Table of Contents

1. Challenge

   Set up the chroot Jail for the BIND Service

   In CentOS all we need to do is run yum install bind-chroot -y, and then ensure that the normal BIND service isn't set to run:

   systemctl stop named
   systemctl disable named
   systemctl enable named-chroot
   

2. Challenge

   Add the Forward Zone Configuration to the /etc/named.conf File, Then Run the named-checkconf Command to Verify the Configuration

   # vim /etc/named.conf
   

   Insert the zone configuration just before the include statements at the bottom of the file:

   zone "mylabserver.com" {
      type master;
      file "/var/named/chroot-zone.db";
   };
   

   Then run the named-checkconf command to verify the configuration:

   # named-checkconf
   

3. Challenge

   Create the Forward Zone File and Check the Configuration for Syntax Errors with named-checkzone

   1. Create the forward zone file:

      vim /var/named/chroot-zone.db
      

   2. Enter the following:

      $TTL    86400
      @       IN      SOA     nameserver.mylabserver.com. root.mylabserver.com. (
                                10030         ; Serial
                                 3600         ; Refresh
                                 1800         ; Retry
                               604800         ; Expiry
                                86400         ; Minimum TTL
      )
      ; Name Server
      @        IN      NS       nameserver.mylabserver.com.
      ; A Record Definitions
      nameserver       IN      A       172.31.18.93
      mailprod         IN      A       172.31.18.30
      mailbackup       IN      A       172.31.18.72
      ; Canonical Name/Alias
      dns        IN    CNAME    nameserver.mylabserver.com.
      ; Mail Exchange Records
      @        IN    MX    10    mailprod.mylabserver.com.
      @        IN    MX    20    mailbackup.mylabserver.com.
      

   3. Save the document with :wq!.

   4. Run the named-checkzone command to check the zone file for syntax errors:

      named-checkzone mylabserver.com /var/named/chroot-zone.db
      

4. Challenge

   Change the File Permissions and the Group Owner for /var/named/fwd.mylabserver.com.db

   1. Change the file permissions for /var/named/chroot-zone.db:

      chmod 760 /var/named/chroot-zone.db
      

   2. Change the group owner of the file to named:

      chgrp named /var/named/chroot-zone.db
      

5. Challenge

   Start the Newly Configured named-chroot Service

   systemctl start named-chroot