WEBVTT

00:00.023 --> 00:03.508
-In this video,
we get introduced to DNS in Linux

00:03.676 --> 00:05.529
for the absolute beginners.

00:05.770 --> 00:07.277
We will discuss the basic concepts

00:07.445 --> 00:12.547
and view some commands that will help us
explore DNS configuration on hosts,

00:12.715 --> 00:14.613
specifically Linux hosts.

00:14.949 --> 00:17.863
At the end of this section,
you will go through a practice test

00:18.031 --> 00:21.375
where you're given a set of challenges
related to DNS

00:21.543 --> 00:24.274
and are asked to solve them on a live,
practical,

00:24.442 --> 00:27.403
hands-on lab environment
right in your browser.

00:27.571 --> 00:28.953
We have two computers,

00:29.121 --> 00:31.918
A and B,
both part of the same network.

00:32.086 --> 00:34.157
They've been assigned
with IP addresses

00:34.325 --> 00:37.434
192.168.1.10 and 1.11.

00:37.657 --> 00:39.539
You're able to ping one computer
from the other

00:39.707 --> 00:42.160
using the other computer's IP address.

00:42.504 --> 00:45.442
You know that system B
has database services on them,

00:45.610 --> 00:49.149
so instead of having to remember
the IP address of system B,

00:49.317 --> 00:51.929
you decide to give it a name, DB.

00:52.214 --> 00:55.089
Going forward,
you would like to ping system B

00:55.264 --> 00:58.781
using the name DB
instead of its IP address.

00:58.968 --> 01:01.023
If you try to ping DB now,

01:01.191 --> 01:05.765
you would see that host A
is unaware of a host named DB.

01:06.097 --> 01:07.425
How do you fix that?

01:07.593 --> 01:09.866
Basically, you want to tell system A

01:10.034 --> 01:15.394
that system B at IP address 192.168.1.11
has a name DB.

01:15.589 --> 01:18.273
I want to tell system A
that when I say DB,

01:18.441 --> 01:21.901
I mean the IP 192.168.1.11.

01:22.069 --> 01:26.398
You can do that by adding an entry
into the /etc/hosts file on system A.

01:26.566 --> 01:27.566
Mention the IP address

01:27.695 --> 01:31.081
and the name you want
your host to see system B as.

01:31.292 --> 01:37.316
We told system A that the IP
at 192.168.1.11 is a host named DB.

01:37.484 --> 01:41.899
Pings to DB now get sent
to the correct IP and are successful.

01:42.192 --> 01:44.661
There is an important point
to note here.

01:44.829 --> 01:51.183
We told system A that the IP
at 192.168.1.11 is a host named DB.

01:51.421 --> 01:53.336
Host A takes that for granted.

01:53.554 --> 01:55.898
Whatever we put
in the /etc/hosts file

01:56.066 --> 01:58.958
is the source of truth for host A,

01:59.126 --> 02:00.735
but that may not be the truth.

02:00.903 --> 02:05.934
Host A does not check to make sure
if system B's actual name is DB.

02:06.231 --> 02:09.520
For instance,
running a hostname command on system B

02:09.688 --> 02:12.757
reveals that it is named host two,

02:13.175 --> 02:14.933
but host A doesn't care,

02:15.101 --> 02:17.599
it goes by what's in the host file.

02:18.968 --> 02:23.358
You can even fool system A
to believing that system B is Google.

02:23.515 --> 02:28.895
Just add an entry into the host file
with an IP mapping to www.google.com,

02:29.063 --> 02:32.679
then ping Google
and you will get a response from system B.

02:32.954 --> 02:35.555
We have two names pointing
to the same system,

02:35.723 --> 02:38.544
one as DB and another as Google.

02:38.712 --> 02:41.641
We can use either names
to reach system B.

02:42.680 --> 02:44.547
You can have as many names
as you want

02:44.715 --> 02:48.598
for as many servers as you want
in the /etc/hosts file.

02:49.144 --> 02:52.708
Every time we reference another host
by its name from host A

02:52.876 --> 02:54.844
through a ping command,
or SSH command,

02:55.012 --> 02:58.622
or through any of the applications
or tools within the system,

02:58.790 --> 03:04.114
it looks into its /etc/hosts file
to find out the IP address of that host.

03:04.282 --> 03:07.212
Translating hostname
to IP address this way

03:07.380 --> 03:09.941
is known as name resolution.

03:10.430 --> 03:12.798
Within a small network
of few systems,

03:12.966 --> 03:17.235
you can easily get away
with the entries in the /etc/hosts file.

03:17.403 --> 03:18.466
On each system,

03:18.634 --> 03:21.978
I specify which are the other systems
in the environment.

03:22.165 --> 03:24.961
That's how it was done in the past

03:26.051 --> 03:27.324
until the environment grew,

03:27.492 --> 03:30.106
and these files got filled
with too many entries,

03:30.274 --> 03:32.485
and managing these became too hard.

03:32.664 --> 03:35.008
If one of the servers' IP changed,

03:35.176 --> 03:38.418
you would need to modify the entries
in all of these hosts,

03:38.586 --> 03:43.867
and that's where we decided to move
all these entries into a single server

03:44.035 --> 03:45.848
who will manage it centrally.

03:46.016 --> 03:48.289
We call that our DNS server.

03:48.457 --> 03:51.637
Then we point all hosts
to look up that server

03:51.805 --> 03:53.594
if they need to resolve the hostname

03:53.762 --> 03:58.161
to an IP address
instead of its own /etc/hosts files.

03:58.329 --> 03:59.329
How do we do that?

03:59.497 --> 04:03.109
How do we point our host
to a DNS server?

04:03.433 --> 04:07.730
Our DNS server
has the IP 192.168.1.100.

04:07.898 --> 04:11.449
Every host has
a DNS resolution configuration file

04:11.617 --> 04:13.937
at /etc/resolv.conf.

04:14.144 --> 04:18.650
You add an entry into it
specifying the address of the DNS server.

04:18.849 --> 04:23.842
We say name server
and point it to 192.168.1.100,

04:24.028 --> 04:25.235
and that should be it.

04:25.473 --> 04:28.059
Once this is configured
on all of your hosts,

04:28.227 --> 04:31.024
every time a host comes up
across a hostname

04:31.192 --> 04:32.774
that it does not know about,

04:32.942 --> 04:35.452
it looks it up from the DNS server.

04:35.745 --> 04:38.503
If the IP of any of the host
was to change,

04:38.671 --> 04:40.319
simply update the DNS server

04:40.487 --> 04:44.760
and all hosts should resolve
the new IP address going forward.

04:45.057 --> 04:50.043
You no longer need any entries
in the /etc/hosts file in any of the hosts

04:50.344 --> 04:53.750
but that does not mean
you can't have entries in hosts file,

04:53.918 --> 04:55.130
you still can.

04:55.298 --> 04:56.465
For example,

04:56.633 --> 05:00.227
say you were to provision
a test server for your own needs.

05:00.485 --> 05:03.172
You don't think others would need
to resolve the server by its name,

05:03.340 --> 05:05.668
so it may not be added
to the DNS server.

05:05.836 --> 05:09.203
In that case,
you can add an entry into your host,

05:09.371 --> 05:10.739
/etc/hosts file,

05:10.907 --> 05:12.411
to resolve this server.

05:12.614 --> 05:13.926
You can now resolve the server,

05:14.094 --> 05:16.961
however, no other system
will be able to do that.

05:17.168 --> 05:20.090
A system is able to use
hostname to IP mapping

05:20.258 --> 05:22.262
from the /etc/hosts file locally,

05:22.430 --> 05:25.060
as well as from a remote DNS server.

05:25.337 --> 05:28.181
What if you have an entry
in both places,

05:28.349 --> 05:32.091
one in your /etc/hosts file
and another in DNS?

05:32.372 --> 05:37.060
I have an entry in my local file
set to 192.168.1.115

05:37.228 --> 05:39.314
and someone added an entry
for the same host

05:39.482 --> 05:43.503
to 192.168.1.116 on the DNS server.

05:43.747 --> 05:48.497
In that case, the host first looks
in the local /etc/hosts file

05:48.665 --> 05:50.400
and then looks at the name server.

05:50.568 --> 05:53.959
If it finds the entry
in the local /etc/hosts file,

05:54.127 --> 05:55.127
it uses that.

05:55.310 --> 05:58.906
If not, it looks for that host
in the DNS server.

05:59.277 --> 06:01.027
That order can be changed.

06:01.195 --> 06:06.859
The order is defined by an entry
in the file /etc/nsswitch.conf,

06:07.144 --> 06:08.929
the line with the host entry.

06:09.121 --> 06:13.627
As you can see, the order is first files,
and then followed by DNS.

06:13.810 --> 06:16.264
Files refers to /etc/hosts file

06:16.432 --> 06:18.963
and DNS refers to the DNS server.

06:19.131 --> 06:20.654
For every hostname,

06:20.822 --> 06:23.604
the host first looks
into the /etc/hosts file

06:23.772 --> 06:27.592
and if it cannot find it there,
it then looks at the DNS server.

06:27.850 --> 06:32.211
This order can be modified
by editing this entry in the file.

06:32.653 --> 06:33.945
As per this order,

06:34.113 --> 06:39.445
our host would resolve the test server
to 192.168.1.115.

06:39.715 --> 06:43.059
What if you try to ping a server
that is not in either list?

06:43.227 --> 06:46.945
For example,
I try and ping www.facebook.com.

06:47.113 --> 06:49.278
I don't have facebook.com
in my /etc/hosts file

06:49.446 --> 06:51.922
and I don't have it
in my DNS server either.

06:52.090 --> 06:53.968
In that case, it will fail.

06:54.136 --> 06:57.105
You can add another entry
into your resolv.conf file

06:57.273 --> 06:59.945
to point to a name server
that knows Facebook.

07:00.113 --> 07:02.511
For example, 8.8.8.8

07:02.679 --> 07:06.640
is a common well-known public name server
available on the internet

07:06.808 --> 07:10.863
hosted by Google that knows
about all websites on the internet.

07:11.207 --> 07:14.597
You can have multiple name servers
like this configured on your host,

07:14.765 --> 07:18.250
but then you will have to configure that
on all your hosts into your network.

07:18.458 --> 07:19.719
You already have a name server

07:19.887 --> 07:22.262
within your network
configured on all the hosts.

07:22.528 --> 07:25.747
In that case,
you can configure the DNS server itself

07:25.915 --> 07:27.978
to forward any unknown hostnames

07:28.146 --> 07:30.600
to the public name server
on the internet.

07:31.065 --> 07:34.916
You should now be able to ping
external sites such as facebook.com.

07:35.358 --> 07:38.116
Until now, we have been just trying
to read systems with their names

07:38.284 --> 07:40.866
like web, DB, NFS, et cetera,

07:41.034 --> 07:45.347
but we just tried to ping Facebook
www.facebook.com.

07:45.757 --> 07:48.858
What is this name
with a www and .com at the end?

07:48.976 --> 07:50.249
It's called a domain name

07:50.417 --> 07:52.464
and it is how IPs translate to names

07:52.632 --> 07:54.546
that we can remember
on the public internet

07:54.714 --> 07:56.526
just like how we did for our host.

07:57.139 --> 07:59.561
The reason they are
in this format separated by dots

07:59.729 --> 08:01.749
is to group like things together.

08:02.222 --> 08:05.269
The last portion of the domain name,
the .coms, the .nets,

08:05.437 --> 08:07.592
.edu, .org, et cetera,

08:07.760 --> 08:09.237
are the top-level domains

08:09.405 --> 08:11.147
that represent the intent of the website,

08:11.315 --> 08:13.894
.com for commercial
or general-purpose,

08:14.164 --> 08:15.390
.net for network,

08:15.558 --> 08:18.199
.edu for educational organizations,

08:18.414 --> 08:21.440
and .org for nonprofit organizations.

08:22.112 --> 08:23.715
Let's look at one in particular.

08:23.816 --> 08:27.035
In Google's case,
the dot is the root,

08:27.258 --> 08:28.523
that's where everything starts.

08:28.691 --> 08:31.160
.com is a top-level domain.

08:31.328 --> 08:34.266
Google is the domain name
assigned to Google

08:34.434 --> 08:37.477
and www is a subdomain.

08:37.645 --> 08:40.950
The subdomains help in further grouping
things together under Google.

08:41.118 --> 08:45.543
For example, Google's map service
is available at maps.google.com,

08:45.882 --> 08:47.508
so maps is a subdomain.

08:47.676 --> 08:51.519
Google's storage service is
available at drive.google.com.

08:51.780 --> 08:54.773
Mobile apps are available
at apps.google.com.

08:55.027 --> 08:58.793
Google's email service
are available at mail.google.com.

08:59.015 --> 09:02.727
You can further divide each of these
into as many subdomains

09:02.895 --> 09:04.137
based on your needs,

09:04.312 --> 09:07.281
so you'll begin to see
a tree structure forming.

09:08.758 --> 09:11.383
When you try to reach
any of these domain names,

09:11.551 --> 09:14.824
say apps.google.com
from within your organization,

09:15.132 --> 09:19.305
your request first hits
your organization's internal DNS server.

09:19.512 --> 09:22.020
It doesn't know
who apps or Google is,

09:22.188 --> 09:24.564
so it forwards
your request to the internet.

09:24.732 --> 09:28.810
On the internet, the IP address
of the server serving apps.google.com

09:28.978 --> 09:32.249
may be resolved with the help
of multiple DNS servers.

09:32.417 --> 09:34.323
A root DNS server looks at your request

09:34.491 --> 09:37.522
and points you
to a DNS server serving .coms.

09:37.721 --> 09:41.471
A .com DNS server looks at your request
and forwards you to Google,

09:41.639 --> 09:45.054
and Google's DNS server
provides you the IP of the server

09:45.222 --> 09:47.940
serving the apps applications.

09:48.315 --> 09:50.964
In order to speed up
all future results,

09:51.132 --> 09:53.272
your organization's DNS server

09:53.440 --> 09:57.106
may choose to cache this IP
for a period of time.

09:57.390 --> 10:00.196
Typically, few seconds
up to a few minutes.

10:00.575 --> 10:04.801
That way, it doesn't have to go
through the whole process again each time.

10:05.547 --> 10:07.583
That was out in the public.

10:07.751 --> 10:09.581
What about your organization?

10:09.749 --> 10:12.077
Your organization can have
a similar structure too.

10:12.245 --> 10:16.112
For example, your organization
could be called as mycompany.com

10:16.280 --> 10:18.726
and have multiple
sub-domains for each purpose.

10:18.894 --> 10:21.558
The www for external-facing website,

10:21.726 --> 10:25.491
mail.my company.com
for accessing your organization's mail,

10:25.659 --> 10:27.269
drive for accessing storage,

10:27.437 --> 10:30.421
pay.company.com
for accessing the payroll application,

10:30.589 --> 10:33.347
HR for accessing
HR application, et cetera.

10:33.542 --> 10:35.034
All of these are configured

10:35.202 --> 10:38.770
in your organization's
internal DNS server.

10:39.790 --> 10:41.258
The reason we discussed all of these

10:41.426 --> 10:45.720
is to understand another entry
in the /etc/resolv.conf.

10:45.888 --> 10:47.232
Remember, this is the file

10:47.400 --> 10:50.224
where we configure the DNS server
to be used for our host.

10:50.392 --> 10:53.634
With that, we were able to resolve
servers in your organization

10:53.802 --> 10:55.482
with just their names like web.

10:55.650 --> 10:57.798
We have now introduced
more standard domain names

10:57.966 --> 11:00.209
like web.mycompany.com

11:00.392 --> 11:02.814
or db.mycompany.com, et cetera.

11:03.271 --> 11:05.732
When you ping web,
you can no longer get a response.

11:05.900 --> 11:08.189
Of course, this is because
we are trying to ping web,

11:08.357 --> 11:12.303
but there is no record
by the name web on my DNS server.

11:12.486 --> 11:14.721
Instead, it is web.mycompany.com

11:14.889 --> 11:17.975
so you have to use
web.mycompany.com.

11:18.682 --> 11:20.666
I can understand
if someone outside of the company

11:20.834 --> 11:22.940
wants to access our web server,

11:23.130 --> 11:25.553
he would have to use
web.mycompany.com.

11:25.721 --> 11:28.127
Within our company, your own company,

11:28.268 --> 11:32.041
you want to simply address the webserver
by its first name, web,

11:32.209 --> 11:34.436
just like how you address
other members in your family

11:34.604 --> 11:36.041
simply by their first names,

11:36.271 --> 11:38.888
which is not the case
when someone outside your family

11:39.056 --> 11:41.467
addresses them
using their full names.

11:41.651 --> 11:47.401
What do you do to configure web
to resolve my web.mycompany.com?

11:47.869 --> 11:49.674
You want to say when I say web,

11:49.849 --> 11:52.186
I mean web.mycompany.com.

11:52.455 --> 11:55.447
For that,
you make an entry into your host

11:55.615 --> 11:58.970
/etc/resolv.conf file called search

11:59.387 --> 12:02.400
and specify the domain name
you want to append.

12:02.662 --> 12:04.505
Next time you try to ping web,

12:04.673 --> 12:08.212
you will see it actually
tries web.mycompany.com.

12:08.380 --> 12:11.802
Your host is intelligent enough
to exclude the search domain

12:11.970 --> 12:15.189
if you specified a domain
in your query like this.

12:15.357 --> 12:18.154
You may also provide
additional search domains like this.

12:18.322 --> 12:20.189
It would mean when I say web,

12:20.357 --> 12:25.650
I mean web.mycompany.com
or web.prod.mycompany.com.

12:26.084 --> 12:29.295
Your host will try searching
all of these domain name

12:29.479 --> 12:31.150
when you look for a hostname.

12:31.666 --> 12:34.166
Finally, a word about record types.

12:34.334 --> 12:37.489
How are the records
stored in the DNS server?

12:37.773 --> 12:40.266
We know that
it stores IP to hostnames.

12:40.434 --> 12:41.981
That's known as A records.

12:42.149 --> 12:46.588
Storing IPv6 to hostnames
is known as AAAA records.

12:46.834 --> 12:50.701
Mapping one name to another name
is called CNAME records.

12:50.962 --> 12:54.315
For example, you may have multiple aliases
for the same application.

12:54.483 --> 12:56.334
Like a food delivery service

12:56.502 --> 12:59.377
may also be reached at eat or hungry.

12:59.616 --> 13:01.951
That's where a CNAME record is used,

13:02.119 --> 13:03.500
name to name mapping.

13:04.159 --> 13:05.159
There are many more,

13:05.178 --> 13:07.139
but that's all we're going
to look at for now.

13:08.186 --> 13:12.842
Ping may not always be the right tool
to test DNS resolution.

13:13.010 --> 13:16.034
There are a few other tools as well,
such as nslookup.

13:16.202 --> 13:20.734
You can use nslookup to query
a hostname from a DNS server.

13:21.074 --> 13:26.808
Remember, nslookup does not consider
the entries in the local /etc/hosts file.

13:27.022 --> 13:29.765
If you add an entry
into the local /etc/hosts file

13:29.933 --> 13:31.211
for your web application,

13:31.379 --> 13:34.735
and if you try to do an nslookup
for that web application,

13:35.004 --> 13:36.543
it is not going to find it.

13:37.109 --> 13:40.172
The entry for your web application
has to be present

13:40.363 --> 13:41.660
in your DNS server.

13:41.828 --> 13:45.437
nslookup only queries the DNS server.

13:46.093 --> 13:47.624
The same goes with dig.

13:47.956 --> 13:51.410
Dig is another useful tool
to test DNS name resolution.

13:51.578 --> 13:54.289
It returns more details
in a similar form

13:54.542 --> 13:56.253
as is stored on the server.

13:56.421 --> 13:58.679
In the upcoming
practice exercises section,

13:58.847 --> 14:02.261
you will practice viewing,
configuring, and troubleshooting DNS

14:02.429 --> 14:05.062
in a lab environment
on actual systems

14:05.230 --> 14:07.904
through some fun
and challenging exercises.

14:08.603 --> 14:09.799
That's it for this lecture.

14:09.967 --> 14:11.029
In the next lecture,

14:11.197 --> 14:14.123
we look at how to set up
an actual DNS server

14:14.291 --> 14:18.309
on a system where we will use
core DNS as our DNS solution.

14:19.141 --> 14:20.516
Thank you so much for watching

14:20.789 --> 14:24.022
and don't forget to subscribe
to my channel for more videos like this.