#Copy SSH keys to VM
## make sure that your local linux default ssh directory exists /root/.ssh if you are on windows

```shell
ssh-copy-id -i ~/.ssh/id_ed25519.pub khwezi@192.168.1.151
```

#Update system packages

```shell
sudo apt update && sudo apt upgrade -y
```

#Install Bind9
## install accompanying utilities as well

```shell
sudo apt install bind9 bind9utils bind9-doc
```

#Configure Bind9

```shell
//1. Define global DNS settings
cp /etc/bind/named.conf.options /etc/bind/named.conf.options.bak
sudo nano /etc/bind/named.conf.options

//2. Modify file contents, use following example
//options {
//    directory "/var/cache/bind";
//    listen-on { any; }; // Listen on all IP addresses
//    allow-query { any; }; // Allow queries from any IP address
//    forwarders {
//        8.8.8.8; // Google Public DNS
//        8.8.4.4;
//    };
//    dnssec-validation auto;
//    auth-nxdomain no;    # conform to RFC1035
//    listen-on-v6 { any; };
//};
//Save changed and exit editor

//3. Create custom DNS Zones
cp /etc/bind/named.conf.local /etc/bind/named.conf.local.bak
sudo nano /etc/bind/named.conf.local

// use the following example
//zone "mngoma.lab" {
//    type master;
//    file "/etc/bind/db.mngoma.lab";
//};
//
//zone "1.168.192.in-addr.arpa" {
//    type master;
//    file "/etc/bind/db.192.168.1";
//};

//4. Create Zone file(s) referenced in /etc/bind/named.conf.local
sudo cp /etc/bind/db.local /etc/bind/db.mngoma.lab
sudo cp /etc/bind/db.127 /etc/bind/db.192.168.1

//5. Edit zone files to contain the records you need
//;
//; Zone file for example.com
//;
//$ORIGIN example.com.
//$TTL 3H
//
//; SOA record - authoritative info about the zone
//@   IN  SOA ns1.example.com. hostmaster.example.com. (
//                2025010101    ; Serial Number
//                21600       ; Refresh (6 hours)
//                3600        ; Retry (1 hour)
//                604800      ; Expire (1 week)
//                86400       ; Minimum TTL (1 day)
//            )
//
//; NS Records - authoritative name servers for the domain
//@   IN  NS  ns1.example.com.
//@   IN  NS  ns2.example.com.
//
//; A Records - mapping hostnames to IPv4 addresses
//ns1     IN  A   192.168.1.10
//ns2     IN  A   192.168.1.11
//www     IN  A   192.168.1.20
//ftp     IN  A   192.168.1.30
//
//; AAAA Records - mapping hostnames to IPv6 addresses (optional)
//ns1     IN  AAAA    2001:db8::10
//www     IN  AAAA    2001:db8::20
//
//; MX Record - for mail exchange servers and priority
//@   IN  MX  10  mail.example.com.
//mail    IN  A   192.168.1.100
//
//; CNAME Record - Alias for another hostname
//web     IN  CNAME   www.example.com.
//----------

//6. check zone file syntax (validate)
sudo named-checkconf
sudo named-checkzone mngoma.lab /etc/bind/db.mngoma.lab
sudo named-checkzone 1.168.192.in-addr.arpa /etc/bind/db.192.168.1

//7. Restart bind9
sudo systemctl restart bind9
```

#Configure firewall (lockdown)
```shell
//1. enable firewall
sudo ufw enable

//2. allow all traffic from my address range
sudo ufw all from 192.168.1.0/24

//3. allow DNS ports
sudo ufw allow 53/udp
sudo ufw allow 53/tcp
```