Subject: Re-configuring BIND DNS Servers for CentOS Web Panel Web Hosting Control Panel on Amazon AWS Cloud Author: Mr. Turritopsis Dohrnii Teo En Ming, Singapore Date: 27 Feb 2020 Thursday Rationale for Re-configuration of BIND DNS Servers for CentOS Web Panel ======================================================================= I have originally followed the approach for cPanel where there are 2 DNS-ONLY servers and one or more cPanel webservers. However, CentOS Web Panel implements DNS Clusters differently. Hence I have to re-configure BIND DNS Servers for CentOS Web Panel web hosting control panel. PREREQUISITES ============= Part 1 of the series: Mr. Teo En Ming's Guide to Deploying CentOS Web Panel (CWP) Web Hosting Control Panel on Amazon AWS Cloud Redundant Blogger and Wordpress blog links: [1] https://tdtemcerts.blogspot.com/2020/02/mr-teo-en-mings-guide-to-deploying.h... [2] https://tdtemcerts.wordpress.com/2020/02/23/mr-teo-en-mings-guide-to-deployi... Part 2 of the series: Setting Up Mail Server Operation for CentOS Web Panel Web Hosting Control Panel on Amazon AWS Cloud Redundant Blogger and Wordpress blog links: [1] https://tdtemcerts.blogspot.com/2020/02/setting-up-mail-server-operation-for... [2] https://tdtemcerts.wordpress.com/2020/02/25/setting-up-mail-server-operation... THIS guide is Part 3 of the series. EXTREMELY DETAILED INSTRUCTIONS OF TEO EN MING'S GUIDE ====================================================== Login to Amazon AWS Console. Setting Up Secondary/Slave DNS Server ===================================== On the EC2 Dashboard, click Instances. Click Launch Instance. Search for centos in the AWS Markpetplace. Select CentOS 7 (x86_64) - with Updates HVM (free tier eligible). Click Continue. Select t2.micro (free tier eligible). Click Next: Configure Instance Details. Network: Teo En Ming VPC Subnet: Public subnet | us-east-2a Click Protect against accidental termination. Click Next: Add Storage Size (GiB): 8 Click Next: Add Tags Key = Name Value = slave Click Next: Configure Security Group Click Select an existing security group Select NameServers Click Review and Launch. Click Launch. Select Choose an existing key pair. Key pair name: cwp Click Launch Instances. Click Instances. Select slave, right click and select Networking > Manage IP Addresses. Click Allocate an elastic IP to this instance. Click Allocate. Click Associate this Elastic IP Address. Instance: slave Click Associate. IPv4 address of Secondary/Slave DNS server is 3.12.224.179 $ ssh -i cwp.pem centos@3.12.224.179 $ sudo passwd $ su - # yum -y update && yum -y install wget # hostnamectl set-hostname ns2.teo-en-ming.com # cd /usr/local/src && wget http://centos-webpanel.com/cwp-el7-latest && sh cwp-el7-latest Started installing CentOS Web Panel at 9:00 PM on 26 Feb 2020 Wed. Completed installing CentOS Web Panel at 9:05 PM on 26 Feb 2020 Wed. Total duration: 5 mins. ############################# # CWP Installed # ############################# Go to CentOS WebPanel Admin GUI at http://SERVER_IP:2030/ http://3.12.224.179:2030 SSL: https://3.12.224.179:2031 --------------------- Username: root Password: ssh server root password MySQL root Password: ######################################################### CentOS Web Panel MailServer Installer ######################################################### SSL Cert name (hostname): ns2.teo-en-ming.com SSL Cert file location /etc/pki/tls/ private|certs ######################################################### Visit for help: www.centos-webpanel.com Write down login details and press ENTER for server reboot! Please reboot the server! Reboot command: shutdown -r now # reboot REFERENCE ========= Guide: Slave DNS Server & Manager - DNS Cluster Link: https://wiki.centos-webpanel.com/slave-dns-server-manager-dns-cluster REFERENCE ========= Guide: Slave DNS Server & Manager download version Link: https://wiki.centos-webpanel.com/slave-dns-server-manager-download-version Login to the CentOS Web Panel Admin Panel on the Slave.

From the left menu, click on CWP Settings, then select Edit Settings.

Admin Email: ceo@teo-en-ming-corp.com Check Activate NAT-ed network configuration. Click Save Changes. Create a New Account on the Secondary/Slave DNS Server ======================================================

From the left menu, click User Accounts, then click New Account.

Domain name: teo-en-ming.com Username: slave Package: default Click Create. Download Slave DNS Manager and upload it to public_html folder on the Secondary/Slave DNS Server ================================================================================================ ssh -i cwp.pem centos@3.12.224.179 su - cd /home/slave/public_html wget http://dl1.centos-webpanel.com/files/cwp/addons/cwp-slave_dns.zip unzip cwp-slave_dns.zip mv slave_dns/* . rm -f index.html Fix file permissions on the Slave DNS Server ============================================ chown -R slave.slave /home/slave/public_html/* MySQL: Create User and Database on the Slave DNS Server =======================================================

From the left menu, click SQL Services, then click MySQL Manager.

Click Create Database and User. New Database for user: slave Database Name: slave Click Create Database. Edit file /home/slave/public_html/inc/db_conn.php.sample and enter your database connection details # nano /home/slave/public_html/inc/db_conn.php.sample # mv inc/db_conn.php.sample inc/db_conn.php # mysql slave_slave < sql/slave_dns.sql # nano /etc/sudoers.d/slave slave ALL= NOPASSWD: /bin/systemctl start named slave ALL= NOPASSWD: /bin/systemctl stop named slave ALL= NOPASSWD: /bin/systemctl restart named slave ALL= NOPASSWD: /bin/systemctl reload named slave ALL= NOPASSWD: /bin/systemctl status named slave ALL= NOPASSWD: /bin/systemctl is-active named # touch /etc/named/slave.conf # chmod 771 /etc/named # usermod -a -G named slave # chown slave.named /etc/named/slave.conf # mkdir /var/named/slave # chown named.named /var/named/slave Edit File: /etc/named.conf and add this in options section before closing } masterfile-format text; Add after options{} where other include lines are specifed //Slave dns configuration include "/etc/named/slave.conf"; Now you can login to Slave DNS Manager GUI by using a domain link of the account you have created. Go to http://3.12.224.179/~slave/index.php?login Default login for Slave DNS Manager GUI admin/root Username: root Password: FX8QKxvQ * Please change the default password after the first login Adding WebServers to Slave DNS Manager ====================================== - On Slave DNS manager GUI create a new user for each server or use a single for all webservers if you plan to transfer accounts from one to another webserver. Click Add New User. Username: Password: Email: API Key: API Secret: Domain Limit: 1000000 Click Save. - On Master CentOS Web Panel WebServer go to DNS Functions -> Slave DNS Manager Buy CWPPro license first. It is only USD$1.49 compared to USD$20 for the license of cPanel. I can't afford to buy the license for cPanel, hence I have to settle for CentOS Web Panel. Then ssh into your Master CentOS Web Panel Webserver. # sh /scripts/update_cwp You have successfully upgraded to CWPpro. On the Master CentOS Web Panel, Go to DNS Functions -> Slave DNS Manager API Key: Secret Key: Base URL: http://3.12.224.179/~slave Master Server IP's: 3.21.30.127 Click Submit. Master CentOS Web Panel WebServer configuration =============================================== Edit File: /etc/named.conf and add this in options section before closing } //Slave dns configuration allow-transfer {3.12.224.179;}; allow-recursion {3.12.224.179;}; also-notify {3.12.224.179;}; masterfile-format text; # named-checkconf # systemctl restart named REFERENCE ========= Guide: How to setup DNS cluster on CWP 1 – Install DNS Manager Link: https://opentechy.com/how-to-setup-dns-cluster-on-cwp/ REFERENCE ========= Guide: How to setup DNS cluster on CWP 2 – Add webservers to DNS cluster Link: https://opentechy.com/how-to-setup-dns-cluster-on-cwp-2-add-webservers-to-dn... CONFIGURING CUSTOM NAME SERVERS AT YOUR DOMAIN REGISTRAR ======================================================== Go to Advanced Features > Hostnames Host: ns1 IP Addresses: 3.21.30.127 Host: ns2 IP Addresses: 3.12.224.179 Nameservers: Using custom nameservers ns1.teo-en-ming.com ns2.teo-en-ming.com CONFIGURING NAME SERVERS ON THE MASTER CENTOS WEB PANEL WEBSERVER ==================================================================

From the left menu, click DNS Functions, then click Edit Nameservers IPs.

Name Server 1: ns1.teo-en-ming.com 3.21.30.127 Name Server 2: ns2.teo-en-ming.com 3.12.224.179 Click Save changes. # systemctl restart named BIND DNS CONFIGURATION ON THE MASTER CENTOS WEB PANEL WEBSERVER =============================================================== File /etc/named.conf: // // named.conf // // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS // server as a caching only nameserver (as a any DNS resolver only). // // See /usr/share/doc/bind*/sample/ for example named configuration files. // // See the BIND Administrator's Reference Manual (ARM) for details about the // configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html options { listen-on port 53 { any; }; listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; recursing-file "/var/named/data/named.recursing"; secroots-file "/var/named/data/named.secroots"; allow-query { any; }; /* - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. - If you are building a RECURSIVE (caching) DNS server, you need to enable recursion. - If your recursive DNS server has a public IP address, you MUST enable access control to limit queries to your legitimate users. Failing to do so will cause your server to become part of large scale DNS amplification attacks. Implementing BCP38 within your network would greatly reduce such attack surface */ // recursion no; dnssec-enable yes; dnssec-validation yes; /* Path to ISC DLV key */ bindkeys-file "/etc/named.root.key"; managed-keys-directory "/var/named/dynamic"; pid-file "/run/named/named.pid"; session-keyfile "/run/named/session.key"; //Slave dns configuration allow-transfer {3.12.224.179;}; allow-recursion {3.12.224.179;}; also-notify {3.12.224.179;}; masterfile-format text; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "." IN { type hint; file "named.ca"; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key"; zone "ns1.teo-en-ming.com" {type master;file "/var/named/ns1.teo-en-ming.com.db";}; zone "ns2.teo-en-ming.com" {type master;file "/var/named/ns2.teo-en-ming.com.db";}; // zone teo-en-ming.com zone "teo-en-ming.com" {type master; file "/var/named/teo-en-ming.com.db";}; // zone_end teo-en-ming.com File /var/named/ns1.teo-en-ming.com.db: ; Panel %version% ; Zone file for ns1.teo-en-ming.com $TTL 14400 ns1.teo-en-ming.com. 86400 IN SOA ns1.teo-en-ming.com. info.centos-webpanel.com. ( 2013071600 ;serial, todays date+todays 86400 ;refresh, seconds 7200 ;retry, seconds 3600000 ;expire, seconds 86400 ;minimum, seconds ) ns1.teo-en-ming.com. 86400 IN NS ns1.teo-en-ming.com. ns1.teo-en-ming.com. 86400 IN NS ns2.teo-en-ming.com. ns1.teo-en-ming.com. 14400 IN A 3.21.30.127 File /var/named/ns2.teo-en-ming.com.db: ; Panel %version% ; Zone file for ns2.teo-en-ming.com $TTL 14400 ns2.teo-en-ming.com. 86400 IN SOA ns1.teo-en-ming.com. info.centos-webpanel.com. ( 2013071600 ;serial, todays date+todays 86400 ;refresh, seconds 7200 ;retry, seconds 3600000 ;expire, seconds 86400 ;minimum, seconds ) ns2.teo-en-ming.com. 86400 IN NS ns1.teo-en-ming.com. ns2.teo-en-ming.com. 86400 IN NS ns2.teo-en-ming.com. ns2.teo-en-ming.com. 14400 IN A 3.12.224.179 File /var/named/teo-en-ming.com.db: ; Generated by CWP ; Zone file for teo-en-ming.com $TTL 14400 @ 86400 IN SOA ns1.teo-en-ming.com. ceo.teo-en-ming-corp.com. ( 2020022453 ; serial, todays date+todays 3600 ; refresh, seconds 7200 ; retry, seconds 1209600 ; expire, seconds 86400 ) ; minimum, seconds @ 86400 IN NS ns1.teo-en-ming.com. @ 86400 IN NS ns2.teo-en-ming.com. @ IN A 3.21.30.127 localhost.teo-en-ming.com. IN A 127.0.0.1 @ IN MX 0 teo-en-ming.com. mail 14400 IN CNAME teo-en-ming.com. smtp 14400 IN CNAME teo-en-ming.com. pop 14400 IN CNAME teo-en-ming.com. pop3 14400 IN CNAME teo-en-ming.com. imap 14400 IN CNAME teo-en-ming.com. webmail 14400 IN A 3.21.30.127 cpanel 14400 IN A 3.21.30.127 cwp 14400 IN A 3.21.30.127 www 14400 IN CNAME teo-en-ming.com. ftp 14400 IN CNAME teo-en-ming.com. _dmarc 14400 IN TXT "v=DMARC1; p=none" @ 14400 IN TXT "v=spf1 +a +mx +ip4:3.21.30.127 ~all" ns1.teo-en-ming.com. 14400 IN A 3.21.30.127 ns2.teo-en-ming.com. 14400 IN A 3.12.224.179 default._domainkey 14400 IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEXk5wQIfKJPjTkkj0yHGX8yIJOOrsOsvAqbqVaEBFBWhRlF7YxyGzchaAdWEVQkozcsWPIL5DgJ7vWBoJIGqfNOT7vO/lStqNcXC+2hYVIF7MTB8i6tBW1/UDEuL8oammKWDq8P9Fpduk6JppV7rtKXeFzrYj35ydIhDIKUABcwIDAQAB" BIND DNS CONFIGURATION ON THE SLAVE DNS MANAGER =============================================== File /etc/named.conf: // // named.conf // // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS // server as a caching only nameserver (as a any DNS resolver only). // // See /usr/share/doc/bind*/sample/ for example named configuration files. // // See the BIND Administrator's Reference Manual (ARM) for details about the // configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html options { listen-on port 53 { any; }; listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; recursing-file "/var/named/data/named.recursing"; secroots-file "/var/named/data/named.secroots"; allow-query { any; }; /* - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. - If you are building a RECURSIVE (caching) DNS server, you need to enable recursion. - If your recursive DNS server has a public IP address, you MUST enable access control to limit queries to your legitimate users. Failing to do so will cause your server to become part of large scale DNS amplification attacks. Implementing BCP38 within your network would greatly reduce such attack surface */ recursion no; dnssec-enable yes; dnssec-validation yes; /* Path to ISC DLV key */ bindkeys-file "/etc/named.root.key"; managed-keys-directory "/var/named/dynamic"; pid-file "/run/named/named.pid"; session-keyfile "/run/named/session.key"; masterfile-format text; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "." IN { type hint; file "named.ca"; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key"; // zone teo-en-ming.com // zone "teo-en-ming.com" {type master; file "/var/named/teo-en-ming.com.db";}; // zone_end teo-en-ming.com //Slave dns configuration include "/etc/named/slave.conf"; File /var/named/teo-en-ming.com.db (WRONG, DON'T USE): ; Generated by CWP ; Zone file for teo-en-ming.com $TTL 14400 @ 86400 IN SOA ns1.centos-webpanel.com. ceo.teo-en-ming-corp.com. ( 2020022660 ; serial, todays date+todays 3600 ; refresh, seconds 7200 ; retry, seconds 1209600 ; expire, seconds 86400 ) ; minimum, seconds @ 86400 IN NS ns1.centos-webpanel.com. @ 86400 IN NS ns2.centos-webpanel.com. @ IN A 3.12.224.179 localhost.teo-en-ming.com. IN A 127.0.0.1 @ IN MX 0 teo-en-ming.com. mail 14400 IN CNAME teo-en-ming.com. smtp 14400 IN CNAME teo-en-ming.com. pop 14400 IN CNAME teo-en-ming.com. pop3 14400 IN CNAME teo-en-ming.com. imap 14400 IN CNAME teo-en-ming.com. webmail 14400 IN A 3.12.224.179 cpanel 14400 IN A 3.12.224.179 cwp 14400 IN A 3.12.224.179 www 14400 IN CNAME teo-en-ming.com. ftp 14400 IN CNAME teo-en-ming.com. _dmarc 14400 IN TXT "v=DMARC1; p=none" @ 14400 IN TXT "v=spf1 +a +mx +ip4:3.12.224.179 ~all" default._domainkey 14400 IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCktDYpEtFO7dyJeErMbjHvyfJYU8RqDeS7WVqQnjH4fP42JSqPmxEFX+QytFTlGqd6ndlz9Tjqi1iZsD0ajB/+0Pkwq/KtL6NVo2TIqnXj8VebV9+FEcx+FGvLA/b5zz+Hfn0Bf+w/2T2bSwUm+tJoHilmANCFGlcGmpO9/lXvAwIDAQAB" File /etc/named/slave.conf: zone "teo-en-ming.com" { type slave; file "slave/db.teo-en-ming.com"; masters { 3.21.30.127; };}; //username:enming That's all folks! -----BEGIN EMAIL SIGNATURE----- The Gospel for all Targeted Individuals (TIs): [The New York Times] Microwave Weapons Are Prime Suspect in Ills of U.S. Embassy Workers Link: https://www.nytimes.com/2018/09/01/science/sonic-attack-cuba-microwave.html ******************************************************************************************** Singaporean Mr. Turritopsis Dohrnii Teo En Ming's Academic Qualifications as at 14 Feb 2019 and refugee seeking attempts at the United Nations Refugee Agency Bangkok (21 Mar 2017), in Taiwan (5 Aug 2019) and Australia (25 Dec 2019 to 9 Jan 2020): [1] https://tdtemcerts.wordpress.com/ [2] https://tdtemcerts.blogspot.sg/ [3] https://www.scribd.com/user/270125049/Teo-En-Ming -----END EMAIL SIGNATURE-----