2008 - Debian 4 - Xen domU - DNS system - djbdns

category: howtoz · date: 2012-02-16 · source: old.linuxor.sk/VIRTUALIZATION/REALSERVER/8_XEN_Debian_Server_domU_DNS.txt

Anglická verzia tohto dokumentu: 2008 - Debian 4 - Xen domU - DNS system - djbdns.

asciiart

|=---------------------------------=[ XEN ]=------------------------------=|
+---------------------------------------------------------------------------+
|
|                          XEN-server domU (REAL SERVER HW)
|                                 Debian 4.0 Etch
|                                 DNS SYSTEM
|
+---------------------------------------------------------------------------+
|=-------------------------------=[ BH 2008 ]=----------------------------=|

Budeme pouzivat BASE system na vytvorenie dalsich virtualnych strojov.

1. Vytvorenie noveho virtualneho stroja

asciiart

    Vytvorenie logickych particii pre novy system
    =============================================
    # lvcreate -L 1.5G -n dns-disk system_vhosts
    # lvcreate -L 1G -n dns-var system_vhosts
    # lvcreate -L 1G -n dns-varlog system_vhosts
    # lvcreate -L 0.5G -n dns-tmp system_vhosts
    # lvcreate -L 2G -n dns-usr system_vhosts
    # lvcreate -L 0.5G -n www-swap system_vhosts
    # mkswap /dev/system_vhosts/www-swap

    Vytvorenie VM z base LVM particii (snapshots)
    =============================================
    # lvcreate -s -L 1.5G -n snap-base-disk /dev/system_vhosts/base-disk
    # lvcreate -s -L 1G -n snap-base-var /dev/system_vhosts/base-var
    # lvcreate -s -L 1G -n snap-base-varlog /dev/system_vhosts/base-varlog
    # lvcreate -s -L 0.5G -n snap-base-tmp /dev/system_vhosts/base-tmp
    # lvcreate -s -L 2G -n snap-base-usr /dev/system_vhosts/base-usr
    # lvcreate -s -L 0.5G -n snap-base-swap /dev/system_vhosts/base-swap

    # dd if=/dev/system_backup/snap-base-disk of=/dev/system_vhosts/dns-disk bs=1024k // (1610612736 bytes (1.6 GB) copied, 50.4256 seconds, 31.9 MB/s)
    # dd if=/dev/system_backup/snap-base-var of=/dev/system_vhosts/dns-var bs=1024k // (1073741824 bytes (1.1 GB) copied, 33.2976 seconds, 32.2 MB/s)
    # dd if=/dev/system_backup/snap-base-varlog of=/dev/system_vhosts/dns-varlog bs=1024k // (1073741824 bytes (1.1 GB) copied, 33.5406 seconds, 32.0 MB/s)
    # dd if=/dev/system_backup/snap-base-tmp of=/dev/system_vhosts/dns-tmp bs=1024k // (536870912 bytes (537 MB) copied, 16.2542 seconds, 33.0 MB/s)
    # dd if=/dev/system_backup/snap-base-usr of=/dev/system_vhosts/dns-usr bs=1024k // (2147483648 bytes (2.1 GB) copied, 66.4581 seconds, 32.3 MB/s)

    Config novovytvoreneho systemu - dom0
    ==============================
    # cp /etc/xen/base.cfg /etc/xen/dns.cfg
    # nano /etc/xen/dns.cfg
    -----------------------
    # DNS SYSTEM

    # Obraz jadra, initrd a pamat pre tento Virtualny Stroj
    kernel  = '/boot/vmlinuz-2.6.18-6-xen-amd64'
    ramdisk = '/boot/initrd.img-2.6.18-6-xen-amd64'
    memory  = '256'
    extra   = 'selinux=0'
    vcpus   = '1'

    # Diskove zariadenia
    root    = '/dev/sda1 ro'
    disk    = [ 'phy:system_vhosts/dns-disk,sda1,w', 'phy:system_vhosts/dns-swap,sda2,w', 'phy:system_vhosts/dns-var,sda3,w',            'phy:system_vhosts/dns-varlog,sda4,w', 'phy:system_vhosts/dns-tmp,sda5,w', 'phy:system_vhosts/dns-usr,sda6,w' ]

    # Hostname
    name    = 'dns'

    # Siet
    vif = [ 'ip=10.0.0.6', 'ip=192.168.0.6' ]

    # Spravanie
    on_poweroff = 'destroy'
    on_reboot   = 'restart'
    on_crash    = 'restart'
    -----------------------END-»/etc/xen/dns.cfg

    Spustenie noveho systemu
    ========================
    # xm create -c dns.cfg

    Konfiguracia domU - dns
    ========================

    # nano /etc/hostname
    --------------------
    dns
    --------------------END-»/etc/interfaces

    # nano /etc/network/interfaces
    ------------------------------
    auto eth0
    iface eth0 inet static
        address 10.0.0.6
        gateway 10.0.0.254
        netmask 255.0.0.0

    auto eth1
    iface eth1 inet static
        address 192.168.0.6
        netmask 255.255.255.0
    -------------------------------END-»/etc/network/interfaces

    # nano /etc/issue
    -----------------
    Virtual.DNS
    -----------------END-»/etc/issue

    # nano /etc/issue.net
    ---------------------
    Virtual.DNS
    ---------------------END-»/etc/issue.net

    # nano /etc/motd
    -----------------
    Virtual.DNS
    ---------------------END-»/etc/motd

2. Nastavenie siete (nated network)

asciiart

----
dom0
----

    # nano /etc/xen/xend-config.sxp
    -------------------------------
    (network-script network-nat)
    (vif-script vif-nat)

    Zapneme SNAT pre siet 10.0.0.0/255.0.0.0
    ----------------------------------------
    # iptables -t nat -A POSTROUTING -s 10.0.0.0/255.0.0.0 -j SNAT --to-source 192.168.254.254

    Presmenurejeme poziadavky na 192.168.254.254:22226 na 10.0.0.6:22
    ----------------------------------------------------------------------
    # iptables -t nat -A PREROUTING -p tcp -s xx.xx.xx.xx -d 192.168.254.254 --dport 22222 -j DNAT --to-destination 10.0.0.6:22

3. Instalacia DNS servera (DJBDNS)

asciiart

DJBDNS nie je v Debiane Etch v podobe binarnych balickov. Existuju len balicky
so zdrojovymi kodmi a to tiez v repozitaroch 'contrib' a 'non-free'.

Poziadavky:
- daemontools
- ucspi-tcp-src

Poznamky:
- IP adresa autoritativneho DNS servera bude 10.0.0.6
- IP adresa cache DNS servera pre virtualne stroje bude 192.168.0.6 (resolver)

3.1 Install - daemontools

asciiart

    # apt-get install daemontools-installer
    # mkdir /install
    # build-daemontools
    -------------------
    Enter a directory where you would like to do this [/tmp/daemontools] -» [/install/daemontools] ENTER

    Which format would you like to use? [fD] «- ENTER

    Do you want to remove all files in /install/daemontools,
    except daemontools_0.76-9_i386.deb now? [Yn] «- ENTER

    Do you want to install daemontools_0.76-9_i386.deb now? [Yn] «- ENTER

    Do you want to purge daemontools-installer now? [yN] «- ENTER
    -------------------

3.2 Install - ucspi-tcp-src

asciiart

    # apt-get install ucspi-tcp-src
    # build-ucspi-tcp
    -----------------
    Enter a directory where you would like to do this [/install/ucspi-tcp] -» [/install/ucspi-tcp] ENTER

    Do you want to remove all files in /install/ucspi-tcp,
    except ucspi-tcp_0.88-10_i386.deb now? [Yn] «- ENTER

    Do you want to install ucspi-tcp_0.88-10_i386.deb now? [Yn] «- ENTER

    Do you want to purge ucspi-tcp-src now? [yN] «- ENTER
    -------------------

3.3 Install - djbdns

asciiart

    # apt-get install djbdns-installer
    # build-djbdns
    --------------
    Enter a directory where you would like to do this [/install/djbdns] -» [/install/djbdns] ENTER

    Do you want to remove all files in /tmp/djbdns,
    except djbdns_1.05-11_i386.deb now? [Yn] «- ENTER

    Do you want to install djbdns_1.05-11_i386.deb now? [Yn] «- ENTER

    Do you want to purge djbdns-installer now? [yN] «- ENTER

3.4 Install - Config - djbdns

asciiart

    # mkdir /var/lib/svscan

3.5 DNS cache server private - dnscache (pre virtualne stroje)

asciiart

    Vytvorime DNS cache server cakajuci na spojenia na adrese 192.168.0.6
    ---------------------------------------------------------------------
    # dnscache-conf dnscache dnslog /var/lib/svscan/dnscache 192.168.0.6

    Stiahneme aktualny zoznam DNS root serverov
    ---------------------------------------------
    ftp://ftp.internic.net/domain/named.root

    Nastavime momentalne platne root servery
    -----------------------------------------
    # nano /var/lib/svscan/dnscache/root/servers
    --------------------------------------------
    198.41.0.4
    192.228.79.201
    192.33.4.12
    128.8.10.90
    192.203.230.10
    192.5.5.141
    192.112.36.4
    128.63.2.53
    192.36.148.17
    192.58.128.30
    193.0.14.129
    199.7.83.42
    202.12.27.33

    Nastavime pre ktore ip adresy robime DNS cache server (192.168.0.*)
    ---------------------------------------------------------------
    # touch /var/lib/svscan/dnscache/root/ip/192.168.0

    Aktivujeme sluzbu vytvorenim odkazu
    -----------------------------------
    # ln -s /var/lib/svscan/dnscache /service

    Restartneme sluzbu takto
    ------------------------
    # svc -d /service/dnscache
    # svc -u /service/dnscache

    alebo takto
    -----------
    # svc -t /service/dnscache

3.6 DNS cache server local - dnscache

asciiart

    Vytvorime DNS cache server cakajuci na spojenia na adrese 127.0.0.1
    ---------------------------------------------------------------------
    # dnscache-conf dnscache dnslog /var/lib/svscan/dnscache-local 127.0.0.1

    Aktivujeme sluzbu vytvorenim odkazu
    -----------------------------------
    # ln -s /var/lib/svscan/dnscache-local /service

3.6 Autoritativny verejny DNS server- tinydns-public

asciiart

    Vytvorime verejny DNS autoritativny server cakajuci na spojenia na adrese 10.0.0.6
    --------------------------------------------------------------------------------
    # tinydns-conf tinydns dnslog /var/lib/svscan/tinydns-public 10.0.0.6

    Aktivujeme sluzbu vytvorenim odkazu
    -----------------------------------
    # ln -s /var/lib/svscan/tinydns-public /service

3.7 Autoritativny privatny DNS server- tinydns-private

asciiart

    Vytvorime privatny DNS autoritativny server cakajuci na spojenia na adrese 127.0.0.1 (localhost preto lebo uz sme obsadili obe interfaci)
    ----------------------------------------------------------------------------------------------------------------------------------
    # tinydns-conf tinydns dnslog /var/lib/svscan/tinydns-private 127.0.0.1

    dnscache serveru povieme aby pouzival privatny autoritativny server na adrese 127.0.0.1 pre rozlisovanie vnutornej domeny client43.example
    ------------------------------------------------------------------------------------------------------------------------------
    # echo 127.0.0.1 » /var/lib/svscan/dnscache/root/servers/client43.example

    dnscache serveru povieme aby pouzival privatny autoritativny server na adrese 127.0.0.1 pre rozlisovanie reverznych zazmaov vnutornej domeny     client43.example
    -------------------------------------------------------------------------------------------------------------------------------------------
    # echo 127.0.0.1 » /var/lib/svscan/dnscache/root/servers/192.in-addr.arpa

    Nastavime privatne zaznamy pre domenu client43.example
    ---------------------------------------------------------------
    cd /var/lib/svscan/tinydns-private/root

    Pridame zaznam pre domenovy server
    -------------------------------------------------
    ./add-ns client43.example 192.168.0.6

    Aktivujeme sluzbu vytvorenim odkazu
    -----------------------------------
    # ln -s /var/lib/svscan/tinydns-private /service

3.8 Autoritativny verejny DNS server- tinydns-public - POVOLENIE TRANSFERU ZONY

asciiart

    Zapneme demon axfrdns pre umoznenie transferu zon z naseho verejneho autoritativneho DNS
    ----------------------------------------------------------------------------------------
    # axfrdns-conf axfrdns dnslog /var/lib/svscan/axfrdns /var/lib/svscan/tinydns-public 10.0.0.6

    Ako root spustime prikaz pre zapnutie ZONE TRANSFERU (AXFR)
    -------------------------------------------------------------
    # echo ':allow,AXFR=""' » /var/lib/svscan/axfrdns/tcp

    Pre domenu client43.example povolime transfer zony z vybranych IP adries
    ---------------------------------------------------------------
    # echo '192.0.2.32:allow,AXFR="client43.example"' »» /service/axfrdns/tcp
    # echo '192.0.2.33:allow,AXFR="client43.example"' »» /service/axfrdns/tcp

    Z datoveho suboru vykompilijeme hash databazu
    ----------------------------------------------
    # cd /var/lib/svscan/axfrdns
    # make

    Aktivujeme sluzbu vytvorenim odkazu
    -----------------------------------
    # ln -s /var/lib/svscan/axfrdns /service

LINKZ

asciiart

    Intro to djbdns
    --------------
    http://www.mn-linux.org/meetings/pastnotes/djbdns.pdf

    FAQ
    ----
    http://www.fefe.de/djbdns/

    DNS split horizon
    ----------------
    http://www.fefe.de/djbdns/split-horizon

    Zone transfer
    -------------
    http://cr.yp.to/djbdns/tcp.html

    How the AXFR protocol works
    ----------------------------
    http://cr.yp.to/djbdns/axfr-notes.html

    The BIND company's ``AXFR clarifications''
    -----------------------------------------
    http://cr.yp.to/djbdns/axfr-clarify.html