Debian Diskless Setup and Configuration

Here we are going setup a server that serves over network to pxe clients a diskless debian. We will be using the following:

• DHCP server: dh1 (see how to install here)
• TFTP server: tftp1 (IP: 192.168.10.35)
• NFS server: nfs1 (IP: 192.168.10.30)
• PXE image location on NFS server: /srv/diskless/c1

How to edit Dynamic DNS zone

All changes made to a zone using dynamic update are stored in the zone's journal file. The zone file is updated every 15 min. The zone files of dynamic zones cannot normally be edited by hand because they are not guaranteed to contain the most recent dynamic changes (those are only in the journal file). Here are few steps that let you edit entries in dynamic dns zone:

1. Suspend updates to all dynamic zones.

   rndc freeze
   

2. Edit zone file
3. Enable updates to all dynamic zones and reload them.

   rndc thaw
   

Read more about advanced dns features here.

Debian DHCP server failover

Before we start I assume you followed previous two posts: setup and dynamic-dns. Our primary dhcp server located at 192.168.10.4 and secondary at 192.168.10.5.

Primary DHCP Server

1. You need declare failover section that identifies the primary dhcp server (file /etc/dhcp/dhcpd.conf).

   failover peer "dhcp-failover" {
     primary; # declare this to be the primary server
     address 192.168.10.4;
     port 647;
     peer address 192.168.10.5;
     peer port 647;
     max-response-delay 30;
     max-unacked-updates 10;
     load balance max seconds 3;
     mclt 1800;
     split 128;
   }
   

2. Failover peer needs to be referenced by concrete subnet:

   subnet 192.168.10.0 netmask 255.255.255.0 {
     pool {
       # In order to turn off failover just comment out
       # the line below
       failover peer "dhcp-failover";
       range 192.168.10.41 192.168.10.254;
     }
     option subnet-mask 255.255.255.0;
     option broadcast-address 192.168.10.255;
     option routers gw1.dev.local;
   }
   

Secondary DHCP Server

1. Failover secondary peer declaration (file /etc/dhcp/dhcpd.conf):

   failover peer "dhcp-failover" {
     secondary; # declare this to be the secondary server
     address 192.168.10.5;
     port 647;
     peer address 192.168.10.4;
     peer port 647;
     max-response-delay 30;
     max-unacked-updates 10;
     load balance max seconds 3;
   }
   

2. subnet 192.168.10.0 netmask 255.255.255.0 {
     pool {
       # In order to turn off failover just comment out
       # the line below
       failover peer "dhcp-failover";
       range 192.168.10.41 192.168.10.254;
     }
     option subnet-mask 255.255.255.0;
     option broadcast-address 192.168.10.255;
     option routers gw1.dev.local;
   }
   

That pretty much you need to do. Read more here.

Dynamic DNS update with DHCP on Debian

If you have many dhcp clients it is much convenient to find them by name than remember ip addresses. This is what dynamic dns update with dhcp is for. I assume you followed few previous posts on dns and dhcp topic.

Configure DNS server

1. We would like to accept only authorized secure updates, so let generate a secure key:

   dnssec-keygen -r /dev/urandom -a hmac-md5 -b 256 -n host key
   cat Kkey.*.private
   rm Kkey*
   

   Here is sample output:

   Private-key-format: v1.3
   Algorithm: 157 (HMAC_MD5)
   Key: 9rHjOgEuZ8O8LpsoJcl4zORqbeOCaPc3WfYDd5Mq3FHI=
   ...
   

2. Add the following (replace md5 key with the one you generated) to a new file /etc/bind/dynamic-dns.key

   key DYNAMICDNS {
           algorithm hmac-md5;
           secret "9rHjOgEuZ8O8LpsoJcl4zORqbeOCaPc3WfYDd5Mq3FHI=";
   };
   

3. Secure key:

   chmod o-r /etc/bind/dynamic-dns.key
   

4. Ensure bind is the owner of the configucation directory, since it save some files there during dynamic updates:

   chmod -R g+w /etc/bind/
   

5. Update zone registration file to allow dynamic updates (file /etc/bind/named.conf.local):

   include "/etc/bind/dynamic-dns.key";
   
   zone "dev.local" IN {
          type master;
          file "/etc/bind/db.dev.local";
          allow-update { key DYNAMICDNS; };
   };
   
   zone "10.168.192.IN-ADDR.ARPA" IN {
          type master;
          file "/etc/bind/db.10.168.192";
          allow-update { key DYNAMICDNS; };
   };
   

6. Restart bind9

Test DNS Settings

1. Let configure DNS for a new host test with ip 192.168.10.7:

   root@ns1:/etc/bind# nsupdate 
   > server 127.0.0.1
   > key DYNAMICDNS 9rHjOgEuZ8O8LpsoJcl4zORqbeOCaPc3WfYDd5Mq3FHI=
   > zone dev.local
   > update add test.dev.local. 600 IN A 192.168.10.7
   > send
   > zone 10.168.192.IN-ADDR.ARPA
   > update add 7.10.168.192.in-addr.arpa 600 IN PTR test.dev.local.
   > send
   

2. And now verify:

   user1@deby01:~$ host test
   test.dev.local has address 192.168.10.7
   
   user1@deby01:~$ host 192.168.10.7
   7.10.168.192.in-addr.arpa domain name pointer test.dev.local.
   

Configure DHCP server

1. Add the following (replace md5 key with the one you generated) to a new file /etc/dhcp/dynamic-dns.key

   key DYNAMICDNS {
           algorithm hmac-md5;
           secret "9rHjOgEuZ8O8LpsoJcl4zORqbeOCaPc3WfYDd5Mq3FHI=";
   };
   

2. Create a new file /etc/dhcp/dhcpd.conf.local with the following content:

   include "/etc/dhcp/dynamic-dns.key";
   
   zone dev.local. {
           primary ns1.dev.local;
           key DYNAMICDNS;
   }
   
   zone 10.168.192.IN-ADDR.ARPA. {
           primary ns1.dev.local;
           key DYNAMICDNS;
   }
   

3. Open file /etc/dhcp/dhcpd.conf and ensure:

   ddns-update-style interim;
   include "/etc/dhcp/dhcpd.conf.local";
   

4. Restart dhcp server so our change take effect.

   /etc/init.d/isc-dhcp-server restart
   

Test DHCP server with Debian client

1. First of all in order to identify your debian client by name you must ensure it send host name to dhcp server. You can check this in file /etc/dhcp/dhclient.conf:

   send host-name "deby01";
   

2. Assuming the dhcp client interface is configured for eth1, here is a command to re-new ip address from server:

   dhclient -v eth1
   

Debian DHCP Server Setup

Dynamic Host Configuration Protocol (DHCP) is a protocol. It gives client machines "leases" for IP addresses and can automatically set their network configuration.

apt-get -y install rsyslog isc-dhcp-server

Before we start configuring the dhcp server let set our requirements:

• Domain name: dev.local
• Network: 192.168.10.0/24
• DNS Servers: ns1.dev.local, ns2.dev.local
• Gateway: gw1.dev.local
• First 40 ip addresses are reserved for servers
• DHCP pool is 41 - 254

Server Configuration

1. The server will be listening on eth0 interface (file /etc/default/isc-dhcp-server):

   # On what interfaces should the DHCP server (dhcpd) 
   # serve DHCP requests? Separate multiple interfaces 
   # with spaces, e.g. "eth0 eth1".
   INTERFACES="eth0"
   

2. Configure DHCP per our requirements (file /etc/dhcp/dhcpd.conf)

   # The ddns-updates-style parameter controls whether or
   # not the server will attempt to do a DNS update when 
   # a lease is confirmed. We default to the behavior of 
   # the version 2 packages ('none', since DHCP v2 didn't
   # have support for DDNS.)
   ddns-update-style none;
   
   # option definitions common to all supported networks
   option domain-name "dev.local";
   option domain-name-servers ns1.dev.local, ns2.dev.local;
   option ip-forwarding off;
   
   # This way you can specify multiple search domains.
   # For Windows clients it doesn't work and need to be
   # setup manually
   option domain-search "dev.local", "corp.local";
   
   # Lease time is in seconds
   default-lease-time 600;
   max-lease-time 7200;
   
   # If this DHCP server is the official DHCP server for 
   # the local network, the authoritative directive should 
   # be uncommented.
   authoritative;
   
   # Use this to send dhcp log messages to a different log 
   # file (you also have to hack syslog.conf to complete 
   # the redirection).
   log-facility local7;
   
   subnet 192.168.10.0 netmask 255.255.255.0 {
     pool {
       range 192.168.10.41 192.168.10.254;
     }
     option subnet-mask 255.255.255.0;
     option broadcast-address 192.168.10.255;
     option routers gw1.dev.local;         
   }
   
   

How to test from Debian client

1. You need a network interface configured for dhcp (file /etc/network/interfaces):

   allow-hotplug eth0
   iface eth0 int dhcp
   

2. Obtain ip address and check your up:

   root@dh1:~# dhclient eth0 && ifconfig eth0 | grep inet
             inet addr:192.168.10.41 ...
   

3. Try some lookups (notice multiple dns search list; in order to use host command you need to install dnsutils package):

   root@dh1:~# host ns1
   ns1.dev.local has address 192.168.10.2
   
   root@dh1:~# host mail
   mail.corp.local has address 192.168.11.10
   

How to enable multi-domain search in Windows client

1. Choose Advanced TCP/IP Settings
2. In DNS tab choose "Append these DNS suffixes (in order)"
3. Add as many as you need domain to search
4. Try some lookups (notice multiple dns search list):

   C:\>nslookup ns1
   ...
   C:\>nslookup mail
   ...
   

Read more here.

How to setup DHCP client on Debian

The Dynamic Host Configuration Protocol (DHCP) is an auto configuration protocol used on IP networks. Before we proceed let assume the hostname we are going to setup is deby01.dev.local.

1. Configure hostname:

   echo "deby01" > /etc/hostname
   

2. Ensure hosts file properly resolves localhost:

   127.0.0.1       localhost
   # In some circumstance it is not recommended to
   # resolve machine name to local ip address
   #127.0.1.1      deby01.dev.local  deby01
   

3. Here is content of /etc/network/interfaces

   # The primary network interface
   allow-hotplug eth0
   iface eth0 inet dhcp
   
   # If you experience issues with obtaining
   # default gateway consider uncomment lines below.
   #       up route add default gw 192.168.10.1
   #       down route del default gw 192.168.10.1
   

4. Let your dhcp client publish our name (so it can be resolved by name). Ensure the following in file /etc/dhcp/dhcpclient.conf:

   send host-name "deby01";
   

5. If you experience issues with DNS you can set them manually (file /etc/dhcp/dhcpclient.conf)

   prepend domain-name-servers 8.8.8.8, 8.8.4.4;
   

6. Reboot in order to changes take effect or issue the following commands:

   ifdown eth0 && ifup eth0
   

7. Check your dynamically obtained ip address:

   deby01:~# ifconfig eth0 | grep inet
    inet addr:192.168.10.41 ...
   

If you need to setup a static ip address, take a look here.