Xen 08 - domU - DNS system - djbdns

category: learnz/xen · date: 2012-02-16 · source: old.linuxor.sk/VIRTUALIZATION/REALSERVER/8_XEN_Debian_Server_domU_DNS.txt · theme: github

Xen on Debian 4 Learning · Previous: domU - WWW system - apache2 + mod_security2 + mod_suphp + php5 + php5_suhosin

The Slovak original of this document: Xen 08 - domU - DNS system - djbdns (slovensky).

asciiart

|=---------------------------------=[ XEN ]=------------------------------=|
+---------------------------------------------------------------------------+
|
|                          XEN-server domU (REAL SERVER HW)
|                                 Debian 4.0 Etch
|                                 DNS SYSTEM
|
+---------------------------------------------------------------------------+
|=-------------------------------=[ BH 2008 ]=----------------------------=|

The BASE system is what further virtual machines are built from.

1. Creating a new virtual machine

asciiart

    Creating the logical partitions for the new system
    ==================================================
    # lvcreate -L 1.5G -n dns-disk system_vhosts
    # lvcreate -L 1G -n dns-var system_vhosts
    # lvcreate -L 1G -n dns-varlog system_vhosts
    # lvcreate -L 0.5G -n dns-tmp system_vhosts
    # lvcreate -L 2G -n dns-usr system_vhosts
    # lvcreate -L 0.5G -n dns-swap system_vhosts
    # mkswap /dev/system_vhosts/dns-swap

    Creating the VM from the base LVM partitions (snapshots)
    ========================================================
    # lvcreate -s -L 1.5G -n snap-base-disk /dev/system_vhosts/base-disk
    # lvcreate -s -L 1G -n snap-base-var /dev/system_vhosts/base-var
    # lvcreate -s -L 1G -n snap-base-varlog /dev/system_vhosts/base-varlog
    # lvcreate -s -L 0.5G -n snap-base-tmp /dev/system_vhosts/base-tmp
    # lvcreate -s -L 2G -n snap-base-usr /dev/system_vhosts/base-usr
    # lvcreate -s -L 0.5G -n snap-base-swap /dev/system_vhosts/base-swap

    # dd if=/dev/system_vhosts/snap-base-disk of=/dev/system_vhosts/dns-disk bs=1024k // (1610612736 bytes (1.6 GB) copied, 50.4256 seconds, 31.9 MB/s)
    # dd if=/dev/system_vhosts/snap-base-var of=/dev/system_vhosts/dns-var bs=1024k // (1073741824 bytes (1.1 GB) copied, 33.2976 seconds, 32.2 MB/s)
    # dd if=/dev/system_vhosts/snap-base-varlog of=/dev/system_vhosts/dns-varlog bs=1024k // (1073741824 bytes (1.1 GB) copied, 33.5406 seconds, 32.0 MB/s)
    # dd if=/dev/system_vhosts/snap-base-tmp of=/dev/system_vhosts/dns-tmp bs=1024k // (536870912 bytes (537 MB) copied, 16.2542 seconds, 33.0 MB/s)
    # dd if=/dev/system_vhosts/snap-base-usr of=/dev/system_vhosts/dns-usr bs=1024k // (2147483648 bytes (2.1 GB) copied, 66.4581 seconds, 32.3 MB/s)

    Config of the newly created system - dom0
    =========================================
    # cp /etc/xen/base.cfg /etc/xen/dns.cfg
    # nano /etc/xen/dns.cfg
    -----------------------
    # DNS SYSTEM

    # The kernel image, the initrd and the memory for this virtual machine
    kernel  = '/boot/vmlinuz-2.6.18-6-xen-amd64'
    ramdisk = '/boot/initrd.img-2.6.18-6-xen-amd64'
    memory  = '256'
    extra   = 'selinux=0'
    vcpus   = '1'

    # Disk devices
    root    = '/dev/sda1 ro'
    disk    = [ 'phy:system_vhosts/dns-disk,sda1,w', 'phy:system_vhosts/dns-swap,sda2,w', 'phy:system_vhosts/dns-var,sda3,w',            'phy:system_vhosts/dns-varlog,sda4,w', 'phy:system_vhosts/dns-tmp,sda5,w', 'phy:system_vhosts/dns-usr,sda6,w' ]

    # Hostname
    name    = 'dns'

    # Network
    vif = [ 'ip=10.0.0.6', 'ip=192.168.0.6' ]

    # Behaviour
    on_poweroff = 'destroy'
    on_reboot   = 'restart'
    on_crash    = 'restart'
    -----------------------END->/etc/xen/dns.cfg

    Starting the new system
    =======================
    # xm create -c dns.cfg

    Configuring the domU - dns
    ==========================

    # nano /etc/hostname
    --------------------
    dns
    --------------------END->/etc/hostname

    # nano /etc/network/interfaces
    ------------------------------
    auto eth0
    iface eth0 inet static
        address 10.0.0.6
        gateway 10.0.0.254
        netmask 255.0.0.0

    auto eth1
    iface eth1 inet static
        address 192.168.0.6
        netmask 255.255.255.0
    -------------------------------END->/etc/network/interfaces

    # nano /etc/issue
    -----------------
    Virtual.DNS
    -----------------END->/etc/issue

    # nano /etc/issue.net
    ---------------------
    Virtual.DNS
    ---------------------END->/etc/issue.net

    # nano /etc/motd
    -----------------
    Virtual.DNS
    ---------------------END->/etc/motd

2. Setting up the network (NAT-ed network)

asciiart

----
dom0
----

    # nano /etc/xen/xend-config.sxp
    -------------------------------
    (network-script network-nat)
    (vif-script vif-nat)

    Enable SNAT for the network 10.0.0.0/255.0.0.0
    ----------------------------------------------
    # iptables -t nat -A POSTROUTING -s 10.0.0.0/255.0.0.0 -j SNAT --to-source 192.168.254.254

    Redirect requests for 192.168.254.254:22226 to 10.0.0.6:22
    ----------------------------------------------------------
    # iptables -t nat -A PREROUTING -p tcp -s xx.xx.xx.xx -d 192.168.254.254 --dport 22226 -j DNAT --to-destination 10.0.0.6:22

3. Installing the DNS server (DJBDNS)

asciiart

DJBDNS is not available in Debian Etch as binary packages. There are only packages
with the source code, and even those are in the 'contrib' and 'non-free' repositories.

Requirements:
- daemontools
- ucspi-tcp-src

Notes:
- the address of the authoritative DNS server will be 10.0.0.6
- the address of the caching DNS server for the virtual machines will be 192.168.0.6 (the resolver)

3.1 Install - daemontools

asciiart

    # apt-get install daemontools-installer
    # mkdir /install
    # build-daemontools
    -------------------
    Enter a directory where you would like to do this [/tmp/daemontools] -> [/install/daemontools] ENTER

    Which format would you like to use? [fD] <- ENTER

    Do you want to remove all files in /install/daemontools,
    except daemontools_0.76-9_i386.deb now? [Yn] <- ENTER

    Do you want to install daemontools_0.76-9_i386.deb now? [Yn] <- ENTER

    Do you want to purge daemontools-installer now? [yN] <- ENTER
    -------------------

3.2 Install - ucspi-tcp-src

asciiart

    # apt-get install ucspi-tcp-src
    # build-ucspi-tcp
    -----------------
    Enter a directory where you would like to do this [/install/ucspi-tcp] -> [/install/ucspi-tcp] ENTER

    Do you want to remove all files in /install/ucspi-tcp,
    except ucspi-tcp_0.88-10_i386.deb now? [Yn] <- ENTER

    Do you want to install ucspi-tcp_0.88-10_i386.deb now? [Yn] <- ENTER

    Do you want to purge ucspi-tcp-src now? [yN] <- ENTER
    -------------------

3.3 Install - djbdns

asciiart

    # apt-get install djbdns-installer
    # build-djbdns
    --------------
    Enter a directory where you would like to do this [/install/djbdns] -> [/install/djbdns] ENTER

    Do you want to remove all files in /tmp/djbdns,
    except djbdns_1.05-11_i386.deb now? [Yn] <- ENTER

    Do you want to install djbdns_1.05-11_i386.deb now? [Yn] <- ENTER

    Do you want to purge djbdns-installer now? [yN] <- ENTER

3.4 Install - Config - djbdns

asciiart

    # mkdir /var/lib/svscan

3.5 DNS cache server private - dnscache (for the virtual machines)

asciiart

    Create a DNS cache server listening for connections on the address 192.168.0.6
    ------------------------------------------------------------------------------
    # dnscache-conf dnscache dnslog /var/lib/svscan/dnscache 192.168.0.6

    Download the current list of DNS root servers
    ---------------------------------------------
    ftp://ftp.internic.net/domain/named.root

    Set the currently valid root servers
    ------------------------------------
    # nano /var/lib/svscan/dnscache/root/servers
    --------------------------------------------
    198.41.0.4
    192.228.79.201
    192.33.4.12
    128.8.10.90
    192.203.230.10
    192.5.5.241
    192.112.36.4
    128.63.2.53
    192.36.148.17
    192.58.128.30
    193.0.14.129
    199.7.83.42
    202.12.27.33

    Set which addresses we run the caching DNS server for (192.168.0.*)
    ---------------------------------------------------------------
    # touch /var/lib/svscan/dnscache/root/ip/192.168.0

    Activate the service by creating a link
    ---------------------------------------
    # ln -s /var/lib/svscan/dnscache /service

    Restart the service like this
    -----------------------------
    # svc -d /service/dnscache
    # svc -u /service/dnscache

    or like this
    ------------
    # svc -t /service/dnscache

3.6 DNS cache server local - dnscache

asciiart

    Create a DNS cache server listening for connections on the address 127.0.0.1
    ----------------------------------------------------------------------------
    # dnscache-conf dnscache dnslog /var/lib/svscan/dnscache-local 127.0.0.1

    Activate the service by creating a link
    ---------------------------------------
    # ln -s /var/lib/svscan/dnscache-local /service

3.7 Authoritative public DNS server- tinydns-public

asciiart

    Create a public authoritative DNS server listening for connections on the address 10.0.0.6
    ------------------------------------------------------------------------------------------
    # tinydns-conf tinydns dnslog /var/lib/svscan/tinydns-public 10.0.0.6

    Activate the service by creating a link
    ---------------------------------------
    # ln -s /var/lib/svscan/tinydns-public /service

3.8 Authoritative private DNS server- tinydns-private

asciiart

    Create a private authoritative DNS server listening on 127.0.0.1 (localhost, because both interfaces are already taken)
    ----------------------------------------------------------------------------------------------------------------------------------
    # tinydns-conf tinydns dnslog /var/lib/svscan/tinydns-private 127.0.0.1

    tell the dnscache server to use the private authoritative server at 127.0.0.1 to resolve the internal domain client43.example
    ------------------------------------------------------------------------------------------------------------------------------
    # echo 127.0.0.1 > /var/lib/svscan/dnscache/root/servers/client43.example

    tell the dnscache server to use the private authoritative server at 127.0.0.1 to resolve the reverse records of the internal domain client43.example
    -------------------------------------------------------------------------------------------------------------------------------------------
    # echo 127.0.0.1 > /var/lib/svscan/dnscache/root/servers/192.in-addr.arpa

    Set the private records for the domain client43.example
    ---------------------------------------------------------------
    cd /var/lib/svscan/tinydns-private/root

    Add a record for the name server
    --------------------------------
    ./add-ns client43.example 192.168.0.6

    Activate the service by creating a link
    ---------------------------------------
    # ln -s /var/lib/svscan/tinydns-private /service

3.9 Authoritative public DNS server- tinydns-public - ALLOWING ZONE TRANSFER

asciiart

    Enable the axfrdns daemon to allow zone transfers from our public authoritative DNS
    -----------------------------------------------------------------------------------
    # axfrdns-conf axfrdns dnslog /var/lib/svscan/axfrdns /var/lib/svscan/tinydns-public 10.0.0.6

    As root, run the command that turns ZONE TRANSFER (AXFR) on
    -----------------------------------------------------------
    # echo ':allow,AXFR=""' > /var/lib/svscan/axfrdns/tcp

    For the domain client43.example allow zone transfer from selected IP addresses
    ------------------------------------------------------------------------------
    # echo '192.0.2.32:allow,AXFR="client43.example"' >> /var/lib/svscan/axfrdns/tcp
    # echo '192.0.2.33:allow,AXFR="client43.example"' >> /var/lib/svscan/axfrdns/tcp

    Compile the hash database from the data file
    --------------------------------------------
    # cd /var/lib/svscan/axfrdns
    # make

    Activate the service by creating a link
    ---------------------------------------
    # ln -s /var/lib/svscan/axfrdns /service

LINKZ

asciiart

    Intro to djbdns
    --------------
    http://www.mn-linux.org/meetings/pastnotes/djbdns.pdf

    FAQ
    ----
    http://www.fefe.de/djbdns/

    DNS split horizon
    ----------------
    http://www.fefe.de/djbdns/split-horizon

    Zone transfer
    -------------
    http://cr.yp.to/djbdns/tcp.html

    How the AXFR protocol works
    ----------------------------
    http://cr.yp.to/djbdns/axfr-notes.html

    The BIND company's ``AXFR clarifications''
    -----------------------------------------
    http://cr.yp.to/djbdns/axfr-clarify.html

Current practice (checked 2026-10)

noteThe article above is kept as it was written in 2008. This section lists what has changed since and what to do instead today.

Installing djbdns: the daemontools-installer, ucspi-tcp-src and djbdns-installer packages with their build-* scripts are not needed any more. Debian main now ships binary packages; nothing is compiled on the server.

bash

$ # apt install daemontools-run djbdns-conf dnscache tinydns axfrdns

Service directory: the article links the services into /service. Debian's daemontools-run supervises /etc/service/, so the links go there (ln -s /var/lib/svscan/dnscache /etc/service/) and svc is pointed at /etc/service/dnscache.
Configuration commands: dnscache-conf, tinydns-conf, axfrdns-conf, the root/ip/ and root/servers/ files and the tcp rules of axfrdns work as written; the software is still version 1.05.
Root server list: three of the thirteen addresses listed in section 3.5 have changed since. B is now 170.247.170.2, D is 199.7.91.13 and H is 198.97.190.53. Take the list from https://www.internic.net/domain/named.root instead of the ftp:// address.
Maintenance and DNSSEC: djbdns 1.05 cannot sign zones and dnscache does not validate DNSSEC, and the Debian package was orphaned in December 2025. For a new installation a maintained pair such as Unbound (validating resolver) and NSD, Knot DNS or BIND (authoritative server) is the usual choice; the split into a separate cache and a separate authoritative server that this article builds is still the right design.
Guest config: extra = 'selinux=0' switches off the SELinux that the base image was given. Leave it enabled and, while a policy problem is being debugged, run permissive instead. Under xl, memory and vcpus are unquoted numbers, the disks get xvd* names without the phy: prefix, and the guest is started with xl create -c /etc/xen/dns.cfg.
dom0 rules: xend-config.sxp and the iptables NAT lines are covered in the "Current practice" sections of the domU and dom0 articles (xl script= per interface, nftables).

Sources: