https://bkraft.fr/blog/bind_9_10_3_and_bind_9_9_8/
http://olex.openlogic.com/packages/bind/9.10.2#package_detail_tabs
2015年11月29日 星期日
2015年11月24日 星期二
Linux Upgrade DNS.....dirty hand
https://forum.directadmin.com/showthread.php?t=46055
For people with CentOS 5 or 6 + DA it is easy
to update.
Check if the bind rpm is installed:
Check if the bind rpm is installed:
Code:
rpm -qv bind
Check if the version is the same:
Code:
named -v
If it is (which is in most cases) you can
safely use yum to update the package:
Code:
yum clean all
yum update bind
If it returns no errors, check again to see
it's version:
Code:
named -v
or
https://www.godaddy.com/help/update-bind-on-your-linux-dedicatedvirtual-dedicated-server-4690
- Connect to your server via SSH
(more info).
- Switch to the root user (more info).
- Type cp /etc/sysconfig/named
/etc/sysconfig/named.bak
- Type yum clean all.
- Type yum update bind
If not start up
cd /etc/init.d
mv named named.backup
wget -O named http://www.directadmin.com/named
chmod 755 named
/sbin/chkconfig named reset
mv named named.backup
wget -O named http://www.directadmin.com/named
chmod 755 named
/sbin/chkconfig named reset
2015年11月9日 星期一
Nessus Console command update
2015-10-12 3:26 AM EDT by Tenable Support
| Hello Albert, Thanks for reply,If nessus scanner has access to Tenable plugin server,could you please execute below command on scanner command terminal and let me know if this help get plugin updated. On nessus scanner open and run command prompt as Administrator C:\Program Files\Tenable\Nessus\nessuscli update --all C:\Program Files\Tenable\Nessus\nessusd -R Once done clear web browser cache and login to Nessus UI. |
2015年11月8日 星期日
Linux Upgrade OPENSSL
http://www.cyberciti.biz/faq/howto-openssl-security-update-cve20150291-cve20150204-cve20150290-cve20150207-cve20150286/
How To Patch and Protect OpenSSL Vulnerability # CVE-2015-0291 CVE-2015-0204 [ 19/March/2015 ]
How to find openssl version on a Linux?
The syntax is as follows:
Find openssl version on a CentOS/RHEL/SL/Fedora Linux
openssl version ## or ## sudo yum list installed openssl
## how do I find out my distro version? ## lsb_release -a ## or use ## cat /etc/*-releaseCentOS/RHEL/Fedora Linux
Type the following yum command to patch openssl as root user to patch openssl:sudo yum clean allTo install the updates, use the yum command as follows:sudo yum updateTo only update the OpenSSL package and its dependencies, use the following yum command:sudo yum update opensslSample outputs:Loaded plugins: auto-update-debuginfo, protectbase, rhnplugin, security This system is receiving updates from RHN Classic or RHN Satellite. Setting up Update Process epel-debuginfo/metalink | 13 kB 00:00 rhel-x86_64-server-6 | 1.5 kB 00:00 rhel-x86_64-server-6/primary | 21 MB 00:05 rhel-x86_64-server-6 14680/14680 rhel-x86_64-server-6-debuginfo | 1.3 kB 00:00 rhel-x86_64-server-6-debuginfo/primary | 1.1 MB 00:00 rhel-x86_64-server-6-debuginfo 5939/5939 rhel-x86_64-server-optional-6 | 1.5 kB 00:00 rhel-x86_64-server-optional-6/primary | 2.0 MB 00:00 rhel-x86_64-server-optional-6 8239/8239 rhel-x86_64-server-optional-6-debuginfo | 1.3 kB 00:00 rhel-x86_64-server-optional-6-debuginfo/primary | 681 kB 00:00 rhel-x86_64-server-optional-6-debuginfo 3571/3571 0 packages excluded due to repository protections Resolving Dependencies --> Running transaction check ---> Package openssl.x86_64 0:1.0.1e-30.el6_6.5 will be updated --> Processing Dependency: openssl = 1.0.1e-30.el6_6.5 for package: openssl-devel-1.0.1e-30.el6_6.5.x86_64 ---> Package openssl.x86_64 0:1.0.1e-30.el6_6.7 will be an update --> Running transaction check ---> Package openssl-devel.x86_64 0:1.0.1e-30.el6_6.5 will be updated ---> Package openssl-devel.x86_64 0:1.0.1e-30.el6_6.7 will be an update --> Finished Dependency Resolution Dependencies Resolved ================================================================================ Package Arch Version Repository Size ================================================================================ Updating: openssl x86_64 1.0.1e-30.el6_6.7 rhel-x86_64-server-6 1.5 M Updating for dependencies: openssl-devel x86_64 1.0.1e-30.el6_6.7 rhel-x86_64-server-6 1.2 M Transaction Summary ================================================================================ Upgrade 2 Package(s) Total download size: 2.7 M Is this ok [y/N]: n Exiting on user Command [root@txvip1 ~]# [root@txvip1 ~]# yum update openssl Loaded plugins: auto-update-debuginfo, protectbase, rhnplugin, security This system is receiving updates from RHN Classic or RHN Satellite. Setting up Update Process 0 packages excluded due to repository protections Resolving Dependencies --> Running transaction check ---> Package openssl.x86_64 0:1.0.1e-30.el6_6.5 will be updated --> Processing Dependency: openssl = 1.0.1e-30.el6_6.5 for package: openssl-devel-1.0.1e-30.el6_6.5.x86_64 ---> Package openssl.x86_64 0:1.0.1e-30.el6_6.7 will be an update --> Running transaction check ---> Package openssl-devel.x86_64 0:1.0.1e-30.el6_6.5 will be updated ---> Package openssl-devel.x86_64 0:1.0.1e-30.el6_6.7 will be an update --> Finished Dependency Resolution Dependencies Resolved ============================================================================================ Package Arch Version Repository Size ============================================================================================ Updating: openssl x86_64 1.0.1e-30.el6_6.7 rhel-x86_64-server-6 1.5 M Updating for dependencies: openssl-devel x86_64 1.0.1e-30.el6_6.7 rhel-x86_64-server-6 1.2 M Transaction Summary ============================================================================================ Upgrade 2 Package(s) Total download size: 2.7 M Is this ok [y/N]: y Downloading Packages: (1/2): openssl-1.0.1e-30.el6_6.7.x86_64.rpm | 1.5 MB 00:00 (2/2): openssl-devel-1.0.1e-30.el6_6.7.x86_64.rpm | 1.2 MB 00:00 -------------------------------------------------------------------------------------------- Total 6.4 MB/s | 2.7 MB 00:00 Running rpm_check_debug Running Transaction Test Transaction Test Succeeded Running Transaction Updating : openssl-1.0.1e-30.el6_6.7.x86_64 1/4 Updating : openssl-devel-1.0.1e-30.el6_6.7.x86_64 2/4 Cleanup : openssl-devel-1.0.1e-30.el6_6.5.x86_64 3/4 Cleanup : openssl-1.0.1e-30.el6_6.5.x86_64 4/4 Verifying : openssl-1.0.1e-30.el6_6.7.x86_64 1/4 Verifying : openssl-devel-1.0.1e-30.el6_6.7.x86_64 2/4 Verifying : openssl-1.0.1e-30.el6_6.5.x86_64 3/4 Verifying : openssl-devel-1.0.1e-30.el6_6.5.x86_64 4/4 Updated: openssl.x86_64 0:1.0.1e-30.el6_6.7 Dependency Updated: openssl-devel.x86_64 0:1.0.1e-30.el6_6.7
Do I need to reboot my server/laptop/computer powered by Linux?
Short answer - yes, you need to reboot your computer/server to make all the necessary changes. Sysadmin should plan on updating as soon as possible or use maintenance reboot window:
sudo reboot
2015年11月3日 星期二
Linux DNS Bind update
https://www.godaddy.com/help/update-bind-on-your-linux-dedicatedvirtual-dedicated-server-4690
UPDATE BIND ON YOUR LINUX DEDICATED/VIRTUAL DEDICATED SERVER
Some of the information in this article is advanced material we make available as a courtesy. Please be advised that you are responsible for properly following the procedures below. Customer Support cannot assist with these topics.
We strongly encourage you to keep the DNS service BIND (Berkeley Internet Name Domain) updated with the latest version on your Dedicated Server.
Note to Red Hat 9 Customers If you are running a Virtual Private Server (VPS) with the Red hat 9 operating system, you will need to either upgrade to a more current operating system or download the source RPM from the BIND website for your version of BIND and compile it on your server.
To Update BIND
- Connect to your server via SSH (more info).
- Switch to the root user (more info).
- Type
cp /etc/sysconfig/named /etc/sysconfig/named.bak - Type
yum clean all. - Type
yum update bind.
The system will then proceed to update all the needed packages for you automatically.
If you are running Parallels Plesk Panel there are certain packages that can be installed that will interfere with Parallels Plesk Panel's functionality. If you have not already, please add the following line to your /etc/yum.conf to ensure that YUM does not update any packages that may break Parallels Plesk Panel.
exclude=bind-chroot caching-nameserver
Adding this line to the configuration file will prevent yum from ever being able to update these packages. This can cause issues in the future should you want to use yum to update anything listed as an exclude.
If you have never made any changes to your yum.conf file you can use the following procedure to make this update:
- Connect to your server via SSH (more info).
- Switch to the root user (more info).
- Type
echo "exclude=bind-chroot caching-nameserver" >> /etc/yum.conf
Once this is complete you can run the yum update statements at the top of the article. If you receive an error similar to the following:
Error: Missing Dependency: bind = 31:9.4.2-3.fc7 is needed by package caching-nameserver
or
Error: Missing Dependency: bind = 31:9.4.2-3.fc7 is needed by package bind-chroot
You may need to remove bind-chroot and/or caching-nameserver from your server prior to upgrading. To do this you can do the following:
- Connect to your server via SSH (more info).
- Switch to the root user (more info).
- Type
yum -y remove bind-chroot caching-nameserver.
The removal of these packages can cause adverse effects on your server. You may need to restore the version of /etc/sysconfig/named that you backed up by using the following command:
cp /etc/sysconfig/named.bak /etc/sysconfig/named
This will install the most up to date version of BIND on your server. As the server administrator it will be your responsibility to determine whether or not a version update will cause any conflicts on your server. It is your responsibility to troubleshoot any issues that arise from performing this update.
2015年10月28日 星期三
2015年10月7日 星期三
Windows backup script for personal in CUSCS
xcopy "d:\CUHK SCS\mailbox\*" n:\2_Albert\pcbk\mailbox
xcopy "d:\CUHK SCS\*" n:\2_Albert\pcbk\ /s /i
xcopy "d:\network\*" n:\2_Albert\SFire\ /s /i
xcopy C:\Users\alberthui\AppData\Roaming\Thunderbird\Profiles\dh0cxcuy.default\Mail\* n:\2_Albert\servermail /s /i
xcopy "d:\CUHK SCS\*" n:\2_Albert\pcbk\ /s /i
xcopy "d:\network\*" n:\2_Albert\SFire\ /s /i
xcopy C:\Users\alberthui\AppData\Roaming\Thunderbird\Profiles\dh0cxcuy.default\Mail\* n:\2_Albert\servermail /s /i
2015年9月22日 星期二
Linux ---Named install centos 6
https://www.digitalocean.com/community/tutorials/how-to-install-the-bind-dns-server-on-centos-6
How To Install the BIND DNS Server on CentOS 6
Preamble
This article will show you how to setup and configure the BIND DNS Server. If you are looking for a guide on how to use DigitalOcean's integrated DNS service, you may want to review the "How to Set Up a Host Name with DigitalOcean" article instead.
Before we begin, it is recommended you have at least two cloud servers to run your nameservers. Two nameservers are suggested to assure your primary and secondary servers are redundant in case of failure. You may want to consider using two different POP's as well. For example, we've used San Francisco 1 and New York 1. For the purpose of this guide, it will be assumed you are configuring both a primary and secondary name server.
It is worth noting that if you are managing a large number of domains this may not be the most viable solution, as you will need to manually add domains on both the master and slave nameservers. With that said, running your own nameservers is a great way to have more direct control over your hosting infrastructure, and assert full control over your DNS records.
As with any new server, it's always important to ensure your system is up to date. You can verify this by checking for updates using yum as follows:
yum update -y
(Note: In DigitalOcean, we call our cloud servers as "droplets". We will use both terms throughout this tutorial)
Initial BIND Installation
To begin, we will need to install the BIND and BIND Utilities packages using yum.
yum install bind bind-utils -y
Next, we'll open the BIND (named) configuration file and make several modifications.
nano -w /etc/named.conf
Your "options" section should appear as follows, replacing 2.2.2.2 with the IP of your second droplet.
options {
#listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
allow-transfer { localhost; 2.2.2.2; };
recursion no;
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
};
Above, listen-on must be commented to listen on all available interfaces. Recursion should be turned off to prevent your server from being abused in "reflection" DDoS attacks. The allow-transfer directive whitelists transfers to your secondary droplet's IP. Furthermore, we have changed the allow-query directive to "any" in order to allow users proper access to hosted zones.
Next, we'll want to add a new zone for our first domain, you should add the following to your named.conf below the existing zones.
zone "mydomain.com" IN {
type master;
file "mydomain.com.zone";
allow-update { none; };
};
After saving named.conf with the changes above, we're ready to create our first zone file.
Configure BIND Zones
Firstly, we'll need to open the zone file, using the name you specified in the configuration above. (Ex: mydomain.com.zone)
nano -w /var/named/mydomain.com.zone
We'll add the following contents to our newly created file. You should replace the applicable information with your own, where 1.1.1.1 is the IP of your first droplet, 2.2.2.2 is the IP of your second droplet and 3.3.3.3 is the IP you wish to point the domain itself to, such as a droplet running a webserver. You are free to add additional entries in the same format.
$TTL 86400
@ IN SOA ns1.mydomain.com. root.mydomain.com. (
2013042201 ;Serial
3600 ;Refresh
1800 ;Retry
604800 ;Expire
86400 ;Minimum TTL
)
; Specify our two nameservers
IN NS ns1.mydomain.com.
IN NS ns2.mydomain.com.
; Resolve nameserver hostnames to IP, replace with your two droplet IP addresses.
ns1 IN A 1.1.1.1
ns2 IN A 2.2.2.2
; Define hostname -> IP pairs which you wish to resolve
@ IN A 3.3.3.3
www IN A 3.3.3.3
We can now start named for the first time. This may take several minutes while named generates therndc.key file, which only occurs on first execution.
service named restart
Once named has started successfully, we'll want to ensure that it is enabled as a startup service, by running the following:
chkconfig named on
By now, we should have a fully operational primary nameserver. You can verify that BIND is working correctly by running the following command, replacing 1.1.1.1 with the IP of your first droplet.
dig @1.1.1.1 mydomain.com
If you recieve a response which includes an answer and authority section, your nameserver has been configured correctly.
Slave Nameserver Configuration
With our primary nameserver configured, we'll now setup a slave nameserver on our second cloud server.
As always, please assure your system is up to date by checking for updates with yum as follows:
yum update -y
We can start by installing BIND (and related utilities) on the second droplet, in the same manner as the first:
yum install bind bind-utils -y
We'll proceed by opening named.conf and making the same changes we made previously, ommitting the "allow transfer" line. This directive is unnecessary as we will only be transfering records from our primary name server.
nano -w /etc/named.conf
options {
#listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
recursion no;
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
};
We will add the zone we configured on the first droplet, this time changing the "type" directive to slave, instead of master. You should replace "1.1.1.1" with your first droplet's IP address.
zone "mydomain.com" IN {
type slave;
masters { 1.1.1.1; };
file "mydomain.com.zone";
};
After configuring our slave zone, we'll start named. Again this may take several minutes while our rndc.keyfile is initially generated.
service named start
As with the first cloud server, we want to assure named is set to run at startup with the following:
chkconfig named on
Your slave nameserver should now be up and running. You can verify that it is fully operational by usingdig again, replacing 2.2.2.2 with the IP of your second droplet.
dig @2.2.2.2 mydomain.com
After any changes you make to the master zone files, you will need to instruct BIND to reload. Remember, you must also increment the "serial" directive to ensure synchronicity between the master and slave.
To reload the zone files, we need to run the following command on the master nameserver, followed by the slave:
rndc reload
BIND in a chroot environment
It is generally advised to install the additional package "bind-chroot" which will drop the privileges of BIND into a chroot environment.
Luckily, the CentOS package makes this extremely simple. The only aspect worth noting is that active paths for BIND will change to their chrooted equivalents, for example /var/named becomes/var/named/chroot/var/named With CentOS 6, you will not need to move any files as the package automatically creates hard symlinks to the non-chrooted directories.
If you'd like to enable this feature for the added security which it provides, you can do the following:
yum install bind-chroot -y service named restart
訂閱：
文章 (Atom)
I have trouble with ssl vpn. I havel multiple ssl portals and I have multiple policy witch ssl vpn.
When I connect via ssl vpn I get ip address 10.28.32.1 and I split route
10.28.1.0/24 via 10.28.32.1 dev ppp0
$ ping 10.28.1.1
PING 10.28.1.1 (10.28.1.1) 56(84) bytes of data.
64 bytes from 10.28.1.1: icmp_seq=1 ttl=249 time=11.1 ms
64 bytes from 10.28.1.1: icmp_seq=2 ttl=249 time=6.13 ms
64 bytes from 10.28.1.1: icmp_seq=3 ttl=249 time=19.1 ms
show trace messages on console
# diag debug flow trace start 100
# diag debug enable
# id=13 trace_id=23 msg=”vd-CUST received a packet(proto=1, 10.28.32.1:26621->10.28.1.1:8) fromssl.CUST. code=8, type=0, id=26621, seq=1.”
id=13 trace_id=23 msg=”allocate a new session-008266b4″
id=13 trace_id=23 msg=”find a route: flags=00000000 gw-172.21.1.1 via internal”
id=13 trace_id=23 msg=”use addr/intf hash, len=3″
id=13 trace_id=23 msg=”find SNAT: IP-172.21.1.254, port-62464″
id=13 trace_id=23 msg=”Allowed by Policy-50: SNAT”
id=13 trace_id=23 msg=”SNAT 10.28.32.1->172.21.1.254:62464″
interfaces=[any]
filters=[host 10.28.1.1]
2.421885 ssl.CUST in 10.28.32.1 -> 10.28.1.1: icmp: echo request
2.422775 internal out 172.21.1.254 -> 10.28.1.1: icmp: echo request
2.427052 internal in 10.28.1.1 -> 172.21.1.254: icmp: echo reply
2.427159 ssl.CUST out 10.28.1.1 -> 10.28.32.1: icmp: echo reply
(50) # show
config firewall policy
edit 50
set srcintf “wan1_CUST”
set dstintf “internal”
set srcaddr “all”
set dstaddr “LAN_net-BRANCH”
set action ssl-vpn
set identity-based enable
config identity-based-policy
edit 1
set schedule “always”
set utm-status enable
set groups “Bilina_static”
set users “test”
set service “ALL”
set sslvpn-portal “VPN_IP_BRANCH”
set av-profile “default”
set ips-sensor “default”
set application-list “default”
set profile-protocol-options “default”
next
end
next