GitHub - ninuxorg/nnxx-bind-server: Playbook Ansible per installare e configurare Bind9 su Debian Stretch

# Ansible role bind

E' un playbook per installare configurare un Server DNS con BIND ISC per più domini Debian/Ubuntu (prossimamente anche per RedHat/CentOS). NEllo specifico il playbook è diviso in 3 ruoli, uno di base COMMON ed uno per BIND.

Common configura principalmente:
- porta ssh
- utenti e chiavi ssh
- banner
- configura il profile per gli alias, colori nel terminale
- iptables: blocco INPUT con accesso SSH, OLSRd2, OpenVPN e DNS
- fail2ban: regole per SSH, OpenVPN e DNS
OpenVPN: installazione e configurazione della VPN Basilicata (attuale openwisp2 ninux di testing)
OLSRd2: installazione e configurazione di olsrd2 per accesso alla rete VPNBAS
installa BIND
- configurazione dei file principali
  - master server
  - slave server
- imposta i file di zona Abbiamo il supporto per più zone e per IPv6.

Installazione di Ansible su Debian

Add the following line to /etc/apt/sources.list

deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main

$ sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
$ sudo apt-get update
$ sudo apt-get install ansible

Installa i ruoli necessari con il comando:

ansible-galaxy install -f -r requirements.yml

Le Variabili per il ruolo di Bind9

Variables are not required, unless specified.

Variable	Default	Comments (type)
`bind_acls`	`[]`	A list of ACL definitions, which are dicts with fields `name` and `match_list`. See below for an example.
`bind_dns_keys`	`[]`	A list of binding keys, which are dicts with fields `name` `algorithm` and `secret`. See below for an example.
`bind_allow_query`	`['localhost']`	A list of hosts that are allowed to query this DNS server. Set to ['any'] to allow all hosts
`bind_allow_recursion`	`['any']`	Similar to bind_allow_query, this option applies to recursive queries.
`bind_check_names`	`[]`	Check host names for compliance with RFC 952 and RFC 1123 and take the defined actioni (e.g. `warn`, `ignore`, `fail`).
`bind_dnssec_enable`	`true`	Is DNSSEC enabled
`bind_dnssec_validation`	`true`	Is DNSSEC validation enabled
`bind_extra_include_files`	`[]`
`bind_forward_only`	`false`	If `true`, BIND is set up as a caching name server
`bind_forwarders`	`[]`	A list of name servers to forward DNS requests to.
`bind_listen_ipv4`	`['127.0.0.1']`	A list of the IPv4 address of the network interface(s) to listen on. Set to ['any'] to listen on all interfaces.
`bind_listen_ipv6`	`['::1']`	A list of the IPv6 address of the network interface(s) to listen on
`bind_log`	`data/named.run`	Path to the log file
`bind_query_log`	-	When defined (e.g. `data/query.log`), this will turn on the query log
`bind_recursion`	`false`	Determines whether requests for which the DNS server is not authoritative should be forwarded†.
`bind_rrset_order`	`random`	Defines order for DNS round robin (either `random` or `cyclic`)
`bind_zone_dir`	-	When defined, sets a custom absolute path to the server directory (for zone files, etc.) instead of the default.
`bind_zone_domains`	n/a	A list of domains to configure, with a seperate dict for each domain, with relevant details
`- allow_update`	`['none']`	A list of hosts that are allowed to dynamically update this DNS zone.
`- also_notify`	-	A list of servers that will receive a notification when the master zone file is reloaded.
`- delegate`	`[]`	Zone delegation. See below this table for examples.
`- hostmaster_email`	`hostmaster`	The e-mail address of the system administrator for the zone
`- hosts`	`[]`	Host definitions. See below this table for examples.
`- ipv6_networks`	`[]`	A list of the IPv6 networks that are part of the domain, in CIDR notation (e.g. 2001:db8::/48)
`- mail_servers`	`[{name: mail, preference: 10}]`	A list of dicts (with fields `name` and `preference`) specifying the mail servers for this domain.
`- name_servers`	`[ansible_hostname]`	A list of the DNS servers for this domain.
`- name`	`example.com`	The domain name
`- networks`	`['10.0.2']`	A list of the networks that are part of the domain
`- other_name_servers`	`[]`	A list of the DNS servers outside of this domain.
`- services`	`[]`	A list of services to be advertized by SRV records
`- text`	`[]`	A list of dicts with fields `name` and `text`, specifying TXT records. `text` can be a list or string.
`bind_zone_file_mode`	0640	The file permissions for the main config file (named.conf)
`bind_zone_master_server_ip`	-	(Required) The IP address of the master DNS server.
`bind_zone_minimum_ttl`	`1D`	Minimum TTL field in the SOA record.
`bind_zone_time_to_expire`	`1W`	Time to expire field in the SOA record.
`bind_zone_time_to_refresh`	`1D`	Time to refresh field in the SOA record.
`bind_zone_time_to_retry`	`1H`	Time to retry field in the SOA record.
`bind_zone_ttl`	`1W`	Time to Live field in the SOA record.

Variabili minime da importare per le zone:

Variable	Master	Slave
`bind_zone_domains`	V	V
`- name`	V	V
`- networks`	V	--
`- name_servers`	V	--
`- hosts`	V	--
`bind_listen_ipv4`	V	V
`bind_allow_query`	V	V

Esempio definizione di un dominio

bind_zone_domains:
  - name: ninux.nnxx
    hosts:
      - name: dns
        ip: 10.27.253.10
        ipv6: 2001:db8::1
        ttl: 900
        aliases:
          - ns
      - name: '@'
        ip:
          - 10.27.253.10
          - 10.27.253.11
        ipv6:
          - 2001:db8::1
          - 2001:db8::2
        aliases:
          - ns1
      - name: ns2
        ip: 10.27.22.5
    networks:
      - '10.27.250'
      - '10.27'
      - '10'
    delegate:
      - zone: basilicata.ninux.nnxx
        dns: 10.27.22.5
    services:
      - name: _ldap._tcp
        weight: 100
        port: 88
        target: dc001

Configurazione minima per lo Slave

    bind_listen_ipv4: ['any']
    bind_allow_query: ['any']
    bind_zone_master_server_ip: 10.27.250.1
    bind_zone_domains:
      - name: ninux.nnxx

Hosts

Gli host che questo server dovrà risolvere devono essere impostati sotto hosts nei campi name, ip e aliases

Tu puoi specificare IP multipli per un host aggiungendo allo stesso nome gli IP in bind_zone_hosts. Questo risulterà in multipli record A/AAAA records per un host e consentire al DNS round robin una semplice tecnica di load balancing. L'ordine degli ip saranno configurati nella variabile bind_rrset_order.

Networks

Non tutti gli host sono nella stessa rete. Per ottere un record PTR dovranno essere specificate in networks. Solo le reti vanno specificate qui! Ad esempio per la rete di Ninux Basilicata andrà inserito "10.27" nella variabile.

Zone delgation

Per delegare una zona DNS è sufficiente creare un record NS (sotto delegato) che è l'equivalente di:

foo IN NS 192.0.2.1

Service records

I record (SRV) posso essere aggiunti come servizio. Questi sono campi obbligatori, come name (service name), target (host providing the service), port (TCP/UDP porta del servizio) come campi opzionali abbiamo priority (default = 0) e weight (default = 0).

ACLs

Le ACLs possono essere definite in questo modo:

bind_acls:
  - name: acl_trasfer
    match_list:
      - 192.0.2.0/24
      - 10.0.0.0/8

Il nome della ACLs verra' aggiunta in allow-transfer nelle opzioni globali.

Esempio del playbook

- hosts: dns-server
  become: "{{ sudo | default('yes') }}"
  roles:
    - common
    - bind
  vars:
    # common
    common_ipv4_forward: 1
    common_ssh_port: 2400
    # variabili per ruolo common
    users:
      - name: michele
        authorized:
          - ./keys/michele.pub
      - name: nino
        authorized:
          - ./keys/nino.pub
      - name: marco
        authorized:
          - ./keys/hispanico.pub
      - name: federico
        authorized:
          - ./keys/federico-1.pub
          - ./keys/federico-2.pub
    # bind
    bind_listen_ipv4:
      - 127.0.0.1
      - 176.9.204.50
      - 176.9.187.218
    bind_zone_master_server_ip: 176.9.204.50
  pre_tasks:
    - name: Get dict for each zone
      include_vars:
        dir: zones
    - name: Merge zone dicts
      set_fact:
        bind_zone_domains:
          "{{ nnxx_ninux_org }} +
           {{ ninux_nnxx }}"

Esempio client nsudate per OpenWRT

#!/bin/sh
if which nsupdate >/dev/null; then

ETH=br-lan
DOMAIN=router.nnxx
DNS=10.27.253.10
SUB=$(cat /proc/sys/kernel/hostname)
ECHO=$(which echo)
NSUPDATE=$(which nsupdate)
IP=$(ip addr show dev $ETH | grep 'inet ' | awk '{split($2,a,"/");print a[1];}')

$ECHO "server $DNS" > /tmp/nsupdate
$ECHO "debug yes" >> /tmp/nsupdate
$ECHO "zone $DOMAIN." >> /tmp/nsupdate
$ECHO "update delete $SUB.$DOMAIN" >> /tmp/nsupdate
$ECHO "update add $SUB.$DOMAIN 60 A $IP" >> /tmp/nsupdate
$ECHO "send" >> /tmp/nsupdate

$NSUPDATE -v /tmp/nsupdate 2>&1

else
    echo installo nsupdate, riavvia lo script dopo
    sleep 5
    opkg update
    opkg install bind-client
fi

Name		Name	Last commit message	Last commit date
Latest commit History 91 Commits
keys		keys
roles		roles
zones		zones
.gitignore		.gitignore
README.md		README.md
ansible.cfg		ansible.cfg
common.yml		common.yml
dns_forwarder.yml		dns_forwarder.yml
dns_server.yml		dns_server.yml
hosts		hosts
olsrd2.yml		olsrd2.yml
requirements.yml		requirements.yml
run		run
vpn.yml		vpn.yml

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Repository files navigation

Installazione di Ansible su Debian

Le Variabili per il ruolo di Bind9

Variabili minime da importare per le zone:

Esempio definizione di un dominio

Configurazione minima per lo Slave

Hosts

Networks

Zone delgation

Service records

ACLs

Esempio del playbook

Esempio client nsudate per OpenWRT

About

Uh oh!

Releases

Packages

Uh oh!

Languages

ninuxorg/nnxx-bind-server

Folders and files

Latest commit

History

Repository files navigation

Installazione di Ansible su Debian

Le Variabili per il ruolo di Bind9

Variabili minime da importare per le zone:

Esempio definizione di un dominio

Configurazione minima per lo Slave

Hosts

Networks

Zone delgation

Service records

ACLs

Esempio del playbook

Esempio client nsudate per OpenWRT

About

Resources

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Uh oh!

Languages

Packages