Authoritarian DNS Server NSD + Shorewall - SME Networks

General index yeakateedzana: Computer Networks yeSMEs: Sumo

Ichi chinyorwa kuenderera kwe:

• Squid + PAM Kusimbiswa paCentOS 7.
• Yemunharaunda mushandisi uye boka manejimendi

Mhoro shamwari neshamwari!

Iboka racho Vanofarira akatenga iyo internet zita rezita desdelinux.fan kune wako Internet Services Provider kana ISP. Sechikamu chekutora uku, vakabvunza ISP yavo kuti iise zvese zvinyorwa zveDNS zvakafanira pamibvunzo inoenderana nezvedunhu ravo kugadziriswa kubva paInternet

Vakakumbirawo kuti zvinyorwa zveSRV zvisanganiswe maererano ne XMPP nekuti ivo vanoronga kuisa iyo pakarepo mameseji server inoenderana ne Prosody iyo ichabatana nemubatanidzwa uripo wemaseva eXMMP anoenderana paInternet.

• Chinangwa chikuru chechinyorwa chino ndechekuratidza maitiro atinogona kuratidza mufaira renzvimbo yeDNS marekodhi eSRV ane hukama neiyo XMPP inoenderana Instant Messaging service.
• Kuiswa kweiyo shore wall Iine imwechete network interface, inogona kushandira avo vanosarudza kuisa sevha seiyi kuti vatarise yakapihwa DNS Zone. Kana iyo server ichibatana neI Enterprise LAN mukuwedzera kune iyo Internet, marongero anodikanwa anofanirwa kuitwa ekushandisa maviri network maficha.

Base server

Tiri kuzoisa ine chiremera DNS server NSD pa Debian "Jessie". Iyi ndiyo midzi server ye "fan." Iwo makuru parameter eiseva ndeaya:

Zita: ns.fan IP kero: 172.16.10.30 midzi @ ns: ~ # hostname
ns

midzi @ ns: ~ # hostname --fqdn
ns.fan

midzi @ ns: ~ # ip addr show
1: chii: munhu 65536 qdisc noqueue state UNKNOWN group default link / loopback 00: 00: 00: 00: 00: 00 brd 00: 00: 00: 00: 00: 00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 :: 1/128 chiyero chekutambira chinoshanda_lft zvachose yakasarudzwa_lft nekusingaperi 2: eth0: munhu 1500 qdisc pfifo_fast state UP group default qlen 1000 link / ether 00: 0c: 29: dc: d7: 1b brd ff: ff: ff: ff: ff: ff inet 172.16.10.30/24 brd 172.16.10.255 scope global eth0 valid_lft zvachose kusarudzika_lft nekusingaperi inet6 fe80 :: 20c: 29ff: fedc: d71b / 64 chiyero chinongedzo chinoshanda_lft zvachose yakasarudzwa_lft zvachose

shore wall

Usati waenda nebasa kuWWW Village, zvakanaka kwazvo kuchengetedza sevha uye masevhisi ayo ainopa kuburikidza neFirewall ine simba - Router. Shorewall iri nyore kugadzirisa uye isarudzo yakachengeteka yekuchengetedza.

• Iyo chaiyo uye yakakwana kumisikidza yeFirewall ibasa revanoziva kana nyanzvi, izvo zvatisiri. Isu tinongopa gwara rekushomeka uye kushanda kwegadziriro.

Isu tinoisa shorewall package uye zvinyorwa zvayo.

midzi @ ns: ~ # aptitude show shorewall
Pasuru: shorewall Nyowani: ehe Mamiriro: haina kuiswa
Shanduro: 4.6.4.3-2

midzi @ ns: ~ # aptitude yekuisa shorewall shorewall-doc

Zvinyorwa

Iwe unowana akawandisa magwaro mumafaira:

• / usr / share / doc / shorewall
• / usr / share / doc / shorewall / mienzaniso
• / usr / share / doc / shorewall-doc / html

Isu tinogadzirira kune network network

midzi @ ns: ~ # cp / usr / share / doc / shorewall / mienzaniso / one-interface / interfaces \
/ nezvimwe / shorewall /

midzi @ ns: ~ # nano / etc / shorewall / interfaces
#ZONE INTERFACE OPTIONS net eth0 tcpflags, logmartians, nosmurfs, sourceroute = 0

Isu tinozivisa nzvimbo dzemoto

midzi @ ns: ~ # cp / usr / share / doc / shorewall / example / one-interface / zones \
/ nezvimwe / shorewall /

midzi @ ns: ~ # nano / etc / shorewall / zones
#ZONE TYPE OPTIONS IN OUT # OPTIONS OPTIONS fw firewall net ipv4

Default marongero ekuwana iyo firewall

midzi @ ns: ~ # cp / usr / share / doc / shorewall / example / one-interface / policy
/ nezvimwe / shorewall /

midzi @ ns: ~ # nano / etc / shorewall / policy
#SOURCE DEST POLICY LOG LEVEL LIMIT: BURST $ FW mambure BATSIRA
mambure ese DROP info
# MUTEMO UNOTEVERA UNOFANIRA KUVE WOKUPEDZISIRA zvese Ramba ruzivo

Mitemo yekuwana iyo firewall

midzi @ ns: ~ # cp / usr / share / doc / shorewall / example / one-interface / mitemo
/ nezvimwe / shorewall /

midzi @ ns: ~ # nano / etc / shorewall / rules
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER / MARK CON $ # PORT PORT (S) DEST LIMIT GROUP? CHIKAMU ZVESE? CHIKAMU CHAKASIMBISWA? CHIKAMU CHAKAITANANA? mapaketi mune zvisina kufanira mamiriro Asina kukodzera (DROP) mambure $ FW tcp # Kudonha Ping kubva kune "zvakaipa" mambure nzvimbo .. uye kudzivirira danda rako kubva pakuzara .. # Rasa Ping kubva kune "yakaipa" mambure zone. # Kudzivirira mafashama eiyo system log (/ var / log / syslog) Ping (DROP) mambure $ FW # Bvumidza mota dzese dzeICMP KUSVIRA kune firewall KUSVIRA kunzvimbo yemambure # Bvumira traffic dzese dzeICMP KUBVA kune firewall KUZIVA nzvimbo mambure. BATIRA $ FW mambure icmp

# Yako mitemo # Kuwana neSSH kubva kumakomputa maviri
SSH / BATIRA net: 172.16.10.1,172.16.10.10 $ FW tcp 22

# Rega traffic pazviteshi 53 / tcp uye 53 / udp
Bvuma net $ FW tcp 53
Bvuma net $ FW udp 53

Isu tinotarisa syntax yemafaira ekugadzirisa

midzi @ ns: ~ # shorewall cheki
Kuongorora ... Processing / etc / shorewall / params ... Processing /etc/shorewall/shorewall.conf ... Kuisa maModule ... Kutarisa / etc / shorewall / zones ... Kuongorora / etc / shorewall / interfaces .. Kusarudza Mauto muZones ... Kuwana MaFaira Ekuita ... Kutarisa / etc / shorewall / mutemo ... Kuwedzera Mitemo yeAnti-smurf Kutarisa TCP Mireza kusefa ... Kutarisa Kernel Nzira Yekupepeta ... Gamuchira Kunobva Gwara ... Kuongorora MAC Kuchenesa - Chikamu 1 ... Kuongorora / etc / shorewall / mitemo ... Kuongorora / etc / shorewall / conntrack ... Kuongorora MAC Kuchenesa - Chikamu 2 ... Kushandisa Mitemo .. .Kutarisa /usr/share/shorewall/action.Drop yeketani Kudonha ... Kutarisa / usr/share/shorewall/action.

midzi @ ns: ~ # nano / etc / default / shorewall
# kudzivirira kutanga nekumisikidza kuseta # isa zvinotevera zvinowoneka kune 1 kuitira kuti Shorewall itange
kutanga =1
------

midzi @ ns: ~ # sevhisi shorewall kutanga
midzi @ ns: ~ # service shorewall restart
midzi @ ns: ~ # sevhisi shorewall chinzvimbo
● shorewall.service - LSB: Gadzira iyo firewall panguva yebhutsu Yakatakurwa: yakatakura (/etc/init.d/shorewall) Inoshanda: inoshanda (yakabuda) kubvira Sun 2017-04-30 16:02:24 EDT; 31min apfuura Maitiro: 2707 ExecStop = / etc / init.d / shorewall stop (kodhi = yakabuda, chinzvimbo = 0 / KUSVIRA) Maitiro: 2777 ExecStart = / etc / init.d / shorewall start (kodhi = yakabuda, chinzvimbo = 0 / KUBUDIRIRA)

Icho chinodzidzisa kwazvo kuverenga zvakanyatsobuda kuburitswa kwemurairo iptables -L kunyanya zvine chekuita nemitemo yakasarudzika yeINPUT, YOKUTANGA, OUTPUT, uye neyainoramba - rega iyo Firewall yekudzivirira kubva pakurwiswa kwekunze. Zvirinani, inoenda kuInternet ine dziviriro shoma, handiti? 😉

midzi @ ns: ~ # iptables -L

N.S.D.

midzi @ ns: ~ # aptitude kuratidza nsd
Pasuru: nsd Nyowani: hongu Mamiriro: akaisirwa Akaiswa otomatiki: kwete
Shanduro: 4.1.0-3

midzi @ ns: ~ # kugona kuisa nsd
midzi @ ns: ~ # ls / usr / share / doc / nsd /
contrib changelog.

midzi @ ns: ~ # nano /etc/nsd/nsd.conf
# NSD yekumisikidza faira yeDebian. # Ona iyo nsd.conf (5) murume peji.
# Ona /usr/share/doc/nsd/examples/nsd.conf yemhinduro
# referensi yekumisikidza faira.
# Mutsara unotevera unosanganisira yekuwedzera mafaira ekugadzirisa kubva ku # /etc/nsd/nsd.conf.d dhairekitori. # YAMBIRO: Maitiro epasi rose haashande ... # sanganisira: "/etc/nsd/nsd.conf.d/*.conf" server: logfile: "/var/log/nsd.log" ip-address : 172.16.10.30 # teerera pane IPv4 kubatana ita-ip4: ehe # teerera pane IPv6 kubatana ita-ip6: hapana # chiteshi kupindura mibvunzo pa. default is 53. port: 53 username: nsd # In zones, iyo yekupa-xfr sarudzo ndeye # axfr yekuongorora nzvimbo: zita: fan zonefile: /etc/nsd/fan.zone zone: name: desdelinux.fan
    zonefile: /etc/nsd/desdelinux.fan.zone provide-xfr: 172.16.10.250 NOKEY zone: zita: 10.16.172
    zonefile: /etc/nsd/10.16.172.arpa.zone inopa-xfr: 172.16.10.250 NOKEY zone: name: swl.fan zonefile: /etc/nsd/swl.fan.zone zone: name: debian.fan zonefile: /etc/nsd/debian.fan.zone zone: name: centos.fan zonefile: /etc/nsd/centos.fan.zone zone: name: freebsd.fan zonefile: /etc/nsd/freebsd.fan.zone


midzi @ ns: ~ # nsd-checkconf /etc/nsd/nsd.conf
midzi @ ns: ~ #

Isu tinogadzira maZones mafaira

Nzvimbo Yemidzi «fan.»Yakagadziridzwa pazasi ndeye YOKUEDZA PEKUTI uye haifanire kutorwa semuenzaniso. Isu hatisi ma Administrator eReal Estate Zita Sevhisi. 😉

midzi @ ns: ~ # nano /etc/nsd/fan.zone
$ FUNGA. $ TTL 3H @ IN SOA ns.fan. mudzi.fan. (1; serial 1D; zorodza 1H; edza zvakare 1W; kupera 3H); shoma kana; Negative caching nguva yekurarama; @ IN NS ns.fan. @ MUNA 172.16.10.30; ns IN A 172.16.10.30

mudzi @ ns: ~# nano /etc/nsd/desdelinux.fan.zone
$ORIGIN desdelinux.fan. $TTL 3H @ IN SOA nhamba.desdelinux.fan. mudzi.desdelinux.fan. ( 1 ; serial 1D ; refresh 1H ; edzazve 1W ; expire 3H ); Minimum or ; Negative caching nguva yekurarama; @ IN NS ns.desdelinux.fan. @ IN MX 10 email.desdelinux.fan. @ IN TXT "v=spf1 a:mail.desdelinux.fan -all" ; ; Nyora kuti ugadzirise mibvunzo yekuchera desdelinux.fan @ IN A 172.16.10.10 ; ns IN A 172.16.10.30 tsamba IN CNAME   desdelinux.fan. chat IN CNAME   desdelinux.fan. www IN CNAME   desdelinux.fan. ; ; SRV zvinyorwa zvine chekuita neXMPP
_xmpp-server._tcp IN SRV 0 0 5269 desdelinux.fan.
_xmpp-client._tcp IN SRV 0 0 5222 desdelinux.fan.
_jabber._tcp IN SRV 0 0 5269 desdelinux.fan.

midzi @ ns: ~ # nano /etc/nsd/10.16.172.arpa.zone
$ CHIKAMU 10.16.172.in-addr.arpa.
$TTL 3H @ IN SOA nhamba.desdelinux.fan. mudzi.desdelinux.fan. ( 1 ; serial 1D ; refresh 1H ; edzazve 1W ; expire 3H ); Minimum or ; Negative caching nguva yekurarama; @ IN NS ns.desdelinux.fan. ; 30 IN PTR nhamba.desdelinux.fan. 10 IN PTR     desdelinux.fan.

mudzi @ ns:~# nsd-checkzone desdelinux.fan /etc/nsd/desdelinux.fan.zone
mapazi desdelinux.fani zvakanaka
midzi @ ns: ~ # nsd-checkzone 10.16.172.in-addr.arpa /etc/nsd/10.16.172.arpa.zone
nzvimbo 10.16.172.in-addr.arpa zvakanaka # PaDebian, iyo NSD inogumisa kumisikidza kwayo kugoneswa nekutadza
midzi @ ns: ~ # systemctl yekutanga nsd
midzi @ ns: ~ # systemctl chimiro nsd
● nsd.service - Zita Server Daemon Yakatakurwa: yakatakura (/lib/systemd/system/nsd.service; yakagoneswa) Inoshanda: inoshanda (inomhanya) kubvira Sun 2017-04-30 09:42:19 EDT; 21min apfuura Main PID: 1230 (nsd) CGroup: /system.slice/nsd.service ├─1230 / usr / sbin / nsd -d -c /etc/nsd/nsd.conf ├─1235 / usr / sbin / nsd - d -c /etc/nsd/nsd.conf -1249 / usr / sbin / nsd -d -c /etc/nsd/nsd.conf

Cheki kubva kune ns.fan server pachayo

mudzi @ ns:~# host desdelinux.fan
desdelinux.fan has address 172.16.10.10
desdelinux.fan mail inobatwa netsamba imwe.desdelinux.fan.

mudzi @ ns:~#hostmail.desdelinux.fan
paemail.desdelinux.fan iri zita rekuti desdelinux.fan.
desdelinux.fan has address 172.16.10.10
desdelinux.fan mail inobatwa netsamba imwe.desdelinux.fan.

mudzi @ ns:~#hostchat.desdelinux.fan
taura.desdelinux.fan iri zita rekuti desdelinux.fan.
desdelinux.fan has address 172.16.10.10
desdelinux.fan mail inobatwa netsamba imwe.desdelinux.fan.

mudzi@ns:~#host www.desdelinux.fan
www.desdelinux.fan iri zita rekuti desdelinux.fan.
desdelinux.fan has address 172.16.10.10
desdelinux.fan mail inobatwa netsamba imwe.desdelinux.fan.

mudzi @ ns:~# host ns.desdelinux.fan
ns.desdelinux.fan has address 172.16.10.30

midzi @ ns: ~ # inomiririra 172.16.10.30
30.10.16.172.in-addr.arpa domain name pointer ns.desdelinux.fan.

midzi @ ns: ~ # inomiririra 172.16.10.10
10.10.16.172.in-addr.arpa domain name pointer desdelinux.fan.

midzi @ ns: ~ # inomiririra ns.fan
ns.fan ine kero 172.16.10.30

Kugadziriswa kwezita kutarisa kubva paInternet

• Iyo yakajeka DNS mibvunzo haina kumbobvira yakawandisa, nekuti iko kushanda kweDomain Domain Kugadziriswa kunoenderana zvakanyanya padanho chairo rekushanda kwenetiweki.

Kuita DNS mibvunzo yandakabatana neyangu switch - chinja test, Laptop ine IP 172.16.10.250 uye gedhi 172.16.10.1, IP kero inoenderana nekwandinoshanda sysadmin.desdelinux.fan sekuzivikanwa kubva muzvinyorwa zvakapfuura.

sandra @ laptop: ~ $ sudo ip addr show
1: chii: munhu 16436 qdisc noqueue state UNKNOWN link / loopback 00: 00: 00: 00: 00: 00 brd 00: 00: 00: 00: 00: 00: 127.0.0.1 inet 8/6 scope host lo inet1 :: 128/2 scope host valid_lft zvachose unosarudza_lft nekusingaperi 0: eth1500: munhu 1000 qdisc pfifo_fast state UP qlen 00 link / ether 17: 42: 8: 85e: 54: 172.16.10.250 brd ff: ff: ff: ff: ff: ff inet 24/172.16.10.255 brd 0 global scope eth6 inet80 fe217: : 42: 8ff: fe8554e: 64/3 chiyero chinobatanidza chinoshanda_lft zvachose yakasarudzwa_lft zvachose 0: wlan1500: munhu 1000 qdisc noop mamiriro PASI qlen 00 chinongedzo / ether 1: 0d: e88: 09: 5: d4 brd ff: ff: ff: ff: ff: ff 0: pan1500: munhu 0 qdisc noop state PASI chinongedzo / ether de: 67b: 52: 69: XNUMX: ad brd ff: ff: ff: ff: ff: ff


sandra @ laptop: ~ $ sudo nzira -n
Kernel IP yekufambisa tafura yekuenda Gateway Genmask Mireza Metric Ref Use Iface 0.0.0.0 172.16.10.1 0.0.0.0 UG 0 0 0 eth0 172.16.10.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

sandra @ laptop: ~ $ katsi /etc/resolv.conf
nameservers 172.16.10.30

sandra@laptop:~$host desdelinux.fan
desdelinux.fan has address 172.16.10.10
desdelinux.fan mail inobatwa netsamba imwe.desdelinux.fan.

sandra @ laptop:~$hostmail.desdelinux.fan
paemail.desdelinux.fan iri zita rekuti desdelinux.fan.
desdelinux.fan has address 172.16.10.10
desdelinux.fan mail inobatwa netsamba imwe.desdelinux.fan.

sandra @ laptop:~$ host ns.desdelinux.fan
ns.desdelinux.fan has address 172.16.10.30

sandra @ laptop: ~ $ host 172.16.10.30
30.10.16.172.in-addr.arpa domain name pointer ns.desdelinux.fan.

sandra @ laptop: ~ $ host 172.16.10.10
10.10.16.172.in-addr.arpa domain name pointer desdelinux.fan.

sandra@laptop:~$ host -t SRV _xmpp-server._tcp.desdelinux.fan
_xmpp-server._tcp.desdelinux.fan has SRV record 0 0 5269 desdelinux.fan.

sandra @ laptop:~$ host -t SRV _xmpp-client._tcp.desdelinux.fan
_xmpp-client._tcp.desdelinux.fan has SRV record 0 0 5222 desdelinux.fan.

sandra @ laptop:~$ host -t SRV _jabber._tcp.desdelinux.fan
_jabber._tcp.desdelinux.fan has SRV record 0 0 5269 desdelinux.fan.

sandra @ laptop: ~ $ host -a fan.
Kuedza "fan" ;; - >> HEADER << - opcode: QUERY, chinzvimbo: NOERROR, id: 57542 ;; mireza: qr aa rd; MUBVUNZO: 1, MHINDURO: 3, SUNGANO: 0, ZVEKUWEDZERA: 1 ;; CHIKAMU CHEMUBVUNZO :; fan. IN ANY ;; MHINDURO CHIKAMU: fani. 10800 IN SOA ns.fan. mudzi.fan. 1 86400 3600 604800 10800 fan. 10800 IN NS ns.fan. fan. 10800 MUNA A 172.16.10.30 ;; CHIMWE CHIKAMU: ns.fan. 10800 IN A 172.16.10.30 Yakagamuchirwa 111 mabheti kubva pa172.16.10.30 # 53 mu 0 ms

• Isu nemaune tinogadza kero 172.16.10.250  PaLaptop, kutarisa ZVESE nenzira yeDNS AXFR query, sezvo maZones akagadzirirwa kubvumidza -asina chero password- iyi mhando yemubvunzo kubva kune iyo IP.

sandra@laptop:~$ dig desdelinux.fan axfr
; <<>> DiG 9.9.5-9+deb8u6-Debian <<>> desdelinux.fan axfr ;; sarudzo dzepasi rose: +cmd
desdelinux.fan. 10800 IN SOA nhamba.desdelinux.fan. mudzi.desdelinux.fan. 1 86400 3600 604800 10800
desdelinux.fan. 10800 IN NS nhamba.desdelinux.fan.
desdelinux.fan. 10800 IN MX 10 email.desdelinux.fan.
desdelinux.fan. 10800 IN TXT "v=spf1 a:mail.desdelinux.fani -zvose"
desdelinux.fan. 10800 IN A 172.16.10.10 _jabber._tcp.desdelinux.fan. 10800 IN SRV 0 0 5269 desdelinux.fan. _xmpp-client._tcp.desdelinux.fan. 10800 IN SRV 0 0 5222 desdelinux.fan. _xmpp-server._tcp.desdelinux.fan. 10800 IN SRV 0 0 5269 desdelinux.fan. chat.desdelinux.fan. 10800 IN CNAME   desdelinux.fan. email.desdelinux.fan. 10800 IN CNAME   desdelinux.fan. ns.desdelinux.fan. 10800 IN A 172.16.10.30 www.desdelinux.fan. 10800 IN CNAME   desdelinux.fan.
desdelinux.fan. 10800 IN SOA nhamba.desdelinux.fan. mudzi.desdelinux.fan. 1 86400 3600 604800 10800 ;; Nguva yekubvunza: 0 msec ;; SERVER: 172.16.10.30#53(172.16.10.30) ;; KANA: Sun Apr 30 10:37:10 EDT 2017 ;; XFR saizi: 13 zvinyorwa (mameseji 1, bytes 428)

sandra @ laptop: ~ $ dig 10.16.172.in-addr.arpa axfr
; <<>> DiG 9.9.5-9+deb8u6-Debian <<>> 10.16.172.in-addr.arpa axfr ;; sarudzo dzepasi rose: +cmd 10.16.172.in-addr.arpa. 10800 IN SOA nhamba.desdelinux.fan. mudzi.desdelinux.fan. 1 86400 3600 604800 10800 10.16.172.in-addr.arpa. 10800 IN NS nhamba.desdelinux.fan. 10.10.16.172.in-addr.arpa. 10800 IN PTR desdelinux.fan. 30.10.16.172.in-addr.arpa. 10800 IN PTR nhamba.desdelinux.fan. 10.16.172.in-addr.arpa. 10800 IN SOA nhamba.desdelinux.fan. mudzi.desdelinux.fan. 1 86400 3600 604800 10800 ;; Nguva yekubvunza: 0 msec ;; SERVER: 172.16.10.30#53(172.16.10.30) ;; KANA: Sun Apr 30 10:37:27 EDT 2017 ;; XFR saizi: 5 zvinyorwa (mameseji 1, bytes 193)

sandra @ laptop:~$ ping ns.desdelinux.fan
PING nhamba.desdelinux.fan (172.16.10.30) 56(84) bytes of data.

Iyo inodiwa DNS mibvunzo yakapindurwa nenzira kwayo. Isu tinoongorora zvakare kuti iyo Shorewall inoshanda nemazvo uye kuti haigamuchire ping kubva kumakomputa akabatana neInternet.

Resumen

• Isu takaona maitiro ekumisikidza nekumisikidza - neakakosha uye mashoma sarudzo - Anemvumo DNS server yakatarwa neNSD. Isu tinoona kuti syntax yemafaira ezoni yakafanana chaizvo neiyo YEMAHARA. PaInternet pane akanaka kwazvo uye akazara mabhuku pane NSD.
• Takasangana nechinangwa chekuratidzira kuziviswa kweRRV zvinyorwa zvine chekuita neXMPP.
• Isu tinobatsira mukumisikidza uye kushomeka kwekugadziriswa kweShorewall-based firewall.

Kunotevera kuendesa

Prosody IM uye vashandisi vemuno.