by issuing that command:

#svc -t /service/dnscachex  ( this command comes with daemontools and -t parameter is used to up and down a service)
 Now our dnscache program is running.

It is a requirement to run 2 dns server for your corporate or educational authoritive dns server.

Prerequisites :

1) Ucspi-TCP
For dns queries that is larger than 512 bytes and zone transfer TCP protocol is used. To accomlish that we have to use uscpi-tcp.

     gunzip ucspi-tcp-0.88.tar
     tar -xf ucspi-tcp-0.88.tar
     cd ucspi-tcp-0.88

     make

     make setup check

We have to decide followings to set up axfrdns:

a)The user which axfrdns is going to run as
b)The user which axfrdns's logs are handled by
c)IP address of axfrdns
d)The directory which we store configuration files and startup scripts