Centos - Bind9 setup

package: Bind
              Bind-chroot

After install, copy

named.conf from /usr/share/doc/bind-9.3.6/sample/etc/named.conf

to

/var/named/chroot/etc/

In order for rndc to connect to a named service, there must be a controls statement in the BIND server's /etc/named.conf file.

The controls statement, shown in the following example, allows rndc to connect from the localhost.

controls {

inet 127.0.0.1 allow { localhost; }

keys { <key-name>; };

};

This statement tells named to listen on the default TCP port 953 of the loopback address and allow rndc commands coming from the localhost, if the proper key is given. The <key-name> specifies a name in the key statement within the /etc/named.conf file. The next example illustrates a sample key statement.

key "<key-name>" {

algorithm hmac-md5;

secret "<key-value>";

};

The key is the most important statement in /etc/rndc.conf.

key "<key-name>" {

algorithm hmac-md5;

secret "<key-value>";

};

The <key-name> and <key-value> should be exactly the same as their settings in /etc/named.conf.

To match the keys specified in the target server's /etc/named.conf, add the following lines to /etc/rndc.conf.

options {

default-server localhost;

default-key "<key-name>";

};

ZONE

open named.conf and edit

vi /var/named/chroot/etc/named.conf

---------------------------------------------------------------------------------------------------------
        zone "gab.lan" {
                type master;
                file "gab.lan.zone";
        };
--------------------------------------------------------------------------------------------------------

save it and exit

then at /var/named/chroot/var/named/

create gab.lan.zone

open and edit it 

--------------------------------------------------------------------------------------------------------

$TTL 3h

@       IN      SOA     gab.lan.  root (
                        2011022101;
                        30m; refresh
                        15m; retry interval
                        1W; expire
                        1D); negative cache TTL


@               IN      NS      ns.gab.lan.
forum          IN      A       169.0.0.1.
wiki             IN      A       169.0.0.2.

ns               IN       A       169.0.0.0

--------------------------------------------------------------------------------------------------------

save and exit.

then make a soft link to /var/named

ln -s /var/named/chroot/var/named/gab.lan.zone /var/named/gab.lan.zone

then start the services

/etc/init.d/named start

then you can check the status by using

/etc/init.d/named status

Use dig to check if it is running

dig wiki.gab.lan

if it is setup correct, it will show something like this

------------------------------------------------------------------------------------------------------

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_5.3 <<>> wiki.gab.lan
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50877
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;wiki.gab.lan.            IN      A

;; ANSWER SECTION:
wiki.gab.lan.     10800   IN      A       169.0.0.2

;; AUTHORITY SECTION:

gab.lan.          10800   IN      NS      gab.lan.

;; Query time: 0 msec
;; SERVER: 172.30.10.98#53(172.30.10.98)
;; WHEN: Tue Feb 22 12:18:35 2011
;; MSG SIZE  rcvd: 80

-----------------------------------------------------------------------------------------------------

Highlight out

please highlight out this part from named.conf

----------------------------------------------------------------------------------------------------------

// All BIND 9 zones are in a "view", which allow different zones to be served
// to different types of client addresses, and for options to be set for groups
// of zones.
//
// By default, if named.conf contains no "view" clauses, all zones are in the
// "default" view, which matches all clients.
//
// If named.conf contains any "view" clause, then all zones MUST be in a view;
// so it is recommended to start off using views to avoid having to restructure
// your configuration files in the future.
//
#view "localhost_resolver"
#{
/* This view sets up named to be a localhost resolver ( caching only nameserver ).
 * If all you want is a caching-only nameserver, then you need only define this view:
 */
#       match-clients           { localhost; };
#       match-destinations      { localhost; };
#       recursion yes;
        # all views must contain the root hints zone:
#       include "/etc/named.root.hints";

        /* these are zones that contain definitions for all the localhost
         * names and addresses, as recommended in RFC1912 - these names should
         * ONLY be served to localhost clients:
         */
#       include "/etc/named.rfc1912.zones";
#};
#view "internal"
#{
/* This view will contain zones you want to serve only to "internal" clients
   that connect via your directly attached LAN interfaces - "localnets" .
 */
#       match-clients           { localnets; };
#       match-destinations      { localnets; };
#       recursion yes;
        // all views must contain the root hints zone:
#       include "/etc/named.root.hints";

        // include "named.rfc1912.zones";
        // you should not serve your rfc1912 names to non-localhost clients.
        // These are your "authoritative" internal zones, and would probably
        // also be included in the "localhost_resolver" view above :

#       zone "my.internal.zone" {
#               type master;
#               file "my.internal.zone.db";
#       };
#       zone "my.slave.internal.zone" {
#               type slave;
#               file "slaves/my.slave.internal.zone.db";
#               masters { /* put master nameserver IPs here */ 127.0.0.1; } ;
#               // put slave zones in the slaves/ directory so named can update them
#       };
#       zone "my.ddns.internal.zone" {
#               type master;
#               allow-update { key ddns_key; };
#               file "slaves/my.ddns.internal.zone.db";
#               // put dynamically updateable zones in the slaves/ directory so named can update them
#       };
#};
#key ddns_key
#{
#       algorithm hmac-md5;
#       secret "use /usr/sbin/dns-keygen to generate TSIG keys";
#};
#view    "external"
#{
#/* This view will contain zones you want to serve only to "external" clients
# * that have addresses that are not on your directly attached LAN interface subnets:
# */
#       match-clients           { any; };
#       match-destinations      { any; };
#
#       recursion no;
#       // you'd probably want to deny recursion to external clients, so you don't
#        // end up providing free DNS service to all takers
#
#       allow-query-cache { none; };
#       // Disable lookups for any cached data and root hints
#
#       // all views must contain the root hints zone:
#       include "/etc/named.root.hints";
#
#       // These are your "authoritative" external zones, and would probably
#        // contain entries for just your web and mail servers:
#
#       zone "my.external.zone" {
#               type master;
#               file "my.external.zone.db";
#       };
#};
 

-----------------------------------------------------------------------------------------------------------------

Change the current Linux DNS point back to yourself at

system-config-network

Reverse Zone

at named.conf, add this zone into it

---------------------------------------------------------------------------------------------------------------

        zone "0.0.169.in-addr.arpa." {
                type master;
                file "db.0.0.169";
        };

---------------------------------------------------------------------------------------------------------------

then at /var/named/chroot/var/named

create a db.0.0.169

open and edit it like this

-------------------------------------------------------------------------------------------------------------- 

$TTL 3h

@       IN      SOA     gab.lan.  root (
                        2011022101;
                        30m; refresh
                        15m; retry interval
                        1W; expire
                        1D); negative cache TTL


@               IN      NS      ns.gab.lan.
1                 IN      PTR    forum.gab.lan.

2                 IN      PTR    wiki.gab.lan.
 

--------------------------------------------------------------------------------------------------------------

save it and reload the services

/etc/init.d/named reload

then try to use dig to see success or not

dig -x 169.0.0.1

and you should get something like this

--------------------------------------------------------------------------------------------------------------; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_5.3 <<>> -x 169.0.0.1
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16382
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;1.0.0.169.in-addr.arpa.    IN      PTR

;; ANSWER SECTION:

1.0.0.169.in-addr.arpa. 10800 IN    PTR     forum.gab.lan.0.0.169.in-addr.arpa.

;; AUTHORITY SECTION:

0.0.169.in-addr.arpa. 10800   IN      NS      gab.lan.0.0.169.in-addr.arpa.

;; Query time: 0 msec
;; SERVER: 172.30.10.98#53(172.30.10.98)
;; WHEN: Tue Feb 22 12:37:06 2011
;; MSG SIZE  rcvd: 96

---------------------------------------------------------------------------------------------------------------

Master - Slave

At slave server install and etup bind
open named.conf and add this zone

--------------------------------------------------------------------------------------------------------------
zone "gab.lan" {
     type slave;
     master {192.168.0.0;};
};
--------------------------------------------------------------------------------------------------------------

DNS Round Robin (DNSRR) load balancing

to balance 2 server or more together, just need to add another A entry for that server
example

www     IN     A     192.160.0.1
www     IN     A     192.168.0.2

Add color to shell prompt

$ vi .bash_profile

add this column into it
# add color to shell prompt

export PS1="\e[0;31m[\u@\h \W]\$ \e[m"

Here is the description 

\e = start color scheme
0;31 = choice of color
\u = Display the current username
\h = Display the hostname

\W = Print the current working directory
\e[m = Stop color scheme 

$PS1 is your shell prompt

additional
\H = Display FQDN hostname
\@ = Display current time in 12-hour am/pm format

List of Color code

Color	Code
Black	0;30
Blue	0;34
Green	0;32
Cyan	0;36
Red	0;31
Purple	0;35
Brown	0;33

Replace digit 0 with 1 to get light color version.

Prevent Accident Shutdown/Reboot

In order to prevent root or super users accidentally shutdown or reboot the Linux server, you can apply the follow method:

1. Login to root, and edit /etc/profile with vi
2. Add the following to the end of file /etc/profile

safereboot () {
      echo -e "\033[32;1m\ \      / / \  |  _ \| \ | |_ _| \ | |/ ___| |\033[0m"
      echo -e "\033[32;1m \ \ /\ / / _ \ | |_) |  \| || ||  \| | |  _| |\033[0m"
      echo -e "\033[32;1m  \ V  V / ___ \|  _ <| |\  || || |\  | |_| |_|\033[0m"
      echo -e "\033[32;1m   \_/\_/_/   \_\_| \_\_| \_|___|_| \_|\____(_)\033[0m"
      echo -e "Are you sure you wanna \033[31;1mSHUTDOWN\033[0m? (Type HOSTNAME to confirm)"
      read confirm
      if [ "$HOSTNAME" == "$confirm" ]; then
              sudo /sbin/shutdown -r +1
      else
              echo "SHUTDOWN aborted..."
      fi
  }
  alias reboot='safereboot'
  alias shutdown='safereboot'
  alias poweroff='safereboot'

eight basic EGA colors are defined as follows: 

30    black foreground

31    red foreground

32    green foreground

33    brown foreground

34    blue foreground

35    magenta (purple) foreground

36    cyan (light blue) foreground

37    gray foreground
 

How to Sniff Network Traffic

How-to

We will use WireShark to sniff the network traffic
so we will need to install the WireShark by

yum instal wireshark

Due to Wireshark is GUI base, we only eed to use one of its Wireshark function which is Tshark

tshark -V -R "filter"

-V will show all the details
-R “filter” will apply the filter rule

Example
If you want to sniff MSN chat, then you need to input:

tshark -V -R "msnms"

If you want to sniff google talk chat, then you need to input:

tshark -V -R "jabber"

If you want to capture all the traffic in the network, then you need to input:

tshark -V

If you want to capture traffic only to a specific destination such as talk.google.com, then you need to input:

tshark -V -R "ip.dst == talk.google.com"
  

due to a lot of traffic, it will be very hard to see so fast, so you will need to record it down to a document for easy reading

tshark -V -R "msnms" > data
vi data

Note

If the chat message is encrypted, it will show as encrypted or truncated
Please refer to the reference below for more filter list

Reference

• http://www.codealias.info/technotes/the_tshark_capture_and_filter_example_page - example
• http://www.manpagez.com/man/4/wireshark-filter/ - filter list

OpenVPN for PfSense

First of all you need to have keys and certificates generated in order to configure the pfSense OpenVPN service;

1. Download and install the most recent software from http://openvpn.net/download.html
   If you plan to connect from a PC with Windows Vista you should get version 2.1 or newer.
2. Use the default options
   Start a command prompt with administrator-rights!
3. Change directory to c:\programfiles\openvpn\easy-rsa
4. run the “init-config.bat” file
5. Edit 'vars.bat' file.
   The following things need to be edited:
   set KEY_COUNTRY=MY
   set KEY_PROVINCE=na
   set KEY_CITY=KL
   set KEY_ORG=OffGamers
   set KEY_EMAIL=youremail@my.offgamers.com
   Save the file
6. Run “vars.bat”
7. Run “clean-all.bat”
8. Run “build-ca.bat“
   Then you are prompted for some different things; Leave them at default, except “Common Name” - put something like “Soekris”
9. Run “build-key-server.bat server“
   Again you are prompted; leave them on default except “Common Name” - use “server”
   Run build-dh.bat

Client

Now its time to generate keys and certificates for the client(s)

• Run “build-key.bat client1“
  Again you are prompted; leave them on default except “Common Name” - here you should put in “client1” (or whatever you have called it)
  The client1 will be the name of the keys, certificate and the name you identify the connection on later. You can use whatever name you like, and generate as many as you want (with different names).
• The following files should now be copied from c:\Program Files\openvpn\ to c:\Program Files\openvpn\config
  easy-rsa\keys\ca.crt
  client1.key
  client1.crt
  (if you dont see a .crt file but only a .csr file, chances are that you dont have admin priviligies. Worst case generate the keys and certificates on a NON-Vista machine)
• Make a file in the c:\Program Files\openvpn\config called “client1.ovpn” and the file should contain

client
dev tun
proto udp
remote 203.223.138.226
ping 10
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
comp-lzo
pull
verb 3

• Put your soekris public IP after the 'remote' attribute

pfsense

• Log into the web-gui of pfSense
• Select VPN > OpenVPN and add an entry in the 'server' page
  Use the following settings:

Protocol: UDP
Local port: 1194
Address pool: 172.30.13.0/24 

(it should be a network that you DONT currently use)
Local Network: 172.30.10.0/24 

!!UPDATE: Note to add this value, you need to first save the setting and EDIT the settings again!!
Remote Network: blank
Cryptography: BF-CBC (128 bit) - or use what you want
Authentication Method: PKI

Now you need to have access to some of the files created in **c:\Program Files\openvpn\easy-rsa\keys** (mentioned in #12)
* Copy the WHOLE content of ca.crt into the "CA certificate" window
* Copy the WHOLE content of server.crt into the "Server Certificate" window
* Copy the WHOLE content of server.key into the "Server Key" window
* Copy the WHOLE content of dh1024.pem into the "DH parameters" window

• Tick DHCP-Opt: Disable NetBIOS (I dont use it anyway)
• Tick LZO Compression

— Now we need a few simple rules in the firewall —

• Go to Firewall > rules
• On the WAN interface you should make a rule that;

PASS

WAN
Protocol: UDP
source: any
OS type: any
Destination: any
Destination port range from: OpenVPN
Destination port range to: OpenVPN
Tick in the LOG
Leave the rest at default.

• and another rule on the interface called LAN

PASS
Any protocol
Source: LAN