Commands:
enable enables the firewall
disable disables the firewall
default ARG set default policy
logging LEVEL set logging to LEVEL
allow ARGS add allow rule
deny ARGS add deny rule
reject ARGS add reject rule
limit ARGS add limit rule
delete RULE|NUM delete RULE
insert NUM RULE insert RULE at NUM
reset reset firewall
status show firewall status
status numbered show firewall status as numbered list of RULES
status verbose show verbose firewall status
show ARG show firewall report
version display version information
Application profile commands:
app list list application profiles
app info PROFILE show information on PROFILE
app update PROFILE update PROFILE
app default ARG set default application policy
# Set to yes to apply rules to support IPv6 (no means only IPv6 on loopback
# accepted). You will need to ‘disable’ and then ‘enable’ the firewall for
# the changes to take affect. IPV6=no
root@ml115:/# update-grub
Generating grub.cfg …
Found linux image: /boot/vmlinuz-3.0.0-12-server
Found initrd image: /boot/initrd.img-3.0.0-12-server
Found memtest86+ image: /memtest86+.bin
done
再起動する
root@ml115:/# shutdown -r now
サーバ側はこれで完了。
2. クライアント側の準備
クライアント側は minicom というソフトウェアを使って接続してみましょう。
まずは minicom のインストール
root@thinkpadx220:~# apt-get install minicom
インストールが終わったら初回起動の設定を済ませておきましょう。
root@thinkpadx220:~# minicom -s
+—–[configuration]——+
| Filenames and paths |
| File transfer protocols |
| Serial port setup |
| Modem and dialing |
| Screen and keyboard |
| Save setup as dfl |
| Save setup as.. |
| Exit |
| Exit from Minicom |
+————————–+
Serial port setup を選択
+———————————————————————–+
| A - Serial Device : /dev/ttyUSB0 |
| B – Lockfile Location : /var/lock |
| C - Callin Program : |
| D - Callout Program : |
| E - Bps/Par/Bits : 9600 8N1 |
| F – Hardware Flow Control : No |
| G – Software Flow Control : No |
| |
| Change which setting? |
+———————————————————————–+
Serial Device や Bps/Par/Bits あたりを自分の環境に合わせて設定しましょう。
編集が終わったらEnterで画面を抜けてトップメニューのでSave setup as dflを選択。
; <<>> DiG 9.7.0-P1 <<>> @ns0.mykw.jp yutarommx.com aaaa
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51434
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 4
;; WARNING: recursion requested but not available
;; QUESTION SECTION:
;yutarommx.com. IN AAAA
;; ANSWER SECTION:
yutarommx.com. 180 IN AAAA 240f:1:33f2:1::beef
;; AUTHORITY SECTION:
yutarommx.com. 180 IN NS ns1.mykw.jp.
yutarommx.com. 180 IN NS ns0.mykw.jp.
;; ADDITIONAL SECTION:
ns0.mykw.jp. 180 IN A 49.212.22.200
ns0.mykw.jp. 180 IN AAAA 2001:e41:31d4:16c8::1
ns1.mykw.jp. 180 IN A 183.181.172.61
ns1.mykw.jp. 180 IN AAAA 2001:2e8:603:0:2:1:0:3d
; <<>> DiG 9.7.0-P1 <<>> @ns0.mykw.jp yutarommx.com a
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37995
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 4
;; WARNING: recursion requested but not available
;; QUESTION SECTION:
;yutarommx.com. IN A
;; ANSWER SECTION:
yutarommx.com. 180 IN A 124.214.243.203
;; AUTHORITY SECTION:
yutarommx.com. 180 IN NS ns0.mykw.jp.
yutarommx.com. 180 IN NS ns1.mykw.jp.
;; ADDITIONAL SECTION:
ns0.mykw.jp. 180 IN A 49.212.22.200
ns0.mykw.jp. 180 IN AAAA 2001:e41:31d4:16c8::1
ns1.mykw.jp. 180 IN A 183.181.172.61
ns1.mykw.jp. 180 IN AAAA 2001:2e8:603:0:2:1:0:3d
sakura# cat yutarommx.com.zone
$TTL 180
@ IN SOA yutarommx.com. yutaro.mykw.jp. (
2012041507 ; serial (d. adams)
3H ; refresh
15M ; retry
1W ; expiry
15M) ; minimum
IN NS ns0.mykw.jp.
IN NS ns1.mykw.jp.
IN A 124.214.243.203
IN AAAA 240f:1:33f2:1::beef
www IN A 124.214.243.203
www IN AAAA 240f:1:33f2:1::beef
tumblr IN A 72.32.231.8
AAAAレコードの結果(After)
micro# dig @ns0.mykw.jp yutarommx.com a
; <<>> DiG 9.7.0-P1 <<>> @ns0.mykw.jp yutarommx.com
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62064
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 4
;; WARNING: recursion requested but not available
;; QUESTION SECTION:
;yutarommx.com. IN A
;; ANSWER SECTION:
yutarommx.com. 180 IN A 124.214.243.203
;; AUTHORITY SECTION:
yutarommx.com. 180 IN NS ns1.mykw.jp.
yutarommx.com. 180 IN NS ns0.mykw.jp.
;; ADDITIONAL SECTION:
ns0.mykw.jp. 180 IN A 49.212.22.200
ns0.mykw.jp. 180 IN AAAA 2001:e41:31d4:16c8::1
ns1.mykw.jp. 180 IN A 183.181.172.61
ns1.mykw.jp. 180 IN AAAA 2001:2e8:603:0:2:1:0:3d
; <<>> DiG 9.7.0-P1 <<>> @ns0.mykw.jp yutarommx.com aaaa
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64265
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 4
;; WARNING: recursion requested but not available
;; QUESTION SECTION:
;yutarommx.com. IN AAAA
;; ANSWER SECTION:
yutarommx.com. 180 IN AAAA 240f:1:33f2:1::beef
;; AUTHORITY SECTION:
yutarommx.com. 180 IN NS ns1.mykw.jp.
yutarommx.com. 180 IN NS ns0.mykw.jp.
;; ADDITIONAL SECTION:
ns0.mykw.jp. 180 IN A 49.212.22.200
ns0.mykw.jp. 180 IN AAAA 2001:e41:31d4:16c8::1
ns1.mykw.jp. 180 IN A 183.181.172.61
ns1.mykw.jp. 180 IN AAAA 2001:2e8:603:0:2:1:0:3d
micro# diff -u unbound.conf.def unbound.conf
— unbound.conf.def 2012-04-14 16:33:20.268064334 +0900
+++ unbound.conf 2012-04-14 16:47:19.748193075 +0900
@@ -34,7 +34,10 @@
# specify 0.0.0.0 and ::0 to bind to all available interfaces.
# specify every interface[@port] on a new ‘interface:’ labelled line.
# The listen interfaces are not changed on reload, only on restart.
- # interface: 192.0.2.153
+ interface: 127.0.0.1
+ interface: 192.168.0.128
+ interface: ::1
+ interface: 240f:1:33f2:1::cafe
# interface: 192.0.2.154
# interface: 192.0.2.154@5003
# interface: 2001:DB8::5
@@ -44,7 +47,7 @@
# interface-automatic: no
# port to answer queries from
- # port: 53
+ port: 53
# specify the interfaces to send outgoing queries to authoritative
# server from by ip-address. If none, the default (all) interface
@@ -116,7 +119,7 @@
# the time to live (TTL) value cap for RRsets and messages in the
# cache. Items are not cached for longer. In seconds.
- # cache-max-ttl: 86400
+ cache-max-ttl: 86400
# the time to live (TTL) value for cached roundtrip times and
# EDNS version information for hosts. In seconds.
@@ -137,16 +140,16 @@
# infra-cache-lame-size: 10k
# if given, a chroot(2) is done to the given directory.
@@ -214,7 +219,7 @@
# file to read root hints from.
# get one from ftp://FTP.INTERNIC.NET/domain/named.cache
- # root-hints: “”
+ root-hints: “/etc/unbound/named.cache”
# enable to not answer id.server and hostname.bind queries.
# hide-identity: no
@@ -437,27 +442,27 @@
remote-control:
# Enable remote control with unbound-control(8) here.
# set up the keys and certificates with unbound-control-setup.
- # control-enable: no
+ control-enable: yes
# what interfaces are listened to for remote control.
# give 0.0.0.0 and ::0 to listen to all interfaces.
- # control-interface: 127.0.0.1
- # control-interface: ::1
+ control-interface: 127.0.0.1
+ control-interface: ::1
# port number for remote control operations.
- # control-port: 953
+ control-port: 953
# unbound-control-setup
setup in directory /etc/unbound
generating unbound_server.key
Generating RSA private key, 1024 bit long modulus
………………..++++++
………………………….++++++
e is 65537 (0×10001)
generating unbound_control.key
Generating RSA private key, 1024 bit long modulus
……….++++++
..++++++
e is 65537 (0×10001)
create unbound_server.pem (self signed certificate)
create unbound_control.pem (signed client certificate)
Signature ok
subject=/CN=unbound-control
Getting CA Private Key
Setup success. Certificates created. Enable in unbound.conf file to use
micro#
5. Unboundを再起動する
micro# /etc/init.d/unbound restart
* Restarting recursive DNS server unbound [ OK ]
micro#
;; ANSWER SECTION:
mykw.jp. 180 IN A 180.222.80.63
;; AUTHORITY SECTION:
mykw.jp. 180 IN NS ns0.mykw.jp.
mykw.jp. 180 IN NS ns1.mykw.jp.
;; ADDITIONAL SECTION:
ns0.mykw.jp. 180 IN A 49.212.22.200
ns0.mykw.jp. 180 IN AAAA 2001:e41:31d4:16c8::1
ns1.mykw.jp. 180 IN A 183.181.172.61
ns1.mykw.jp. 180 IN AAAA 2001:2e8:603:0:2:1:0:3d
Usage: dnsperf [-d datafile] [-s server_addr] [-p port] [-b bufsize] [-f family] [-e] [-D] [-y name:secret] [-v] [-A] [-h] [-q num_queries] [-t timeout] [-Q max_qps] [-1] [-l limit] [-c] [-H histogram_buckets] [-T histogram_seconds] [-u] -d specifies the input data file (default: stdin) -s sets the server to query (default: 127.0.0.1) -p sets the port on which to query the server (default: 53) -b set socket send/receive buffer size in kilobytes (default: 32 k) -f specify address family of DNS transport, inet or inet6 (default: any) -e enable EDNS 0 -D set the DNSSEC OK bit (implies EDNS) -y specifies the TSIG name and secret (no default) -A report command-line arguments -h print this usage -q specifies the maximum number of queries outstanding (default: 20) -t specifies the timeout for query completion in seconds (default: 5) -Q limit the number of queries per second (no default) -1 run through input only once (default: multiple iff limit given) -l specifies how a limit for how long to run tests in seconds (no default) -c print the number of packets with each rcode -H print a response latency histogram with this many buckets -T include latencies up to this many seconds in histogram (use with -H) -u send dynamic updates instead of queries -v verbose: report the RCODE of each response on stdout
“/etc/fstab” 12 lines, 681 characters
# /etc/fstab: static file system information.
#
# Use ‘blkid -o value -s UUID’ to print the universally unique identifier
# for a device; this may be used with UUID= as a more robust way to name
# devices that works even if disks are added and removed. See fstab(5).
#
# <file system> <mount point> <type> <options> <dump> <pass>
proc /proc proc nodev,noexec,nosuid 0 0
# / was on /dev/vda1 during installation
UUID=c65156da-fd9f-4694-a3a3-cba8dd1db6bf / ext4 errors=remount-ro,usrquota,grpquota 0 1
# swap was on /dev/vda5 during installation
UUID=2c8d9c41-c46a-4906-a633-cfd7be97d018 none swap sw 0 0
再マウント
root@wktk:/# mount -o remount /dev/vda1
wktk# mount
/dev/vda1 on / type ext4 (rw,errors=remount-ro,usrquota,grpquota)
proc on /proc type proc (rw,noexec,nosuid,nodev)
none on /sys type sysfs (rw,noexec,nosuid,nodev)
none on /sys/fs/fuse/connections type fusectl (rw)
none on /sys/kernel/debug type debugfs (rw)
none on /sys/kernel/security type securityfs (rw)
none on /dev type devtmpfs (rw,mode=0755)
none on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=0620)
none on /dev/shm type tmpfs (rw,nosuid,nodev)
none on /var/run type tmpfs (rw,nosuid,mode=0755)
none on /var/lock type tmpfs (rw,noexec,nosuid,nodev)
none on /lib/init/rw type tmpfs (rw,nosuid,mode=0755)
none on /var/lib/ureadahead/debugfs type debugfs (rw,relatime)
クオータの有効化
root@wktk:/# quotaon -p /dev/vda1
group quota on / (/dev/vda1) is on
user quota on / (/dev/vda1) is on
root@wktk:/# quota
root@wktk:/# quotaon -avug
/dev/vda1 [/]: group quotas turned on
/dev/vda1 [/]: user quotas turned on
root@wktk:/#
ファイルの所有権チェック
root@wktk:/# quotacheck -avugm
quotacheck: Your kernel probably supports journaled quota but you are not using it. Consider switching to journaled quot
a to avoid running quotacheck after an unclean shutdown.
quotacheck: WARNING – Quotafile //quota.user was probably truncated. Cannot save quota settings…
quotacheck: WARNING – Quotafile //quota.group was probably truncated. Cannot save quota settings…
quotacheck: Scanning /dev/vda1 [/] done
quotacheck: Checked 11909 directories and 76257 files
root@wktk:/#
クオータの状況確認
wktk# repquota -a
*** Report for user quotas on device /dev/vda1
Block grace time: 7days; Inode grace time: 7days
Block limits File limits
User used soft hard grace used soft hard grace
———————————————————————-
root — 1502740 0 0 78726 0 0
deb http://ftp.jp.debian.org/debian/ squeeze main contrib non-free
#deb http://ftp.jp.debian.org/debian-volatile/ squeeze/volatile main contrib non-free
deb http://security.debian.org/ squeeze/updates main contrib non-free
~
dti# uname -a
Linux dti.mykw.jp 2.6.18-164.15.1.el5.028stab068.9 #1 SMP Tue Mar 30 18:07:38 MSD 2010 x86_64 GNU/Linux
dti#
残念！
4. いらない子のお掃除 & 再起動
いらない子をお掃除してディスクを節約。
dti# apt-get autoremove
Reading package lists… Done
Building dependency tree
Reading state information… Done
The following packages will be REMOVED:
libbind9-50
0 upgraded, 0 newly installed, 1 to remove and 0 not upgraded.
After this operation, 81.9 kB disk space will be freed.
Do you want to continue [Y/n]? y
(Reading database … 28104 files and directories currently installed.)
Removing libbind9-50 …
dti# shutdown -r now
Broadcast message from root@dti.mykw.jp (pts/4) (Sun Jan 22 21:54:51 2012):
The system is going down for reboot NOW!
