How to edit Dynamic DNS zone

All changes made to a zone using dynamic update are stored in the zone's journal file. The zone file is updated every 15 min. The zone files of dynamic zones cannot normally be edited by hand because they are not guaranteed to contain the most recent dynamic changes (those are only in the journal file). Here are few steps that let you edit entries in dynamic dns zone:

1. Suspend updates to all dynamic zones.

   rndc freeze
   

2. Edit zone file
3. Enable updates to all dynamic zones and reload them.

   rndc thaw
   

Read more about advanced dns features here.

Debian DHCP server failover

Before we start I assume you followed previous two posts: setup and dynamic-dns. Our primary dhcp server located at 192.168.10.4 and secondary at 192.168.10.5.

Primary DHCP Server

1. You need declare failover section that identifies the primary dhcp server (file /etc/dhcp/dhcpd.conf).

   failover peer "dhcp-failover" {
     primary; # declare this to be the primary server
     address 192.168.10.4;
     port 647;
     peer address 192.168.10.5;
     peer port 647;
     max-response-delay 30;
     max-unacked-updates 10;
     load balance max seconds 3;
     mclt 1800;
     split 128;
   }
   

2. Failover peer needs to be referenced by concrete subnet:

   subnet 192.168.10.0 netmask 255.255.255.0 {
     pool {
       # In order to turn off failover just comment out
       # the line below
       failover peer "dhcp-failover";
       range 192.168.10.41 192.168.10.254;
     }
     option subnet-mask 255.255.255.0;
     option broadcast-address 192.168.10.255;
     option routers gw1.dev.local;
   }
   

Secondary DHCP Server

1. Failover secondary peer declaration (file /etc/dhcp/dhcpd.conf):

   failover peer "dhcp-failover" {
     secondary; # declare this to be the secondary server
     address 192.168.10.5;
     port 647;
     peer address 192.168.10.4;
     peer port 647;
     max-response-delay 30;
     max-unacked-updates 10;
     load balance max seconds 3;
   }
   

2. subnet 192.168.10.0 netmask 255.255.255.0 {
     pool {
       # In order to turn off failover just comment out
       # the line below
       failover peer "dhcp-failover";
       range 192.168.10.41 192.168.10.254;
     }
     option subnet-mask 255.255.255.0;
     option broadcast-address 192.168.10.255;
     option routers gw1.dev.local;
   }
   

That pretty much you need to do. Read more here.

Dynamic DNS update with DHCP on Debian

If you have many dhcp clients it is much convenient to find them by name than remember ip addresses. This is what dynamic dns update with dhcp is for. I assume you followed few previous posts on dns and dhcp topic.

Configure DNS server

1. We would like to accept only authorized secure updates, so let generate a secure key:

   dnssec-keygen -r /dev/urandom -a hmac-md5 -b 256 -n host key
   cat Kkey.*.private
   rm Kkey*
   

   Here is sample output:

   Private-key-format: v1.3
   Algorithm: 157 (HMAC_MD5)
   Key: 9rHjOgEuZ8O8LpsoJcl4zORqbeOCaPc3WfYDd5Mq3FHI=
   ...
   

2. Add the following (replace md5 key with the one you generated) to a new file /etc/bind/dynamic-dns.key

   key DYNAMICDNS {
           algorithm hmac-md5;
           secret "9rHjOgEuZ8O8LpsoJcl4zORqbeOCaPc3WfYDd5Mq3FHI=";
   };
   

3. Secure key:

   chmod o-r /etc/bind/dynamic-dns.key
   

4. Ensure bind is the owner of the configucation directory, since it save some files there during dynamic updates:

   chmod -R g+w /etc/bind/
   

5. Update zone registration file to allow dynamic updates (file /etc/bind/named.conf.local):

   include "/etc/bind/dynamic-dns.key";
   
   zone "dev.local" IN {
          type master;
          file "/etc/bind/db.dev.local";
          allow-update { key DYNAMICDNS; };
   };
   
   zone "10.168.192.IN-ADDR.ARPA" IN {
          type master;
          file "/etc/bind/db.10.168.192";
          allow-update { key DYNAMICDNS; };
   };
   

6. Restart bind9

Test DNS Settings

1. Let configure DNS for a new host test with ip 192.168.10.7:

   root@ns1:/etc/bind# nsupdate 
   > server 127.0.0.1
   > key DYNAMICDNS 9rHjOgEuZ8O8LpsoJcl4zORqbeOCaPc3WfYDd5Mq3FHI=
   > zone dev.local
   > update add test.dev.local. 600 IN A 192.168.10.7
   > send
   > zone 10.168.192.IN-ADDR.ARPA
   > update add 7.10.168.192.in-addr.arpa 600 IN PTR test.dev.local.
   > send
   

2. And now verify:

   user1@deby01:~$ host test
   test.dev.local has address 192.168.10.7
   
   user1@deby01:~$ host 192.168.10.7
   7.10.168.192.in-addr.arpa domain name pointer test.dev.local.
   

Configure DHCP server

1. Add the following (replace md5 key with the one you generated) to a new file /etc/dhcp/dynamic-dns.key

   key DYNAMICDNS {
           algorithm hmac-md5;
           secret "9rHjOgEuZ8O8LpsoJcl4zORqbeOCaPc3WfYDd5Mq3FHI=";
   };
   

2. Create a new file /etc/dhcp/dhcpd.conf.local with the following content:

   include "/etc/dhcp/dynamic-dns.key";
   
   zone dev.local. {
           primary ns1.dev.local;
           key DYNAMICDNS;
   }
   
   zone 10.168.192.IN-ADDR.ARPA. {
           primary ns1.dev.local;
           key DYNAMICDNS;
   }
   

3. Open file /etc/dhcp/dhcpd.conf and ensure:

   ddns-update-style interim;
   include "/etc/dhcp/dhcpd.conf.local";
   

4. Restart dhcp server so our change take effect.

   /etc/init.d/isc-dhcp-server restart
   

Test DHCP server with Debian client

1. First of all in order to identify your debian client by name you must ensure it send host name to dhcp server. You can check this in file /etc/dhcp/dhclient.conf:

   send host-name "deby01";
   

2. Assuming the dhcp client interface is configured for eth1, here is a command to re-new ip address from server:

   dhclient -v eth1
   

Debian DHCP Server Setup

Dynamic Host Configuration Protocol (DHCP) is a protocol. It gives client machines "leases" for IP addresses and can automatically set their network configuration.

apt-get -y install rsyslog isc-dhcp-server

Before we start configuring the dhcp server let set our requirements:

• Domain name: dev.local
• Network: 192.168.10.0/24
• DNS Servers: ns1.dev.local, ns2.dev.local
• Gateway: gw1.dev.local
• First 40 ip addresses are reserved for servers
• DHCP pool is 41 - 254

Server Configuration

1. The server will be listening on eth0 interface (file /etc/default/isc-dhcp-server):

   # On what interfaces should the DHCP server (dhcpd) 
   # serve DHCP requests? Separate multiple interfaces 
   # with spaces, e.g. "eth0 eth1".
   INTERFACES="eth0"
   

2. Configure DHCP per our requirements (file /etc/dhcp/dhcpd.conf)

   # The ddns-updates-style parameter controls whether or
   # not the server will attempt to do a DNS update when 
   # a lease is confirmed. We default to the behavior of 
   # the version 2 packages ('none', since DHCP v2 didn't
   # have support for DDNS.)
   ddns-update-style none;
   
   # option definitions common to all supported networks
   option domain-name "dev.local";
   option domain-name-servers ns1.dev.local, ns2.dev.local;
   option ip-forwarding off;
   
   # This way you can specify multiple search domains.
   # For Windows clients it doesn't work and need to be
   # setup manually
   option domain-search "dev.local", "corp.local";
   
   # Lease time is in seconds
   default-lease-time 600;
   max-lease-time 7200;
   
   # If this DHCP server is the official DHCP server for 
   # the local network, the authoritative directive should 
   # be uncommented.
   authoritative;
   
   # Use this to send dhcp log messages to a different log 
   # file (you also have to hack syslog.conf to complete 
   # the redirection).
   log-facility local7;
   
   subnet 192.168.10.0 netmask 255.255.255.0 {
     pool {
       range 192.168.10.41 192.168.10.254;
     }
     option subnet-mask 255.255.255.0;
     option broadcast-address 192.168.10.255;
     option routers gw1.dev.local;         
   }
   
   

How to test from Debian client

1. You need a network interface configured for dhcp (file /etc/network/interfaces):

   allow-hotplug eth0
   iface eth0 int dhcp
   

2. Obtain ip address and check your up:

   root@dh1:~# dhclient eth0 && ifconfig eth0 | grep inet
             inet addr:192.168.10.41 ...
   

3. Try some lookups (notice multiple dns search list; in order to use host command you need to install dnsutils package):

   root@dh1:~# host ns1
   ns1.dev.local has address 192.168.10.2
   
   root@dh1:~# host mail
   mail.corp.local has address 192.168.11.10
   

How to enable multi-domain search in Windows client

1. Choose Advanced TCP/IP Settings
2. In DNS tab choose "Append these DNS suffixes (in order)"
3. Add as many as you need domain to search
4. Try some lookups (notice multiple dns search list):

   C:\>nslookup ns1
   ...
   C:\>nslookup mail
   ...
   

Read more here.

Debian Slave DNS Server Setup

The setup of Slave (Secondary) DNS Server is pretty easy. You need to follow two previous posts of setting up a simple DNS server and chroot bind9.

Master (Primary) DNS Server

1. Add the following to /etc/bind/named.conf.options

   dnssec-enable yes;
   

2. Generate MD5 hash key:

   dnssec-keygen -r /dev/urandom -a hmac-md5 \
    -b 256 -n host rndc ; cat Krndc.*.private \
    | grep Key ; rm Krndc*
   

   Here is output:

   Key: 9EKQM+7+EnJzO7TWyayUf0vks4k+SZPf9DAs8fOeREM=
   

3. Add the following (replace md5 key with the one you generated) to a new file /etc/bind/transfer.key

   key TRANSFER {
           algorithm hmac-md5;
           secret "9EKQM+7+EnJzO7TWyayUf0vks4k+SZPf9DAs8fOeREM=";
   };
   

4. Secure key:

   chmod o-r /etc/bind/transfer.key
   

5. Add the following to a new file /etc/bind/named.conf.transfer

   include "/etc/bind/transfer.key";
   
   // Slave IP Address
   server 192.168.10.3 {
           keys {
           TRANSFER;
       };
   };
   

6. Add the following to file /etc/bind/named.conf

   include "/etc/bind/named.conf.transfer";
   

Slave (Secondary) DNS Server

1. Add the following to /etc/bind/named.conf.options

   dnssec-enable yes;
   

2. Add the following (replace md5 key with the one you generated) to file /etc/bind/transfer.key

   key TRANSFER {
           algorithm hmac-md5;
           secret "9EKQM+7+EnJzO7TWyayUf0vks4k+SZPf9DAs8fOeREM=";
   };
   

3. Secure key:

   chmod o-r /etc/bind/transfer.key
   

4. Add the following to file /etc/bind/named.conf.transfer

   include "/etc/bind/transfer.key";
   
   // Master IP Address
   server 192.168.10.2 {
           keys {
           TRANSFER;
       };
   };
   

5. Add the following to file /etc/bind/named.conf

   include "/etc/bind/named.conf.transfer";
   

6. Specify slave zones in file /etc/bind/named.conf.local:

   zone "dev.local" IN {
          type slave;
          file "/etc/bind/db.dev.local";
          masters { 192.168.10.2; };
          allow-notify { 192.168.10.2; };
   };
   
   zone "10.168.192.IN-ADDR.ARPA" IN {
          type slave;
          file "/etc/bind/db.10.168.192";
          masters { 192.168.10.2; };
          allow-notify { 192.168.10.2; };
   };
   

7. Copy forwards to slave (file /etc/bind/named.conf.forward):

   zone "corp.local" IN {
          type forward;
          forwarders { 192.168.11.2; 192.168.11.3; };
   };
   

8. Ensure bind:bind is the owner of the configuration so it can update the files received from master.

   chown -R bind:bind /var/chroot/bind9/etc/*
   

In order to keep both servers in sync, setup ntpdate (on master and slave dns servers):

root@ns2:/etc/bind# apt-get install ntpdate
...
root@ns2:/etc/bind# ntpdate pool.ntp.org

Now you can restart bind9 on both servers and ensure that slave received zone files.

Troubleshooting

Have a look at system log file (/var/log/syslog) for any errors reported by named. If you will see something telling you permission denied while dumping a file, ensure bind:bind is the owner as following:

chown -R bind:bind /var/chroot/bind9/etc/*
/etc/init.d/bind9 restart
ls -l /ent/bind/db.*