Super Sparrow: Configuration: Dents on the POP X Router

Configuration: Dents on the POP X Router

Network Diagram
System Preparation: Disabling named
Building the Configuration File
Starting Dents and Debugging
Running Dents on System Boot
Configuration Files
Notes on Commands

Network Diagram

System Preparation: Disabling `named`

Dents is a DNS daemon that will listen on TCP/IP and UDP/IP port 53 for clients. Dents cannot run on a system if another DNS daemon is listening on these ports. In particular it is important that ISC BIND, usually installed as named is not running.

If named has been installed from an RPM it can be shutdown using its init script:

$ /etc/rc.d/init.d/named stop   
Shutting down named:                         [  OK  ]

Otherwise, it may be killed using killall:

$ killall named

If named was installed as an RPM it can be prevented from starting on system boot using chkconfig:

$ /sbin/chkconfig --del named
$ /sbin/chkconfig --list named
named           0:off   1:off   2:off   3:off   4:off   5:off   6:off

Otherwise you should edit the init scripts in /etc/rc.d/ manually to ensure that named is not started.

Building the Configuration File

Dents allows for one of three different configuration file formats to be used: named.boot, named.conf and dents.xml. To configure Dents to use mod_supersparrow the dents.xml format should be used. The /etc/dents.xml configuration used for the POP X router is annotated below:

Set the XML version and register the name space for all the modules that will be used:

<?xml version="1.0"?>

<dents 
  xmlns:mod_recursive="http://www.dents.org/mod_recursive/0.4" 
  xmlns:mod_stddb="http://www.dents.org/mod_stddb/0.4" 
  xmlns:mod_supersparrow="http://www.dents.org/mod_supersparrow/0.1">

Set some global options: The directory that zone files are located in. The port to listen on. The IP address to bind to. And the directory to look for modules in.

  <options recursion="yes" multiple-cnames="no">
    <directory>/var/named</directory>
    <listen-on port="53">
      <address-list>
        <ip name="any"/>
      </address-list>
    </listen-on>
    <module-dir>/usr/lib/dents</module-dir>
  </options>

Begin defining zones:

  <zones>

Zone to enable resolution of 127.0.0.1. Dents needs to be able to resolve this address so it can answer queries sent to the loopback interface.

    <zone name="0.0.127.in-addr.arpa." class="IN" module="mod_stddb">
      <mod_stddb:option type="master" file="named.local"/>
    </zone>

Zone to enable resolution of 192.168.192.13, the IP address this router has on its ethernet interface. Dents needs to be able to resolve this address so it can answer queries sent to this interface.

    <zone name="192.168.192.in-addr.arpa." class="IN" module="mod_stddb">
      <mod_stddb:option type="master" file="192.168.192.db"/>
    </zone>

The zone handled by mod_supersparrow. The options peer, debug, rotue_server, host, password, self and verbose are as per the description for the sample invocation of the supersparrow standalone application. The ttl sets the the time to live for DNS replies. The default is 86400. cache_timeout sets the time in seconds that an object in the result cache is considered valid. This value should be less than the ttl. The cache_size sets the maximum number of objects that will be stored in the result cache. With the exception of ttl options are provided by libsupersparrow. A full list of libsupersparrow cam be found by running supersparrow --help.

    <zone name="test.supersparrow." class="IN" module="mod_supersparrow">
       <mod_supersparrow:option 
         cache_timeout="10"
         cache_size="16"
         peer="64751=192.168.192.13,64750=192.168.193.11"
         debug="yes"
         host="localhost"
         password="frub"
         route_server="zebra"
         self="192.168.192.13"
         ttl="20"
         verbose="yes"
       />
    </zone>

Zone to enable resolution of recursive queries:

    <zone name="." class="IN" module="mod_recursive">
      <mod_recursive:option file="named.ca"/>
    </zone>

End of zones section and the end of the configuration file:

  </zones>
</dents>

As this file contains potentially sensitive information you should make sure that only the super user can access it.

$ chmod 600 /etc/dents.xml

Starting Dents and Debugging

When starting dents for the first time it is best to instruct Dents not to detach from the terminal. This is done using the -n option. "-c /etc/dents.xml" instructs dents to use /etc/dents.xml as the configuration file.

$ dents -n -c /etc/dents.xml
dents[26351]: dents v0.4.0pre1.ss.2
directory /var/named
listen-on
dents_mod_supersparrow[26351]: mod_supersparrow_init version 0.0.0
Copyright Horms

dents_mod_supersparrow[26351]: cache_timeout=10, cache_size=16, debug=1,
host="localhost", peer="64751=192.168.192.13,64750=192.168.193.11",
port="2605", password="frub", no_lookup=0, route_server="zebra",
result_count=3, self==192.168.192.13, timeout=60, verbose=1 

Hello, this is zebra (version 0.90.pre.horms.1)
Copyright 1996-2000 Kunihiro Ishiguro


User Access Verification

������"��Password: 

GLib-CRITICAL **: file gmain.c: line 500 (g_source_remove): assertion `tag
> 0' failed.

The output shows that mod_supersparrow was initialised and shows all the the options available options to this module, and their values. It also shows that the module was able to access the GNU Zebra route server and there are no authentication errors. Please see the notes on mod_supersparrow and supersparrow logging to ensure that messages are lobed to syslog correctly. You can ignore the Glob-CRITICAL as it shouldn't effect dents operation.

By sending a DNS query to Dents for a host in the fictitious test.supersparrow domain that is handled by mod_supersparrow the configuration can be tested.

$ nslookup www.test.supersparrow 127.0.0.1
Server:  localhost
Address:  127.0.0.1

Name:    www.test.supersparrow
Address:  192.168.192.13

In the terminal that dents is connected to, as it was run with the -n option, output should be displayed showing that mod_supersparrow queried the route server.

jasmine> sh ip bgp  127.0.0.1
BGP routing table entry for 0.0.0.0/0
Paths: (1 available, best #1, table Default-IP-Routing-Table)
  64600
    192.168.192.10 from 192.168.192.12 (192.168.192.12)
      Origin IGP, metric 1, localpref 100, valid, external, best
      Last update: Sun Oct  8 16:08:20 2000

jasmine> 
PEERS: 64751=192.168.192.13 64750=192.168.193.11
ASPATH: 64600

This shows that the source address for the query was 127.0.0.1. This is because nslookup connected directly to dents on the loopback interface to make a query to the server 127.0.0.1. One prefix was found for this address, with an AS path of 64600. This is not the AS number of any of the configured peers so the IP address specified by the self option, 192.168.192.13, is used. This is returned to the client.

By using the host command the time to live of the result can be verified to be 20 seconds, as set by the ttl option for the zone in /etc/dents.xml

$ host -v -t A www.test.supersparrow 127.0.0.1 
Using domain server 127.0.0.1:
Trying null domain
rcode = 0 (Success), ancount=1
The following answer is not verified as authentic by the server:
www.test.supersparrow   20 IN   A       192.168.192.13

The 20 on the last line indicates that the time to live for the record is 20 seconds. Observe that if multiple requests are sent to dents for this record from the same host the result is and as a result output from the route server does not appear in the terminal that Dents is attached to every time a DNS query is made.

Once testing has finished kill the Dents process by typing control-C in the terminal that it is running in.

Running Dents on System Boot

If Dents has been installed from an RPM then configuring Dents to use a dents.xml format configuration file is done by editing /etc/sysconfig/dents such that DENTS_CONFIG is set to /etc/dents.xml. An example follows:

# Specify the path for the dents configuration file
#
# Samples for each configuration file format are
# supplied with dents and the RPM should install
# these in /usr/doc/dents-/
#
# You should copy one of these sample files into /etc/,
# edit it to match your setup and uncomment the
# corresponding line below.

#DENTS_CONFIG="/etc/named.boot"       # named.boot format
#DENTS_CONFIG="/etc/named.conf"       # named.conf format
DENTS_CONFIG="/etc/dents.xml"        # dents.xml  format

If an RPM was used to install Dents it may be started in the background using its init script:

$ /etc/rc.d/init.d/dents start
Starting dents:                            [  OK  ]

Otherwise, Dents may be started manually:

/usr/sbin/dents -c /etc/dents.xml

To ensure that Dents is started on system boot init needs to run Dents. If Dents was installed from an RPM this should be configured automatically. To verify this use chkconfig:

$ /sbin/chkconfig --list dents
dents           0:off   1:off   2:off   3:on    4:on    5:on    6:off

If Dents is not listed as being on for run-levels 3, 4 and 5 then run the following command. The output from the previous command should then indicate that dents will run at these run-levels:

$ /sbin/chkconfig --level 345 dents on
$ /sbin/chkconfig --level 0126 dents off

If dents was not installed from an RPM, then adding the following to /etc/rd.d/rc.local should start the daemon on system boot. The paths should be changed to match the installation.

if [ -x /usr/sbin/dents -a -e /etc/dents.xml ]; then
  echo Starting Dents
  /usr/sbin/dents -c /etc/dents.xml
fi

Configuration Files

For reference the resulting configuration files for the Dents are available.

POP X Router: /etc/dents.xml, /var/named/192.168.192.db, /var/named/named.ca, /var/named/named.local.

A complete set of configuration files for this network setup can be found here.

Notes on Commands

Commands shown in paragraphs of preformated text are prefixed by the shell prompt $ to avoid confusion between commands and their output. An instruction to run the command echo flim is formated as:

$ echo flim
flim