How-to: Backup DNS server with DirectAdmin

[rootbsd]

I just got done setting up a backup DNS server for a DirectAdmin customer and wanted to share with others as I think this is useful in many situations

Background

I was setting up a single DirectAdmin web hosting server for a customer. I wanted them to be able to use DirectAdmin for DNS control and automation but also have the redundancy of an off-site DNS server.

Method

I read the "What options do I have for setting up an external dns server" article in the knowledgebase (link) but wasn't happy with any of those options - to me it seems easier to make use of DNS zone transfers built into bind, since dns inherently is made to work on multiple servers. The cluster tool in DA would probably work well but I didn't see the value in setting up another DA server just for doing DNS.

So, my method is to:

• Authorize zone transfers on DA to external dns box
• configure external dns box as dns slave for all zones on DA
• When a new zone is added on DA, it must be added to named.conf on external dns
• when a zone is modified on DA, the change will automatically be pushed to external dns by use of DNS notifications from BIND on DA server
• external dns box is a small cheap VPS in another datacenter

How to set it up

For the sake of example, 192.168.1.1 is the IP of the DA server and 10.1.1.1 is the IP of the external dns server

Step 1: Configure named.conf on DA server

Modify your options section to look like this:

options {
        directory "/var/named";
        recursion no;
        allow-transfer {
                127.0.0.1;
                10.1.1.1;   // allow transfers to our external dns server
        };
        notify yes;
};

Remove all of the junk/useless zones from your named.conf file such as localhost, localdomain, 0.0.127, etc. I left the root hits zone ( zone "." ) and of course the real zones we have setup in DA

Confirm that your /etc/named.conf file is world-readable (mine was already 644).

Restart named


Step 2: Setup SSH key logins

We must setup ssh key-based logins between DA server and EXTDNS server

Select a user account on DA server, mine is user "admin"

• root user on DA server should be able to ssh to root user on EXTDNS server
• root user on EXTDNS server should be able to ssh to admin user on DA server

Of course, the keys should not require a passphrase since this will all be automated. Setting up the key-based login is out of the scope of this post but if you google for "ssh key login" you can find plenty of guides.

Confirm that you can ssh in both directions listed above without entering a password/passphrase


Step 3: Setup checker script on DA server

put the script check-namedconf.php in /root/bin directory

Run this command to seed the /etc/named.conf.time file:

echo 0 > /etc/named.conf.time

Step 4: Configure named.conf on EXTDNS server

Modify your options section to look like this:

options {
        directory "/var/named";
        recursion no;
        allow-transfer {
                127.0.0.1;
        };
};

Again remove the junk zones in /etc/named.conf that are unneeded

Make sure you have a "slaves" directory in your named root directory (my named root is /var/named) and that the "slaves" directory is writable by named (i.e. chown named /var/named/slaves)

Add this line to the bottom of your /etc/named.conf

include "/etc/named.zones.conf";

Restart named

Make sure rndc works, i.e. rndc status

Step 5: Add sync-zones.sh script on EXTDNS

Place the sync-zones.sh script in /root/bin on EXTDNS

Modify the script appropriately for your usernames/IPs

Chmod the script to 700

Test the script out - you should be able to run it and not see errors

Step 6: Test script from DA server

Now on the DA server you should be able to run this:

/usr/local/bin/php /root/bin/check-namedconf.php

this should initiate the sync-zones.sh script on EXTDNS server. If you run it again, nothing should happen because it sees your named.conf file hasn't been updated. You can make an edit to the comments in your /etc/named.conf file and then it should run again when you execute it. It only runs sync-zones.sh on EXTDNS when the local named.conf file has been modified

Step 7: add to cron

If you got past step 6 with no errors, then add this to root's cron on DA server to check named.conf every 5 minutes

*/5 * * * *     /usr/local/bin/php /root/bin/check-namedconf.php 1>/dev/null 2>&1

Note: When you modify a DNS zone in DA, it will take up to 1 minute until the change is seen on EXTDNS. This is because DA doesn't tell named to reload zones instantly, it happens through the system queue.

Note 2: In order for BIND on DA server to notify the EXTDNS server, the zone must have a NS record in it indicating that EXTDNS is a nameserver for that domain. example in a dns zone:

exampledomain.com.          NS   ns1.myhosting.com.
exampledomain.com.          NS   ns2.myhosting.com.

ns1.myhosting.com resolves to 192.168.1.1 (DA server)
ns2.myhosting.com resolves to 10.1.1.1 (EXTDNS server)




Let me know what you think. The scripts are in the attached zip file. Make sure you modify them with your usernames/IPs. Although most of what I do is FreeBSD in this example I am working with Linux systems. Your paths may be different.

 

[nobaloney]

Did you look at the Master2Slave DNS Replicator I've written about on these forums? It's an open source project and is available (beta version) here.

You've done a lot of work .

Jeff

 

[rootbsd]

Did you look at the Master2Slave DNS Replicator I've written about on these forums? It's an open source project and is available (beta version)

I did download and take a glance at it. I wasn't really clear on how it worked and since it was still marked as BETA I decided to put this together. It really didnt take very long. Just 2 scripts that I recycled out of other scripts I had.

 

[midas]

Ive been trying your script, but it seems it doenst copy the .db files which contains the dns records.

Is there a solution for this?

 

[rootbsd]

Ive been trying your script, but it seems it doenst copy the .db files which contains the dns records.

You are correct, it is not supposed to copy the .db files. the slave dns server is supposed to pull them from the master via AXFR. If yours isn't working you may need to check your log files for error messages, make sure you followed all of the steps and/or get someone with BIND experience to look at it.

 

[scsi]

You should not use root user you should use an unprivledged user.

 

[nobaloney]

You should not use root user you should use an unprivledged user.

What are you referring to; we don't use the root user.

Jeff

 

[nobaloney]

Ive been trying your script, but it seems it doenst copy the .db files which contains the dns records.

Check to make sure the table exists in your /var/www/html/namedftp directory.

If it doesn't, then uncomment the "cp" command at the bottom of the shell script running in the master.

If it does, then check for errors when running the script manually on your slave server, and look for errors. Also are you running the cron jobs on both servers?

Also check the file in your /var/named/slaves directory, and make sure the lines are all there.

If everything else checks out then run the program manually on your slave server while tailing the /var/log/messages log:

# tail -f /var/log/messages

so you'll see if there are any errors.

I had master2slave DNS Replicator written as a service to the open source community. We offer a commercial installation service starting at $25 per server, $50 minimum. The soonest we could do the work would be this coming Monday. Please send me an email (not a private message here) if you're interested; my email address is below, in my siglines.

Jeff

 

[madman1133]

Why us DA as NS1

So if in this configuration why would you still use the DA box as NS1? Would it not make sense to setup a second external DNS server as NS1? I'm asking because I really like this configuration and want to implement it but I was not planning on using the DA as NS at all. I guess my theory is that as I add additional DA servers into the pool it would be easier to manage two NS for the entire infrastructure.

I just want a easy way to scale the DA servers without having a bunch of DNS problems down the road. I think you process solve a lot of the worries that I had.

Anyway, I'm really interested in your thoughts. Thanks for posting all this great information!

 

[nobaloney]

So if in this configuration why would you still use the DA box as NS1?

Sorry, I don't see where I wrote that. You can use any names for nameservers you want.

Earthlink has these two nameservers (among others) for example:

scratchy.earthlink.net
itchy.earthlink.net

They are the authoritative nameservers for the earthlink.net domain.

You can even use your DirectAdmin based nameservers as hidden masters; we do that ourselves, using our master2slave DNS Replicator software.

Jeff

 

[rootbsd]

So if in this configuration why would you still use the DA box as NS1? Would it not make sense to setup a second external DNS server as NS1?

In this configuration the customer was only going to have 1 DA server and they just needed the redundancy of 1 separate DNS server.

I just want a easy way to scale the DA servers without having a bunch of DNS problems down the road. I think you process solve a lot of the worries that I had.

The scripts and procedure above that I posted are just for adding an external DNS server for a single DA server to use. It could be adapted to serve multiple DA servers. You should also look at DirectAdmin's DNS clustering feature.

 

[madman1133]

DNS Clustering

Yeah I see why you setup DNS the way that you did. In my environment we will have multiple DA servers running (more then two) and would like to have two stand alone DNS servers for the entire DA environment. I like the work that you have done and will give it a shot if I can't get the Master2Slave software working.

Thanks for the response!

Donny