first commit

shared/bind9/commands.md

@@ -0,0 +1,120 @@
+#Copy SSH keys to VM
+## make sure that your local linux default ssh directory exists /root/.ssh if you are on windows
+
+```shell
+ssh-copy-id -i ~/.ssh/id_ed25519.pub khwezi@192.168.1.151
+```
+
+#Update system packages
+
+```shell
+sudo apt update && sudo apt upgrade -y
+```
+
+#Install Bind9
+## install accompanying utilities as well
+
+```shell
+sudo apt install bind9 bind9utils bind9-doc
+```
+
+#Configure Bind9
+
+```shell
+//1. Define global DNS settings
+cp /etc/bind/named.conf.options /etc/bind/named.conf.options.bak
+sudo nano /etc/bind/named.conf.options
+
+//2. Modify file contents, use following example
+//options {
+//    directory "/var/cache/bind";
+//    listen-on { any; }; // Listen on all IP addresses
+//    allow-query { any; }; // Allow queries from any IP address
+//    forwarders {
+//        8.8.8.8; // Google Public DNS
+//        8.8.4.4;
+//    };
+//    dnssec-validation auto;
+//    auth-nxdomain no;    # conform to RFC1035
+//    listen-on-v6 { any; };
+//};
+//Save changed and exit editor
+
+//3. Create custom DNS Zones
+cp /etc/bind/named.conf.local /etc/bind/named.conf.local.bak
+sudo nano /etc/bind/named.conf.local
+
+// use the following example
+//zone "mngoma.lab" {
+//    type master;
+//    file "/etc/bind/db.mngoma.lab";
+//};
+//
+//zone "1.168.192.in-addr.arpa" {
+//    type master;
+//    file "/etc/bind/db.192.168.1";
+//};
+
+//4. Create Zone file(s) referenced in /etc/bind/named.conf.local
+sudo cp /etc/bind/db.local /etc/bind/db.mngoma.lab
+sudo cp /etc/bind/db.127 /etc/bind/db.192.168.1
+
+//5. Edit zone files to contain the records you need
+//;
+//; Zone file for example.com
+//;
+//$ORIGIN example.com.
+//$TTL 3H
+//
+//; SOA record - authoritative info about the zone
+//@   IN  SOA ns1.example.com. hostmaster.example.com. (
+//                2025010101    ; Serial Number
+//                21600       ; Refresh (6 hours)
+//                3600        ; Retry (1 hour)
+//                604800      ; Expire (1 week)
+//                86400       ; Minimum TTL (1 day)
+//            )
+//
+//; NS Records - authoritative name servers for the domain
+//@   IN  NS  ns1.example.com.
+//@   IN  NS  ns2.example.com.
+//
+//; A Records - mapping hostnames to IPv4 addresses
+//ns1     IN  A   192.168.1.10
+//ns2     IN  A   192.168.1.11
+//www     IN  A   192.168.1.20
+//ftp     IN  A   192.168.1.30
+//
+//; AAAA Records - mapping hostnames to IPv6 addresses (optional)
+//ns1     IN  AAAA    2001:db8::10
+//www     IN  AAAA    2001:db8::20
+//
+//; MX Record - for mail exchange servers and priority
+//@   IN  MX  10  mail.example.com.
+//mail    IN  A   192.168.1.100
+//
+//; CNAME Record - Alias for another hostname
+//web     IN  CNAME   www.example.com.
+//----------
+
+//6. check zone file syntax (validate)
+sudo named-checkconf
+sudo named-checkzone mngoma.lab /etc/bind/db.mngoma.lab
+sudo named-checkzone 1.168.192.in-addr.arpa /etc/bind/db.192.168.1
+
+//7. Restart bind9
+sudo systemctl restart bind9
+```
+
+#Configure firewall (lockdown)
+```shell
+//1. enable firewall
+sudo ufw enable
+
+//2. allow all traffic from my address range
+sudo ufw all from 192.168.1.0/24
+
+//3. allow DNS ports
+sudo ufw allow 53/udp
+sudo ufw allow 53/tcp
+```