Wiki » Historique » Version 1
sacha, 25/12/2022 23:44
| 1 | 1 | sacha | # DNS récursif Ouvert DoH DoT & HA |
|---|---|---|---|
| 2 | |||
| 3 | Aquilenet propose deux serveurs DNS ouverts cf https://www.aquilenet.fr/services/dns/ |
||
| 4 | On a mis DNS ouvert aussi sur l'IP 45.67.81.23 car facile à retenir, c'est l'adresse de dns.aquilenet.fr (voir [http://dns.aquilenet.fr](http://dns.aquilenet.fr)) . Nous en avons profité pour ajouter DoH et DoT et d'avoir cette adresse en IP Virtuelle partagée entre Gaia et Hades. |
||
| 5 | |||
| 6 | |||
| 7 | ## Apache2 |
||
| 8 | |||
| 9 | * /etc/apache2/sites-enabled/dns.aquilenet.fr.conf |
||
| 10 | ~~~ |
||
| 11 | <VirtualHost *:80> |
||
| 12 | ServerAdmin webmaster@aquilenet.fr |
||
| 13 | ServerName dns.aquilenet.fr |
||
| 14 | DocumentRoot /srv/www/dns.aquilenet.fr |
||
| 15 | |||
| 16 | ErrorLog ${APACHE_LOG_DIR}/dns.aqln.error.log |
||
| 17 | LogLevel warn |
||
| 18 | CustomLog ${APACHE_LOG_DIR}/dns.aqln.access.log combined |
||
| 19 | |||
| 20 | Alias /.well-known/acme-challenge /srv/letsencrypt/challenges/dns.aquilenet.fr |
||
| 21 | <Directory /srv/letsencrypt/challenges/dns.aquilenet.fr> |
||
| 22 | Require all granted |
||
| 23 | </Directory> |
||
| 24 | <Directory /> |
||
| 25 | Options FollowSymLinks |
||
| 26 | AllowOverride None |
||
| 27 | Require all granted |
||
| 28 | </Directory> |
||
| 29 | </VirtualHost> |
||
| 30 | ~~~ |
||
| 31 | |||
| 32 | ## Génération du certificat SSL |
||
| 33 | |||
| 34 | ~~~ |
||
| 35 | certbot --apache --agree-tos --email sysop@aquilenet.fr -d dns.aquilenet.fr |
||
| 36 | chgrp bind /etc/letsencrypt/live/dns.aquilenet.fr/privkey.pem |
||
| 37 | chmod 0640 /etc/letsencrypt/live/dns.aquilenet.fr/privkey.pem |
||
| 38 | openssl dhparam -out /etc/bind/dhparam.pem 4096 |
||
| 39 | ~~~ |
||
| 40 | |||
| 41 | Copie du certificat sur gaia |
||
| 42 | |||
| 43 | * /etc/letsencrypt/renewal-hooks/post/sync-cert.sh |
||
| 44 | ~~~ |
||
| 45 | #!/bin/bash |
||
| 46 | rsync -aPHSA /etc/letsencrypt/archive/dns.aquilenet.fr gaia:/etc/letsencrypt/archive/ |
||
| 47 | ~~~ |
||
| 48 | |||
| 49 | ## Bind9 |
||
| 50 | |||
| 51 | BIND 9.17.10 implémente DoH, au jour de l'installation il n'est disponible que dans les backports bullseye (A changer quand il sera dans main). |
||
| 52 | |||
| 53 | * /etc/bind/named.conf.options |
||
| 54 | |||
| 55 | Dans la catégorie "options {" |
||
| 56 | ~~~ |
||
| 57 | listen-on-v6 { 2a0c:e300::101; }; |
||
| 58 | listen-on { 185.233.100.101; 45.67.81.23; }; |
||
| 59 | # DOH |
||
| 60 | listen-on port 443 tls local-tls http default { 45.67.81.23; }; |
||
| 61 | # DoT |
||
| 62 | listen-on port 853 tls local-tls { 45.67.81.23; }; |
||
| 63 | recursion yes; |
||
| 64 | dnssec-validation auto; |
||
| 65 | ~~~ |
||
| 66 | |||
| 67 | ~~~ |
||
| 68 | # DoH DoT |
||
| 69 | tls local-tls { |
||
| 70 | key-file "/etc/letsencrypt/live/dns.aquilenet.fr/privkey.pem"; |
||
| 71 | cert-file "/etc/letsencrypt/live/dns.aquilenet.fr/fullchain.pem"; |
||
| 72 | dhparam-file "/etc/bind/dhparam.pem"; |
||
| 73 | protocols { TLSv1.2; TLSv1.3; }; |
||
| 74 | ciphers "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256"; |
||
| 75 | prefer-server-ciphers yes; |
||
| 76 | session-tickets no; |
||
| 77 | }; |
||
| 78 | ~~~ |
||
| 79 | |||
| 80 | * /etc/apparmor.d/local/usr.sbin.named |
||
| 81 | |||
| 82 | ~~~ |
||
| 83 | /etc/letsencrypt/** r, |
||
| 84 | ~~~ |
||
| 85 | `apparmor_parser -r /etc/apparmor.d/usr.sbin.named` |