Wiki » Historique » Version 3
sacha, 26/12/2022 00:07
| 1 | 1 | sacha | # DNS récursif Ouvert DoH DoT & HA |
|---|---|---|---|
| 2 | |||
| 3 | Aquilenet propose deux serveurs DNS ouverts cf https://www.aquilenet.fr/services/dns/ |
||
| 4 | 3 | sacha | On a mis aussi un DNS ouvert aussi sur l'IP 45.67.81.23 car facile à retenir, c'est l'adresse de dns.aquilenet.fr (voir [http://dns.aquilenet.fr](http://dns.aquilenet.fr)) . Nous en avons profité pour ajouter DoH et DoT et d'avoir cette adresse en IP Virtuelle partagée entre Gaia et Hades. |
| 5 | 1 | sacha | |
| 6 | 3 | sacha | ## Configurations communes à Gaia et Hades |
| 7 | 1 | sacha | |
| 8 | 3 | sacha | ### Apache2 |
| 9 | 1 | sacha | |
| 10 | * /etc/apache2/sites-enabled/dns.aquilenet.fr.conf |
||
| 11 | ~~~ |
||
| 12 | <VirtualHost *:80> |
||
| 13 | ServerAdmin webmaster@aquilenet.fr |
||
| 14 | ServerName dns.aquilenet.fr |
||
| 15 | DocumentRoot /srv/www/dns.aquilenet.fr |
||
| 16 | |||
| 17 | ErrorLog ${APACHE_LOG_DIR}/dns.aqln.error.log |
||
| 18 | LogLevel warn |
||
| 19 | CustomLog ${APACHE_LOG_DIR}/dns.aqln.access.log combined |
||
| 20 | |||
| 21 | Alias /.well-known/acme-challenge /srv/letsencrypt/challenges/dns.aquilenet.fr |
||
| 22 | <Directory /srv/letsencrypt/challenges/dns.aquilenet.fr> |
||
| 23 | Require all granted |
||
| 24 | </Directory> |
||
| 25 | <Directory /> |
||
| 26 | Options FollowSymLinks |
||
| 27 | AllowOverride None |
||
| 28 | Require all granted |
||
| 29 | </Directory> |
||
| 30 | </VirtualHost> |
||
| 31 | ~~~ |
||
| 32 | |||
| 33 | 3 | sacha | ### Bind9 |
| 34 | 1 | sacha | |
| 35 | BIND 9.17.10 implémente DoH, au jour de l'installation il n'est disponible que dans les backports bullseye (A changer quand il sera dans main). |
||
| 36 | |||
| 37 | * /etc/bind/named.conf.options |
||
| 38 | |||
| 39 | Dans la catégorie "options {" |
||
| 40 | ~~~ |
||
| 41 | listen-on-v6 { 2a0c:e300::101; }; |
||
| 42 | listen-on { 185.233.100.101; 45.67.81.23; }; |
||
| 43 | # DOH |
||
| 44 | listen-on port 443 tls local-tls http default { 45.67.81.23; }; |
||
| 45 | # DoT |
||
| 46 | listen-on port 853 tls local-tls { 45.67.81.23; }; |
||
| 47 | recursion yes; |
||
| 48 | dnssec-validation auto; |
||
| 49 | ~~~ |
||
| 50 | |||
| 51 | ~~~ |
||
| 52 | # DoH DoT |
||
| 53 | tls local-tls { |
||
| 54 | key-file "/etc/letsencrypt/live/dns.aquilenet.fr/privkey.pem"; |
||
| 55 | cert-file "/etc/letsencrypt/live/dns.aquilenet.fr/fullchain.pem"; |
||
| 56 | dhparam-file "/etc/bind/dhparam.pem"; |
||
| 57 | protocols { TLSv1.2; TLSv1.3; }; |
||
| 58 | prefer-server-ciphers yes; |
||
| 59 | session-tickets no; |
||
| 60 | }; |
||
| 61 | ~~~ |
||
| 62 | |||
| 63 | 3 | sacha | ### AppArmor |
| 64 | 1 | sacha | |
| 65 | * /etc/apparmor.d/local/usr.sbin.named |
||
| 66 | |||
| 67 | ~~~ |
||
| 68 | /etc/letsencrypt/** r, |
||
| 69 | ~~~ |
||
| 70 | appliquer avec: `apparmor_parser -r /etc/apparmor.d/usr.sbin.named` |
||
| 71 | 3 | sacha | |
| 72 | ## Configurations spécifiques |
||
| 73 | |||
| 74 | ### Génération du certificat SSL sur Hades |
||
| 75 | |||
| 76 | ~~~ |
||
| 77 | certbot --apache --agree-tos --email sysop@aquilenet.fr -d dns.aquilenet.fr |
||
| 78 | chgrp bind /etc/letsencrypt/live/dns.aquilenet.fr/privkey.pem |
||
| 79 | chmod 0640 /etc/letsencrypt/live/dns.aquilenet.fr/privkey.pem |
||
| 80 | openssl dhparam -out /etc/bind/dhparam.pem 4096 |
||
| 81 | ~~~ |
||
| 82 | |||
| 83 | Copie du certificat sur gaia |
||
| 84 | |||
| 85 | * /etc/letsencrypt/renewal-hooks/post/sync-cert.sh |
||
| 86 | ~~~ |
||
| 87 | #!/bin/bash |
||
| 88 | rsync -aPHSA /etc/letsencrypt/archive/dns.aquilenet.fr gaia:/etc/letsencrypt/archive/ |
||
| 89 | ~~~ |
||
| 90 | |||
| 91 | ### Keepalived |
||
| 92 | |||
| 93 | #### Hades Master |
||
| 94 | |||
| 95 | * /etc/keepalived/keepalived.conf |
||
| 96 | |||
| 97 | ~~~ |
||
| 98 | global_defs { |
||
| 99 | notification_email { |
||
| 100 | sysop@aquilenet.fr |
||
| 101 | } |
||
| 102 | notification_email_from vrrp-dns@aquilenet.fr.fr |
||
| 103 | smtp_server localhost |
||
| 104 | smtp_connect_timeout 30 |
||
| 105 | } |
||
| 106 | |||
| 107 | vrrp_instance DNS { |
||
| 108 | state MASTER |
||
| 109 | interface eth0 |
||
| 110 | virtual_router_id 101 |
||
| 111 | priority 100 |
||
| 112 | advert_int 2 |
||
| 113 | smtp_alert |
||
| 114 | unicast_src_ip 185.233.100.16 |
||
| 115 | unicast_peer { |
||
| 116 | 185.233.100.2 |
||
| 117 | } |
||
| 118 | virtual_ipaddress { |
||
| 119 | 45.67.81.23/32 dev eth1 scope global # VIP |
||
| 120 | } |
||
| 121 | } |
||
| 122 | ~~~ |
||
| 123 | |||
| 124 | #### Gaia Slave |
||
| 125 | |||
| 126 | * /etc/keepalived/keepalived.conf |
||
| 127 | |||
| 128 | ~~~ |
||
| 129 | global_defs { |
||
| 130 | notification_email { |
||
| 131 | sysop@aquilenet.fr |
||
| 132 | } |
||
| 133 | notification_email_from vrrp-dns@aquilenet.fr.fr |
||
| 134 | smtp_server localhost |
||
| 135 | smtp_connect_timeout 30 |
||
| 136 | } |
||
| 137 | |||
| 138 | vrrp_instance DNS { |
||
| 139 | state BACKUP |
||
| 140 | interface eth0 |
||
| 141 | virtual_router_id 101 |
||
| 142 | priority 50 |
||
| 143 | advert_int 2 |
||
| 144 | smtp_alert |
||
| 145 | unicast_src_ip 185.233.100.2 |
||
| 146 | unicast_peer { |
||
| 147 | 185.233.100.16 |
||
| 148 | } |
||
| 149 | virtual_ipaddress { |
||
| 150 | 45.67.81.23/32 dev eth1 scope global # VIP |
||
| 151 | } |
||
| 152 | } |
||
| 153 | |||
| 154 | ~~~ |