<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<div class="moz-cite-prefix">On 2014-03-21 23:09, Tom Hayward wrote:<br>
</div>
<blockquote
cite="mid:CAFXO5Z3XtqV_2_yNMvnR1xw0AbD0VSnG0KQOxTMvn-=gGmtvEQ@mail.gmail.com"
type="cite">
<pre wrap="">On Fri, Mar 21, 2014 at 8:40 PM, Dean Gibson AE7Q <a class="moz-txt-link-rfc2396E" href="mailto:hamwan@ae7q.net"><hamwan@ae7q.net></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">...
</pre>
</blockquote>
<pre wrap="">Dean,
This is a really good question. DNS is an essential service for a network. It makes higher-level services much more useful (who wants to memorize IP addresses? Okay... other than me!). HamWAN plans to let you create *.hamwan.net hostnames. At the moment, the DNS servers are running (redundant, at multiple sites), but there's no user interface for people like you to add entries. Only a few records have been manually entered.
</pre>
</blockquote>
<br>
You have a user interface. If you are running ISC's BIND version 9,
in your master "named.conf" file, add the following clause to the
"zone" statement for "hamwan.net": <font color="#cc0000"><tt>update-policy
</tt><tt>{ };</tt><br>
</font><br>
Then, once for each user, you just need to do (substitute the user's
callsign for <font color="#cc0000"><i><b>ae7q</b></i></font>):<br>
<ol>
<li>On a Linux system, run: <font color="#cc0000"><tt>dnssec-keygen
-a HMAC-MD5 -b 128 -n HOST </tt><i><tt><b>ae7q</b></tt></i></font></li>
<li>Send the user a copy of the "K<i><b>ae7q</b></i>.+157.#####.key"
file. The user will use the key value in the radio's <tt>"/tool
dns-update ..."</tt> command (or equivalently, the Linux <tt>"nsupdate"</tt>
command) whenever the IP address needs to be updated. You'll
need to tell the user the IP address of the master DNS server
(probably a.ns.hamwan.net = 44.24.244.2, unless your A and B DNS
servers are slaves to a hidden master).<br>
</li>
<li>In your master "named.conf" file, add the following line, using
the key value from the above file: <font color="#cc0000"><tt>key
"<i><b>ae7q</b></i>" {algorithm hmac-md5; secret "<i>key
value...</i>"; };</tt></font></li>
<li>In your master "named.conf" file, in the zone statement for
"hamwan.net", insert the following into the <tt>"update-policy"</tt>
clause: <font color="#cc0000"><tt>grant "</tt><i><tt><b>ae7q</b></tt></i><tt>"
subdomain "</tt><i><tt><b>ae7q</b></tt></i><tt>.hamwan.net"</tt><tt>;</tt></font></li>
<li>Reload BIND (named). On CentOS: <font color="#cc0000"><tt>service
named reload</tt></font><br>
</li>
</ol>
<p>This way, users will only be able to create/update DNS records of
the form "anything.<only-their-callsign>.hamwan.net".<br>
</p>
<p>-- Dean<br>
</p>
<p>ps: I've tested this on my own DNS servers. It's much better
than using the zone "allow-update" clause, because the latter
applies to a whole zone (which would mean creating a new zone for
each user ...).<br>
</p>
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>
</body>
</html>