Insizakalo Yezikhombisi ene-LDAP [2]: i-NTP ne-dnsmasq

Sanibonani zihlobo !. Siqale ukusebenzisa nokulungisa izinsizakalo. Vele kuyadingeka ukuthi elula yethu Insiza Yezincwadi kusekelwe I-OpenLDAP, ube nezinsizakalo eziyisisekelo ukuze zisebenze kahle. Phakathi kwabo sinezinsizakalo DNS noma «Disizinda NAme Suhlelo", DHCP noma » Damandla Host Cukuguquguquka Pi-rotocol«, Futhi kuya NTP noma «NEtwork Time Pi-rotocol".

Uhlelo olusebenzayo esizolusebenzisa yi- I-Debian 6 "Cindezela". Izindlela eziningi ezichazwe zingasetshenziselwa Ubuntu 12.04 "Eqondile", naku- I-Debian 7 "Wheezy".

Yize kubonakala kuyinto encane - empeleni izindatshana zethu zenza isikhathi eside - izincazelo, nokuzifunda kwabafundi kuyadingeka. Ungakwazi futhi abanye abakwazi nokuzifunda bese beya ngqo "enkukhu nelayisi elinenkukhu." Iphutha elikhulu. Futhi angikhulumi ngabanolwazi, ngoba bona, lapho nje bebona isihloko, bayazi ukuthi bayathanda yini noma cha.

Sibhekisa kulabo abaqala ebuholini bamaBusiness Networks. Siyabacela ukuthi bafunde izincazelo futhi balandele izixhumanisi, bangene ezingxenyeni zomqondo ezingeyona imiyalo noma ikhodi yekhodi, bese belandela yonke i-athikili.

Ngale ndlela sizokonga isikhathi esiningi, bobabili nathi, ekubuzeni nasekuphenduleni imibuzo enezimpendulo eziqondile ezingxenyeni zalezi zincazelo nezethulo. 🙂

Sifuna futhi ukusho unomphela ukuthi ulimi oluyisisekelo nolubaluleke kakhulu lomphathi wenethiwekhi noma usosayensi wekhompyutha wulimi lwesiNgisi. :-). Asikwazi ukuhlinzeka ngaso sonke isikhathi ukuhumusha, ngoba asibona ochwepheshe bolimi lwesiNgisi.

Vele, ngaphambi kokuqhubeka, sincoma kakhulu ukuthi ufunde ifayili le- Isingeniso kulolu chungechunge lwezihloko.

Izincazelo ziyadingeka

Kuthathwe ku-Wikipedia:

dnsmasq. Iseva ye-DNS engasindi, i-TFTP ne-DHCP. Inhloso yawo ukuhlinzeka ngezinsizakalo ze-DNS ne-DHCP kunethiwekhi yendawo. Kungukuqaliswa kwamahhala komthetho olandelwayo we-DNS othola izicelo ezivela kumakhasimende acela ikheli le-IP ngokususelwa egameni lomshini. Iseva izophendula kulezi zicelo ngokunikeza i-IP.

DNS Domain Name System (o DNS, ngeSpanishi, uhlelo lwegama lesizinda). Luhlelo lokuphakanyiswa kwamagama lwamakhompiyutha, izinsizakalo noma iyiphi insiza exhunywe kwi-inthanethi noma kwinethiwekhi yangasese. Lolu hlelo luhlobanisa imininingwane ehlukahlukene namagama wesizinda anikezwe ngamunye wabahlanganyeli. Umsebenzi wawo obaluleke kakhulu ukuhumusha (ukuxazulula) amagama abantu aqondakalayo abe yizikhombi kanambambili ezihambisana namakhompyutha axhumeke kwinethiwekhi, lokhu ukuze ukwazi ukuthola nokubhekana nalawa makhompyutha emhlabeni jikelele.

DHCP (isifinyezo se- Damandla Host Cukuguquguquka Protocol) yiphrothokholi yenethiwekhi evumela ama-node kunethiwekhi IP thola amapharamitha wokumisa ngokuzenzakalela. Kuyindlela olandelwayo yohlobo iklayenti / iseva lapho iseva ngokuvamile inohlu lwamakheli we-IP ashukumisayo futhi iwanika amaklayenti njengoba ekhululeka, azi ngaso sonke isikhathi ukuthi ngubani ophethe leyo IP, bekuyisikhathi esingakanani nokuthi ngubani onikezwe ngaleso sikhathi.

NTP I-Protocol Time Protocol, umthetho olandelwayo owenzelwe ukuvumelanisa amawashi ezindawo zokusebenzela ngenethiwekhi. I-Version 3 yale protocol yi-Internet Draft Standard, eyenziwe yahlelwa ku-RFC 1305. I-NTP version 4 protocol iyisibuyekezo esibalulekile sezinga elishiwo, futhi liyathuthukiswa, kepha alikenziwa ngokusemthethweni ku-RFC. Uhlobo olulula lwenguqulo ye-NTP (SNTP) 4 ichazwe ku-RFC 2030

ISC-DHCP-IServer (I-Internet Software Consortium DHCP Server). Iseva ye-DHCP iseva okuwukuqalisa mahhala kwe-DHCP protocol ethola izicelo ezivela kumakhasimende acela ukumiswa kwenethiwekhi ye-IP. Iseva izophendula kulezi zicelo ngokunikela ngamapharamitha avumela amaklayenti ukuthi azilungiselele. Ukuze i-PC icele ukumiswa kusuka kuseva, ekucushweni kwenethiwekhi ye-PC, khetha inketho yokuthola ikheli le-IP ngokuzenzakalela.

I-Kerberos uhlelo lokufakazela ubuqiniso lomsebenzisi, olunenhloso ephindwe kabili:

• Vimbela okhiye ekuthumeleni ngenethiwekhi, ngengozi elandelayo yokudalulwa kwabo.
• Hlanganisa ukuqinisekiswa komsebenzisi, ukugcina i-database eyodwa yomsebenzisi kuyo yonke inethiwekhi.

I-Kerberos, njengeprotocol yokuphepha, isebenzisa i-Symmetric Key Cryptography, okusho ukuthi ukhiye osetshenziselwa ukubethela ukhiye ofanayo osetshenziselwa ukubhala ngemfihlo noma ukugunyaza abasebenzisi. Lokhu kuvumela amakhompyutha amabili kunethiwekhi engavikelekile ukufakazela ngokuphepha ubunikazi bawo komunye nomunye. I-Kerberos bese ivimbela ukufinyelela kubasebenzisi abagunyaziwe kuphela futhi iqinisekisa izicelo zensizakalo, kucatshangelwa indawo evulekile esatshalalisiwe, lapho abasebenzisi abatholakala ezindaweni zokusebenzela bafinyelela khona lezi zinsizakalo kumaseva asatshalaliswe kwinethiwekhi.

Yikuphi ukusetshenziswa kwezinsizakalo ze-DNS ne-DHCP esizokuthuthukisa?

Sizokwakha ezimbili: eyodwa isuselwa ku- dnsmasq, nasezihlokweni ezilandelayo lowo ohambelana naye Isibopho9 futhi i I-ISC-DHCP-Server. Kulabo abafuna ukufunda ngokuningiliziwe ukuthi bangayisebenzisa kanjani futhi bayimise kanjani i-DNS, sincoma ukuthi ufunde indatshanaUngayifaka kanjani futhi uyilungiselele kanjani i-Primary Master DNS ye-LAN ku-Debian 6.0»

Kungani sidinga amasevisi e-DNS, DHCP ne-NTP?

• DNS: Ukugcina i-database enamagama abaphathi namakheli abo e-IP, wamakhompyutha azoxhunywa kwinethiwekhi yethu yezinkampani, ukuze sikwazi ukubabiza ngamagama abo, esikhundleni samakheli abo e-IP.
• DHCP: Gwema ukuthuthela endaweni lapho kutholakala khona ikhompyutha yeklayenti, ukulungisa ikheli layo le-IP nemingcele ehlobene nayo. Nge-DHCP silungiselela ngokuzenzakalela ikheli le-IP leklayenti, imaski yalo ye-subnet, isango, iseva ye-DNS okufanele ibonane nayo, ikheli le-IP leseva yeposi ye-LAN yethu, uhlobo lwe-node, igama le-server le-NetBIOS neminye imingcele eminingi . Ngokusobala, ngale nsizakalo, singagwema amaphutha wokumisa ngesandla wesici esibaluleke kangaka kumakhompyutha amaklayenti.
• NTP: Uma esikhathini esizayo esiseduze sinquma ukuhlanganisa iKerberos nesiphakeli sethu se-LDAP, sizoyidinga le nsizakalo. I-Kerberos incike kakhulu kunqubo ye-NTP protocol kanye nezinsizakalo ze-DNS.

Ngabe sizohlanganisa izinsizakalo ze-DNS neze-DHCP kuseva ye-LDAP?

Impendulo okwamanje ithi CHA. Ekuqaleni CHA. Isihloko se-OpenLDAP sinobuchwepheshe ngokwaso. Futhi uma senza impilo yethu ibe yinkimbinkimbi ngalolo hlobo lokuhlanganiswa ekuqaleni, ngeke size kude kakhulu. Qaphela ukuthi Sula i-ClearOS, sebenzisa i- dnsmasq. I-Zentyal Okwamanje isebenzisa i- Isibopho9 futhi i DHCP Iseva ngaphandle kokuzihlanganisa neseva I-LDAP.

Ake sisuke kokulula siye kokuyinkimbinkimbi ukuze singangeni phakathi kwemilenze yamahhashi. 🙂

Isibonelo senethiwekhi

Lan: 10.10.10.0/24
Dominio: amigos.cu
Servidor: mildap.amigos.cu
Sistema Operativo Servidor: Debian 6 "Squeeze
Dirección IP del servidor: 10.10.10.15
Cliente 1: debian7.amigos.cu
Cliente 2: raring.amigos.cu
Cliente 3: suse13.amigos.cu
Cliente 4: seven.amigos.cu

Iseva ye-Dnsmasq

Sifaka futhi silungiselele:

: ~ # aptitude ukufaka i-dnsmasq: ~ # mv /etc/dnsmasq.conf /etc/dnsmasq.conf.original

Sihlela ifayela elingenalutho manje /etc/dnsmasq.conf futhi sikushiya nokuqukethwe okulandelayo:

: ~ # nano /etc/dnsmasq.conf
# Ungalokothi udlulise amagama angenalutho ngaphandle kw ichashazi # noma ingxenye yesizinda edingeka kusizinda = friends.cu # Ungadluli amakheli esikhaleni se- # unrouted. bogus-priv # Buza ama-nameservers ku- # ngokulandelana kwawo avela kufayela # /etc/resolv.conf-oda eliqinile # Izimpendulo zemibuzo zizovela kuphela ku- # / etc / hosts or from DHCP. kwasendaweni = / localnet /
# ISO NGOBUSO
isikhombimsebenzisi = eth1
expand-hosts # Shintsha ibanga ngokwezidingo zakho # kanye nesikhathi sokuqasha # sekheli le-IP
dhcp-range = 10.10.10.150,10.10.10.200,12h # Izinketho zeRANGE # Iseva yesikhathi
dhcp-option = inketho: ntp-server, 10.10.10.15

# I-IP yeseva ye-NTP iyefana naleyo ye-dnsmasq
dhcp-inketho = 42,0.0.0.0

# Izinketho ezilandelayo yilezo ezinconyelwa yiSamba
# ISC-DHCP-Server amaseva ekhasini lakho
# http://www.samba.org/samba/ftp/docs/textdocs/DHCP-Server-Configuration.txt
# Zenzelwe ikesi lapho iseva yeSamba # isebenza kuseva efanayo ye-dnsmasq. # Unganqamula amanye noma wonke, uma usebenzisa amaklayenti we # Windows neseva ye-Samba ku-LAN yakho. # dhcp-option = 19,0 # option ip-forwarding off dhcp-option = 44,0.0.0.0 # Igama leseva ye-NetBIOS-over-TCP / IP. UKUNQOBA
i-dhcp-option = 45,0.0.0.0 # I-NetBIOS Datagram Distribution Server dhcp-option = 46,8 # Uhlobo lweNode ye-NetBIOS

Ukuze ufunde kabanzi nge dnsmasq, sincoma ukuthi ufunde ifayili ngokucophelela dnsmasq.conf, esiyiqamba ngokuthi kanjani dnsmasq.conf.original. Yi-Pasta Bible mayelana nale nkonzo. KusingesiNgisi.

Siqala kabusha insiza:

:~# service dnsmasq restart
Restarting DNS forwarder and DHCP server: dnsmasq.


Simemezela amakheli we-IP amisiwe wamaseva ku-LAN yethu kufayela / njll / amabamba kusuka kuseva uqobo lapho i dnsmasq.

: ~ # i-nano / njll / ibamba
27.0.0.1 localhost 10.10.10.15 mildap.amigos.cu mildap 10.10.10.1 gandalf.amigos.cu gandalf 10.10.10.5 miwww.amigos.cu miwww

Njalo lapho sifaka igama ne-IP kufayela / njll / amabamba , kufanele siphoqe ukulayishwa kabusha kwensiza ukuze umphathi obangeziwe abonakale ngemiyalo Bamba, ukumba y nslookup, kokubili kuseva uqobo, nakwezinye izindawo zokusebenza ezithole i-IP kusuka kule seva:

: ~ # service dnsmasq force-reload

NoteIfayela lapho ifayela le- dnsmasq igcina amakheli e-IP anikezwe noma «Ukuqashisa», iyona /var/lib/misc/dnsmasq.leases.

Iseva ye-NTP

Kuthintwe umthombo oyinhloko"Ukumiswa kweseva nge-GNU / Linux. Uhlelo lukaJanuwari 2012. Umbhali: Joel Barrios Dueñas ».

Sifaka futhi silungiselele:

:~# aptitude install ntp
:~# cp /etc/ntp.conf /etc/ntp.conf.original
:~# cp /dev/null /etc/ntp.conf


Sihlela ifayela elingenalutho manje /etc/ntp.conf futhi sikushiya nokuqukethwe okulandelayo:

# Inqubomgomo ezenzakalelayo isethelwe noma iyiphi iseva yesikhathi esingu- # esetshenzisiwe: ukuvumelanisa isikhathi # nemithombo kuvunyelwe, kepha ngaphandle kokuvumela umthombo # ukubuza (i-noquery), noma ukuguqula insiza kuhlelo # (khetha) nokuncipha kokuhlinzeka nge-log # imiyalezo (notrap). khawulela okuzenzakalelayo khetha i-notrap noquery # Vumela konke ukufinyelela kusistimu # buyisela isikhombimsebenzisi. vimbela i-127.0.0.1 # Inethiwekhi yendawo ivunyelwe ukuvumelanisa neseva # kepha ngaphandle kokuyivumela ukuthi iguqule ukucushwa kohlelo #, nangaphandle kokuyisebenzisa njengokulingana ukuvumelanisa. khawulela imaskhi engu-10.10.10.0 255.255.255.0 khetha i-notrap # Iwashi lasendaweni elingaqondisiwe. # Lona umshayeli wokulingisa osetshenziswa kuphela njengesipele esingu- # uma engekho amafonti angempela atholakalayo #. fudge 127.127.1.0 stratum 10 server 127.127.1.0 # Ifayela elihlukile. driftfile / var / lib / ntp / drift ukusakaza ukubambezeleka 0.008 # # UMA UNOKUFINYELELA KWI-INTERNET # Uhlu lwe-stratum 1 noma 2 amaseva wesikhathi. # Amaseva amaningi ku: # http://kopernix.com/?q=ntp # http://www.eecis.udel.edu/~mills/ntp/servers.html # # Uma unokufinyelela kwe-inthanethi, ukungavumeli ukulandela imigqa emi-3 # iseva 3.pool.ntp.org #server 0.pool.ntp.org #server 1.pool.ntp.org # Izimvume ezizonikezwa iseva ngayinye. # Ezibonelweni, imithombo ayivunyelwe ukubuza, # shintsha insiza ohlelweni, noma thumela imiyalezo # yokubhalisa. # # Uma unokufinyelela kwe-inthanethi, susa imisho kule migqa emi-2 elandelayo #restrict 3.pool.ntp.org mask 0 nomodify notrap noquery #restrict 255.255.255.255.pool.ntp.org mask 1 nomodify notrap noquery #restrict 255.255.255.255.pool .ntp.org mask 2 khetha i-notrap noquery # Ukusatshalaliswa kwamakhasimende kuyasebenza
umsakazi

Siqala kabusha insiza ye-NTP:

:~# service ntp restart
Stopping NTP server: ntpd.
Starting NTP server: ntpd.

Iklayenti le-NTP

:~# aptitude install ntp
:~# cp /etc/ntp.conf /etc/ntp.conf.original
:~# cp /dev/null /etc/ntp.conf


Sihlela ifayela elingenalutho manje /etc/ntp.conf futhi sikushiya nokuqukethwe okulandelayo:

i-server mildap.amigos.cu

Amasheke kuKlayenti

Isibonelo, ake sithathe iklayenti lethu phuzekhemisi.cu, lapho ngaphambili sifake khona iphakethe le-openssh-server.

impande @ debian7: ~ # ssh-debian7
iphasiwedi ye-root @ debian7: [----] impande @ debian7: ~ # ifconfig
I-eth0 Link encap: I-Ethernet HWaddr 52: 54: 00: 8f: ee: f6  
          i-inet addr: 10.10.10.153 Bcast: 10.10.10.255 Mask: 255.255.255.0
          inet6 addr: fe80 :: 5054: ff: fe8f: eef6 / 64 Scope: Link UP BROADCAST RUNNING MULTICAST MTU: 1500 Metric: 1 RX packets: 4967 error: 0 dropped: 0 overruns: 0 frame: 0 TX pack: 906 error: 0 kwehlisiwe: 0 kweqa: 0 othwala: 0 ukushayisana: 0 txqueuelen: 1000 RX byte: 6705409 (6.3 MiB) TX bytes: 93635 (91.4 KiB) Ukuphazamisa: 10 Ikheli lesisekelo: 0x6000 lo Link encap: Local Loopback inet addr: 127.0.0.1. 255.0.0.0 Mask: 6 inet1 addr: :: 128/16436 Scope: Host UP LOOPBACK RUNNING MTU: 1 Metric: 8 RX packets: 0 errors: 0 dropped: 0 overruns: 0 frame: 8 TX packets: 0 errors: 0 dropped : 0 kweqa: 0 othwala: 0 ukushayisana: 0 txqueuelen: 480 RX byte: 480.0 (480 B) TX bytes: 480.0 (XNUMX B)

Sesivele sikuqinisekisile ukuthi uthole ikheli le-IP kusuka ku- dnsmasq efakwe kuseva yethu ye-OpenLDAP. Ngakho-ke, leyo nsizakalo isebenza kahle. Manje ake sihlole insiza ye-NTP, engathatha imizuzwana embalwa:

: ~ # ntpdate -u mildap.amigos.cu
25 Jan 20:07:00 ntpdate [4608]: i-step time server 10.10.10.15 isethi -0.633909 sec

Mayelana nensizakalo ye-NTP, konke kusebenza KULUNGILE.

Okunye ukuhlola:

impande @ debian7: ~ # bamba gandalf.amigos.cu

; << >> I-DiG 9.8.4-rpz2 + rl005.12-P1 << >> gandalf.amigos.cu [----] ;; ISIQEPHU SOMBUZO :; gandalf.amigos.cu. KWI [----] ;; ISIGABA SEMPENDULO: gandalf.amigos.cu. 0 KU-A 10.10.10.1 [----] impande @ debian7: ~ # bamba i-gandalf
[----] ;; ISIQEPHU SOMBUZO :; gandalf. KWI [----] ;; ISIGABA SEMPENDULO: gandalf. 0 KU-A 10.10.10.1 [----] impande @ debian7: ~ # bamba miwww
[----] ;; ISIGABA SOMBUZO :; miwww. KWI [----] ;; ISIGABA SEMPENDULO: miwww. 0 KU-A 10.10.10.5 [----] impande @ debian7: ~ # bamba i-debian7
[----] ;; ISIQEPHU SOMBUZO :; debian7. KWI [----] ;; ISIGABA SEMPENDULO: debian7. 0 KU-A 10.10.10.153 [----] impande @ debian7: ~ # bamba imephu
i-mildap.amigos.cu inekheli 10.10.10.15 Host mildap.amigos.cu ayitholakali: 5 (REFUSED) Host mildap.amigos.cu ayitholakalanga: 5 (REFUSED) root @ debian7: ~ # bamba i-mildap.amigos.cu
i-mildap.amigos.cu inekheli 10.10.10.15 Host mildap.amigos.cu.amigos.cu ayitholakali: 5 (REFUSED) Host mildap.amigos.cu.amigos.cu ayitholakalanga: 5 (REFUSED)

Futhi njengoba lezi zinsizakalo ezimbili zifakiwe futhi zahlelwa kahle kakhulu, sivala ukuxhumana kwanamuhla kuze kube isitolimende esilandelayo sendatshana yokuthi ungazisebenzisa kanjani izinsizakalo ze-DNS ne-DHCP ngokuvuselela i-DNS, ngokuya nge-Bind9 ne-ISC-DHCP-Server, kulabo abaphatha amanethiwekhi amakhulu futhi ayinkimbinkimbi.

Kuze kube yisikhathi esilandelayo, bangani !!!