Добавить README.md
This commit is contained in:
588
README.md
Normal file
588
README.md
Normal file
@@ -0,0 +1,588 @@
|
||||
# Домашнее задание 36
|
||||
|
||||
## DNS - настройка и обслуживание
|
||||
|
||||
Для выполнение задания используется стенд https://github.com/erlong15/vagrant-bind
|
||||
|
||||
### Корректировка Vagrantfile
|
||||
|
||||
В иходный Vagrantfile добавлена еще одна VM - Client2 с ip 192.168.50.20
|
||||
|
||||
```bash
|
||||
config.vm.define "client2" do |client2|
|
||||
client2.vm.network "private_network", ip: "192.168.50.20", virtualbox__intnet: "dns"
|
||||
client2.vm.hostname = "client2"
|
||||
end
|
||||
```
|
||||
|
||||
Для ns02 добавлен еще один ip адрес 192.168.50.12
|
||||
|
||||
```bash
|
||||
config.vm.define "ns02" do |ns02|
|
||||
ns02.vm.network "private_network", ip: "192.168.50.11", virtualbox__intnet: "dns"
|
||||
ns02.vm.network "private_network", ip: "192.168.50.12", virtualbox__intnet: "dns"
|
||||
ns02.vm.hostname = "ns02"
|
||||
end
|
||||
```
|
||||
|
||||
Готовый [Vagrantfile](Vagrantfile)
|
||||
|
||||
### Корректировка playbook.yml
|
||||
|
||||
|
||||
Итак цели ДЗ следующие
|
||||
|
||||
Что нужно сделать?
|
||||
1. Взять стенд https://github.com/erlong15/vagrant-bind
|
||||
2. Добавить еще один сервер client2
|
||||
3. Завести в зоне dns.lab:
|
||||
1. имя **web1** - смотрит на клиент1
|
||||
2. имя **web2** - смотрит на клиент2
|
||||
4. Завести еще одну зону newdns.lab
|
||||
5. Завести в зоне newdns.lab запись **www** - смотрит на обоих клиентов
|
||||
6. Настроить **split-dns**
|
||||
1. клиент1 - видит обе зоны, но в зоне **dns.lab** только **web1**
|
||||
2. клиент2 видит только **dns.lab**
|
||||
|
||||
|
||||
Пункты **1** и **2**мы уже выполнили добавить новую VM в Vagratfile
|
||||
|
||||
Первое что сделаем, это отредактируем ссылки на репозитории, добавив в **provisioning/playbook.yml** следующие:
|
||||
```bash
|
||||
- name: update centos repo
|
||||
shell: |
|
||||
sed -i s/mirror.centos.org/vault.centos.org/g /etc/yum.repos.d/CentOS*
|
||||
sed -i s/^#.*baseurl=http/baseurl=http/g /etc/yum.repos.d/CentOS*
|
||||
sed -i s/^mirrorlist=http/#mirrorlist=http/g /etc/yum.repos.d/CentOS*
|
||||
```
|
||||
|
||||
|
||||
Для выполнения целей по ДЗ **3.1** и **3.2**, отредактируем файл **provisioning/named.dns.lab**, добавив имена:
|
||||
**web1** - смотрит на 192.168.50.15 (vm client)
|
||||
**web2** - смотрит на 192.168.50.20 (vm client2)
|
||||
```bash
|
||||
$TTL 3600
|
||||
$ORIGIN dns.lab.
|
||||
@ IN SOA ns01.dns.lab. root.dns.lab. (
|
||||
2711201407 ; serial
|
||||
3600 ; refresh (1 hour)
|
||||
600 ; retry (10 minutes)
|
||||
86400 ; expire (1 day)
|
||||
600 ; minimum (10 minutes)
|
||||
)
|
||||
|
||||
IN NS ns01.dns.lab.
|
||||
IN NS ns02.dns.lab.
|
||||
|
||||
; DNS Servers
|
||||
ns01 IN A 192.168.50.10
|
||||
ns02 IN A 192.168.50.11
|
||||
|
||||
;web1 & web2
|
||||
web1 IN A 192.168.50.15
|
||||
web2 IN A 192.168.50.20
|
||||
|
||||
```
|
||||
|
||||
|
||||
Для выполнения целей по ДЗ **4** и **5** добавим в каталог **provisioning/** кофигурационный файл **named.newdns.lab**, со следующим содержанием:
|
||||
```bash
|
||||
$TTL 3600
|
||||
$ORIGIN newdns.lab.
|
||||
@ IN SOA ns01.newdns.lab. root.newdns.lab. (
|
||||
2711201407 ; serial
|
||||
3600 ; refresh (1 hour)
|
||||
600 ; retry (10 minutes)
|
||||
86400 ; expire (1 day)
|
||||
600 ; minimum (10 minutes)
|
||||
)
|
||||
|
||||
IN NS ns01.newdns.lab.
|
||||
IN NS ns02.newdns.lab.
|
||||
|
||||
; DNS Servers
|
||||
ns01 IN A 192.168.50.10
|
||||
ns02 IN A 192.168.50.11
|
||||
|
||||
;www
|
||||
www IN A 192.168.50.15
|
||||
www IN A 192.168.50.20
|
||||
|
||||
```
|
||||
|
||||
Так же изменим **provisioning/master-named.conf**, добавим туда путь до файла конфигурации новой зоны **newdns.lab**
|
||||
|
||||
```bash
|
||||
// lab's zone
|
||||
zone "newdns.lab" {
|
||||
type master;
|
||||
allow-transfer { key "zonetransfer.key"; };
|
||||
file "/etc/named/named.newdns.lab";
|
||||
};
|
||||
```
|
||||
|
||||
|
||||
Для выполнения целей по ДЗ **6.1** и **6.2** добавим в каталог **provisioning/** еще один кофигурационный файл **named.dns.lab.limit** Со следующим содержимом:
|
||||
|
||||
```bash
|
||||
$TTL 3600
|
||||
$ORIGIN dns.lab.
|
||||
@ IN SOA ns01.dns.lab. root.dns.lab. (
|
||||
2711201407 ; serial
|
||||
3600 ; refresh (1 hour)
|
||||
600 ; retry (10 minutes)
|
||||
86400 ; expire (1 day)
|
||||
600 ; minimum (10 minutes)
|
||||
)
|
||||
|
||||
IN NS ns01.dns.lab.
|
||||
IN NS ns02.dns.lab.
|
||||
|
||||
; DNS Servers
|
||||
ns01 IN A 192.168.50.10
|
||||
ns02 IN A 192.168.50.11
|
||||
|
||||
;web1
|
||||
web1 IN A 192.168.50.15
|
||||
|
||||
```
|
||||
|
||||
Далее требуется изменить **provisioning/master-named.conf** и **provisioning/slave-named.conf** настроив access листы, для правильной работы split-dns
|
||||
|
||||
|
||||
Добавим 2 ACL
|
||||
```bash
|
||||
acl "client" { 192.168.50.15; };
|
||||
acl "client2" { 192.168.50.20; };
|
||||
acl "slave" { 192.168.50.12; };
|
||||
```
|
||||
|
||||
- Для ACL **client** мы добавим разрешие смотреть полность в зону **newdns.lab** а так же в зону **dns.lab** которую мы определили в файле **named.dns.lab.limit**, тем самым **client** будет видить только **web1**/
|
||||
|
||||
- Для ACL **client2** мы добавим разрешие смотреть полность в зону **dns.lab**.
|
||||
|
||||
- ACL **slave** нам нужен для того, что бы забрать парвильную зону named.dns.lab.limit
|
||||
|
||||
- Для всех остальных, разрешим все
|
||||
|
||||
Итого конфигурационный файл **provisioning/master-named.conf**, примет следующий вид:
|
||||
<details>
|
||||
<summary>**provisioning/master-named.conf**. Нажмите, чтобы развернуть</summary>
|
||||
|
||||
```bash
|
||||
options {
|
||||
|
||||
// network
|
||||
listen-on port 53 { 192.168.50.10; };
|
||||
listen-on-v6 port 53 { ::1; };
|
||||
|
||||
// data
|
||||
directory "/var/named";
|
||||
dump-file "/var/named/data/cache_dump.db";
|
||||
statistics-file "/var/named/data/named_stats.txt";
|
||||
memstatistics-file "/var/named/data/named_mem_stats.txt";
|
||||
|
||||
// server
|
||||
recursion yes;
|
||||
allow-query { any; };
|
||||
allow-transfer { any; };
|
||||
|
||||
// dnssec
|
||||
dnssec-enable yes;
|
||||
dnssec-validation yes;
|
||||
|
||||
// others
|
||||
bindkeys-file "/etc/named.iscdlv.key";
|
||||
managed-keys-directory "/var/named/dynamic";
|
||||
pid-file "/run/named/named.pid";
|
||||
session-keyfile "/run/named/session.key";
|
||||
};
|
||||
|
||||
logging {
|
||||
channel default_debug {
|
||||
file "data/named.run";
|
||||
severity dynamic;
|
||||
};
|
||||
};
|
||||
|
||||
// RNDC Control for client
|
||||
key "rndc-key" {
|
||||
algorithm hmac-md5;
|
||||
secret "GrtiE9kz16GK+OKKU/qJvQ==";
|
||||
};
|
||||
controls {
|
||||
inet 192.168.50.10 allow { 192.168.50.15; } keys { "rndc-key"; };
|
||||
};
|
||||
|
||||
|
||||
// ZONE TRANSFER WITH TSIG
|
||||
include "/etc/named.zonetransfer.key";
|
||||
server 192.168.50.11 {
|
||||
keys { "zonetransfer.key"; };
|
||||
};
|
||||
server 192.168.50.12 {
|
||||
keys { "zonetransfer.key"; };
|
||||
};
|
||||
|
||||
acl "client" { 192.168.50.15; };
|
||||
acl "client2" { 192.168.50.20; };
|
||||
acl "slave" { 192.168.50.12; };
|
||||
|
||||
view "client" {
|
||||
match-clients { "client"; "slave"; };
|
||||
zone "dns.lab" {
|
||||
type master;
|
||||
allow-transfer { key "zonetransfer.key"; };
|
||||
file "/etc/named/named.dns.lab.limit";
|
||||
};
|
||||
|
||||
zone "newdns.lab" {
|
||||
type master;
|
||||
allow-transfer { key "zonetransfer.key"; };
|
||||
file "/etc/named/named.newdns.lab";
|
||||
};
|
||||
};
|
||||
|
||||
view "client2" {
|
||||
match-clients { "client2"; };
|
||||
zone "dns.lab" {
|
||||
type master;
|
||||
allow-transfer { key "zonetransfer.key"; };
|
||||
file "/etc/named/named.dns.lab";
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
view "any" {
|
||||
match-clients { "any"; };
|
||||
|
||||
// root zone
|
||||
zone "." IN {
|
||||
type hint;
|
||||
file "named.ca";
|
||||
};
|
||||
|
||||
// zones like localhost
|
||||
include "/etc/named.rfc1912.zones";
|
||||
// root's DNSKEY
|
||||
include "/etc/named.root.key";
|
||||
|
||||
// lab's zone
|
||||
zone "dns.lab" {
|
||||
type master;
|
||||
allow-transfer { key "zonetransfer.key"; };
|
||||
file "/etc/named/named.dns.lab";
|
||||
};
|
||||
|
||||
|
||||
// lab's zone reverse
|
||||
zone "50.168.192.in-addr.arpa" {
|
||||
type master;
|
||||
allow-transfer { key "zonetransfer.key"; };
|
||||
file "/etc/named/named.dns.lab.rev";
|
||||
};
|
||||
|
||||
// lab's ddns zone
|
||||
zone "ddns.lab" {
|
||||
type master;
|
||||
allow-transfer { key "zonetransfer.key"; };
|
||||
allow-update { key "zonetransfer.key"; };
|
||||
file "/etc/named/named.ddns.lab";
|
||||
};
|
||||
|
||||
// newlab's zone
|
||||
zone "newdns.lab" {
|
||||
type master;
|
||||
allow-transfer { key "zonetransfer.key"; };
|
||||
file "/etc/named/named.newdns.lab";
|
||||
};
|
||||
|
||||
};
|
||||
```
|
||||
</details>
|
||||
|
||||
Конфигурационный файл **provisioning/slave-named.conf**, примет следующий вид:
|
||||
|
||||
<details>
|
||||
<summary>**provisioning/slave-named.conf**. Нажмите, чтобы развернуть</summary>
|
||||
|
||||
```bash
|
||||
options {
|
||||
|
||||
// network
|
||||
listen-on port 53 { 192.168.50.11; };
|
||||
listen-on-v6 port 53 { ::1; };
|
||||
|
||||
// data
|
||||
directory "/var/named";
|
||||
dump-file "/var/named/data/cache_dump.db";
|
||||
statistics-file "/var/named/data/named_stats.txt";
|
||||
memstatistics-file "/var/named/data/named_mem_stats.txt";
|
||||
|
||||
// server
|
||||
recursion yes;
|
||||
allow-query { any; };
|
||||
allow-transfer { any; };
|
||||
|
||||
// dnssec
|
||||
dnssec-enable yes;
|
||||
dnssec-validation yes;
|
||||
|
||||
// others
|
||||
bindkeys-file "/etc/named.iscdlv.key";
|
||||
managed-keys-directory "/var/named/dynamic";
|
||||
pid-file "/run/named/named.pid";
|
||||
session-keyfile "/run/named/session.key";
|
||||
};
|
||||
|
||||
logging {
|
||||
channel default_debug {
|
||||
file "data/named.run";
|
||||
severity dynamic;
|
||||
};
|
||||
};
|
||||
|
||||
// RNDC Control for client
|
||||
key "rndc-key" {
|
||||
algorithm hmac-md5;
|
||||
secret "GrtiE9kz16GK+OKKU/qJvQ==";
|
||||
};
|
||||
controls {
|
||||
inet 192.168.50.11 allow { 192.168.50.15; } keys { "rndc-key"; };
|
||||
};
|
||||
|
||||
|
||||
// ZONE TRANSFER WITH TSIG
|
||||
include "/etc/named.zonetransfer.key";
|
||||
server 192.168.50.10 {
|
||||
keys { "zonetransfer.key"; };
|
||||
};
|
||||
|
||||
|
||||
acl "client" { 192.168.50.15; };
|
||||
acl "client2" { 192.168.50.20; };
|
||||
|
||||
view "client" {
|
||||
match-clients { "client"; };
|
||||
zone "dns.lab" {
|
||||
type slave;
|
||||
masters { 192.168.50.10; };
|
||||
transfer-source 192.168.50.12;
|
||||
file "/etc/named/named.dns.lab.limit";
|
||||
};
|
||||
|
||||
zone "newdns.lab" {
|
||||
type slave;
|
||||
masters { 192.168.50.10; };
|
||||
file "/etc/named/named.newdns.lab";
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
|
||||
view "client2" {
|
||||
match-clients { "client2"; };
|
||||
zone "dns.lab" {
|
||||
type slave;
|
||||
masters { 192.168.50.10; };
|
||||
file "/etc/named/named.dns.lab";
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
view "any" {
|
||||
match-clients { "any"; };
|
||||
// root zone
|
||||
zone "." IN {
|
||||
type hint;
|
||||
file "named.ca";
|
||||
};
|
||||
|
||||
// zones like localhost
|
||||
include "/etc/named.rfc1912.zones";
|
||||
// root's DNSKEY
|
||||
include "/etc/named.root.key";
|
||||
|
||||
// lab's zone
|
||||
zone "dns.lab" {
|
||||
type slave;
|
||||
masters { 192.168.50.10; };
|
||||
file "/etc/named/named.dns.lab";
|
||||
};
|
||||
|
||||
// lab's zone reverse
|
||||
zone "50.168.192.in-addr.arpa" {
|
||||
type slave;
|
||||
masters { 192.168.50.10; };
|
||||
file "/etc/named/named.dns.lab.rev";
|
||||
};
|
||||
|
||||
// lab's ddns zone
|
||||
zone "ddns.lab" {
|
||||
type slave;
|
||||
masters { 192.168.50.10; };
|
||||
file "/etc/named/named.ddns.lab";
|
||||
};
|
||||
|
||||
// newlab's zone
|
||||
zone "newdns.lab" {
|
||||
type slave;
|
||||
masters { 192.168.50.10; };
|
||||
file "/etc/named/named.newdns.lab";
|
||||
};
|
||||
};
|
||||
```
|
||||
</details>
|
||||
|
||||
|
||||
Для правильной работы SELinux добавим в **provisioning/playbook.yml** для выполнения на **ns01** и **ns02**
|
||||
```bash
|
||||
- name: SELinux /etc/named
|
||||
file:
|
||||
path: /etc/named
|
||||
setype: named_zone_t
|
||||
recurse: yes
|
||||
```
|
||||
|
||||
|
||||
### Проверка
|
||||
|
||||
Запускаем vagrant
|
||||
```bash
|
||||
alex@ubuntu-pc:~/Документы/36$ vagrant up
|
||||
DEPRECATION: The 'sudo' option for the Ansible provisioner is deprecated.
|
||||
Please use the 'become' option instead.
|
||||
The 'sudo' option will be removed in a future release of Vagrant.
|
||||
|
||||
Bringing machine 'ns01' up with 'virtualbox' provider...
|
||||
Bringing machine 'ns02' up with 'virtualbox' provider...
|
||||
Bringing machine 'client' up with 'virtualbox' provider...
|
||||
Bringing machine 'client2' up with 'virtualbox' provider...
|
||||
==> ns01: Importing base box 'centos/7'...
|
||||
==> ns01: Matching MAC address for NAT networking...
|
||||
==> ns01: Checking if box 'centos/7' version '2004.01' is up to date...
|
||||
==> ns01: Setting the name of the VM: 36_ns01_1774890326153_42178
|
||||
==> ns01: Clearing any previously set network interfaces...
|
||||
==> ns01: Preparing network interfaces based on configuration...
|
||||
ns01: Adapter 1: nat
|
||||
ns01: Adapter 2: intnet
|
||||
==> ns01: Forwarding ports...
|
||||
ns01: 22 (guest) => 2222 (host) (adapter 1)
|
||||
==> ns01: Running 'pre-boot' VM customizations...
|
||||
==> ns01: Booting VM...
|
||||
...
|
||||
|
||||
...
|
||||
changed: [client2] => (item=bind-utils)
|
||||
changed: [client2] => (item=ntp)
|
||||
|
||||
TASK [copy transferkey to all servers and the client] **************************
|
||||
changed: [client2]
|
||||
|
||||
PLAY [ns01] ********************************************************************
|
||||
skipping: no hosts matched
|
||||
|
||||
PLAY [ns02] ********************************************************************
|
||||
skipping: no hosts matched
|
||||
|
||||
PLAY [client] ******************************************************************
|
||||
skipping: no hosts matched
|
||||
|
||||
PLAY RECAP *********************************************************************
|
||||
client2 : ok=4 changed=3 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
|
||||
```
|
||||
|
||||
|
||||
Подключаемся по ssh к VM **client**, и смотрим что будут отдавать DNS сервера на наши запросы
|
||||
```bash
|
||||
[vagrant@client ~]$ nslookup web1.dns.lab 192.168.50.10
|
||||
Server: 192.168.50.10
|
||||
Address: 192.168.50.10#53
|
||||
|
||||
Name: web1.dns.lab
|
||||
Address: 192.168.50.15
|
||||
|
||||
[vagrant@client ~]$ nslookup web2.dns.lab 192.168.50.10
|
||||
Server: 192.168.50.10
|
||||
Address: 192.168.50.10#53
|
||||
|
||||
** server can't find web2.dns.lab: NXDOMAIN
|
||||
|
||||
[vagrant@client ~]$ nslookup web1.dns.lab 192.168.50.11
|
||||
Server: 192.168.50.11
|
||||
Address: 192.168.50.11#53
|
||||
|
||||
Name: web1.dns.lab
|
||||
Address: 192.168.50.15
|
||||
|
||||
[vagrant@client ~]$ nslookup web2.dns.lab 192.168.50.11
|
||||
Server: 192.168.50.11
|
||||
Address: 192.168.50.11#53
|
||||
|
||||
** server can't find web2.dns.lab: NXDOMAIN
|
||||
|
||||
[vagrant@client ~]$ nslookup www.dns.lab 192.168.50.11
|
||||
Server: 192.168.50.11
|
||||
Address: 192.168.50.11#53
|
||||
|
||||
** server can't find www.dns.lab: NXDOMAIN
|
||||
|
||||
[vagrant@client ~]$ nslookup www.dns.lab 192.168.50.10
|
||||
Server: 192.168.50.10
|
||||
Address: 192.168.50.10#53
|
||||
|
||||
** server can't find www.dns.lab: NXDOMAIN
|
||||
```
|
||||
|
||||
Как видим, оба сервера отдают для **client** именно то что и требуются по ДЗ
|
||||
|
||||
Подключаемся по ssh к VM **client2**, и смотрим что будут отдавать там DNS сервера
|
||||
|
||||
```bash
|
||||
[vagrant@client2 ~]$ nslookup web1.dns.lab 192.168.50.10
|
||||
Server: 192.168.50.10
|
||||
Address: 192.168.50.10#53
|
||||
|
||||
Name: web1.dns.lab
|
||||
Address: 192.168.50.15
|
||||
|
||||
[vagrant@client2 ~]$ nslookup web1.dns.lab 192.168.50.11
|
||||
Server: 192.168.50.11
|
||||
Address: 192.168.50.11#53
|
||||
|
||||
Name: web1.dns.lab
|
||||
Address: 192.168.50.15
|
||||
|
||||
[vagrant@client2 ~]$ nslookup web2.dns.lab 192.168.50.11
|
||||
Server: 192.168.50.11
|
||||
Address: 192.168.50.11#53
|
||||
|
||||
Name: web2.dns.lab
|
||||
Address: 192.168.50.20
|
||||
|
||||
[vagrant@client2 ~]$ nslookup web2.dns.lab 192.168.50.10
|
||||
Server: 192.168.50.10
|
||||
Address: 192.168.50.10#53
|
||||
|
||||
Name: web2.dns.lab
|
||||
Address: 192.168.50.20
|
||||
|
||||
[vagrant@client2 ~]$ nslookup www.newdns.lab 192.168.50.10
|
||||
Server: 192.168.50.10
|
||||
Address: 192.168.50.10#53
|
||||
|
||||
** server can't find www.newdns.lab: NXDOMAIN
|
||||
|
||||
[vagrant@client2 ~]$ nslookup www.newdns.lab 192.168.50.11
|
||||
Server: 192.168.50.11
|
||||
Address: 192.168.50.11#53
|
||||
|
||||
** server can't find www.newdns.lab: NXDOMAIN
|
||||
|
||||
```
|
||||
|
||||
Для **client2** так же отдаются верные результаты
|
||||
|
||||
|
||||
Задание выполнено!
|
||||
|
||||
Reference in New Issue
Block a user