Editing DNS (section)

= Setup - ns3c =

<pre>cd /mnt/data1/
mkdir ns3c-dir
cd /usr/src/
make world DESTDIR=/mnt/data1/ns3c-dir ; pagedave
cd etc
make distribution DESTDIR=/mnt/data1/ns3c-dir

scp backup2:/mnt/data4/bin/freebsd6.x/jailkill /usr/local/sbin
scp backup2:/mnt/data4/bin/freebsd6.x/jailps /usr/local/sbin

scp backup2:/mnt/data4/build/freebsd/devfs.rules /etc/devfs.rules
cat >> /etc/rc.conf
devfs_system_ruleset="devfsrules_show_all"

/etc/rc.d/devfs start
devfs rule showsets
devfs rule -s 3 show
mount -t devfs devfs /mnt/data1/ns3c-dir/dev/
ls /mnt/data1/ns3c-dir/dev/
devfs -m /mnt/data1/ns3c-dir//dev rule -s 3 applyset

cd /mnt/data1/ns3c-dir/
ln -sf dev/null kernel
jail /mnt/data1/ns3c-dir testhostname 192.168.11.100 /bin/sh

csh
touch /etc/fstab
echo 'network_interfaces=""\
hostname="ns3c.johncompanies.com"\
kern_securelevel_enable="NO"\
sendmail_enable="YES"\
sshd_enable="YES"' > /etc/rc.conf

echo "nameserver nameserver 66.181.0.2\
nameserver 69.55.230.3" >> /etc/resolv.conf

vi /etc/crontab
remove the adjkerntz lines
comment out periodic’s and put this line above them:
# IF YOU UNCOMMENT THESE, PLEASE ADJUST THEIR RUN TIME

rm -rf /etc/periodic/daily/400.status-disks

check /tmp for crap

vi /etc/periodic/security/100.chksetuid
replace: MP=`mount -t ufs | grep -v " nosuid" | awk '{ print $3 }' | sort`
with: MP='/' (use single quotes)

mkdir -p /usr/compat/linux/dev

adduser (Add account for user, make sure in wheel group)

Username: user
Full name: user
Uid (Leave empty for default):
Login group [user]:
Login group is user. Invite user into other groups? []: wheel
Login class [default]:
Shell (sh csh tcsh nologin) [sh]:
Home directory [/home/user]:
Home directory permissions (Leave empty for default):
Use password-based authentication? [yes]:
Use an empty password? (yes/no) [no]:
Use a random password? (yes/no) [no]: y
Lock out the account after creation? [no]:
Username   : user
Password   : <random>
Full Name  : user
Uid        : 1001
Class      :
Groups     : user
Home       : /home/user
Home Mode  :
Shell      : /bin/sh
Locked     : no
OK? (yes/no): y
adduser: INFO: Successfully added (user) to the user database.
adduser: INFO: Password for (user) is: 901gmYjO
Add another user? (yes/no): n
Goodbye!

vi /usr/home/user/.profile (and add to the file):
TERM=vt100;     export TERM

tzsetup

newaliases 

rm /sbin/halt /sbin/reboot
ln /sbin/jkill /sbin/halt
ln /sbin/jkill /sbin/reboot

vi /etc/syslog.conf (comment out console and move to /var/log/messages):
#*.err;kern.warning;auth.notice;mail.crit               /dev/console *.err;kern.warning;auth.notice;mail.crit                /var/log/messages 

passwd root

exit
exit

#cd libexec
#chflags noschg ld-elf32.so.1
#chflags noschg ld-elf.so.1

#mv ld-elf32.so.1 ld-elf32.so.1-orig
#ln ld-elf.so.1 ld-elf32.so.1

#chflags schg ld-elf.so.1
#chflags schg ld-elf32.so.1


cd /usr/ports
make -DNOCLEANDEPENDS clean 
(2450: 15mins , supermicro: 29mins, 2950: 18mins)
rm -fr /usr/ports/distfiles/*
cp -r /usr/ports /mnt/data1/ns3c-dir/usr (2450: 2:00 mins , supermicro: 15mins, 2950: 3mins)

rm /mnt/data1/jail-DIR/root/.history

cat >> /usr/local/etc/rc.d/ns3c.sh
mount -t devfs devfs /mnt/data1/ns3c-dir/dev/
devfs -m /mnt/data1/ns3c-dir//dev rule -s 3 applyset
jail /mnt/data1/ns3c-dir ns3c.johncompanies.com 69.55.229.3 /bin/sh /etc/rc

add to .cshrc
set prompt = "`/bin/hostname -s` %/# "

cd /usr/ports/lang/perl5.8
make install clean

cd /tmp
fetch http://www.openssl.org/source/openssl-0.9.8o.tar.gz
tar xzf openssl-0.9.8o.tar.gz
cd openssl-0.9.8o
./config --prefix=/usr --openssldir=/usr/local/openssl
make install clean
./config --prefix=/usr/local --openssldir=/usr/local/openssl
make install clean

(for some reason bind didn’t find all files when installed to /usr so installed again to /usr/local- installed to /usr too to overwrite
existing openssl)

cd /tmp
fetch http://ftp.isc.org/isc/bind9/cur/9.7/bind-9.7.1-P2.tar.gz
tar xzf bind-9.7.1-P2.tar.gz
cd /tmp/bind-9.7.1-P2
./configure --with-openssl=/usr/local --sysconfdir=/etc/namedb --bindir=/usr/bin --sbindir=/usr/sbin --enable-threads
make install

(copy over files from namedb)

cd /etc/namedb
rehash
rndc-confgen

cat > rndc.conf
# Start of rndc.conf
key "rndc-key" {
        algorithm hmac-md5;
        secret "TywD8Rmk42q+QUbP299C3Q==";
};

options {
        default-key "rndc-key";
        default-server 69.55.229.3;
        default-port 953;
};
# End of rndc.conf

(paste into named.conf)


key "rndc-key" {
      algorithm hmac-md5;
      secret "TywD8Rmk42q+QUbP299C3Q==";
};

controls {
      inet 69.55.229.3 port 953
              allow { 69.55.229.3; } keys { "rndc-key"; };
};


adduser ns1
From ns1:
cat /root/.ssh/id_dsa.pub | ssh ns1@ns3c.johncompanies.com 'cat - >> /usr/home/ns1/.ssh/authorized_keys' 

copy over createzone code. on ns2c:
scp /etc/namedb/createzones.pl user@ns3c.johncompanies.com:~
scp /etc/namedb/named_head user@ns3c.johncompanies.com:~

on ns3c:
mv ~user/named_head /etc/namedb/named_head
mv ~user/createzones.pl /etc/namedb/createzones.pl
chown root:wheel /etc/namedb/named_head
chown root:wheel /etc/namedb/createzones.pl
chmod o-rwx /etc/namedb/named_head
chmod o-rwx /etc/namedb/createzones.pl
vi /etc/namedb/createzones.pl
:%s/ns2c/ns3c/g

vi /etc/namedb/named_head
replace RNDC key and set IP

mkdir /etc/namedb/s

cd /usr/ports/mail/p5-Mail-Sendmail
make install clean

crontab -e 
10 12,0 * * * perl /etc/namedb/createzones.pl

update named.conf, /etc/namedb/sendzones.pl on ns1c

on firewall:
ipfw add 00096 allow ip from { 69.55.229.4 or 69.55.229.3 } to 69.55.230.2 1984
ipfw add 00096 allow ip from 69.55.229.3 to 69.55.230.2</pre>