10.7. Domain Name Servers (DNS)

The Domain Name Service (DNS) is a fundamental component of the Internet: it maps host names to IP addresses (and vice-versa), which allows the use of www.debian.org instead of 130.89.148.77 or 2001:67c:2564:a119::77.

Record-record DNS disusun dalam zona; setiap zona cocok dengan suatu domain (atau subdomain) atau suatu rentang alamat IP (karena alamat IP umumnya dialokasikan dalam rentang berturutan). Sebuah server adalah otoritatif atas isi suatu zona; server sekunder, sering diwadahi pada mesin terpisah, menyediakan salinan zona utama yang diperbarui secara teratur.

Setiap zona dapat berisi record dari berbagai jenis (Record Sumber Daya), ini adalah beberapa yang paling umum:

A (address record): IPv4 address. This is the most common form to point a domain to an IPv4 address.
CNAME (canonical name record): alias
MX (mail exchange): an email server. This information is used by other email servers to find where to send email addressed to a given address. Each MX record has a priority. The highest-priority server (with the lowest number) is tried first (see sidebar KEMBALI KE DASAR SMTP); other servers are contacted in order of decreasing priority if the first one does not reply.
PTR (pointer): mapping of an IP address to a name. Such a record is stored in a “reverse DNS” zone named after the IP address range. For example, 1.168.192.in-addr.arpa is the zone containing the reverse mapping for all addresses in the 192.168.1.0/24 range.
AAAA (IPv6 address record): IPv6 address.
NS (name server): maps a name to a name server. Each domain must have at least one NS record. These records point at a DNS server that can answer queries concerning this domain; they usually point at the primary and secondary servers for the domain. These records also allow DNS delegation; for instance, the falcot.com zone can include an NS record for internal.falcot.com, which means that the internal.falcot.com zone is handled by another server. Of course, this server must declare an internal.falcot.com zone.

10.7.1. Perangkat lunak DNS

The reference name server, Bind, was developed and is maintained by ISC (the Internet Software Consortium). It is provided in Debian by the bind9 package. Version 9 brings two major changes compared to previous versions. First, the DNS server can now run under an unprivileged user, so that a security vulnerability in the server does not grant root privileges to the attacker (as was seen repeatedly with versions 8.x).

Selain itu, Bind mendukung standar DNSSEC untuk penandatanganan (dan karena itu otentikasi) record DNS, yang memungkinkan memblokir setiap spoofing data ini selama serangan man-in-the-middle.

10.7.2. Mengkonfigurasi bind

Berkas konfigurasi untuk bind, terlepas dari versi, memiliki struktur yang sama.

Para administrator Falcot menciptakan sebuah zona utama falcot.com untuk menyimpan informasi yang terkait dengan domain ini, dan zona 168.192.in-addr.arpa untuk pemetaan balik alamat IP pada jaringan lokal.

Kutipan-kutipan konfigurasi berikut, diambil dari berkas Falcot, dapat berfungsi sebagai titik awal untuk mengkonfigurasi sebuah server DNS:

Contoh 10.12. Kutipan dari /etc/bind/named.conf.local

zone "falcot.com" {
        type master;
        file "/etc/bind/db.falcot.com";
        allow-query { any; };
        allow-transfer {
                195.20.105.149/32 ; // ns0.xname.org
                193.23.158.13/32 ; // ns1.xname.org
        };
};

zone "internal.falcot.com" {
        type master;
        file "/etc/bind/db.internal.falcot.com";
        allow-query { 192.168.0.0/16; };
};

zone "168.192.in-addr.arpa" {
        type master;
        file "/etc/bind/db.192.168";
        allow-query { 192.168.0.0/16; };
};

Contoh 10.13. Kutipan dari /etc/bind/db.falcot.com

; falcot.com Zone 
; admin.falcot.com. => zone contact: admin@falcot.com
$TTL    604800
@       IN      SOA     falcot.com. admin.falcot.com. (
                        20040121        ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
; The @ refers to the zone name ("falcot.com" here)
; or to $ORIGIN if that directive has been used
;
@       IN      NS      ns
@       IN      NS      ns0.xname.org.

internal IN      NS      192.168.0.2

@       IN      A       212.94.201.10
@       IN      MX      5 mail
@       IN      MX      10 mail2

ns      IN      A       212.94.201.10
mail    IN      A       212.94.201.10
mail2   IN      A       212.94.201.11
www     IN      A       212.94.201.11

dns     IN      CNAME   ns

Contoh 10.14. Kutipan dari /etc/bind/db.192.168

; Reverse zone for 192.168.0.0/16
; admin.falcot.com. => zone contact: admin@falcot.com
$TTL    604800
@       IN      SOA     ns.internal.falcot.com. admin.falcot.com. (
                        20040121        ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL

        IN      NS      ns.internal.falcot.com.

; 192.168.0.1 -> arrakis
1.0     IN      PTR     arrakis.internal.falcot.com.
; 192.168.0.2 -> neptune
2.0     IN      PTR     neptune.internal.falcot.com.

; 192.168.3.1 -> pau
1.3     IN      PTR     pau.internal.falcot.com.