Managing networking infrastructure services Red Hat Enterprise Linux 9 A guide to managing networking infrastructure services in Red Hat Enterprise Linux 9 Red Hat Customer Content Services

Commands:
dnf install bind bind-utils
dnf install bind-chroot
listen-on port 53 { 127.0.0.1; 192.0.2.1; }; listen-on-v6 port 53 { ::1; 2001:db8:1::1; };
allow-query { localhost; 192.0.2.0/24; 2001:db8:1::/64; };
allow-recursion { localhost; 192.0.2.0/24; 2001:db8:1::/64; };
forwarders { 198.51.100.1; 203.0.113.5; };
named-checkconf
firewall-cmd --permanent --add-service=dns firewall-cmd --reload
systemctl enable --now named
dig @ localhost www.example.org www.example.org. 86400 IN A 198.51.100.34 ;; Query time: 917 msec
dig @ localhost www.example.org www.example.org. 85332 IN A 198.51.100.34 ;; Query time: 1 msec
logging { category notify { zone_transfer_log; }; category xfer-in { zone_transfer_log; }; category xfer-out { zone_transfer_log; }; channel zone_transfer_log { file " /var/named/log/transfer.log " versions 10 size 50m ; print-time yes; print-category yes; print-severity yes; severity info; }; };
mkdir /var/named/log/ chown named:named /var/named/log/ chmod 700 /var/named/log/
named-checkconf
systemctl restart named
cat /var/named/log/transfer.log 06-Jul-2022 15:08:51.261 xfer-out: info: client @0x7fecbc0b0700 192.0.2.2#36121/key example-transfer-key (example.com): transfer of 'example.com/IN': AXFR started: TSIG example-transfer-key (serial 2022070603) 06-Jul-2022 15:08:51.261 xfer-out: info: client @0x7fecbc0b0700 192.0.2.2#36121/key example-transfer-key (example.com): transfer of 'example.com/IN': AXFR ended
acl internal-networks { 127.0.0.1; 192.0.2.0/24; 2001:db8:1::/64; }; acl dmz-networks { 198.51.100.0/24; 2001:db8:2::/64; };
allow-query { internal-networks; dmz-networks; }; allow-recursion { internal-networks; };
named-checkconf
systemctl reload named
dig +short @ 192.0.2.1 www.example.com
dig @ 192.0.2.1 www.example.com ;; WARNING: recursion requested but not available
name class type mname rname serial refresh retry expire minimum
@ IN SOA ns1.example.com. hostmaster.example.com. ( 2022070601 ; serial number 1d ; refresh period 3h ; retry period 3d ; expire time 3h ) ; minimum TTL
zone " example.com " { type master; file " example.com.zone "; allow-query { any; }; allow-transfer { none; }; };
named-checkconf
USDTTL 8h @ IN SOA ns1.example.com. hostmaster.example.com. ( 2022070601 ; serial number 1d ; refresh period 3h ; retry period 3d ; expire time 3h ) ; minimum TTL IN NS ns1.example.com. IN MX 10 mail.example.com. www IN A 192.0.2.30 www IN AAAA 2001:db8:1::30 ns1 IN A 192.0.2.1 ns1 IN AAAA 2001:db8:1::1 mail IN A 192.0.2.20 mail IN AAAA 2001:db8:1::20
chown root:named /var/named/ example.com.zone chmod 640 /var/named/ example.com.zone
named-checkzone example.com /var/named/example.com.zone zone example.com/IN : loaded serial 2022070601 OK
systemctl reload named
dig +short @ localhost AAAA www.example.com 2001:db8:1::30 dig +short @ localhost NS example.com ns1.example.com. dig +short @ localhost A ns1.example.com 192.0.2.1
zone " 2.0.192.in-addr.arpa " { type master; file " 2.0.192.in-addr.arpa.zone "; allow-query { any; }; allow-transfer { none; }; };
named-checkconf
USDTTL 8h @ IN SOA ns1.example.com. hostmaster.example.com. ( 2022070601 ; serial number 1d ; refresh period 3h ; retry period 3d ; expire time 3h ) ; minimum TTL IN NS ns1.example.com. 1 IN PTR ns1.example.com. 30 IN PTR www.example.com.
chown root:named /var/named/ 2.0.192.in-addr.arpa.zone chmod 640 /var/named/ 2.0.192.in-addr.arpa.zone
named-checkzone 2.0.192.in-addr.arpa /var/named/2.0.192.in-addr.arpa.zone zone 2.0.192.in-addr.arpa/IN : loaded serial 2022070601 OK
systemctl reload named
dig +short @ localhost -x 192.0.2.1 ns1.example.com. dig +short @ localhost -x 192.0.2.30 www.example.com.
options { directory " /var/named "; } zone " example.com " { file " example.com.zone "; };
named-checkzone example.com /var/named/example.com.zone zone example.com/IN : loaded serial 2022062802 OK
systemctl reload named
dig +short @ localhost A ns2.example.com 192.0.2.2
zone " example.com " { dnssec-policy default; };
systemctl reload named
dnssec-dsfromkey /var/named/K example.com.+013+61141 .key example.com. IN DS 61141 13 2 3E184188CF6D2521EDFDC3F07CFEE8D0195AACBD85E68BAE0620F638B4B1B027
grep DNSKEY /var/named/K example.com.+013+61141.key example.com. 3600 IN DNSKEY 257 3 13 sjzT3jNEp120aSO4mPEHHSkReHUf7AABNnT8hNRTzD5cKMQSjDJin2I3 5CaKVcWO1pm+HltxUEt+X9dfp8OZkg==
dig +dnssec +short @ localhost A www.example.com 192.0.2.30 A 13 3 28800 20220718081258 20220705120353 61141 example.com. e7Cfh6GuOBMAWsgsHSVTPh+JJSOI/Y6zctzIuqIU1JqEgOOAfL/Qz474 M0sgi54m1Kmnr2ANBKJN9uvOs5eXYw==
dig @ localhost example.com +dnssec ;; flags: qr rd ra ad ; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
tsig-keygen example-transfer-key | tee -a /etc/named.conf key " example-transfer-key " { algorithm hmac-sha256; secret " q7ANbnyliDMuvWgnKOxMLi313JGcTZB5ydMW5CyUGXQ= "; };
zone " example.com " { allow-transfer { key example-transfer-key; }; };
zone " example.com " { also-notify { 192.0.2.2; 2001:db8:1::2; }; };
named-checkconf
systemctl reload named
key " example-transfer-key " { algorithm hmac-sha256; secret " q7ANbnyliDMuvWgnKOxMLi313JGcTZB5ydMW5CyUGXQ= "; };
zone " example.com " { type slave; file " slaves/example.com.zone "; allow-query { any; }; allow-transfer { none; }; masters { 192.0.2.1 key example-transfer-key; 2001:db8:1::1 key example-transfer-key; }; };
named-checkconf
systemctl reload named
journalctl -u named Jul 06 15:08:51 ns2.example.com named[2024]: zone example.com/IN: Transfer started. Jul 06 15:08:51 ns2.example.com named[2024]: transfer of 'example.com/IN' from 192.0.2.1#53: connected using 192.0.2.2#45803 Jul 06 15:08:51 ns2.example.com named[2024]: zone example.com/IN: transferred serial 2022070101 Jul 06 15:08:51 ns2.example.com named[2024]: transfer of 'example.com/IN' from 192.0.2.1#53: Transfer status: success Jul 06 15:08:51 ns2.example.com named[2024]: transfer of 'example.com/IN' from 192.0.2.1#53: Transfer completed: 1 messages, 29 records, 2002 bytes, 0.003 secs (667333 bytes/sec)
ls -l /var/named/slaves/ total 4 -rw-r--r--. 1 named named 2736 Jul 6 15:08 example.com.zone
dig +short @ 192.0.2.2 AAAA www.example.com 2001:db8:1::30
options { response-policy { zone " rpz.local "; }; }
zone "rpz.local" { type master; file "rpz.local"; allow-query { localhost; 192.0.2.0/24; 2001:db8:1::/64; }; allow-transfer { none; }; };
named-checkconf
USDTTL 10m @ IN SOA ns1.example.com. hostmaster.example.com. ( 2022070601 ; serial number 1h ; refresh period 1m ; retry period 3d ; expire time 1m ) ; minimum TTL IN NS ns1.example.com. example.org IN CNAME . *.example.org IN CNAME . example.net IN CNAME rpz-drop. *.example.net IN CNAME rpz-drop.
named-checkzone rpz.local /var/named/rpz.local zone rpz.local/IN : loaded serial 2022070601 OK
systemctl reload named
dig @localhost www.example.org ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN , id: 30286
dig @localhost www.example.net ;; connection timed out; no servers could be reached
options { dnstap { all; }; # Configure filter dnstap-output file "/var/named/data/dnstap.bin" versions 2; }; end of options
Example: dnstap {auth response; client query; update;};
systemctl restart named.service
Example: sudoedit /etc/cron.daily/dnstap #!/bin/sh rndc dnstap -roll 3 mv /var/named/data/dnstap.bin.1 /var/log/named/dnstap/dnstap-USD(date -I).bin use dnstap-read to analyze saved logs sudo chmod a+x /etc/cron.daily/dnstap
Example: dnstap-read -p /var/named/data/dnstap.bin
dnf install unbound
interface: 127.0.0.1 interface: 192.0.2.1 interface: 2001:db8:1::1
access-control: 127.0.0.0/8 allow access-control: 192.0.2.0/24 allow access-control: 2001:db8:1::/64 allow
systemctl restart unbound-keygen
unbound-checkconf unbound-checkconf: no errors in /etc/unbound/unbound.conf
firewall-cmd --permanent --add-service=dns firewall-cmd --reload
systemctl enable --now unbound
dig @ localhost www.example.com www.example.com. 86400 IN A 198.51.100.34 ;; Query time: 330 msec
dig @ localhost www.example.com www.example.com. 85332 IN A 198.51.100.34 ;; Query time: 1 msec
nmcli connection modify Example_Connection ipv4.dns 192.0.2.1 nmcli connection modify Example_Connection ipv6.dns 2001:db8:1::1
dnf install radvd
interface enp1s0 { AdvSendAdvert on; AdvManagedFlag on; AdvOtherConfigFlag on; prefix 2001:db8:0:1::/64 { }; };
systemctl enable radvd
systemctl start radvd
radvdump
cp /usr/lib/systemd/system/dhcpd.service /etc/systemd/system/
ExecStart=/usr/sbin/dhcpd -f -cf /etc/dhcp/dhcpd.conf -user dhcpd -group dhcpd --no-pid USDDHCPDARGS enp0s1 enp7s0
systemctl daemon-reload
systemctl restart dhcpd.service
cp /usr/lib/systemd/system/dhcpd6.service /etc/systemd/system/
ExecStart=/usr/sbin/dhcpd -f -6 -cf /etc/dhcp/dhcpd6.conf -user dhcpd -group dhcpd --no-pid USDDHCPDARGS enp0s1 enp7s0
systemctl daemon-reload
systemctl restart dhcpd6.service
option domain-name "example.com"; default-lease-time 86400;
authoritative;
subnet 192.0.2.0 netmask 255.255.255.0 { range 192.0.2.20 192.0.2.100; option domain-name-servers 192.0.2.1; option routers 192.0.2.1; option broadcast-address 192.0.2.255; max-lease-time 172800; }
systemctl enable dhcpd
systemctl start dhcpd
option dhcp6.domain-search "example.com"; default-lease-time 86400;
authoritative;
subnet6 2001:db8:0:1::/64 { range6 2001:db8:0:1::20 2001:db8:0:1::100; option dhcp6.name-servers 2001:db8:0:1::1; max-lease-time 172800; }
systemctl enable dhcpd6
systemctl start dhcpd6
option domain-name "example.com"; default-lease-time 86400;
authoritative;
shared-network example { option domain-name-servers 192.0.2.1; subnet 192.0.2.0 netmask 255.255.255.0 { range 192.0.2.20 192.0.2.100; option routers 192.0.2.1; } subnet 198.51.100.0 netmask 255.255.255.0 { range 198.51.100.20 198.51.100.100; option routers 198.51.100.1; } }
subnet 203.0.113.0 netmask 255.255.255.0 { }
systemctl enable dhcpd
systemctl start dhcpd
option dhcp6.domain-search "example.com"; default-lease-time 86400;
authoritative;
shared-network example { option domain-name-servers 2001:db8:0:1::1:1 subnet6 2001:db8:0:1::1:0/120 { range6 2001:db8:0:1::1:20 2001:db8:0:1::1:100 } subnet6 2001:db8:0:1::2:0/120 { range6 2001:db8:0:1::2:20 2001:db8:0:1::2:100 } }
subnet6 2001:db8:0:1::50:0/120 { }
systemctl enable dhcpd6
systemctl start dhcpd6
host server.example.com { hardware ethernet 52:54:00:72:2f:6e; fixed-address 192.0.2.130; }
systemctl start dhcpd
host server.example.com { hardware ethernet 52:54:00:72:2f:6e; fixed-address6 2001:db8:0:1::200; }
systemctl start dhcpd6
group { option domain-name-servers 192.0.2.1; host server1.example.com { hardware ethernet 52:54:00:72:2f:6e; fixed-address 192.0.2.130; } host server2.example.com { hardware ethernet 52:54:00:1b:f3:cf; fixed-address 192.0.2.140; } }
systemctl start dhcpd
group { option dhcp6.domain-search "example.com"; host server1.example.com { hardware ethernet 52:54:00:72:2f:6e; fixed-address 2001:db8:0:1::200; } host server2.example.com { hardware ethernet 52:54:00:1b:f3:cf; fixed-address 2001:db8:0:1::ba3; } }
systemctl start dhcpd6
systemctl stop dhcpd
mv /var/lib/dhcpd/dhcpd.leases /var/lib/dhcpd/dhcpd.leases.corrupt
cp -p /var/lib/dhcpd/dhcpd.leases~ /var/lib/dhcpd/dhcpd.leases
systemctl start dhcpd
systemctl stop dhcpd6
mv /var/lib/dhcpd/dhcpd6.leases /var/lib/dhcpd/dhcpd6.leases.corrupt
cp -p /var/lib/dhcpd/dhcpd6.leases~ /var/lib/dhcpd/dhcpd6.leases
systemctl start dhcpd6
dnf install dhcp-relay
cp /lib/systemd/system/dhcrelay.service /etc/systemd/system/
ExecStart=/usr/sbin/dhcrelay -d --no-pid -i enp1s0 192.0.2.1
systemctl daemon-reload
systemctl enable dhcrelay.service
systemctl start dhcrelay.service
dnf install dhcp-relay
cp /lib/systemd/system/dhcrelay.service /etc/systemd/system/dhcrelay6.service
ExecStart=/usr/sbin/dhcrelay -d --no-pid -l enp1s0 -u enp7s0
systemctl daemon-reload
systemctl enable dhcrelay6.service
systemctl start dhcrelay6.service