Setting DNS Server

Domain Name System adalah suatu metode untuk meng-konversikan Ip Address (numerik) suatu komputer ke dalam suatu nama domain (alphabetic), ataupun sebaliknya. Yang memudahkan kita dalam mengingat computer tersebut. Misalnya, server Debian memiliki alamat Ip Address sekian, namun pada umumnya, orang tidak akan mudah mengingat alamat Ip dalam bentuk numerik tersebut. Dengan adanya DNS Server, kita bisa mengakses halaman situs dari server Debian tersebut hanya dengan mengakses nama Domain-nya (www.debian.edu), tanpa mengingat Ip Address dari computer tersebut.

4.1. Installasi
Bind9 (Berkeley Internet Name Domain versi 9) adalah salah satu aplikasi linux yang sangat populer sebagai DNS Server, dan hampir semua distro linux menggunakanya. Selain itu, dalam konfigurasinya pun cukup mudah dimengerti, khususnya bagi pemula awal.

debian-server:/home/pudja# apt-get install bind9

4.2. Konfigurasi
Berikut file-file penting yang akan kita konfigurasi dalam DNS Server;
a. /etc/bind/named.conf
b. file forward
c. file reverse
d. /etc/resolv.conf
4.2.1. Membuat Zone Domain
Bagian ini adalah yang terpenting, dimana kita akan menentukan nama untuk Domain dari server Debian kita nantinya. Kita boleh membuat Zone Domain menggunakan Tld (Top Level Domain) hanya pada jaringan local (There’s no Internet Connection). Karena sudah ada organisasi yang khusus mengatur domain Tld tersebut, contohnya di Indonesia adalah Pandi. Edit dan tambahkan konfigurasi untuk forward dan reverse, pada file named.conf atau bisa juga pada file named.conf.local. Kemudian tambahkan script di bawah ini.
debian-server:/home/pudja# vim /etc/bind/named.conf
#. . .
zone "debian.edu" { //Zone Domain anda

                 type master;
                 file "db.debian"; //lokasi file FORWARD, default di /var/cache/bind/
};
zone "192.in-addr.arpa" { //1 blok ip paling depan
                 type master;
                 file "db.192"; //lokasi file REVERSE, default di /var/cache/bind/
};

include "/etc/bind/named.conf.local"; //membuat file named.conf.local di process

4.2.2. File Forward

Forward berfungsi untuk konversi dari DNS ke Ip Address. Misalnya ketika kita ketik www.debian.edu melalui Web Browser, maka akan muncul website dari server Debian. Buat file konfigurasi untuk file forward dari DNS tersebut. Karna konfigurasinya cukup banyak, kita tinggal copykan saja file default yang sudah ada.

debian-server:/home/pudja# cd /etc/bind/ 

debian-server:/etc/bind# cp db.local /var/cache/bind/db.debian

debian-server:/etc/bind# vim /var/cache/bind/db.debian
                                         

$TTL 604800
@ IN SOA debian.edu. root.debian.edu. (
                                   2 ; Serial
                                   604800 ; Refresh
                                   86400 ; Retry
                                   2419200 ; Expire
                                   604800 ) ; Negative Cache TTL

@                     IN        NS      debian.edu. ;tambahkan “titik” di akhir domain
@                     IN        A        192.168.10.1
www                IN        A        192.168.10.1
ftp                    IN        A        192.168.10.1
sub-domain     IN        A         192.168.10.1 ;jika ingin membuat sub-domain
mail                 IN        A         192.168.10.1
streaming        IN        A         192.168.10.1 ;alamat untuk streaming server

4.2.3. File Reverse

Reverse berfungsi untuk konversi Ip Address ke DNS. Misalnya jika kita mengetikan Ip Address http://192.168.10.1 pada Web Browser, secara otomatis akan redirect ke alamat www.debian.edu. Bagian ini adalah opsional, jika kita tidak ingin mengkonfigurasi file reverse pun, juga boleh (^_^). Take it easy, okey.

debian-server:/etc/bind# cp db.127 /var/cache/bind/db.192
debian-server:/etc/bind# vim /var/cache/bind/db.192

$TTL 604800
@          IN           SOA        debian.edu. root.debian.edu. (
                             1 ; Serial

                             604800 ; Refresh
                             86400 ; Retry
                             2419200 ; Expire
                             604800 ) ; Negative Cache TTL
;

@                     IN         NS            debian.edu. ;ingat “titik”
1.10.168           IN        PTR           debian.edu. ;3 blok ip terakhir, dan dibalik

4.2.4. Menambah dns-name-server

Tambahkan dns dan nameserver dari server Debian tersebut pada file resolv.conf. Agar dapat diakses melalui computer localhost.

debian-server:/etc/bind# vim /etc/resolv.conf
search debian.edu
nameserver 192.168.10.1

Terakhir, restart daemon dari bind9.

debian-server:/etc/bind# /etc/init.d/bind9 restart

Bagi pemula awal, pada bagian ini sering sekali terjadi failed. Hal ini terjadi, karena Anda melakukan kesalahan pada satu file, yaitu file named.conf. Periksa kembali script yang anda buat, dan sesuaikan seperti konfigurasi diatas.

4.3. Pengujian 

Test apakah DNS Server tersebut berhasil atau tidak, dengan perintah nslookup dari computer Localhost ataupun dari computer client.

debian-server:/etc/bind# nslookup 192.168.10.1
Server : 192.168.10.1
Address : 192.168.10.1#53
1.10.168.192.in-addr.arpa name = debian.edu.

debian-server:/etc/bind# nslookup debian.edu
Server : 192.168.10.1
Address : 192.168.10.1#53
Name : debian.edu

Jika muncul pesan seperti ini,
Server : 192.168.10.1
Address : 192.168.10.1#53
** server can't find debian.edu.debian.edu: SERVFAIL

Berarti masih terdapat script yang salah, periksa dimana file yang salah tersebut. Jika pesan error itu muncul ketika
nslookup DNS, berarti kesalahan terletak antara file db.debian atau named.conf. Namun jika muncul ketika di
nslookup IP, berarti kesalahan di file db.192 atau named.conf.
Atau anda bisa menggunakan perintah dig untuk pengujian dari server localhost.
debian-server:/etc/bind# dig debian.edu

Sumber : Al-Mansyurin

Read More

Setting DHCP Server

Sebelumnya, admin sudah membahas cara mengkonfigurasi IP Server pada Debian 5. Sekarang admin mau membahas tentang instalasi dan konfigurasi DHCP Server. Jika ada diantara kawan-kawan yang memiliki spesialisasi di jaringan pasti sudah tidak asing lagi dengan istilah ini. Haanya sekedar informasi, DHCP Server merupakan server yang secara otomatis memberikan IP kepada client. Jadi tidak perlu lagi mengisikan IP Secara manual. Untuk lebih jelasnya, langsung saja pada proses instalasi dan konfigurasinya seperti di bawah ini.

Pertama kita install dhcp dengan mengetik apt-get install dhcp3-server kemudian tekan enter (admin menggunakan aplikasi dhcp3-server)

Jika muncul tampilan Non-authoritative version of DHCP server ….dst,  kita tekan enter.
Setelah itu, kita edit konfigurasi di /etc/dhcp/dhcpd.conf dengan mengetik nano /etc/dhcp/dhcpd.conf lalu tekan enter.
Atur seperti di bawah ini
#A slightly different configuration for an internal subnet
subnet 192.168.1.0 netmask 255.255.255.0 {
                range 192.168.1.4 192.168.1.30;
                option domain-name-servers 192.168.1.3
                option domain-name “dewi.co.id”;
                option routers 192.168.1.3;
                option broadcast-address 192.168.1.255;
                default-lease-time 600;
                max-lease-time 7200;
}

Jika sudah selesai, simpan dengan menggunakan ^O dan keluar dengan menggunakan ^X

Kemudian, kita atur interface mana yang akan digunakan untuk memberikan ip secara otomatis kepada client. Caranya ketik nano /etc/default/dhcp3-server kemudian tekan enter.

Kita tambahkan eth0 pada baris interfaces sehingga menjadi INTERFACES=”eth0”
Jika sudah selesai, simpan dengan menggunakan ^O dan keluar dengan menggunakan ^X

Terakhir, kita restart dengan menggunakan perintah /etc/init.d/dhcp3-server restart lalu tekan enter
jika berhasil, akan muncul seperti di bawah ini
Stopping DHCP server: dhcp3 failed!
Starting DHCP server: dhcp3 .

Kita tinggal mensetting di client agar support dhcp caranya klik Obtain an IP address automatically pada saat pengaturan ip maka server akan memberikan ip otomatis kepada client.

Sumber : http://siput12.wordpress.com

Read More

Open VPN

Installation

Install the openvpn package on both client and server.

# apt-get install openvpn

Configuration

OpenVPN support user/pass, pre-shared key, certificates etc. to authenticate users.

Test VPN

Testing raw connection to check VPN link.

In Server:

# openvpn --remote CLIENT_IP --dev tun1 --ifconfig 10.9.8.1 10.9.8.2
...
Wed Mar  7 06:03:03 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Mar  7 06:03:03 2012 ******* WARNING *******: all encryption and authentication features disabled -- all data will be tunnelled as cleartext
Wed Mar  7 06:03:03 2012 TUN/TAP device tun1 opened
...

You may skip the --remote CLIENT_IP part if your client is having a dynamic IP address.

In client:

# openvpn --remote SERVER_IP --dev tun1 --ifconfig 10.9.8.2 10.9.8.1
...
Wed Mar  7 18:05:30 2012 Peer Connection Initiated with [AF_INET]SERVER_IP:PORT
Wed Mar  7 18:05:30 2012 Initialization Sequence Completed
...

Check your #/sbin/ifconfig. You may also run ping command for testing.

tun1      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.9.8.2  P-t-P:10.9.8.1  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:13 errors:0 dropped:0 overruns:0 frame:0
          TX packets:16 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:2262 (2.2 KiB)  TX bytes:1819 (1.7 KiB)

Static-Key VPN

In the server's /etc/openvpn directory, run the following command to generate a static key:

# openvpn --genkey --secret static.key

Copy this static key to the clients /etc/openvpn directory using a secure channel like scp or sftp.

On the server, create a new /etc/openvpn/tun0.conf file and add the following:

dev tun0
ifconfig 10.9.8.1 10.9.8.2
secret /etc/openvpn/static.key

Where 10.9.8.x is your VPN subnetwork, 10.9.8.1 will be IP of the server, 10.9.8.2 is IP of client.

On the client, copy /etc/openvpn/static.key from server and create a new /etc/openvpn/tun0.conf file and add the following:

remote your-server.org
dev tun0
ifconfig 10.9.8.2 10.9.8.1
secret /etc/openvpn/static.key

On the server's firewall, open up UDP 1194 (default port).

If you are using shorewall, on both devices, add a new VPN zone to represent tun0 and create a default policy for it. This means adding something to the following files in /etc/shorewall:

• zone
• interfaces
• policy

Bear in mind that 90% of all connection problems encountered by new OpenVPN users are firewall-related.

Start OpenVPN by hand on both sides with the following command:

# openvpn --config /etc/openvpn/tun0.conf --verb 6  // verbose output.

You should probably configure your route at this step.

To verify that the VPN is running, you should be able to ping 10.9.8.2 from the server and 10.9.8.1 from the client.

TLS-enabled VPN

In server, copy key generating script from openvpn example to /etc/openvpn and add executable permission:

# cd /etc/openvpn
# mkdir easy-rsa
# cp -R /usr/share/doc/openvpn/examples/easy-rsa/2.0/* easy-rsa/
# chmod -R +x easy-rsa/

Edit /etc/openvpn/easy-rsa/vars bottom according to your ogranization.

export KEY_COUNTRY="US"
export KEY_PROVINCE="CA"
export KEY_CITY="SanFrancisco"
export KEY_ORG="Fort-Funston"
export KEY_EMAIL="mail@domain"
export KEY_EMAIL=mail@domain

Execute the following command:

# cd easy-rsa/
# . ./vars  # set environment variables
# ./clean-all

Remember:

• only .key files should be kept confidential.
• .crt and .csr files can be sent over insecure channels such as plaintext email.
• do not need to copy a .key file between computers.
• each computer will have its own certificate/key pair.

Generate CERTIFICATE AUTHORITY (CA) CERTIFICATE/KEY:

# ./build-ca

It will generate ca.crt and ca.key in /etc/openvpn/easy-rsa/keys/ directory.

Generate BUILD AN INTERMEDIATE CERTIFICATE AUTHORITY CERTIFICATE/KEY (optional):

# ./build-key-server server

It will generate server.crt and server.key in /etc/openvpn/easy-rsa/keys/, and signed with your root certificate.

Generate BUILD DIFFIE-HELLMAN PARAMETERS (necessary for the server end of a SSL/TLS connection):

./build-dh

Generate key for each client:

./build-key clientname

It will generate keys in /etc/openvpn/easy-rsa/keys/

Copy the ca.crt, clientname.crt, clientname.key from Server to Client /etc/openvpn/easy-rsa/keys/ directory.

Check OpenVPN RSA Key and code.mixpanel.com VPN for details.

Test the connectivity from command line.

Server:

openvpn --dev tun1 --ifconfig 10.9.8.1 10.9.8.2 --tls-server --dh /etc/openvpn/easy-rsa/keys/dh1024.pem --ca /etc/openvpn/easy-rsa/keys/ca.crt --cert /etc/openvpn/easy-rsa/keys/server.crt --key /etc/openvpn/easy-rsa/keys/server.key --reneg-sec 60 --verb 5

Client:

openvpn --remote SERVER_IP --dev tun1 --ifconfig 10.9.8.2 10.9.8.1 --tls-client --ca /etc/openvpn/easy-rsa/keys/ca.crt --cert /etc/openvpn/easy-rsa/keys/clientname.crt --key /etc/openvpn/easy-rsa/keys/clientname.key --reneg-sec 60 --verb 5

If the connection is successful create file configuration.

In Server create /etc/openvpn/server.conf as follows:

port 1194
proto udp
dev tun

ca      /etc/openvpn/easy-rsa/keys/ca.crt    # generated keys
cert    /etc/openvpn/easy-rsa/keys/server.crt
key     /etc/openvpn/easy-rsa/keys/server.key  # keep secret
dh      /etc/openvpn/easy-rsa/keys/dh1024.pem

server 10.9.8.0 255.255.255.0  # internal tun0 connection IP
ifconfig-pool-persist ipp.txt

keepalive 10 120

comp-lzo         # Compression - must be turned on at both end
persist-key
persist-tun

status log/openvpn-status.log

verb 3  # verbose mode
client-to-client

Check code.mixpanel.com VPN and rackspace OpenVPN for details.

Create log directory:

# cd /etc/openvpn
# mkdir -p log/
# touch log/openvpn-status.log

Restart OpenVPN (note that the /etc/init.d/openvpn script will start an openvpn server for every .conf file in /etc/openvpn/, so if you still have the tun0.conf file from above, rename it to something else than *.conf):

# /etc/init.d/openvpn restart

In Client create /etc/openvpn/client.conf as follows:

(note: you may use graphical vpn tool network-manager UI by providing the key and certificates)

client
dev tun
port 1194
proto udp

remote VPNSERVER_IP 1194             # VPN server IP : PORT
nobind

ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/clientname.crt
key /etc/openvpn/easy-rsa/keys/clientname.key

comp-lzo
persist-key
persist-tun

verb 3

Restart OpenVPN:

# /etc/init.d/openvpn restart

Forward traffic via VPN

In Server enable runtime IP forwarding:

echo 1 > /proc/sys/net/ipv4/ip_forward

Edit /etc/sysctl.conf uncomment the following line to make it permanent:

net.ipv4.ip_forward = 1

TLDP Masquerade for details.

Execute the following command in server for testing:

iptables -A FORWARD -i eth0 -o tun0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -s 10.9.8.0/24 -o eth0 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.9.8.0/24 -o eth0 -j MASQUERADE

You may also use the rc.firewall-iptables script from TLDP Masquerade as an alternative.

In client:

# ip route add VPNSERVER_IP via LOCALGATEWAY_IP dev eth0  proto static
# ip route change default via 10.9.8.5 dev tun0  proto static   //client tun0 10.9.8.5

If you use graphical client generally you may not need to execute these command.

If everying is working fine, save the iptables rules:

# iptables-save > /etc/iptables.up.rules

To restore:

# iptables-restore < /etc/iptables.up.rules

add this to startup script. Debian wiki iptables page for details.

Auto-start

By default, all configured VPNs are started during system boot. Edit /etc/default/openvpn to start specific VPNs or to disable this behavior.

openvpn ifupdown hooks are also available for starting/stopping tunnels using /etc/network/interfaces, e.g.:

auto dsl
iface dsl inet ppp
    provider dsl-provider
    openvpn work_vpn

See /usr/share/doc/openvpn/README.Debian.gz for more information.

Application to a VPN passing through a http proxy

This part describe how to configure a VPN to pass through a http proxy, which allow only trafic on port 443 (and 80). This use the http_proxy of OpenVPN.

1. First of all, check that the port 443 isn't already used by another service on your server.
2. Configure OpenVPN on server side by adding port 443 and proto tcp-server to the configuration file.
3. Configure OpenVPN on the client side by adding port 443, proto tcp-client and http-proxy 1.1.1.1 8080 to the configuration file.

Where 1.1.1.1 and 8080 are IP and port of your proxy.

1. Now you should launch OpenVPN on the server and next on the client.
2. At this time, you should configure routes to use the VPN tunnel:
   • Remove the default route through the proxy: route del default eth0
   • Add default route through your VPN: route add default gw 10.9.8.1 dev tun0
   • You should keep the route to the proxy with: route add 1.1.1.1 eth0

Update your /etc/resolv.conf according to your needs.

Read More

NTP Debian Server

Secara umum, Network Time Protocol (NTP) adalah protocol untuk meng-sinkron-kan sistem waktu pada komputer terhadap sumber (server). Terdapat beberapa situs NTP “Stratum 1″ (situs NTP dengan sumber waktu dari atomic clock) and “Stratum 2″ (situs NTP dengan sumber waktu dari situs NTP lain, dengan sedikit penurunan tingkat akurasi) yang dapat digunakan oleh publik. Namun saya akan membuat bagaimana membuat ntp server lokal, jadi tidak perlu adanya akses internet. Caranya sangat mudah:

#Instalasinya#

 pertama masuk root console, dan install paket ntp yang dibutuhkan

      # apt-get install ntp ntpdate

     # nano /etc/ntp.conf

edit dan tambahkan :

# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help

driftfile /var/lib/ntp/ntp.drift

# Enable this if you want statistics to be logged.

#statsdir /var/log/ntpstats/

statistics loopstats peerstats clockstats

filegen loopstats file loopstats type day enable

filegen peerstats file peerstats type day enable

filegen clockstats file clockstats type day enable

# You do need to talk to an NTP server or two (or three).

#server ntp.your-provider.example

# pool.ntp.org maps to about 1000 low-stratum NTP servers. Your server will

# pick a different set every time it starts up. Please consider joining the

# pool: <http://www.pool.ntp.org/join.html>

#server 0.debian.pool.ntp.org iburst dynamic

#server 1.debian.pool.ntp.org iburst dynamic

#server 2.debian.pool.ntp.org iburst dynamic

#server 3.debian.pool.ntp.org iburst dynamic

server 127.127.1.0 iburst

fudge 127.127.1.0 stratum 10

# Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html for

# details. The web page <http://support.ntp.org/bin/view/Support/AccessRestrictions>

# might also be helpful.

#

# Note that "restrict" applies to both servers and clients, so a configuration

# that might be intended to block requests from certain clients could also end

# up blocking replies from your own upstream servers.

# By default, exchange time with everybody, but don't allow configuration.

restrict -4 default kod notrap nomodify nopeer noquery

restrict -6 default kod notrap nomodify nopeer noquery

# Local users may interrogate the ntp server more closely.

restrict 127.0.0.1

restrict ::1

# Clients from this (example!) subnet have unlimited access, but only if

# cryptographically authenticated.

#restrict 192.168.123.0 mask 255.255.255.0 notrust

# If you want to provide time to your local subnet, change the next line.

# (Again, the address is an example only.)

#broadcast 192.168.123.255

# If you want to listen to time broadcasts on your local subnet, de-comment the

# next lines. Please do this only if you trust everybody on the network!

#disable auth

#broadcastclient

Simpan dengan mengetikkan ctrl+o

Setelah itu restart program dengan mengetikan 

#/etc.init.d/ntp restart

ketikkan perintah 

#ntpq -p (untuk melihat hasil konfigurasi)

> *gambar ketika sudah sinkron dengan server ntp local terdapat tanda * didepan LOCAL (0)

Read More