主页 / user-145357

gmazoyer's questions

Martin Hope
gmazoyer
Asked: 2018-06-02 05:13:22 +0800 CST
  • 0

我目前正在尝试设置 DHCP 服务器以在 ZTP 环境中使用它。我的第一个目标是能够基于硬件自动升级我的瞻博网络设备。

我真正想要实现的是将适当的 JUNOS 软件分配给适当的瞻博网络硬件。例如，MX104 应下载 MX104 目标映像，EX4550 应下载 EX4550 目标映像。

到现在为止，我已经用 ISC 成功地设置了一个 DHCP 服务器。但这很简单，直到这里。

现在我正在尝试使用类和池来匹配供应商类标识符集，并将其设置为正确的池。

我的 DHCP 服务器配置如下：

option domain-name "example.com";
option domain-name-servers 8.8.8.8, 8.8.4.4;
option domain-search "example.com";

set vendor-string = option vendor-class-identifier;
option ztp-file-server code 150 = { ip-address };
option space ztp-ops;
option ztp-ops.image-file-name code 0 = text;
option ztp-ops.config-file-name code 1 = text;
option ztp-ops.image-file-type code 2 = text;
option ztp-ops.transfer-mode code 3 = text;
option ztp-ops-encapsulation code 43 = encapsulate ztp-ops;

class "juniper-mx10003" {
  match if substring(option vendor-class-identifier, 0, 15) = "Juniper-mx10003";
}

subnet 10.24.0.0 netmask 255.255.0.0 {
  default-lease-time 600;
  max-lease-time 86400;
  option routers 10.24.0.1;
  range 10.24.254.0 10.24.254.254;
  # Address pool(s)
  pool {
    range 10.24.253.0 10.24.253.10;
    allow members of "juniper-mx10003";
    option ztp-file-server 10.24.1.2;
    option ztp-ops.transfer-mode "http";
    option ztp-ops.image-file-name "/junos-vmhost-install-mx-x86-64-18.1R1.9.tgz";
  }
}

我的 MX10003 有一个瞻博网络配置，如下所示：

system {
    root-authentication {
        encrypted-password "YEAH"; ## SECRET-DATA
    }
    syslog {
        user * {
            any emergency;
        }
        file messages {
            any notice;
            authorization info;
        }
        file interactive-commands {
            interactive-commands any;
        }
    }
}
interfaces {
    fxp0 {
        unit 0 {
            family inet {
                dhcp {
                    vendor-id Juniper-mx10003;
                }
            }
        }
    }
}

在启动或清除并请求租用时，MX 要求 IP 地址，但这是分配的 10.24.254.0 到 10.24.254.254 范围之一，而不是从 10.24.253.0 到 10.24.253.10。

我尝试使用 dhcpdump 转储 DHCP 交换，结果如下：

  TIME: 2018-06-01 15:07:50.357
    IP: 0.0.0.0 (d8:18:d3:1e:a9:66) > 255.255.255.255 (ff:ff:ff:ff:ff:ff)
    OP: 1 (BOOTPREQUEST)
 HTYPE: 1 (Ethernet)
  HLEN: 6
  HOPS: 0
   XID: 52cccd10
  SECS: 0
 FLAGS: 7f80
CIADDR: 0.0.0.0
YIADDR: 0.0.0.0
SIADDR: 0.0.0.0
GIADDR: 0.0.0.0
CHADDR: d8:18:d3:1e:a9:66:00:00:00:00:00:00:00:00:00:00
 SNAME: .
 FNAME: .
OPTION:  53 (  1) DHCP message type         1 (DHCPDISCOVER)
OPTION:  60 ( 15) Vendor class identifier   Juniper-mx10003
OPTION:  51 (  4) IP address leasetime      86400 (24h)
---------------------------------------------------------------------------

  TIME: 2018-06-01 15:07:51.297
    IP: 10.24.1.2 (0:c:29:8:a6:dd) > 255.255.255.255 (ff:ff:ff:ff:ff:ff)
    OP: 2 (BOOTPREPLY)
 HTYPE: 1 (Ethernet)
  HLEN: 6
  HOPS: 0
   XID: 52cccd10
  SECS: 0
 FLAGS: 7f80
CIADDR: 0.0.0.0
YIADDR: 10.24.254.0
SIADDR: 0.0.0.0
GIADDR: 0.0.0.0
CHADDR: d8:18:d3:1e:a9:66:00:00:00:00:00:00:00:00:00:00
 SNAME: .
 FNAME: .
OPTION:  53 (  1) DHCP message type         2 (DHCPOFFER)
OPTION:  54 (  4) Server identifier         10.24.1.2
OPTION:  51 (  4) IP address leasetime      86400 (24h)
OPTION:   1 (  4) Subnet mask               255.255.0.0
OPTION:   3 (  4) Routers                   10.24.0.1
OPTION:   6 (  8) DNS server                8.8.8.8,8.8.4.4
OPTION: 119 ( 30) Domain Search             0a6c75786e657477 .example
                                            6f726b0269       .com.
OPTION:  15 ( 13) Domainname                example.com
---------------------------------------------------------------------------

  TIME: 2018-06-01 15:07:51.302
    IP: 0.0.0.0 (d8:18:d3:1e:a9:66) > 255.255.255.255 (ff:ff:ff:ff:ff:ff)
    OP: 1 (BOOTPREQUEST)
 HTYPE: 1 (Ethernet)
  HLEN: 6
  HOPS: 0
   XID: 52cccd10
  SECS: 0
 FLAGS: 7f80
CIADDR: 0.0.0.0
YIADDR: 0.0.0.0
SIADDR: 0.0.0.0
GIADDR: 0.0.0.0
CHADDR: d8:18:d3:1e:a9:66:00:00:00:00:00:00:00:00:00:00
 SNAME: .
 FNAME: .
OPTION:  54 (  4) Server identifier         10.24.1.2
OPTION:  55 ( 14) Parameter Request List      3 (Routers)
                                             51 (IP address leasetime)
                                              1 (Subnet mask)
                                             15 (Domainname)
                                              6 (DNS server)
                                             66 (TFTP server name)
                                             67 (Bootfile name)
                                            120 (SIP Servers DHCP Option)
                                             44 (NetBIOS name server)
                                             43 (Vendor specific info)
                                            150 (???)
                                             12 (Host name)
                                              7 (Log server)
                                             42 (NTP servers)

OPTION:  50 (  4) Request IP address        10.24.254.0
OPTION:  53 (  1) DHCP message type         3 (DHCPREQUEST)
OPTION:  60 ( 15) Vendor class identifier   Juniper-mx10003
OPTION:  51 (  4) IP address leasetime      86400 (24h)
---------------------------------------------------------------------------

  TIME: 2018-06-01 15:07:51.398
    IP: 10.24.1.2 (0:c:29:8:a6:dd) > 255.255.255.255 (ff:ff:ff:ff:ff:ff)
    OP: 2 (BOOTPREPLY)
 HTYPE: 1 (Ethernet)
  HLEN: 6
  HOPS: 0
   XID: 52cccd10
  SECS: 0
 FLAGS: 7f80
CIADDR: 0.0.0.0
YIADDR: 10.24.254.0
SIADDR: 0.0.0.0
GIADDR: 0.0.0.0
CHADDR: d8:18:d3:1e:a9:66:00:00:00:00:00:00:00:00:00:00
 SNAME: .
 FNAME: .
OPTION:  53 (  1) DHCP message type         5 (DHCPACK)
OPTION:  54 (  4) Server identifier         10.24.1.2
OPTION:  51 (  4) IP address leasetime      86400 (24h)
OPTION:   1 (  4) Subnet mask               255.255.0.0
OPTION:   3 (  4) Routers                   10.24.0.1
OPTION:  15 ( 13) Domainname                example.com
OPTION:   6 (  8) DNS server                8.8.8.8,8.8.4.4
---------------------------------------------------------------------------

有没有人尝试做同样的事情？也许我缺少一些明显的东西？

debian
Martin Hope
gmazoyer
Asked: 2016-05-09 15:02:33 +0800 CST
  • 4

尝试将完整区域从 PowerDNS 服务器传输到 Bind9 服务器时遇到问题。奇怪的是，PowerDNS 服务器上有几个区域用作隐藏的主服务器（带有 MySQL 后端），但只有一个区域无法传输到 Bind9 服务器。

两台服务器都运行 Ubuntu 16.04 LTS。和：

  • Bind9 版本 = 9.10.3.dfsg.P4-8ubuntu1
  • PowerDNS 版本 = 4.0.0~alpha2-3build1

Bind9 从区配置如下：

zone "example.net" {
    type slave;
    file "/var/lib/bind/slaves/db.example.net";
    masters {
          10.0.0.1;
    };
};

PowerDNS 的 DNS 区域是：

% sudo pdnsutil show-zone example.net
This is a Master zone
Last SOA serial number we notified: 2016050801 == 2016050801 (serial in the database)
Zone is not actively secured
Metadata items: None
No keys for zone 'example.net.'.

% sudo pdnsutil list-zone example.net
example.net.    10800   IN  MX  10 mx1.example.org.
example.net.    10800   IN  MX  50 mx2.example.org.
example.net.    10800   IN  NS  ns1.example.org.
example.net.    10800   IN  NS  ns2.example.org.
example.net.    86400   IN  SOA ns1.example.org. hostmaster.example.org. 2016050801 28800 7200 604800 86400
...

请注意此输出中.net和.org之间的区别。这是在尝试将区域提供给 Bind 时日志中的 PowerDNS 输出。

May  9 00:44:14 hdns01 pdns[40494]: AXFR of domain 'example.net.' initiated by 10.0.0.2
May  9 00:44:14 hdns01 pdns[40494]: AXFR of domain 'example.net.' allowed: client IP 10.0.0.2 is in allow-axfr-ips
May  9 00:44:14 hdns01 pdns[40494]: AXFR of domain 'example.net.' failed: not authoritative

以及Bind给出的对应日志。

May  9 00:44:14 rdns01 named[32973]: zone example.net/IN: refresh: unexpected rcode (REFUSED) from master 10.0.0.1#53 (source 0.0.0.0#0)
May  9 00:44:14 rdns01 named[32973]: zone example.net/IN: Transfer started.
May  9 00:44:14 rdns01 named[32973]: transfer of 'example.net/IN' from 10.0.0.1#53: connected using 10.0.0.2#55376
May  9 00:44:14 rdns01 named[32973]: transfer of 'example.net/IN' from 10.0.0.1#53: failed while receiving responses: NOTAUTH
May  9 00:44:14 rdns01 named[32973]: transfer of 'example.net/IN' from 10.0.0.1#53: Transfer status: NOTAUTH
May  9 00:44:14 rdns01 named[32973]: transfer of 'example.net/IN' from 10.0.0.1#53: Transfer completed: 0 messages, 0 records, 0 bytes, 0.004 secs (0 bytes/sec)

所以Bind9是说服务器不权威。这很奇怪。因此，让我们使用dig让事情变得更清晰。

% dig @10.0.0.1 example.net. SOA          

; <<>> DiG 9.10.3-P4-Ubuntu <<>> @10.0.0.1 example.net. SOA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47002
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1680
;; QUESTION SECTION:
;example.net.           IN  SOA

;; ANSWER SECTION:
example.net.        86400   IN  SOA ns1.example.org. hostmaster.example.org. 2016050801 28800 7200 604800 86400

;; Query time: 2 msec
;; SERVER: 10.0.0.1#53(10.0.0.1)
;; WHEN: Mon May 09 00:53:51 CEST 2016
;; MSG SIZE  rcvd: 104

对我来说似乎很权威。所以在那之后我尝试用 dig 做一个 AXFR。令人惊讶的是它有效......

% dig -t axfr example.net @10.0.0.1

; <<>> DiG 9.10.3-P4-Ubuntu <<>> -t axfr example.net @10.0.0.1
;; global options: +cmd
example.net.        86400   IN  SOA ns1.example.org. hostmaster.example.org. 2016050801 28800 7200 604800 86400
...
;; Query time: 73 msec
;; SERVER: 10.0.0.1#53(10.0.0.1)
;; WHEN: Mon May 09 00:56:42 CEST 2016
;; XFR size: 58 records (messages 3, bytes 1952)

我不知道该去哪里找了。

谢谢你的帮助。

更新：

数据包捕获的日志：

1   0.000000    10.0.0.2    10.0.0.1    DNS 82  Standard query 0xe0dd SOA example.net OPT
2   0.002902    10.0.0.1    10.0.0.2    DNS 82  Standard query response 0xe0dd Refused SOA example.net OPT
6   0.004506    10.0.0.2    10.0.0.1    DNS 97  Standard query 0x205c AXFR example.net
8   0.006432    10.0.0.1    10.0.0.2    DNS 97  Standard query response 0x205c Not authoritative AXFR example.net

来自成功的手动 AXFR 的 PowerDNS 日志：

May  9 08:19:51 hdns01 pdns[40494]: AXFR of domain 'example.net.' initiated by 10.0.0.2
May  9 08:19:51 hdns01 pdns[40494]: AXFR of domain 'example.net.' allowed: client IP 10.0.0.2 is in allow-axfr-ips
May  9 08:19:52 hdns01 pdns[40494]: AXFR of domain 'example.net.' to 10.0.0.2 finished

PowerDNS 配置文件：

#################################
# allow-axfr-ips    Allow zonetransfers only to these subnets
#
allow-axfr-ips=127.0.0.0/8,::1,10.0.0.2

#################################
# also-notify   When notifying a domain, also notify these nameservers
#
also-notify=10.20.1.78,10.0.0.2

#################################
# daemon    Operate as a daemon
#
daemon=yes

#################################
# include-dir   Include *.conf files from this directory
#
# include-dir=
include-dir=/etc/powerdns/pdns.d

#################################
# launch    Which backends to launch and order to query them in
#
# launch=
launch=

#################################
# master    Act as a master
#
master=yes

#################################
# setgid    If set, change group id to this gid for more security
#
setgid=pdns

#################################
# setuid    If set, change user id to this uid for more security
#
setuid=pdns

以及/etc/powerdns/pdns.d/目录中的 MySQL 后端配置部分。

# MySQL Configuration
#
# Launch gmysql backend
launch+=gmysql

# gmysql parameters
gmysql-host=127.0.0.1
gmysql-port=
gmysql-dbname=pdns
gmysql-user=MYUSER
gmysql-password=MYPASSWORD
gmysql-dnssec=yes
# gmysql-socket=
ubuntu domain-name-system bind powerdns