589 lines
17 KiB
Markdown
589 lines
17 KiB
Markdown
# Домашнее задание 36
|
||
|
||
## DNS - настройка и обслуживание
|
||
|
||
Для выполнение задания используется стенд https://github.com/erlong15/vagrant-bind
|
||
|
||
### Корректировка Vagrantfile
|
||
|
||
В иходный Vagrantfile добавлена еще одна VM - Client2 с ip 192.168.50.20
|
||
|
||
```bash
|
||
config.vm.define "client2" do |client2|
|
||
client2.vm.network "private_network", ip: "192.168.50.20", virtualbox__intnet: "dns"
|
||
client2.vm.hostname = "client2"
|
||
end
|
||
```
|
||
|
||
Для ns02 добавлен еще один ip адрес 192.168.50.12
|
||
|
||
```bash
|
||
config.vm.define "ns02" do |ns02|
|
||
ns02.vm.network "private_network", ip: "192.168.50.11", virtualbox__intnet: "dns"
|
||
ns02.vm.network "private_network", ip: "192.168.50.12", virtualbox__intnet: "dns"
|
||
ns02.vm.hostname = "ns02"
|
||
end
|
||
```
|
||
|
||
Готовый [Vagrantfile](Vagrantfile)
|
||
|
||
### Корректировка playbook.yml
|
||
|
||
|
||
Итак цели ДЗ следующие
|
||
|
||
Что нужно сделать?
|
||
1. Взять стенд https://github.com/erlong15/vagrant-bind
|
||
2. Добавить еще один сервер client2
|
||
3. Завести в зоне dns.lab:
|
||
1. имя **web1** - смотрит на клиент1
|
||
2. имя **web2** - смотрит на клиент2
|
||
4. Завести еще одну зону newdns.lab
|
||
5. Завести в зоне newdns.lab запись **www** - смотрит на обоих клиентов
|
||
6. Настроить **split-dns**
|
||
1. клиент1 - видит обе зоны, но в зоне **dns.lab** только **web1**
|
||
2. клиент2 видит только **dns.lab**
|
||
|
||
|
||
Пункты **1** и **2**мы уже выполнили добавить новую VM в Vagratfile
|
||
|
||
Первое что сделаем, это отредактируем ссылки на репозитории, добавив в **provisioning/playbook.yml** следующие:
|
||
```bash
|
||
- name: update centos repo
|
||
shell: |
|
||
sed -i s/mirror.centos.org/vault.centos.org/g /etc/yum.repos.d/CentOS*
|
||
sed -i s/^#.*baseurl=http/baseurl=http/g /etc/yum.repos.d/CentOS*
|
||
sed -i s/^mirrorlist=http/#mirrorlist=http/g /etc/yum.repos.d/CentOS*
|
||
```
|
||
|
||
|
||
Для выполнения целей по ДЗ **3.1** и **3.2**, отредактируем файл **provisioning/named.dns.lab**, добавив имена:
|
||
**web1** - смотрит на 192.168.50.15 (vm client)
|
||
**web2** - смотрит на 192.168.50.20 (vm client2)
|
||
```bash
|
||
$TTL 3600
|
||
$ORIGIN dns.lab.
|
||
@ IN SOA ns01.dns.lab. root.dns.lab. (
|
||
2711201407 ; serial
|
||
3600 ; refresh (1 hour)
|
||
600 ; retry (10 minutes)
|
||
86400 ; expire (1 day)
|
||
600 ; minimum (10 minutes)
|
||
)
|
||
|
||
IN NS ns01.dns.lab.
|
||
IN NS ns02.dns.lab.
|
||
|
||
; DNS Servers
|
||
ns01 IN A 192.168.50.10
|
||
ns02 IN A 192.168.50.11
|
||
|
||
;web1 & web2
|
||
web1 IN A 192.168.50.15
|
||
web2 IN A 192.168.50.20
|
||
|
||
```
|
||
|
||
|
||
Для выполнения целей по ДЗ **4** и **5** добавим в каталог **provisioning/** кофигурационный файл **named.newdns.lab**, со следующим содержанием:
|
||
```bash
|
||
$TTL 3600
|
||
$ORIGIN newdns.lab.
|
||
@ IN SOA ns01.newdns.lab. root.newdns.lab. (
|
||
2711201407 ; serial
|
||
3600 ; refresh (1 hour)
|
||
600 ; retry (10 minutes)
|
||
86400 ; expire (1 day)
|
||
600 ; minimum (10 minutes)
|
||
)
|
||
|
||
IN NS ns01.newdns.lab.
|
||
IN NS ns02.newdns.lab.
|
||
|
||
; DNS Servers
|
||
ns01 IN A 192.168.50.10
|
||
ns02 IN A 192.168.50.11
|
||
|
||
;www
|
||
www IN A 192.168.50.15
|
||
www IN A 192.168.50.20
|
||
|
||
```
|
||
|
||
Так же изменим **provisioning/master-named.conf**, добавим туда путь до файла конфигурации новой зоны **newdns.lab**
|
||
|
||
```bash
|
||
// lab's zone
|
||
zone "newdns.lab" {
|
||
type master;
|
||
allow-transfer { key "zonetransfer.key"; };
|
||
file "/etc/named/named.newdns.lab";
|
||
};
|
||
```
|
||
|
||
|
||
Для выполнения целей по ДЗ **6.1** и **6.2** добавим в каталог **provisioning/** еще один кофигурационный файл **named.dns.lab.limit** Со следующим содержимом:
|
||
|
||
```bash
|
||
$TTL 3600
|
||
$ORIGIN dns.lab.
|
||
@ IN SOA ns01.dns.lab. root.dns.lab. (
|
||
2711201407 ; serial
|
||
3600 ; refresh (1 hour)
|
||
600 ; retry (10 minutes)
|
||
86400 ; expire (1 day)
|
||
600 ; minimum (10 minutes)
|
||
)
|
||
|
||
IN NS ns01.dns.lab.
|
||
IN NS ns02.dns.lab.
|
||
|
||
; DNS Servers
|
||
ns01 IN A 192.168.50.10
|
||
ns02 IN A 192.168.50.11
|
||
|
||
;web1
|
||
web1 IN A 192.168.50.15
|
||
|
||
```
|
||
|
||
Далее требуется изменить **provisioning/master-named.conf** и **provisioning/slave-named.conf** настроив access листы, для правильной работы split-dns
|
||
|
||
|
||
Добавим 2 ACL
|
||
```bash
|
||
acl "client" { 192.168.50.15; };
|
||
acl "client2" { 192.168.50.20; };
|
||
acl "slave" { 192.168.50.12; };
|
||
```
|
||
|
||
- Для ACL **client** мы добавим разрешие смотреть полность в зону **newdns.lab** а так же в зону **dns.lab** которую мы определили в файле **named.dns.lab.limit**, тем самым **client** будет видить только **web1**/
|
||
|
||
- Для ACL **client2** мы добавим разрешие смотреть полность в зону **dns.lab**.
|
||
|
||
- ACL **slave** нам нужен для того, что бы забрать парвильную зону named.dns.lab.limit
|
||
|
||
- Для всех остальных, разрешим все
|
||
|
||
Итого конфигурационный файл **provisioning/master-named.conf**, примет следующий вид:
|
||
<details>
|
||
<summary>**provisioning/master-named.conf**. Нажмите, чтобы развернуть</summary>
|
||
|
||
```bash
|
||
options {
|
||
|
||
// network
|
||
listen-on port 53 { 192.168.50.10; };
|
||
listen-on-v6 port 53 { ::1; };
|
||
|
||
// data
|
||
directory "/var/named";
|
||
dump-file "/var/named/data/cache_dump.db";
|
||
statistics-file "/var/named/data/named_stats.txt";
|
||
memstatistics-file "/var/named/data/named_mem_stats.txt";
|
||
|
||
// server
|
||
recursion yes;
|
||
allow-query { any; };
|
||
allow-transfer { any; };
|
||
|
||
// dnssec
|
||
dnssec-enable yes;
|
||
dnssec-validation yes;
|
||
|
||
// others
|
||
bindkeys-file "/etc/named.iscdlv.key";
|
||
managed-keys-directory "/var/named/dynamic";
|
||
pid-file "/run/named/named.pid";
|
||
session-keyfile "/run/named/session.key";
|
||
};
|
||
|
||
logging {
|
||
channel default_debug {
|
||
file "data/named.run";
|
||
severity dynamic;
|
||
};
|
||
};
|
||
|
||
// RNDC Control for client
|
||
key "rndc-key" {
|
||
algorithm hmac-md5;
|
||
secret "GrtiE9kz16GK+OKKU/qJvQ==";
|
||
};
|
||
controls {
|
||
inet 192.168.50.10 allow { 192.168.50.15; } keys { "rndc-key"; };
|
||
};
|
||
|
||
|
||
// ZONE TRANSFER WITH TSIG
|
||
include "/etc/named.zonetransfer.key";
|
||
server 192.168.50.11 {
|
||
keys { "zonetransfer.key"; };
|
||
};
|
||
server 192.168.50.12 {
|
||
keys { "zonetransfer.key"; };
|
||
};
|
||
|
||
acl "client" { 192.168.50.15; };
|
||
acl "client2" { 192.168.50.20; };
|
||
acl "slave" { 192.168.50.12; };
|
||
|
||
view "client" {
|
||
match-clients { "client"; "slave"; };
|
||
zone "dns.lab" {
|
||
type master;
|
||
allow-transfer { key "zonetransfer.key"; };
|
||
file "/etc/named/named.dns.lab.limit";
|
||
};
|
||
|
||
zone "newdns.lab" {
|
||
type master;
|
||
allow-transfer { key "zonetransfer.key"; };
|
||
file "/etc/named/named.newdns.lab";
|
||
};
|
||
};
|
||
|
||
view "client2" {
|
||
match-clients { "client2"; };
|
||
zone "dns.lab" {
|
||
type master;
|
||
allow-transfer { key "zonetransfer.key"; };
|
||
file "/etc/named/named.dns.lab";
|
||
};
|
||
|
||
};
|
||
|
||
view "any" {
|
||
match-clients { "any"; };
|
||
|
||
// root zone
|
||
zone "." IN {
|
||
type hint;
|
||
file "named.ca";
|
||
};
|
||
|
||
// zones like localhost
|
||
include "/etc/named.rfc1912.zones";
|
||
// root's DNSKEY
|
||
include "/etc/named.root.key";
|
||
|
||
// lab's zone
|
||
zone "dns.lab" {
|
||
type master;
|
||
allow-transfer { key "zonetransfer.key"; };
|
||
file "/etc/named/named.dns.lab";
|
||
};
|
||
|
||
|
||
// lab's zone reverse
|
||
zone "50.168.192.in-addr.arpa" {
|
||
type master;
|
||
allow-transfer { key "zonetransfer.key"; };
|
||
file "/etc/named/named.dns.lab.rev";
|
||
};
|
||
|
||
// lab's ddns zone
|
||
zone "ddns.lab" {
|
||
type master;
|
||
allow-transfer { key "zonetransfer.key"; };
|
||
allow-update { key "zonetransfer.key"; };
|
||
file "/etc/named/named.ddns.lab";
|
||
};
|
||
|
||
// newlab's zone
|
||
zone "newdns.lab" {
|
||
type master;
|
||
allow-transfer { key "zonetransfer.key"; };
|
||
file "/etc/named/named.newdns.lab";
|
||
};
|
||
|
||
};
|
||
```
|
||
</details>
|
||
|
||
Конфигурационный файл **provisioning/slave-named.conf**, примет следующий вид:
|
||
|
||
<details>
|
||
<summary>**provisioning/slave-named.conf**. Нажмите, чтобы развернуть</summary>
|
||
|
||
```bash
|
||
options {
|
||
|
||
// network
|
||
listen-on port 53 { 192.168.50.11; };
|
||
listen-on-v6 port 53 { ::1; };
|
||
|
||
// data
|
||
directory "/var/named";
|
||
dump-file "/var/named/data/cache_dump.db";
|
||
statistics-file "/var/named/data/named_stats.txt";
|
||
memstatistics-file "/var/named/data/named_mem_stats.txt";
|
||
|
||
// server
|
||
recursion yes;
|
||
allow-query { any; };
|
||
allow-transfer { any; };
|
||
|
||
// dnssec
|
||
dnssec-enable yes;
|
||
dnssec-validation yes;
|
||
|
||
// others
|
||
bindkeys-file "/etc/named.iscdlv.key";
|
||
managed-keys-directory "/var/named/dynamic";
|
||
pid-file "/run/named/named.pid";
|
||
session-keyfile "/run/named/session.key";
|
||
};
|
||
|
||
logging {
|
||
channel default_debug {
|
||
file "data/named.run";
|
||
severity dynamic;
|
||
};
|
||
};
|
||
|
||
// RNDC Control for client
|
||
key "rndc-key" {
|
||
algorithm hmac-md5;
|
||
secret "GrtiE9kz16GK+OKKU/qJvQ==";
|
||
};
|
||
controls {
|
||
inet 192.168.50.11 allow { 192.168.50.15; } keys { "rndc-key"; };
|
||
};
|
||
|
||
|
||
// ZONE TRANSFER WITH TSIG
|
||
include "/etc/named.zonetransfer.key";
|
||
server 192.168.50.10 {
|
||
keys { "zonetransfer.key"; };
|
||
};
|
||
|
||
|
||
acl "client" { 192.168.50.15; };
|
||
acl "client2" { 192.168.50.20; };
|
||
|
||
view "client" {
|
||
match-clients { "client"; };
|
||
zone "dns.lab" {
|
||
type slave;
|
||
masters { 192.168.50.10; };
|
||
transfer-source 192.168.50.12;
|
||
file "/etc/named/named.dns.lab.limit";
|
||
};
|
||
|
||
zone "newdns.lab" {
|
||
type slave;
|
||
masters { 192.168.50.10; };
|
||
file "/etc/named/named.newdns.lab";
|
||
};
|
||
|
||
};
|
||
|
||
|
||
view "client2" {
|
||
match-clients { "client2"; };
|
||
zone "dns.lab" {
|
||
type slave;
|
||
masters { 192.168.50.10; };
|
||
file "/etc/named/named.dns.lab";
|
||
};
|
||
|
||
};
|
||
|
||
view "any" {
|
||
match-clients { "any"; };
|
||
// root zone
|
||
zone "." IN {
|
||
type hint;
|
||
file "named.ca";
|
||
};
|
||
|
||
// zones like localhost
|
||
include "/etc/named.rfc1912.zones";
|
||
// root's DNSKEY
|
||
include "/etc/named.root.key";
|
||
|
||
// lab's zone
|
||
zone "dns.lab" {
|
||
type slave;
|
||
masters { 192.168.50.10; };
|
||
file "/etc/named/named.dns.lab";
|
||
};
|
||
|
||
// lab's zone reverse
|
||
zone "50.168.192.in-addr.arpa" {
|
||
type slave;
|
||
masters { 192.168.50.10; };
|
||
file "/etc/named/named.dns.lab.rev";
|
||
};
|
||
|
||
// lab's ddns zone
|
||
zone "ddns.lab" {
|
||
type slave;
|
||
masters { 192.168.50.10; };
|
||
file "/etc/named/named.ddns.lab";
|
||
};
|
||
|
||
// newlab's zone
|
||
zone "newdns.lab" {
|
||
type slave;
|
||
masters { 192.168.50.10; };
|
||
file "/etc/named/named.newdns.lab";
|
||
};
|
||
};
|
||
```
|
||
</details>
|
||
|
||
|
||
Для правильной работы SELinux добавим в **provisioning/playbook.yml** для выполнения на **ns01** и **ns02**
|
||
```bash
|
||
- name: SELinux /etc/named
|
||
file:
|
||
path: /etc/named
|
||
setype: named_zone_t
|
||
recurse: yes
|
||
```
|
||
|
||
|
||
### Проверка
|
||
|
||
Запускаем vagrant
|
||
```bash
|
||
alex@ubuntu-pc:~/Документы/36$ vagrant up
|
||
DEPRECATION: The 'sudo' option for the Ansible provisioner is deprecated.
|
||
Please use the 'become' option instead.
|
||
The 'sudo' option will be removed in a future release of Vagrant.
|
||
|
||
Bringing machine 'ns01' up with 'virtualbox' provider...
|
||
Bringing machine 'ns02' up with 'virtualbox' provider...
|
||
Bringing machine 'client' up with 'virtualbox' provider...
|
||
Bringing machine 'client2' up with 'virtualbox' provider...
|
||
==> ns01: Importing base box 'centos/7'...
|
||
==> ns01: Matching MAC address for NAT networking...
|
||
==> ns01: Checking if box 'centos/7' version '2004.01' is up to date...
|
||
==> ns01: Setting the name of the VM: 36_ns01_1774890326153_42178
|
||
==> ns01: Clearing any previously set network interfaces...
|
||
==> ns01: Preparing network interfaces based on configuration...
|
||
ns01: Adapter 1: nat
|
||
ns01: Adapter 2: intnet
|
||
==> ns01: Forwarding ports...
|
||
ns01: 22 (guest) => 2222 (host) (adapter 1)
|
||
==> ns01: Running 'pre-boot' VM customizations...
|
||
==> ns01: Booting VM...
|
||
...
|
||
|
||
...
|
||
changed: [client2] => (item=bind-utils)
|
||
changed: [client2] => (item=ntp)
|
||
|
||
TASK [copy transferkey to all servers and the client] **************************
|
||
changed: [client2]
|
||
|
||
PLAY [ns01] ********************************************************************
|
||
skipping: no hosts matched
|
||
|
||
PLAY [ns02] ********************************************************************
|
||
skipping: no hosts matched
|
||
|
||
PLAY [client] ******************************************************************
|
||
skipping: no hosts matched
|
||
|
||
PLAY RECAP *********************************************************************
|
||
client2 : ok=4 changed=3 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
|
||
```
|
||
|
||
|
||
Подключаемся по ssh к VM **client**, и смотрим что будут отдавать DNS сервера на наши запросы
|
||
```bash
|
||
[vagrant@client ~]$ nslookup web1.dns.lab 192.168.50.10
|
||
Server: 192.168.50.10
|
||
Address: 192.168.50.10#53
|
||
|
||
Name: web1.dns.lab
|
||
Address: 192.168.50.15
|
||
|
||
[vagrant@client ~]$ nslookup web2.dns.lab 192.168.50.10
|
||
Server: 192.168.50.10
|
||
Address: 192.168.50.10#53
|
||
|
||
** server can't find web2.dns.lab: NXDOMAIN
|
||
|
||
[vagrant@client ~]$ nslookup web1.dns.lab 192.168.50.11
|
||
Server: 192.168.50.11
|
||
Address: 192.168.50.11#53
|
||
|
||
Name: web1.dns.lab
|
||
Address: 192.168.50.15
|
||
|
||
[vagrant@client ~]$ nslookup web2.dns.lab 192.168.50.11
|
||
Server: 192.168.50.11
|
||
Address: 192.168.50.11#53
|
||
|
||
** server can't find web2.dns.lab: NXDOMAIN
|
||
|
||
[vagrant@client ~]$ nslookup www.dns.lab 192.168.50.11
|
||
Server: 192.168.50.11
|
||
Address: 192.168.50.11#53
|
||
|
||
** server can't find www.dns.lab: NXDOMAIN
|
||
|
||
[vagrant@client ~]$ nslookup www.dns.lab 192.168.50.10
|
||
Server: 192.168.50.10
|
||
Address: 192.168.50.10#53
|
||
|
||
** server can't find www.dns.lab: NXDOMAIN
|
||
```
|
||
|
||
Как видим, оба сервера отдают для **client** именно то что и требуются по ДЗ
|
||
|
||
Подключаемся по ssh к VM **client2**, и смотрим что будут отдавать там DNS сервера
|
||
|
||
```bash
|
||
[vagrant@client2 ~]$ nslookup web1.dns.lab 192.168.50.10
|
||
Server: 192.168.50.10
|
||
Address: 192.168.50.10#53
|
||
|
||
Name: web1.dns.lab
|
||
Address: 192.168.50.15
|
||
|
||
[vagrant@client2 ~]$ nslookup web1.dns.lab 192.168.50.11
|
||
Server: 192.168.50.11
|
||
Address: 192.168.50.11#53
|
||
|
||
Name: web1.dns.lab
|
||
Address: 192.168.50.15
|
||
|
||
[vagrant@client2 ~]$ nslookup web2.dns.lab 192.168.50.11
|
||
Server: 192.168.50.11
|
||
Address: 192.168.50.11#53
|
||
|
||
Name: web2.dns.lab
|
||
Address: 192.168.50.20
|
||
|
||
[vagrant@client2 ~]$ nslookup web2.dns.lab 192.168.50.10
|
||
Server: 192.168.50.10
|
||
Address: 192.168.50.10#53
|
||
|
||
Name: web2.dns.lab
|
||
Address: 192.168.50.20
|
||
|
||
[vagrant@client2 ~]$ nslookup www.newdns.lab 192.168.50.10
|
||
Server: 192.168.50.10
|
||
Address: 192.168.50.10#53
|
||
|
||
** server can't find www.newdns.lab: NXDOMAIN
|
||
|
||
[vagrant@client2 ~]$ nslookup www.newdns.lab 192.168.50.11
|
||
Server: 192.168.50.11
|
||
Address: 192.168.50.11#53
|
||
|
||
** server can't find www.newdns.lab: NXDOMAIN
|
||
|
||
```
|
||
|
||
Для **client2** так же отдаются верные результаты
|
||
|
||
|
||
Задание выполнено!
|
||
|