121 lines
3.1 KiB
Markdown
121 lines
3.1 KiB
Markdown
#Copy SSH keys to VM
|
|
## make sure that your local linux default ssh directory exists /root/.ssh if you are on windows
|
|
|
|
```shell
|
|
ssh-copy-id -i ~/.ssh/id_ed25519.pub khwezi@192.168.1.151
|
|
```
|
|
|
|
#Update system packages
|
|
|
|
```shell
|
|
sudo apt update && sudo apt upgrade -y
|
|
```
|
|
|
|
#Install Bind9
|
|
## install accompanying utilities as well
|
|
|
|
```shell
|
|
sudo apt install bind9 bind9utils bind9-doc
|
|
```
|
|
|
|
#Configure Bind9
|
|
|
|
```shell
|
|
//1. Define global DNS settings
|
|
cp /etc/bind/named.conf.options /etc/bind/named.conf.options.bak
|
|
sudo nano /etc/bind/named.conf.options
|
|
|
|
//2. Modify file contents, use following example
|
|
//options {
|
|
// directory "/var/cache/bind";
|
|
// listen-on { any; }; // Listen on all IP addresses
|
|
// allow-query { any; }; // Allow queries from any IP address
|
|
// forwarders {
|
|
// 8.8.8.8; // Google Public DNS
|
|
// 8.8.4.4;
|
|
// };
|
|
// dnssec-validation auto;
|
|
// auth-nxdomain no; # conform to RFC1035
|
|
// listen-on-v6 { any; };
|
|
//};
|
|
//Save changed and exit editor
|
|
|
|
//3. Create custom DNS Zones
|
|
cp /etc/bind/named.conf.local /etc/bind/named.conf.local.bak
|
|
sudo nano /etc/bind/named.conf.local
|
|
|
|
// use the following example
|
|
//zone "mngoma.lab" {
|
|
// type master;
|
|
// file "/etc/bind/db.mngoma.lab";
|
|
//};
|
|
//
|
|
//zone "1.168.192.in-addr.arpa" {
|
|
// type master;
|
|
// file "/etc/bind/db.192.168.1";
|
|
//};
|
|
|
|
//4. Create Zone file(s) referenced in /etc/bind/named.conf.local
|
|
sudo cp /etc/bind/db.local /etc/bind/db.mngoma.lab
|
|
sudo cp /etc/bind/db.127 /etc/bind/db.192.168.1
|
|
|
|
//5. Edit zone files to contain the records you need
|
|
//;
|
|
//; Zone file for example.com
|
|
//;
|
|
//$ORIGIN example.com.
|
|
//$TTL 3H
|
|
//
|
|
//; SOA record - authoritative info about the zone
|
|
//@ IN SOA ns1.example.com. hostmaster.example.com. (
|
|
// 2025010101 ; Serial Number
|
|
// 21600 ; Refresh (6 hours)
|
|
// 3600 ; Retry (1 hour)
|
|
// 604800 ; Expire (1 week)
|
|
// 86400 ; Minimum TTL (1 day)
|
|
// )
|
|
//
|
|
//; NS Records - authoritative name servers for the domain
|
|
//@ IN NS ns1.example.com.
|
|
//@ IN NS ns2.example.com.
|
|
//
|
|
//; A Records - mapping hostnames to IPv4 addresses
|
|
//ns1 IN A 192.168.1.10
|
|
//ns2 IN A 192.168.1.11
|
|
//www IN A 192.168.1.20
|
|
//ftp IN A 192.168.1.30
|
|
//
|
|
//; AAAA Records - mapping hostnames to IPv6 addresses (optional)
|
|
//ns1 IN AAAA 2001:db8::10
|
|
//www IN AAAA 2001:db8::20
|
|
//
|
|
//; MX Record - for mail exchange servers and priority
|
|
//@ IN MX 10 mail.example.com.
|
|
//mail IN A 192.168.1.100
|
|
//
|
|
//; CNAME Record - Alias for another hostname
|
|
//web IN CNAME www.example.com.
|
|
//----------
|
|
|
|
//6. check zone file syntax (validate)
|
|
sudo named-checkconf
|
|
sudo named-checkzone mngoma.lab /etc/bind/db.mngoma.lab
|
|
sudo named-checkzone 1.168.192.in-addr.arpa /etc/bind/db.192.168.1
|
|
|
|
//7. Restart bind9
|
|
sudo systemctl restart bind9
|
|
```
|
|
|
|
#Configure firewall (lockdown)
|
|
```shell
|
|
//1. enable firewall
|
|
sudo ufw enable
|
|
|
|
//2. allow all traffic from my address range
|
|
sudo ufw all from 192.168.1.0/24
|
|
|
|
//3. allow DNS ports
|
|
sudo ufw allow 53/udp
|
|
sudo ufw allow 53/tcp
|
|
```
|