Inkonzo yesikhombisi ne-LDAP [2]: NTP kunye nednsmasq

Molweni zihlobo! Siqale ukuphumeza kunye nokuqwalasela iinkonzo. Ewe kuyimfuneko ukuba elula Inkonzo yoLawulo esekwe VulaLDAPUkuba neenkonzo ezisisiseko ukuze zisebenze ngokufanelekileyo. Phakathi kwabo sineenkonzo DNS okanye «Dindawo Numama System", DHCP okanye » Damandla Hbucala ngasekhohlo Cukulungiswa Pinkqubo«, Kwaye ukuya NTP okanye «NEnkqubo Tukuba lisetyenziswe Pinkqubo«.

Inkqubo yokusebenza esisiseko esiza kuyisebenzisa yile 6 "Cudisa" kwiDebian. Uninzi lweendlela ezichaziweyo zinokusetyenziselwa Ubuntu 12.04 "echanekileyo", nakwifayile ye- I-Debian 7 "Wheezy".

Nangona kubonakala kuyinto encinci - eneneni amanqaku ethu enza ixesha elide-iinkcazo, kunye nokufundwa kwazo ngabafundi kubalulekile. Unakho kwaye abanye abazifundanga kwaye baye ngqo "kwinkukhu kunye nerayisi enenkukhu." Impazamo enkulu. Kwaye andibhekiseli kwabo banamava, kuba, ngokukhawuleza xa bebona isihloko bayazi ukuba banomdla okanye akunjalo.

Sibhekisa kwabo baqala kubunkokheli beeNethiwekhi zeShishini. Siyabacela ukuba bafunde iinkcazo kwaye balandele amakhonkco, bangene kumacandelo omxholo anganyanzelekanga ukuba ayalele imigca okanye ikhowudi, emva koko balandele lonke inqaku.

Ngale ndlela siza konga ixesha elininzi, bobabini kunye nathi, ekubuzeni nasekuphenduleni imibuzo eneempendulo ezichanekileyo kwezi nkcazo kunye nakwintshayelelo. 🙂

Sifuna kwakhona kwangoko, ukuba olona lwimi lusisiseko kwaye lubaluleke kakhulu kumlawuli wenethiwekhi okanye kwisazinzulu sekhompyuter, luLwimi lwesiNgesi. :-). Asinakusoloko sinika iinguqulelo, njengoko singezizo iingcali kulwimi lwesiNgesi.

Ewe kunjalo, ngaphambi kokuqhubeka, Sicebisa kakhulu ukuba ufunde Intshayelelo kolu ngcelele lwamanqaku.

Iinkcazo ziyafuneka

Ithathwe kwiWikipedia:

dnsmasq. I-DNS elula, i-TFTP kunye ne-DHCP iseva. Injongo yayo kukubonelela ngeenkonzo ze-DNS kunye ne-DHCP kwinethiwekhi yendawo. Kukumiliselwa simahla komgaqo olandelwayo we-DNS ofumana izicelo kubaxumi abacela idilesi ye-IP esekwe kwigama lomatshini. Umncedisi uya kuphendula kwezi zicelo ngokubonelela nge-IP.

DNS Domain Name System (o DNS, ngesiSpanish, inkqubo yegama lesizinda). Yinkqubo yokuhlelwa kwamagama ngokulandelelana kweekhompyuter, iinkonzo okanye nasiphi na isibonelelo esidityaniswe kwi-intanethi okanye kwinethiwekhi yabucala. Le nkqubo inxibelelanisa ulwazi olwahlukeneyo namagama esizinda abelwe ngamnye wabathathi-nxaxheba. Owona msebenzi ubalulekileyo kukuguqulela (ukusombulula) amagama aqondwa ngabantu afakwe kwizichazi ezibini ezinxulunyaniswa neekhompyuter ezixhume kwinethiwekhi, ukuze ukwazi ukufumana nokujongana nezi khompyuter kwihlabathi liphela.

DHCP (isifinyezo se Damandla Hbucala ngasekhohlo Cukulungiswa Protocol) yinkqubo yenethiwekhi evumela iindawo kwinethiwekhi IP fumana iparameter yoqwalaselo ngokuzenzekelayo. Yinkqubo yohlobo umxhasi / umncedisi Apho umncedisi ngokubanzi anoluhlu lweedilesi ze-IP ezinamandla kwaye azinikeze abathengi njengoko besiya bekhululeka, besazi ngawo onke amaxesha ukuba ngubani ophethe i-IP, banexesha elingakanani benayo kwaye ngubani oyabelweyo ngelo xesha.

NTP Protocol yexesha lenethiwekhi, yiprotocol eyilelwe ukungqamanisa iiwotshi zeendawo zokusebenzela kwinethiwekhi. Inguqulelo yesi-3 yale protocol ngumgaqo osayilwayo we-Intanethi, owenziwe ngokusesikweni kwi-RFC 1305. Inkqubo ye-NTP yenguqulo yesi-4 sisimo esibalulekileyo sokuhlaziywa komgangatho okhankanyiweyo, kwaye uphantsi kophuhliso, kodwa awukenziwa ngokusesikweni kwi-RFC. Inguqulelo elula yeNTP (SNTP) inguqulelo yesi-4 ichazwe kwi-RFC 2030

ISC-DHCP-INKONZO (I-Intanethi yeSoftware Consortium DHCP Server). Umncedisi we-DHCP ngumncedisi ophumeza simahla umthetho olandelwayo we-DHCP ofumana izicelo kubaxumi abafuna ukucwangciswa kwenethiwekhi ye-IP. Umncedisi uya kuphendula kwezi zicelo ngokubonelela ngeeparameter ezivumela abathengi ukuba baziqwalasele ngokwabo. Ukuze iPC icele ubumbeko kwiseva, kuqwalaselo lwenethiwekhi yePC, khetha ukhetho lokufumana idilesi ye-IP ngokuzenzekelayo.

IKerberos yinkqubo yokuqinisekisa yomsebenzisi, enenjongo ephindiweyo:

• Thintela izitshixo ekubeni zithunyelwe kwinethiwekhi, kunye nomngcipheko olandelayo wokuxelwa kwabo.
• Ukuqinisekisa ukungqinisisa komsebenzisi omnye, ukugcina isiseko sedatha esinye somsebenzisi kuyo yonke inethiwekhi.

I-Kerberos, njengeprotocol yokhuseleko, isebenzisa i-Symmetric Key Cryptography, oko kuthetha ukuba isitshixo esisetyenziselwa ukubethela sisitshixo esinye esisetyenziselwa ukucacisa okanye ukungqinisisa abasebenzisi. Oku kuvumela iikhompyuter ezimbini kuthungelwano olungakhuselekanga ukuba zingqine ngokukhuselekileyo omnye komnye. I-Kerberos ke iyakuthintela ukufikelela kubasebenzisi abagunyazisiweyo kuphela kwaye iqinisekise izicelo kwiinkonzo, ithatha indawo evulekileyo evulekileyo, apho abasebenzisi abasebenza kwiindawo zokusebenzela bafikelela kwezi nkonzo kumaseva asasazwe kwinethiwekhi.

Luluphi uzalisekiso lweenkonzo ze-DNS kunye ne-DHCP esiza kuyiphuhlisa?

Siza kuphuhlisa ezimbini: enye esekwe kwi dnsmasq, kwaye kula manqaku alandelayo elihambelana nalo Bopha9 kunye ISC-DHCP-Umncedisi. Kulabo bafuna ukufunda ngokweenkcukacha indlela yokuphumeza kunye nokumisela i-DNS, sicebisa ukuba ufunde inqaku «Uyifaka njani kwaye uyiqwalasele i-Master Master DNS ye-LAN kwi-Debian 6.0»

Kutheni sifuna i-DNS, DHCP kunye neenkonzo ze-NTP?

• DNS: Ukugcina isiseko sedatha esinamagama ababuki zindwendwe kunye needilesi ze-IP, zeekhompyuter eziya kuthi zidityaniswe kuthungelwano lweshishini lethu, ukuze sibabize ngamagama abo, endaweni yeedilesi zabo ze-IP.
• DHCPThintela ukuya kwindawo apho ikhompyuter ikhoyo, ukumisela idilesi ye-IP kunye neeparameter ezinxulumene noko. Ngokusebenzisa i-DHCP simisela ngokuzenzekelayo idilesi ye-IP yomthengi, imaski ye-subnet, isango, iserver ye-DNS ekufanele ukuba idibane nayo, idilesi ye-IP yeseva yeposi ye-LAN yethu, uhlobo lwendawo, igama leNetBIOS server kunye nezinye iiparameter. . Ngokucacileyo, ngale nkonzo, sinokuziphepha iimpazamo zoqwalaselo lwento ebalulekileyo enjalo kwiikhompyuter zabaxhasi.
• NTP: Ukuba kwikamva elingekude sithathe isigqibo sokudibanisa iKerberos neserver ye-LDAP, siya kuyidinga le nkonzo. I-Kerberos ixhomekeke kakhulu kwi-NTP protocol kunye neenkonzo ze-DNS.

Ngaba siya kudibanisa iinkonzo ze-DNS kunye ne-DHCP kwiseva ye-LDAP?

Impendulo okwangoku ayikho. Ekuqaleni HAYI. Umxholo we-OpenLDAP ubuchwephesha ngokwawo. Kwaye ukuba sibenza nzima ubomi bethu kolo hlobo lokudityaniswa kwasekuqaleni, asizukufikelela kude. Qaphela ukuba I-ClearOSSebenzisa i dnsmasq. Amashumi amabini Okwangoku isebenzisa i Bopha9 kunye DHCP Iseva ngaphandle kokudibanisa kunye neseva I-LDAP.

Masihambe ngokulula siye entsonkothileyo ukuze singangeni phakathi kwemilenze yamahashe. 🙂

Umzekelo womnatha

Lan: 10.10.10.0/24
Dominio: amigos.cu
Servidor: mildap.amigos.cu
Sistema Operativo Servidor: Debian 6 "Squeeze
Dirección IP del servidor: 10.10.10.15
Cliente 1: debian7.amigos.cu
Cliente 2: raring.amigos.cu
Cliente 3: suse13.amigos.cu
Cliente 4: seven.amigos.cu

Umncedisi we-Dnsmasq

Sifaka kwaye siqwalasele:

~ ~ ukufaneleka ukufaka i-dnsmasq: ~ # mv /etc/dnsmasq.conf /etc/dnsmasq.conf.

Sihlela ifayile engenanto ngoku /etc/dnsmasq.conf kwaye siyishiya nomxholo olandelayo:

: ~ # nano /etc/dnsmasq.conf
# Ungaze udlulise amagama angenanto ngaphandle kw ichaphaza # okanye indawo yedomeyini efunekayo kwisizinda = abahlobo.cu # Musa ukudlulisa iidilesi kwindawo engafakwanga yedilesi #. i-bogus-priv # Buza amagama amagama # ngokulandelelana kwazo kwifayile # /etc/resolv.conf -stong # yengingqi = / yendawonet /
# EYE NGOKUJONGA
Ujongano = eth1
Nweba-bamba # Guqula uluhlu ngokweemfuno zakho # kunye nexesha lokuqeshisa # kwidilesi ye-IP
dhcp-range = 10.10.10.150,10.10.10.200,12h # Iinketho zokwenza RANGE # Ixesha leseva
dhcp-option = ukhetho: ntp-server, 10.10.10.15

# I-IP yeseva ye-NTP iyafana naleyo ye-dnsmasq
dhcp-ukhetho = 42,0.0.0.0

# Olu khetho lulandelayo zezo uSamba azicebisayo
# ISC-DHCP-Server ziseva kwiphepha lakho
# http://www.samba.org/samba/ftp/docs/textdocs/DHCP-Server-Configuration.txt
# Zilungiselelwe imeko apho iserver yeSamba # isebenza kwiseva enye ye-dnsmasq. # Uncomment ezinye okanye zonke, ukuba usebenzisa # abaxhasi beWindows kunye neseva yeSamba kwi-LAN yakho. # dhcp-option = 19,0 # option ip-forwarding off dhcp-option = 44,0.0.0.0 # NetBIOS-over-TCP / IP igama lomncedisi. IMPUMELELO
dhcp-option = 45,0.0.0.0 # NetBIOS Datagram Distribution Server dhcp-option = 46,8 # Uhlobo lweNode yeNOSBIOS

Ukuze ufunde okungakumbi malunga dnsmasqSincoma ukuba sifunde ifayile ngononophelo wdmasmasq.conf, esithiya igama njani dnsmasq.conf.yokuqala. Yibhayibhile yePasta malunga nale nkonzo. Kungenxa yesiNgesi.

Siqala inkonzo kwakhona:

:~# service dnsmasq restart
Restarting DNS forwarder and DHCP server: dnsmasq.


Sibhengeza iidilesi ze-IP ezisisigxina kwiiseva kwi-LAN yethu kwifayile / njl / imikhosi ukusuka kwiseva ngokwayo apho ifayile ye- dnsmasq.

: ~ # nano / njl / imikhosi
27.0.0.1 indawo yangaphakathi 10.10.10.15 mildap.amigos.cu 10.10.10.1 gandalf.amigos.cu gandalf 10.10.10.5 miwww.amigos.cu miwww

Ngalo lonke ixesha sidibanisa igama kunye ne-IP kwifayile / njl / imikhosi , kufuneka sinyanzele ukuphinda kulayishwe inkonzo ukuze umncedisi ongezelelweyo abonakale ngemiyalelo umkhosi, ukumba y nsokuokup, zombini kwiserver uqobo, nakwezinye iindawo zokusebenza ezifumene i-IP kule seva:

: ~ # inkonzo dnsmasq ngamandla-kwakhona

QaphelaIfayile apho ifayile ye- dnsmasq igcina iidilesi ze-IP ezinikiweyo okanye «Uqeshiso», Ingaba u /var/lib/misc/dnsmasq.leases.

Umncedisi we-NTP

Umthombo ophambili kuboniswene nawo: «Ukucwangciswa kweseva ngeGNU / Linux. UHlelo lukaJanuwari 2012. Umbhali: Joel Barrios Dueñas ».

Sifaka kwaye siqwalasele:

:~# aptitude install ntp
:~# cp /etc/ntp.conf /etc/ntp.conf.original
:~# cp /dev/null /etc/ntp.conf


Sihlela ifayile engenanto ngoku /etc/ntp.conf kwaye siyishiya nomxholo olandelayo:

# Umgaqo-nkqubo osisiseko usetelwe naliphi na ixesha # elisetyenzisiweyo: ukungqamanisa ixesha # kunye nemithombo kuvunyelwe, kodwa ngaphandle kokuvumela umthombo # ukubuza (isikhalazo), okanye ukuguqula inkonzo kwinkqubo # (chonga) kunye nokwala ukubonelela ngelog # imiyalezo (notrap). thintela ukungagqibeki ukukhetha i-notrap noquery # Vumela lonke ufikelelo kwinkqubo # yokubuyisela ujongano. Uthintelo 127.0.0.1 # Inethiwekhi yendawo ivumelekile ukungqamanisa neseva # kodwa ngaphandle kokuyivumela ukuba iguqule ubumbeko lwenkqubo #, nangaphandle kokuyisebenzisa njengalingana nokuvumelanisa. isithintelo se-10.10.10.0 mask 255.255.255.0 chonga i-notrap # iwotshi yengingqi engaqeqeshwanga. # Lo ngumqhubi okhutshelweyo osetyenziswa kuphela njenge- # yogcino xa kungekho namnye iifonti ezikhoyo # ezikhoyo. I-fudge 127.127.1.0 stratum 10 server 127.127.1.0 # Ifayile eyahlukileyo. driftfile / var / lib / ntp / drift Broadcasting delay 0.008 ## UKUBA UNOKUFUMANEKA KWI-INTERNET # Uluhlu lwe-stratum 1 okanye ii-server zexesha ezi-2. # Iiseva ezingakumbi apha: # http://kopernix.com/?q=ntp # http://www.eecis.udel.edu/~mills/ntp/servers.html ## Ukuba unokufikelela kwi-intanethi, ukungonwabi ukulandela imigca emi-3 #seva 3.pool.ntp.org #server 0.pool.ntp.org #server 1.pool.ntp.org # Iimvume zokunikwa ixesha ngalinye. # Kwimizekelo, imithombo ayivunyelwe ukubuza, # lungisa inkonzo kwinkqubo, okanye thumela ubhaliso # umyalezo. ## Ukuba unokufikelela kwi-intanethi, susa ukungasebenzi kwimigca emi-2 elandelayo #restrict 3.pool.ntp.org mask 0 chonga i-notrap noquery #restrict 255.255.255.255.pool.ntp.org mask 1 chaza i-notrap noquery #restrict 255.255.255.255.pool .ntp.org mask 2 khankanya i-notrap noquery # Ukuhanjiswa kwabathengi kuyasebenza
losasazo

Siyiqala kwakhona inkonzo ye-NTP:

:~# service ntp restart
Stopping NTP server: ntpd.
Starting NTP server: ntpd.

Umxhasi we-NTP

:~# aptitude install ntp
:~# cp /etc/ntp.conf /etc/ntp.conf.original
:~# cp /dev/null /etc/ntp.conf


Sihlela ifayile engenanto ngoku /etc/ntp.conf kwaye siyishiya nomxholo olandelayo:

Ubungakanani beserap.amigos.cu

Itshekisha kwiKlayenti

Umzekelo, masithathe abathengi bethu iivsikets.cu, ebesikade sifakele kuyo iphakheji ye-open-server.

ingcambu @ debian7: ~ # ssh-debian7
(Imeyile ikhuselwe) igama eligqithisiweyo: [----] ingcambu @ debian7: ~ # ifconfig
Ikhonkco le-eth0: I-Ethernet HWaddr 52: 54: 00: 8f: ee: f6  
          i-inet yongeza: 10.10.10.153 iBcast: 10.10.10.255 Mask: 255.255.255.0
          inet6 addr: fe80 :: 5054: ff: fe8f: eef6 / 64 Scope: Link UP BROADCAST RUNNING MULTICAST MTU: 1500 Metric: 1 RX packets: 4967 error: 0 drop: 0 overruns: 0 frame: 0 TX packets: 906 iimpazamo: I-0 yehlisiwe: 0 igqitha: 0 yenethiwekhi: 0 ukungqubana: 0 txqueuelen: 1000 RX byte: 6705409 (6.3 MiB) TX bytes: 93635 (91.4 KiB) Ukuphazamisa: 10 Idilesi yesiseko: 0x6000 lo Qhagamshela ikhonkco: Ingingqi yeLoopback inet addr: 127.0.0.1. 255.0.0.0 Mask: 6 inet1 addr: :: 128/16436 Scope: Host UP LOOPBACK RUNNING MTU: 1 Metric: 8 RX packets: 0 error: 0 dropped: 0 overruns: 0 frame: 8 TX packets: 0 error: 0 drop : 0 igqithisile: 0 yenethiwekhi: 0 ukungqubana: 0 txqueuelen: 480 RX byte: 480.0 (480 B) TX bytes: 480.0 (XNUMX B)

Sele siqinisekisile ukuba ufumene idilesi ye-IP kwi dnsmasq efakwe kwiseva yethu ye-OpenLDAP. Ke ngoko, le nkonzo isebenza ngokuchanekileyo. Ngoku makhe sijonge inkonzo ye-NTP, enokuthatha imizuzwana eliqela:

: ~ # ntpdate -u ngobulali.amigos.cu
25 Jan 20:07:00 ntpdate [4608]: ixesha leserver 10.10.10.15 iseti -0.633909 umzuzwana

Ngokumalunga nenkonzo ye-NTP, yonke into iyasebenza.

Olunye uhlolo:

ingcambu @ debian7: ~ # ukumba i-gandalf.amigos.cu

; << >> I-DiG 9.8.4-rpz2 + rl005.12-P1 << >> gandalf.amigos.cu [----] ;; ICANDELO LOMBUZO :; gandalf.amigos.cu. KWI [----] ;; ICANDELO LEMPENDULO: gandalf.amigos.cu. 0 KWI-10.10.10.1 [----] ingcambu @ debian7: ~ # bemba igandalf
[----] ;; ICANDELO LOMBUZO :; gandalf. KWI [----] ;; ICANDELO LEMPENDULO: gandalf. 0 KWI-10.10.10.1 [----] ingcambu @ debian7: ~ # mbewwww
[----] ;; ICANDELO LOMBUZO :; miwww. KWI [----] ;; ICANDELO LEMPENDULO: miwww. 0 KWI-10.10.10.5 [----] ingcambu @ debian7: ~ # bemba debian7
[----] ;; ICANDELO LOMBUZO :; debian7. KWI [----] ;; ICANDELO LEMPENDULO: debian7. 0 KWI-10.10.10.153 [----] ingcambu @ debian7: ~ # Umphathi wobumnene
I-mildap.amigos.cu inedilesi ye-10.10.10.15 ye-mildap.amigos.cu ayifumanekanga: 5 (REFUSED) Host mildap.amigos.cu ayifumanekanga: 5 (REFUSED) root @ debian7: ~ # Umnumzana mildap.amigos.cu
I-mildap.amigos.cu inedilesi 10.10.10.15 Umnumzana mildap.amigos.cu.amigos.cu akafumaneki: 5 (REFUSED) Host mildap.amigos.cu.amigos.cu akafumaneki: 5 (REFUSED)

Ukusukela ukuba ezi nkonzo zimbini zifakelwe kwaye ziqwalaselwe kakuhle, sivala unxibelelwano ukuza kuthi ga ngoku kude kufakelwe isifaki senqaku malunga nendlela yokwenza iinkonzo ze-DNS kunye ne-DHCP ngokuhlaziya i-DNS, esekwe kwi-Bind9 kunye ne-ISC-DHCP-Server, kwabo balawula kancinci iinethiwekhi ezinkulu kwaye zinzima.

Kude kube lixesha elizayo, zihlobo !!!