DHCP dan DNS

ipoelnet · Nov 19, 2009, 8:42 AM

Ini Om, settingannya :

pkg_add -rv http://dl2.foss-id.web.id/freebsd/ports/i386/packages-7.2-release/dns/bind96-9.6.0.1.tbz

/etc/resolv.conf

domain taqwa.local
nameserver 127.0.0.1
nameserver 202.134.1.10

/var/named/master/taqwa.local

$TTL    3600
taqwa.local.                     IN    SOA     ns2.taqwa.local.   root.taqwa.local. (
                                                   1            ; Serial 
                                                   10800    ; Refresh
                                                   3600       ; Retry
                                                    604800  ; Expire
                                                   86400 )   ;Minimum TTL
; DNS Servers
taqwa.local.                     IN               NS   ns2.taqwa.local.

; Computer names and records
ns2.taqwa.local.     IN               A    192.168.254.254

; Aliases
www                          IN              CNAME    ns2.taqwa.local.

; Mail MX Records
taqwa.local.                    IN     MX     10   ns2.taqwa.local.

/var/named/master/taqwa.local.rev

$TTL    3600
254.168.192.in-addr.arpa.          IN    SOA    ns2.taqwa.local.     root.taqwa.local. (
                                                   1            ; Serial
                                                    10800    ; Refresh
                                                   3600      ; Retry
                                                    604800   ; Expire
                                                    86400)   ; Minimum TTL
; DNS Servers
254.168.192.in-addr.arpa.          IN              NS    ns2.taqwa.local.

; Computer IPs
100                                     IN               PTR    ns2.taqwa.local.
100                                     IN               PTR    www.taqwa.local.

/usr/local/sbin/rndc-confgen -a

wrote key file "/usr/local/etc/rndc.key"

find / | grep rndc.key

/usr/local/etc/rndc.key

cat /usr/local/etc/rndc.key >> named.conf

/var/named/named.conf

forwarders {
              127.0.0.1;
};
zone "taqwa.local" {
        type master;
        file "master/taqwa.local";
        allow-transfer { localhost; };
        allow-update { key rndc-key };
};
zone "0.0.127.in-addr.arpa" {
        type master;
        file "master/taqwa.local.rev";
        allow-transfer { localhost; };
        allow-update { key rndc-key };
};
key "rndc-key" {
	algorithm hmac-md5;
	secret "JtU+O0PpufgIhsWdA3tSQA==";
};

reboot PF….........

**# sockstat -4l | grep -i 53
nobody dnsmasq 480 3 udp4 :53 :
nobody dnsmasq 480 4 tcp4 :53 :

??? ???

grage95 · Nov 19, 2009, 9:14 AM

buat file

/usr/local/etc/dnsmasq.conf


port=54
# increase DNS cache size
# cache-size=10000

expand-hosts 

# Resolve(generated from WAN DHCP)
resolv-file=/etc/resolv.conf
#
# Extra : Blackhole DNS adresses. (NO blackholeDNS, comment next line)
# conf-file=/etc/blackhole.conf
#
#server=208.67.222.222
#server=208.67.220.220
# include another configuration
#conf-file=/etc/dnsmasq-adblock.conf

restart dnsmasq dan jalankan bind

named -4
trus cek dg sockstat lagi

utk tahap pertama : config named sebagai cache dahulu, untuk zone domain belakangan saja.

ini contoh named.conf hanya utk cache

acl "localnet" {192.168.0.0/16;10.0.0.0/8; localhost;};

options {
        // Relative to the chroot directory, if any
        directory       "/etc/namedb";
        pid-file        "/var/run/named/pid";
        dump-file       "/var/dump/named_dump.db";
        statistics-file "/var/stats/named.stats";
        allow-recursion { any; };
      //allow-query     { any; };
      //allow-query-cache  { any; };
        allow-query     { localnet; };
        allow-query-cache  { localnet; };
        minimal-responses       yes;
        datasize 196M;
        max-cache-size 128M;
        listen-on     { any;};
        //listen-on     { 127.0.0.1; 192.168.2.1 };

forward first;
//forward only;

//forwader for block porn
//forwarders {203.34.118.12; 203.34.118.10; };

//forwader ip dns spidol

forwarders { ; 203.130.196.6; 202.134.2.5;};
};

logging {category lame-servers { null; };
};

controls { inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { "rndc-key"; };
};

zone    "localhost" {
        type master;
        file "master/localhost-forward.db";
};

zone    "127.in-addr.arpa" {
        type master;
        file "master/localhost-reverse.db";
};

zone    "." {
        type hint;
        file "named.root";
};

//include "master/hikmah-teknologi.zone";

//zone block
//include "master/zoneblock.zone";

key "rndc-key" {
        algorithm hmac-md5;
        secret "Kht7CoEd89/kbjno/KPFkA==";
};

ipoelnet · Nov 19, 2009, 9:15 AM

@grage95:

buat file

/usr/local/etc/dnsmasq.conf


port=54
# increase DNS cache size
# cache-size=10000

expand-hosts 

# Resolve(generated from WAN DHCP)
resolv-file=/etc/resolv.conf
#
# Extra : Blackhole DNS adresses. (NO blackholeDNS, comment next line)
# conf-file=/etc/blackhole.conf
#
#server=208.67.222.222
#server=208.67.220.220
# include another configuration
#conf-file=/etc/dnsmasq-adblock.conf

restart dnsmasq dan jalankan bind

named -4
trus cek dg sockstat lagi

setelah restartdnsmasq lewat Web GUI…
terus...

**# usr/local/sbin/named

usr/local/sbin/named -4

sockstat -4 -l |grep -i 53

#**

kosong Om g' da yang jalan…..........

grage95 · Nov 19, 2009, 9:58 AM

berarti tinggal named nya
coba di log messages nya

tail -f /var/log/messages ada yang aneh enggak

config named.conf gunakan yg seperti contoh yang aku kasih

taruh di /var/named/etc/namedb/named.conf

cek dengan sockstat dan ps -ax

# sockstat -4 -l |grep -i 53
root named 66164 20 tcp4 192.168.1.12:53 :
root named 66164 21 tcp4 127.0.0.1:53 :
root named 66164 22 tcp4 127.0.0.1:953 :
root named 66164 512udp4 192.168.1.12:53 :
root named 66164 513udp4 127.0.0.1:53 :

#ps -ax |grep named
66164 ?? Is 0:00.04 named -4

#tail -f /var/log/messages
Nov 19 16:48:12 freebsd named[66164]: starting BIND 9.4.3-P2 -4
Nov 19 16:48:12 freebsd named[66164]: command channel listening on 127.0.0.1#953
Nov 19 16:48:12 freebsd named[66164]: running

ipoelnet · Nov 19, 2009, 10:08 AM

zone "localhost" {
type master;
file "master/localhost-forward.db";
};

zone "127.in-addr.arpa" {
type master;
file "master/localhost-reverse.db";
};

Isinya yg tebal OM?

grage95 · Nov 19, 2009, 10:14 AM

isinya ada di directory master (by default)

/var/named/etc/namedb/master

http://src.gnu-darwin.org/src/etc/namedb/master/

ipoelnet · Nov 19, 2009, 10:48 AM

named-checkconf

/usr/local/etc/named.conf:32: unknown option 'controls'
/usr/local/etc/named.conf:37: unknown option 'zone'
/usr/local/etc/named.conf:42: unknown option 'zone'
/usr/local/etc/named.conf:47: unknown option 'zone'
/usr/local/etc/named.conf:57: unknown option 'key'
/usr/local/etc/named.conf:61: '}' expected near end of file

grage95 · Nov 19, 2009, 12:11 PM

coba paste kesini :
/usr/local/etc/named.conf

ipoelnet · Nov 19, 2009, 12:29 PM

ip server 192.168.254.254
hostname ns2.taqwa.local

/usr/local/etc/named.conf

acl "localnet" {192.168.0.0/16;10.0.0.0/8; localhost;};

options {
// Relative to the chroot directory, if any
directory "/etc/namedb";
pid-file "/var/run/named/pid";
dump-file "/var/dump/named_dump.db";
statistics-file "/var/stats/named.stats";
allow-recursion { any; };
//allow-query { any; };
//allow-query-cache { any; };
allow-query { localnet; };
allow-query-cache { localnet; };
minimal-responses yes;
datasize 196M;
max-cache-size 128M;
listen-on { any;};
//listen-on { 127.0.0.1; 192.168.2.1 };

forward first;
//forward only;

//forwader for block porn
//forwarders {203.34.118.12; 203.34.118.10; };

//forwader ip dns spidol

forwarders { 203.130.196.155; 202.134.1.10;};

//logging {category name-servers { null; }; };

controls { inet 127.0.0.1 port 953
allow { 127.0.0.1; };
keys { "rndc-key"; };
};

zone "localhost" {
type master;
file "master/localhost-forward.db";
};

zone "127.in-addr.arpa" {
type master;
file "master/localhost-reverse.db";
};

zone "." {
type hint;
file "named.root";
};

//include "master/hikmah-teknologi.zone";

//zone block
//include "master/zoneblock.zone";

key "rndc-key" {
algorithm hmac-md5;
secret "JtU+O0PpufgIhsWdA3tSQA==";
};

grage95 · Nov 19, 2009, 1:07 PM

@ipoelnet:

ip server 192.168.254.254
hostname ns2.taqwa.local

/usr/local/etc/named.conf

acl "localnet" {192.168.0.0/16;10.0.0.0/8; localhost;};

options {
// Relative to the chroot directory, if any
directory "/etc/namedb";
pid-file "/var/run/named/pid";
dump-file "/var/dump/named_dump.db";
statistics-file "/var/stats/named.stats";
allow-recursion { any; };
//allow-query { any; };
//allow-query-cache { any; };
allow-query { localnet; };
allow-query-cache { localnet; };
minimal-responses yes;
datasize 196M;
max-cache-size 128M;
listen-on { any;};
//listen-on { 127.0.0.1; 192.168.2.1 };

forward first;
//forward only;

//forwader for block porn
//forwarders {203.34.118.12; 203.34.118.10; };

//forwader ip dns spidol

forwarders { 203.130.196.155; 202.134.1.10;};

//logging {category name-servers { null; }; };

controls { inet 127.0.0.1 port 953
allow { 127.0.0.1; };
keys { "rndc-key"; };
};

zone "localhost" {
type master;
file "master/localhost-forward.db";
};

zone "127.in-addr.arpa" {
type master;
file "master/localhost-reverse.db";
};

zone "." {
type hint;
file "named.root";
};

//include "master/hikmah-teknologi.zone";

//zone block
//include "master/zoneblock.zone";

key "rndc-key" {
algorithm hmac-md5;
secret "JtU+O0PpufgIhsWdA3tSQA==";
sesuikan dengan ker yang baru
};

keynya di sesuaikan

cat /usr/local/etc/rndc.key >> named.conf

btw default directorynya ke /usr/local/etc ???
sedangkan option diatas directory "/etc/namedb";

config yang di gunakan named.conf yang mana ?

ipoelnet · Nov 19, 2009, 1:33 PM

/usr/local/etc/named.conf sebab jika di cek dengan # /usr/local/sbin/named-checkconf arahnya kesitu Om errornya, jadi named.conf dan master q ganti disitu untuk key udah q generate om. tapi tetep errornya spt itu.

/usr/local/sbin/named -4

ps -ax | grep named

6249 p0 S+ 0:00.00 grep named

grage95 · Nov 19, 2009, 1:54 PM

ok, tapi di optionya di sesuaikan dengan hasil dari /usr/local/sbin/named-checkconf
defaultnya bind mengunakan bind chroot utk security, terutama ddos, directorynya ada di /var/named/etc/namedb

/usr/local/sbin/named-checkconf

/usr/local/etc/named.conf:61: '}' expected near end of file

kayanya ada yang kelewat untuk nutup }; di bagian option

itu terjadi karena option
logging {category name-servers { null; }; };
di kasih //

kalau gak mau di pake, tambahkan }; di bawahnya itu
jadinya
//logging {category name-servers { null; }; };
};

yang bener itu lame-server seperti dalam contoh saya, bukan name-server, kenapa di rubah ???

logging {category lame-servers { null; }; };

kalau itu di kasih //
berarti kamu mau melog dns, dan ini menurut saya log itu gak penting banget, bikin beban walopun sedikit

_lame-servers Lame servers. Mis-configuration in the delegation of domains discovered by BIND 9 when trying to authoritative answers. If the volume of these messages is high many users elect to send them to the null channel e.g. category lame-servers {null;}; statement.

null 'null' writes to /dev/null - the bit bucket, nowhere. It does not produce a log. From the grammar above 'file', 'syslog', 'stderr' and 'null' are mutually exclusive for a 'channel'._

http://www.zytrax.com/books/dns/ch7/logging.html

ipoelnet · Nov 19, 2009, 2:23 PM

Siiiip, tapi file ini g' ada :

pid-file "/var/run/named/pid";
dump-file "/var/dump/named_dump.db";
statistics-file "/var/stats/named.stats"

waduh… tambah parah...

grage95 · Nov 19, 2009, 2:55 PM

ganti saja /var/run/named.id

yang ini di //
//dump-file "/var/dump/named_dump.db";
//statistics-file "/var/stats/named.stats"