Wiki » Historique » Version 4
sacha, 26/12/2022 00:25
| 1 | 1 | sacha | # DNS récursif Ouvert DoH DoT & HA |
|---|---|---|---|
| 2 | |||
| 3 | Aquilenet propose deux serveurs DNS ouverts cf https://www.aquilenet.fr/services/dns/ |
||
| 4 | 4 | sacha | On a mis aussi un DNS ouvert sur l'IP 45.67.81.23 car facile à retenir, avec l'adresse de dns.aquilenet.fr (voir [http://dns.aquilenet.fr](http://dns.aquilenet.fr)) . Nous en avons profité pour ajouter [DoH](https://fr.wikipedia.org/wiki/DNS_over_HTTPS) et [DoT](https://fr.wikipedia.org/wiki/DNS_over_TLS) et d'avoir cette adresse en IP Virtuelle partagée entre Gaia et Hades. |
| 5 | Cette IP virtuelle est portée par Keepalived sur Hades le primaire et Gaia le secondaire. Si le démon Keepalived est arrêté sur Hades, l'ip bascule sur Gaia. Si on redémarre le démon sur Hades, ce dernier reprend l'IP: pratique pour les mises à jour, le service continue à fonctionner. |
||
| 6 | 1 | sacha | |
| 7 | 3 | sacha | ## Configurations communes à Gaia et Hades |
| 8 | 1 | sacha | |
| 9 | 3 | sacha | ### Apache2 |
| 10 | 1 | sacha | |
| 11 | * /etc/apache2/sites-enabled/dns.aquilenet.fr.conf |
||
| 12 | ~~~ |
||
| 13 | <VirtualHost *:80> |
||
| 14 | ServerAdmin webmaster@aquilenet.fr |
||
| 15 | ServerName dns.aquilenet.fr |
||
| 16 | DocumentRoot /srv/www/dns.aquilenet.fr |
||
| 17 | |||
| 18 | ErrorLog ${APACHE_LOG_DIR}/dns.aqln.error.log |
||
| 19 | LogLevel warn |
||
| 20 | CustomLog ${APACHE_LOG_DIR}/dns.aqln.access.log combined |
||
| 21 | |||
| 22 | Alias /.well-known/acme-challenge /srv/letsencrypt/challenges/dns.aquilenet.fr |
||
| 23 | <Directory /srv/letsencrypt/challenges/dns.aquilenet.fr> |
||
| 24 | Require all granted |
||
| 25 | </Directory> |
||
| 26 | <Directory /> |
||
| 27 | Options FollowSymLinks |
||
| 28 | AllowOverride None |
||
| 29 | Require all granted |
||
| 30 | </Directory> |
||
| 31 | </VirtualHost> |
||
| 32 | ~~~ |
||
| 33 | |||
| 34 | 3 | sacha | ### Bind9 |
| 35 | 1 | sacha | |
| 36 | BIND 9.17.10 implémente DoH, au jour de l'installation il n'est disponible que dans les backports bullseye (A changer quand il sera dans main). |
||
| 37 | |||
| 38 | * /etc/bind/named.conf.options |
||
| 39 | |||
| 40 | Dans la catégorie "options {" |
||
| 41 | ~~~ |
||
| 42 | listen-on-v6 { 2a0c:e300::101; }; |
||
| 43 | listen-on { 185.233.100.101; 45.67.81.23; }; |
||
| 44 | # DOH |
||
| 45 | listen-on port 443 tls local-tls http default { 45.67.81.23; }; |
||
| 46 | # DoT |
||
| 47 | listen-on port 853 tls local-tls { 45.67.81.23; }; |
||
| 48 | recursion yes; |
||
| 49 | dnssec-validation auto; |
||
| 50 | ~~~ |
||
| 51 | |||
| 52 | ~~~ |
||
| 53 | # DoH DoT |
||
| 54 | tls local-tls { |
||
| 55 | key-file "/etc/letsencrypt/live/dns.aquilenet.fr/privkey.pem"; |
||
| 56 | cert-file "/etc/letsencrypt/live/dns.aquilenet.fr/fullchain.pem"; |
||
| 57 | dhparam-file "/etc/bind/dhparam.pem"; |
||
| 58 | protocols { TLSv1.2; TLSv1.3; }; |
||
| 59 | prefer-server-ciphers yes; |
||
| 60 | session-tickets no; |
||
| 61 | }; |
||
| 62 | ~~~ |
||
| 63 | |||
| 64 | 3 | sacha | ### AppArmor |
| 65 | 1 | sacha | |
| 66 | * /etc/apparmor.d/local/usr.sbin.named |
||
| 67 | |||
| 68 | ~~~ |
||
| 69 | /etc/letsencrypt/** r, |
||
| 70 | ~~~ |
||
| 71 | appliquer avec: `apparmor_parser -r /etc/apparmor.d/usr.sbin.named` |
||
| 72 | 3 | sacha | |
| 73 | ## Configurations spécifiques |
||
| 74 | |||
| 75 | ### Génération du certificat SSL sur Hades |
||
| 76 | |||
| 77 | ~~~ |
||
| 78 | certbot --apache --agree-tos --email sysop@aquilenet.fr -d dns.aquilenet.fr |
||
| 79 | chgrp bind /etc/letsencrypt/live/dns.aquilenet.fr/privkey.pem |
||
| 80 | chmod 0640 /etc/letsencrypt/live/dns.aquilenet.fr/privkey.pem |
||
| 81 | openssl dhparam -out /etc/bind/dhparam.pem 4096 |
||
| 82 | ~~~ |
||
| 83 | |||
| 84 | Copie du certificat sur gaia |
||
| 85 | |||
| 86 | * /etc/letsencrypt/renewal-hooks/post/sync-cert.sh |
||
| 87 | ~~~ |
||
| 88 | #!/bin/bash |
||
| 89 | rsync -aPHSA /etc/letsencrypt/archive/dns.aquilenet.fr gaia:/etc/letsencrypt/archive/ |
||
| 90 | ~~~ |
||
| 91 | |||
| 92 | ### Keepalived |
||
| 93 | |||
| 94 | #### Hades Master |
||
| 95 | |||
| 96 | * /etc/keepalived/keepalived.conf |
||
| 97 | |||
| 98 | ~~~ |
||
| 99 | global_defs { |
||
| 100 | notification_email { |
||
| 101 | sysop@aquilenet.fr |
||
| 102 | } |
||
| 103 | notification_email_from vrrp-dns@aquilenet.fr.fr |
||
| 104 | smtp_server localhost |
||
| 105 | smtp_connect_timeout 30 |
||
| 106 | } |
||
| 107 | |||
| 108 | vrrp_instance DNS { |
||
| 109 | state MASTER |
||
| 110 | interface eth0 |
||
| 111 | virtual_router_id 101 |
||
| 112 | priority 100 |
||
| 113 | advert_int 2 |
||
| 114 | smtp_alert |
||
| 115 | unicast_src_ip 185.233.100.16 |
||
| 116 | unicast_peer { |
||
| 117 | 185.233.100.2 |
||
| 118 | } |
||
| 119 | virtual_ipaddress { |
||
| 120 | 45.67.81.23/32 dev eth1 scope global # VIP |
||
| 121 | } |
||
| 122 | } |
||
| 123 | ~~~ |
||
| 124 | |||
| 125 | #### Gaia Slave |
||
| 126 | |||
| 127 | * /etc/keepalived/keepalived.conf |
||
| 128 | |||
| 129 | ~~~ |
||
| 130 | global_defs { |
||
| 131 | notification_email { |
||
| 132 | sysop@aquilenet.fr |
||
| 133 | } |
||
| 134 | notification_email_from vrrp-dns@aquilenet.fr.fr |
||
| 135 | smtp_server localhost |
||
| 136 | smtp_connect_timeout 30 |
||
| 137 | } |
||
| 138 | |||
| 139 | vrrp_instance DNS { |
||
| 140 | state BACKUP |
||
| 141 | interface eth0 |
||
| 142 | virtual_router_id 101 |
||
| 143 | priority 50 |
||
| 144 | advert_int 2 |
||
| 145 | smtp_alert |
||
| 146 | unicast_src_ip 185.233.100.2 |
||
| 147 | unicast_peer { |
||
| 148 | 185.233.100.16 |
||
| 149 | } |
||
| 150 | virtual_ipaddress { |
||
| 151 | 45.67.81.23/32 dev eth1 scope global # VIP |
||
| 152 | } |
||
| 153 | } |
||
| 154 | |||
| 155 | 1 | sacha | ~~~ |
| 156 | 4 | sacha | |
| 157 | ## Validation |
||
| 158 | |||
| 159 | * test du service |
||
| 160 | ~~~ |
||
| 161 | dig +https +short x.org @45.67.81.23 |
||
| 162 | 131.252.210.176 |
||
| 163 | dig +tls +short x.org @45.67.81.23 |
||
| 164 | 131.252.210.176 |
||
| 165 | ~~~ |
||
| 166 | |||
| 167 | * bascule keepalived |