Serveur DNS Bind [Résolu]

[ghostrider95]

Bonjour à tous,
Je met en place un serveur DNS et un client pour tester celui-ci sauf que ça ne fonctionne pas je m'explique:
Mon serveur DNS (dns) ne ping que lui en terme de noms mais pas son client et vice-versa.
Voici les fichiers de configurations :

Serveur DNS:

named.conf

// $FreeBSD: src/etc/namedb/named.conf,v 1.29.2.3.4.1 2010/12/21 17:09:25 kensmith Exp $
//
// Refer to the named.conf(5) and named(8) man pages, and the documentation
// in /usr/share/doc/bind9 for more details.
//
// If you are going to set up an authoritative server, make sure you
// understand the hairy details of how DNS works. Even with
// simple mistakes, you can break connectivity for affected parties,
// or cause huge amounts of useless Internet traffic.

options {
// All file and path names are relative to the chroot directory,
// if any, and should be fully qualified.
directory "/etc/namedb";
pid-file "/var/run/named/pid";
dump-file "/var/dump/named_dump.db";
statistics-file "/var/stats/named.stats";

// If named is being used only as a local resolver, this is a safe default.
// For named to be accessible to the network, comment this option, specify
// the proper IP address, or delete this option.
listen-on { 127.0.0.1; };

// If you have IPv6 enabled on this system, uncomment this option for
// use as a local resolver. To give access to the network, specify
// an IPv6 address, or the keyword "any".
// listen-on-v6 { ::1; };

// These zones are already covered by the empty zones listed below.
// If you remove the related empty zones below, comment these lines out.
disable-empty-zone "255.255.255.255.IN-ADDR.ARPA";
disable-empty-zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA";
disable-empty-zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA";

// If you've got a DNS server around at your upstream provider, enter
// its IP address here, and enable the line below. This will make you
// benefit from its cache, thus reduce overall DNS traffic in the Internet.
/*
forwarders {
127.0.0.1;
};
*/

// If the 'forwarders' clause is not empty the default is to 'forward first'
// which will fall back to sending a query from your local server if the name
// servers in 'forwarders' do not have the answer. Alternatively you can
// force your name server to never initiate queries of its own by enabling the
// following line:
// forward only;

// If you wish to have forwarding configured automatically based on
// the entries in /etc/resolv.conf, uncomment the following line and
// set named_auto_forward=yes in /etc/rc.conf. You can also enable
// named_auto_forward_only (the effect of which is described above).
// include "/etc/namedb/auto_forward.conf";

/*
Modern versions of BIND use a random UDP port for each outgoing
query by default in order to dramatically reduce the possibility
of cache poisoning. All users are strongly encouraged to utilize
this feature, and to configure their firewalls to accommodate it.

AS A LAST RESORT in order to get around a restrictive firewall
policy you can try enabling the option below. Use of this option
will significantly reduce your ability to withstand cache poisoning
attacks, and should be avoided if at all possible.

Replace NNNNN in the example with a number between 49160 and 65530.
*/
// query-source address * port NNNNN;
};

// If you enable a local name server, don't forget to enter 127.0.0.1
// first in your /etc/resolv.conf so this server will be queried.
// Also, make sure to enable it in /etc/rc.conf.

// The traditional root hints mechanism. Use this, OR the slave zones below.
zone "." { type hint; file "/etc/namedb/named.root"; };

/* Slaving the following zones from the root name servers has some
significant advantages:
1. Faster local resolution for your users
2. No spurious traffic will be sent from your network to the roots
3. Greater resilience to any potential root server failure/DDoS

On the other hand, this method requires more monitoring than the
hints file to be sure that an unexpected failure mode has not
incapacitated your server. Name servers that are serving a lot
of clients will benefit more from this approach than individual
hosts. Use with caution.

To use this mechanism, uncomment the entries below, and comment
the hint zone above.

zone "example.local" {
type master;
allow-update{
key "key rndc-key";
file "/etc/namedb/master/example.local";
};
};

/* Example of a slave reverse zone
zone "1.168.192.in-addr.arpa" {
type master;
file "/etc/namedb/master/example.local.rev";
};
};


key "rndc-key" {
algorithm hmac-md5;
secret "8zjduMJ7vO6DriNIP2jd/w==";
};
};
*/

example.local

$TTL 3600
example.local. IN SOA dns.example.local. root.example.local. (
1 ; Serial
10800 ; Refresh
3600 ; Retry
604800 ; Expire
86400 ) ;Minimum TTL
; DNS Servers
example.local. IN NS dns.example.local.

; Computer names and records

dns.example.local. IN A 192.168.1.50

client IN A 192.168.1.51
client.example.local. IN A 192.168.1.51

example.local.rev

$TTL 3600
1.168.192.in-addr.arpa. IN SOA dns.example.local. root.example.local.(
1 ; Serial
10800 ; Refresh
3600 ; Retry
604800 ; Expire
86400) ; Minimum TTL
; DNS Servers
1.168.192.in-addr.arpa. IN NS dns.example.local.rev

; Computer IPs
50 IN PTR dns.example.local.
51 IN PTR client.example.local.

fichier hosts

::1 localhost localhost.example.local
127.0.0.1 localhost localhost.example.local
192.168.1.50 dns.example.local dns
192.168.1.50 dns.example.local.

resolv.conf

domain example.local
nameserver 192.168.1.50

[Mygale1978]

Salut,

Les fichiers resolv.conf et hosts sont-ils les fichiers du client ou ceux du serveur dns?

[ghostrider95]

Salut,

Ce sont les fichiers du serveur
Sur mon client (client) je n'ai modifié que le resolv.conf avec :
nameserver <@ip serveur dns>

[Mygale1978]

Oki,

A partir du client, peux-tu renvoyer le résultat de la commande suivante stp?

Code :

1
2
 
dig example.local any

[ghostrider95]

Voici

client# dig example.local any

; <<>> DiG 9.6.-ESV-R3 <<>> example.local any
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 33873
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;example.local. IN ANY

;; Query time: 0 msec
;; SERVER: 192.168.1.50#53(192.168.1.50)
;; WHEN: Sun Feb 5 17:07:27 2012
;; MSG SIZE rcvd: 28

[Mygale1978]

Ok,

On peut voir d'après le résultat qu'aucune réponse n'est renvoyée au client ayant une ip 192.168.1.X

En regardant de plus près ton fichier de configuration named.conf, On voit que ton service dns n'est en écoute que sur localhost. Donc les autres machines du réseau 192.168.1.X ne pourront pas interroger ton serveur dns.


Pourrais-tu donc adapter la ligne suivante de cette manière dans le fichier named.conf, redémarrer le service bind et refaire le même test dig à partir du client stp.

Remplacer

Code :

1
2
 
listen-on { 127.0.0.1; };

par

Code :

1
2
 
listen-on { 127.0.0.1; 192.168.1.50; };

[ghostrider95]

j'ai changé cette conf mais c'est toujours pareil

[Mygale1978]

Tu as bien redémarré le service bind après avoir effectué cette modification?

[ghostrider95]

Oui /etc/rc.d/namedb restart
j'ai meme rebooté

[Mygale1978]

Ok,

Quelle distribution utilises-tu?

Peux-tu fournir le résultat des commandes suivantes sur le serveur dns

En tant que root

Code :

1
2
 
netstat -anltup

Code :

1
2
 
named-checkconf

Code :

1
2
 
named-checkzone

Code :

1
2
 
iptables -L

[ghostrider95]

Aucune des commandes ci-dessus ne fonctionnent car je ne suis pas sur du Linux mais sur de l'UNIX ( FreeBSD 8.2-RELEASE-p3°

Veux-tu que je reposte ma config serveur?

[Mygale1978]

Il s'agit ici d'un forum linux, Tu as un forum dédié aux systèmes BSD.

http://www.developpez.net/forums/f87...emes/unix/bsd/

Sinon pour la commande netstat les options sont différentes

Code :

1
2
 
netstat -vautn

[ghostrider95]

Oui je sais mais le forum Unix n'est pas aussi mis à jour que celui de Linux..
Surtout que la configuration de Bind reste presque la même selon les système d'exploitation.
Voulez-vous que je reposte la configuration?
Savez -vous comment rajoutez les logs?

[Mygale1978]

Oui mais il peut y avoir des variantes sur certaines commandes et sur la localisation des fichiers logs et de fichier configuration.

Concernant le fichier serveurs si tu as juste modifié ce que je t'ai demandé, ça ne servira pas à grand chose.

Par contre si tu pouvais déjà fournir le résultat de la commande netstat avec les options spécifiques à freebsd.

Code :

1
2
 
netstat -vautn

[ghostrider95]

Voici avec un netstat - A:

dns# netstat -A
Active Internet connections
Tcpcb Proto Recv-Q Send-Q Local Address Foreign Address (state)
c2c29278 tcp4 0 52 dns.ssh 192.168.1.16.61495 ESTABLISHED
c2ae9b2c udp4 0 0 localhost.domain *.*
c2ae9a50 udp4 0 0 dns.domain *.*
Active UNIX domain sockets
Address Type Recv-Q Send-Q Inode Conn Refs Nextref Addr
c2aed560 stream 0 0 0 c2aed35c 0 0
c2aed35c stream 0 0 0 c2aed560 0 0
c2aedd70 stream 0 0 c2b9e000 0 0 0 /var/run/devd.pipe
c2aee000 dgram 0 0 0 c2aed8bc 0 c2aed4b4
c2aed408 dgram 0 0 0 c2aed810 0 0
c2aed4b4 dgram 0 0 0 c2aed8bc 0 0
c2aed764 dgram 0 0 c2bfa218 0 0 0 /var/named/var/run/log
c2aed810 dgram 0 0 c2bfa648 0 c2aed408 0 /var/run/log
c2aed8bc dgram 0 0 c2bfa754 0 c2aee000 0 /var/run/logpriv
c2aed968 dgram 0 0 c2bfa860 0 0 0 /var/run/log

[ghostrider95]

dns# netstat -na
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp6 0 0 ::1.953 *.* LISTEN
tcp4 0 0 127.0.0.1.953 *.* LISTEN
tcp4 0 0 127.0.0.1.53 *.* LISTEN
tcp4 0 0 192.168.1.50.53 *.* LISTEN
tcp4 0 0 127.0.0.1.953 127.0.0.1.59743 TIME_WAIT
tcp4 0 52 192.168.1.50.22 192.168.1.16.61775 ESTABLISHED
tcp4 0 0 127.0.0.1.25 *.* LISTEN
tcp4 0 0 *.22 *.* LISTEN
tcp6 0 0 *.22 *.* LISTEN
udp4 0 0 127.0.0.1.53 *.*
udp4 0 0 192.168.1.50.53 *.*
udp4 0 0 *.514 *.*
udp6 0 0 *.514 *.*
Active UNIX domain sockets
Address Type Recv-Q Send-Q Inode Conn Refs Nextref Addr
c2aef560 stream 0 0 0 c2aef4b4 0 0
c2aef4b4 stream 0 0 0 c2aef560 0 0
c2aefd70 stream 0 0 c2ad696c 0 0 0 /var/run/devd.pipe
c2aefb6c dgram 0 0 0 c2aef8bc 0 c2aef408
c2aef35c dgram 0 0 0 c2aef810 0 0
c2aef408 dgram 0 0 0 c2aef8bc 0 0
c2aef764 dgram 0 0 c2bfc000 0 0 0 /var/named/var/run/log
c2aef810 dgram 0 0 c2bfc10c 0 c2aef35c 0 /var/run/log
c2aef8bc dgram 0 0 c2bfc218 0 c2aefb6c 0 /var/run/logpriv
c2aef968 dgram 0 0 c2bfc324 0 0 0 /var/run/log

J'ai changé la configuration en suivant un tuto freebsd bind
je te le poste juste après

[ghostrider95]

Bonsoir,

J'ai réussi à trouvé une solution:
Mon serveur ping bien le nom de mon client
Mais l'inverse ne fonctionne pas