DHCP сервер.

aptitude -y install rsyslog isc-dhcp-server

Конфигурируем сервер.

Изменяем /etc/default/isc-dhcp-server

# On what interfaces should the DHCP server (dhcpd)

# serve DHCP requests? Separate multiple interfaces

# with spaces, e.g. "eth0 eth1".

INTERFACES="eth0"

Изменяем /etc/dhcp/dhcpd.conf

# The ddns-updates-style parameter controls whether or

# not the server will attempt to do a DNS update when

# a lease is confirmed. We default to the behavior of

# the version 2 packages ('none', since DHCP v2 didn't

# have support for DDNS.)

ddns-update-style none;

# option definitions common to all supported networks

option domain-name "OFFICE.LOCAL";

option domain-name-servers ns1.office.local, ns2.office.local;

option ip-forwarding off;

# This way you can specify multiple search domains.

# For Windows clients it doesn't work and need to be

# setup manually

option domain-search "OFFICE.LOCAL", "corp.local";

# Lease time is in seconds

default-lease-time 600;

max-lease-time 7200;

# If this DHCP server is the official DHCP server for

# the local network, the authoritative directive should

# be uncommented.

authoritative;

# Use this to send dhcp log messages to a different log

# file (you also have to hack syslog.conf to complete

# the redirection).

log-facility local7;

subnet 192.168.17.0 netmask 255.255.255.0 {

  pool {

    range 192.168.17.41 192.168.17.199;

  }

  option subnet-mask 255.255.255.0;

  option broadcast-address 192.168.17.255;

  option routers gw1.office.local;        

}

/etc/init.d/isc-dhcp-server restart

Вторичный DNS сервер.

Сначала настроим первичный  DNS сервер.

Добавляем в /etc/bind/named.conf.options следующее:

dnssec-enable yes;

Генерируем MD5 хэш ключ:

dnssec-keygen -r /dev/urandom -a hmac-md5 \

 -b 256 -n host rndc ; cat Krndc.*.private \

 | grep Key ; rm Krndc*

Результат:

Key: 9EKQM+7+EnJzO7TWyayUf0vks4k+SZPf9DAs8fOeREM=

Создаем /etc/bind/transfer.key

key TRANSFER {

        algorithm hmac-md5;

        secret "9EKQM+7+EnJzO7TWyayUf0vks4k+SZPf9DAs8fOeREM=";

};

Защищаем ключ:

chmod o-r /etc/bind/transfer.key

Создаем /etc/bind/named.conf.transfer

include "/etc/bind/transfer.key";

// Slave IP Address

server 192.168.17.3 {

        keys {

        TRANSFER;

    };

};

Добавляем в /etc/bind/named.conf

include "/etc/bind/named.conf.transfer";

Настройка вторичный DNS сервер.

Добавляем в /etc/bind/named.conf.options

dnssec-enable yes;

Вносим в /etc/bind/transfer.key

key TRANSFER {

        algorithm hmac-md5;

        secret "9EKQM+7+EnJzO7TWyayUf0vks4k+SZPf9DAs8fOeREM=";

};

ключ поставить ваш сгенерированный ранее.

Защищаем ключ:

chmod o-r /etc/bind/transfer.key

Добавляем в /etc/bind/named.conf.transfer

include "/etc/bind/transfer.key";

// Master IP Address

server 192.168.17.2 {

        keys {

        TRANSFER;

    };

};

Добавляем в /etc/bind/named.conf

include "/etc/bind/named.conf.transfer";

Указываем SLAVE зоны в /etc/bind/named.conf.local

zone "OFFICE.LOCAL" IN {

       type slave;

       file "/etc/bind/db.OFFICE.LOCAL";

       masters { 192.168.17.2; };

       allow-notify { 192.168.17.2; };

};

zone "17.168.192.IN-ADDR.ARPA" IN {

       type slave;

       file "/etc/bind/db.17.168.192";

       masters { 192.168.17.2; };

       allow-notify { 192.168.17.2; };

};

Копируем форвардинг (если он есть) в вторичный конфиг /etc/bind/named.conf.forward

zone "corp.local" IN {

       type forward;

       forwarders { 192.168.11.2; 192.168.11.3; };

};

Убеждаемся, что bind:bind есть владельцем конфигурации и может принимать обновления от первичного сервера.

chown -R bind:bind /var/chroot/bind9/etc/*

Проверяем синхронизацию времени на серверах. Рестартим bind9 на обоих серверах и убеждаемся, что вторичный получает обновления с первичного.

/etc/init.d/rsyslog restart ; /etc/init.d/bind9 start

Если что то идет не так, смотрим файлы лога:

tail -f /var/log/syslog

Настройка DNS сервера для нашей сети.

Настройка Forward Lookup Zone

(/etc/bind/db.office.local)

$TTL 2d

office.local.    IN     SOA     ns1.office.local. hostmaster.office.local. (

                             2010122201 ; se = serial number

                             6h         ; ref = refresh

                             15m        ; ret = update retry

                             3w         ; ex = expiry

                             3h         ; min = minimum

                             )

              IN     NS      ns1.office.local.

              IN     NS      ns2.office.local.

              IN     MX  10  mail.office.local.

              IN     A       192.168.17.251 #DHCP server

; hosts

gw1           IN     A       192.168.17.1

ns1           IN     A       192.168.17.2

ns2           IN     A       192.168.17.3

Настраиваем Reverse Lookup Zone

/etc/bind/db.17.168.192

$ORIGIN .

$TTL 2d

17.168.192.IN-ADDR.ARPA      IN   SOA   ns1.office.local. hostmaster.office.local. (

                             2010122201 ; se = serial number

                             6h         ; ref = refresh

                             15m        ; ret = update retry

                             3w         ; ex = expiry

                             3h         ; min = minimum

                             )

              IN     NS      ns1.office.local.

              IN     NS      ns2.office.local.

$ORIGIN 17.168.192.IN-ADDR.ARPA.

1             IN     PTR     gw1.office.local.

2             IN     PTR     ns1.office.local.

3             IN     PTR     ns2.office.local.

Добавляем зоны в DNS сервер

/etc/bind/named.conf.local

//

// Do any local configuration here

//

zone "office.local" IN {

       type master;

       file "/etc/bind/db.office.local";

};

zone "17.168.192.IN-ADDR.ARPA" IN {

       type master;

       file "/etc/bind/db.17.168.192";

};

// Consider adding the 1918 zones here, if they are not

// used in your organization

include "/etc/bind/zones.rfc1918";

Форвардинг на другие DNS сервера.

/etc/bind/named.conf.forward

zone "corp.local" IN {

       type forward;

       forwarders { 192.168.11.2; 192.168.11.3; };

};

zone "11.168.192.IN-ADDR.ARPA" IN {

       type forward;

       forwarders { 192.168.11.2; 192.168.11.3; };

};

Добавляем в /etc/bind/named.conf

include "/etc/bind/named.conf.forward";

/etc/init.d/bind9 reload

Форвардинг к IPS DNS серверам.

/etc/bind/named.conf.options 

// forwarders {

//      0.0.0.0;

// };

forwarders {

        192.168.123.123;    # ns1.your-isp.net

        192.168.321.321;    # ns2.your-isp.net

};

Конфигурация клиента.

/etc/resolv.conf

search office.local

nameserver 192.168.17.253