Provoz DNS v prostředí univerzitní sítě

Abstract

This master's thesis focuses on the design and implementation of a modern Domain Name System (DNS) service in the test environment of a university computer network. The thesis addresses several key areas. The first of these is securing the responses of the authoritative DNS server using digital signatures of zone data, which guarantee their authenticity and protect against forgery. Furthermore, two recursive servers were deployed to act as intermediaries between user queries for domain names and the Internet. These servers are capable of blocking access to malicious or unwanted websites based on regularly updated lists. These lists are automatically shared between both servers, ensuring their consistency. Both servers also operate in high-availability mode, thereby minimizing the impact of outages on users. For both types of servers, regular backup of settings and the transmission of operational logs to the university’s central repository have been implemented. The final part of the work addresses the automatic acquisition of certificates, which are essential for ubiquitous encrypted communication. This solution is specifically designed for servers that are not directly accessible from the internet. The entire process is designed so that any potential theft of access credentials has the least possible impact on the security of the resulting system. All procedures used are documented in detail and are easily reproducible.