View source for Testbed of DNS Installation and Deployment In Real Environment


== Testbed DNS Installation ==

===
<p>System Infrastructure and Installation</p>===
<p>Our testbed has been implemented to see the process of DNS flow. The blue shapes of '''figure.1''' are the local servers that have been installed such as Name Server and its sub-Name Server, Resolver Server, Web Server.</p></li></ol>


<li><p>Registered Domain</p></li></ol>

<ul>
<li><p>bekhinfosec.be have been pointed to two name servers:</p>
<ul>
<li><p>ns1.infosec.unamur.be (stands as parent zone and child zone which resolves sub-domain is ns2.bekhinfosec.be)</p>
<p>ns1.infosec.unamur.be : 138.48.246.201</p>
<p>ns2.bekhinfosec.be : 138.48.246.202</p></li>
<li><p>ns2.infosec.umamur.be (not installed)</p>

</li></ul>

[[File:1.png|thumb]]

Figure 1. Testbed Architecture


<ol style="list-style-type: lower-alpha;">
<li><p>Servers Installation</p></li></ol>

<ul>
<li><p>'''Name Sever Installation and Configuration'''<br />
We use Ubuntu Server version 20.04 as Operating System and in order to make name server we use bind9 and the process of installation as below:</p>
<ul>
<li><p>Update system and Package Installation</p>
<p>'''''Sudo apt-get update'''''</p>
<p>'''''Sudo apt-get install bind9 dnsutils'''''</p></li>
<li><p>Zone Configuration file and Zone file</p>
<p>In the location of '''/etc/bind'''</p>
<p>'''''Sudo nano named.conf.local '''''</p>
<p>For example: ns1.infosec.unamur.be : 138.48.246.201</p>
<p>'''''zone &quot;bekhinfosec.be&quot; IN {'''''</p>
<p>'''''type master;'''''</p>
<p>'''''file &quot;/var/lib/bind/db.bekhinfosec.be&quot;;'''''</p>
<p>'''''};'''''</p>
<p>'''''zone &quot;246.48.138.in-addr.arpa&quot; IN {'''''</p>
<p>'''''type master;'''''</p>
<p>'''''file &quot;/var/lib/bind/db.246.48.138.in-addr.arpa&quot;;'''''</p>
<p>'''''};'''''</p>
<p>That we store the zone file and its reverse file in the location of '''/var/lib/bind'''</p>
<p>File: ''db.bekhinfosec.be''</p>
<p>'''''$TTL 1H'''''</p>
<p>'''''@ IN SOA @ hostmaster.bekhinfosec.be. ('''''</p>
<p>'''''0 ; serial'''''</p>
<p>'''''1H ; refresh'''''</p>
<p>'''''1H ; retry'''''</p>
<p>'''''1W ; expire'''''</p>
<p>'''''1H ) ;minimum'''''</p>
<p>'''''@ IN NS ns1.infosec.unamur.be.'''''</p>
<p>'''''ns1 IN A 138.48.246.201'''''</p>
<p>'''''www IN NS ns2.bekhinfosec.be.'''''</p>
<p>'''''ns2 IN A 138.48.246.202'''''</p>
<p>'''''host1 IN A 138.48.246.203 ;'''''</p>
<p>Reverse zone file: ''db.246.48.138.in-addr.arpa''</p>
<p>'''''$TTL 1H'''''</p>
<p>'''''@ IN SOA @ hostmaster.bekhinfosec.be. ('''''</p>
<p>'''''0 ; serial'''''</p>
<p>'''''1H ; refresh'''''</p>
<p>'''''1H ; retry'''''</p>
<p>'''''1W ; expire'''''</p>
<p>'''''1H ) ;minimum'''''</p>
<p>'''''@ IN NS ns1.infosec.unamur.be.'''''</p>
<p>'''''ns1 IN A 138.48.246.201'''''</p>
<p>'''''www IN NS ns2.bekhinfosec.be.'''''</p>
<p>'''''ns2 IN A 138.48.246.202'''''</p>
<p>'''''host1 IN A 138.48.246.203'''''</p>
<p>'''''201 IN PTR ns1.infosec.unamur.be.'''''</p>
<p>'''''202 IN PTR ns2.bekhinfosec.be.'''''</p>
<p>'''''203 IN PTR host1.bekhinfosec.be.'''''</p>
<p>For the sub name server the process, installation and configuration is the same as parent zone. For named.conf.local in this installation it is put the same name and location. And for the zone file is like below:</p>
<p>File: ''db.bekhinfosec.be''</p>
<p>'''''$TTL 604800'''''</p>
<p>'''''@ IN SOA @ hostmaster.bekhinfosec.be. ('''''</p>
<p>'''''2 ; Serial'''''</p>
<p>'''''604800 ; Refresh'''''</p>
<p>'''''86400 ; Retry'''''</p>
<p>'''''2419200 ; Expire'''''</p>
<p>'''''604800 ) ; Negative Cache TTL'''''</p>
<p>''''';'''''</p>
<p>'''''@ IN NS ns2.bekhinfosec.be.'''''</p>
<p>'''''ns2 IN A 138.48.246.202'''''</p>
<p>'''''www IN A 138.48.246.205'''''</p>
<p>Reverse zone file: ''db.246.48.138.in-addr.arpa''</p>
<p>'''''$TTL 604800'''''</p>
<p>'''''@ IN SOA @ hostmaster.bekhinfosec.be. ('''''</p>
<p>'''''2 ; Serial'''''</p>
<p>'''''604800 ; Refresh'''''</p>
<p>'''''86400 ; Retry'''''</p>
<p>'''''2419200 ; Expire'''''</p>
<p>'''''604800 ) ; Negative Cache TTL'''''</p>
<p>''''';'''''</p>
<p>'''''@ IN NS ns2.bekhinfosec.be.'''''</p>
<p>'''''ns2 IN A 138.48.246.202'''''</p>
<p>'''''www IN A 138.48.246.205'''''</p>
<p>'''''202 IN PTR ns2.bekhinfosec.be.'''''</p>
<p>'''''205 IN PTR www.bekhinfosec.be.'''''</p>
<p>Below is the most common used syntax for our installation and configuration</p>
<p># Check syntax and zone in configuration and restart service:</p>
<p>'''''Sudo named-checkconf'''''</p>
<p>'''''sudo named-checkzone bekhinfosec.be db.bekhinfosec.be'''''</p>
<p>'''''sudo named-checkzone 246.48.138.in-addr.arpa db.246.48.138.in-addr.arpasudo service bind9 restart'''''</p>
<p>'''''sudo service bind9 status'''''</p></li></ul>
</li>
<li><p>'''Resolver Installation and Configuration '''</p></li></ul>

<blockquote>To install resolver server there are many open-source can be used, but in this testbed, we have used unbound package to implement our local resolver.
</blockquote>
<ul>
<li><p>Update system and Package Installation</p>
<p>'''''Sudo apt-get update'''''</p>
<p>'''''Sudo apt-get install unbound'''''</p></li>
<li><p>Configuration file in the location /etc/unbound/</p>
<p>'''''Sudo nano unbound.conf '''''</p>
<p>For example: our resolver: 138.48.246.204</p>
<p>'''''server:'''''</p>
<p>'''''directory: &quot;/etc/unbound&quot;'''''</p>
<p>'''''username: infosec'''''</p>
<p>'''''interface: 138.48.246.204'''''</p>
<p>'''''interface: ::0'''''</p>
<p>'''''access-control: 138.48.246.0/24 allow'''''</p>
<p>'''''access-control: 172.0.0.1 allow'''''</p>
<p>'''''access-control: ::1 allow'''''</p>
<p>'''''access-control: 0.0.0.0/0 deny'''''</p>
<p>'''''access-control: ::/0 deny'''''</p>
<p>'''''# In case you want to limit the ttl of cache of your resolver '''''</p>
<p>'''''# cache-max-ttl: 30 '''''</p>
<p>'''''# cache-min-ttl: 0'''''</p>
<p>'''''serve-expired: no'''''</p>
<p>'''''# In case you want to base on other public resolver (google) '''''</p>
<p>'''''#forward-zone: '''''</p>
<p>'''''# name: &quot;.&quot;'''''</p>
<p>'''''# forward-addr: 4.2.2.2'''''</p>
<p>'''''# forward-addr: 4.2.2.1'''''</p>
<p>'''''# forward-first: yes'''''</p></li>
<li><p>Restart and service check up</p></li></ul>

'''''sudo systemctl restart unbound.service'''''

'''''sudo systemctl status unbound.service'''''

* '''Web Server installation '''

<blockquote>To resolver the name of one machine, we have made web hosting to represent that machine. We used nginx as web server.
</blockquote>
<ul>
<li><p>Update system and Package Installation</p>
<p>'''''Sudo apt-get update'''''</p>
<p>'''''Sudo apt-get install nginx'''''</p></li>
<li><p>Create project folder and file in the location /var/www/'''bekhinfosec.be/index.html'''</p>
<p>'''''&lt;!DOCTYPE html&gt;'''''</p>
<p>'''''&lt;html&gt;'''''</p>
<p>'''''&lt;head&gt;'''''</p>
<p>'''''&lt;style&gt;'''''</p>
<p>'''''title {text-align: center;}'''''</p>
<p>'''''h1 {text-align: center;}'''''</p>
<p>'''''&lt;/style&gt;'''''</p>
<p>'''''&lt;title&gt; Welcome to My Page&lt;/title&gt;'''''</p>
<p>'''''&lt;/head&gt;'''''</p>
<p>'''''&lt;body&gt;'''''</p>
<p>'''''&lt;h1&gt; Here is my Testbet Page&lt;/h1&gt;'''''</p>
<p>'''''&lt;p&gt; Welcome to my pages and this page is for testing only&lt;/p&gt;'''''</p>
<p>'''''&lt;/body&gt;'''''</p>
<p>'''''&lt;/html&gt;'''''</p></li>
<li><p>File configuration (site) in a location /etc/nginx/sites-available/bekhinfosec.be</p>
<p>'''''server {'''''</p>
<p>'''''listen 80 default_server;'''''</p>
<p>'''''listen [::]:80 default_server;'''''</p>
<p>'''''root /var/www/bekhinfosec.be;'''''</p>
<p>'''''index index.html;'''''</p>
<p>'''''server_name bekhinfosec.be www.bekhinfosec.be;'''''</p>
<p>'''''location / {'''''</p>
<p>'''''try_files $uri $uri/ =404;'''''</p>
<p>'''''}'''''</p>
<p>'''''}'''''</p>
<p>Then we have to create a hard link for other directory is sites-enabled</p>
<p>'''''sudo ln -s /etc/nginx/sites-available/bekhinfosec.be /etc/nginx/sites-enabled/bekhinfosec.be'''''</p>
<p>finally, we have to restart nginx</p>
<p>'''''sudo systemctl restart nginx'''''</p>
<p>To check error of your configuration you can use:</p>
<p>'''''Sudo nginx -t '''''</p></li></ul>

* '''Client machine configuration '''

<blockquote>For client machine we just need to assign the resolver and name to resolv.conf file so we can test our connection. In the location of /etc/resolv.conf

'''''Sudo nano /etc/resolv.conf'''''

'''''Search bekhinfosec.be'''''

'''''Nameserver 138.48.246.204'''''
</blockquote>
# '''Traffic Capturing '''

<blockquote>As we installed our system in Proxmox as VM so to capture traffic we can use tcpdump or you can install wireshark to capture the data
</blockquote>
<ol style="list-style-type: lower-alpha;">
<li><p>Wireshark Installation</p>
<p>'''''Sudo apt-get update'''''</p>
<p>'''''Sudo apt-get upgrade'''''</p>
<p>'''''Sudo apt-get install wireshark '''''</p>
<p>[[File:media/image2.png|594x84px]]</p></li></ol>

<blockquote>For this process we don’t see the whole connection from client to Name Server because we have tested it and the data have been cached in the resolver: 138.48.246.204. But if you see like this it means that your testbed has been working well. For example you can test with: [http://www.bekhinfosec.be www.bekhinfosec.be] you will see the result of testing page (index.html):

[[File:media/image3.png|532x80px]]

[[File:media/image4.png|449x486px]]We can use tcpdump and save in pcap file then it can be opened with wireshark.

'''''Sudo tcpdump -in vmbr0 port 53 -w testing.pcap'''''

Vmbr0 is the vitual interface of my network in proxmox and we capture only dns traffic (port 53)
</blockquote>