Exercise 2 and 3, DHCP and NTP

Transcription

1 Exercise 2 and 3, DHCP and NTP DHCP Our goal is to set up as DHCP server on both "servers" and "workstations" subnet. We have already installed dnsmasq. Dnsmasq can also act as DHCP server. NB! Keep in mind that you also have to turn off DHCP on router. 2 independet DHCP servers on the same subnet is usually BAD IDEA! So, we need to configure dnsmasq as DHCP server and also add some DNS configuration snippets. First, lets set our domain name. Find setting #domain=... and change it to domain=i803.zz Now find a commented out stanza with text "...example DHCP range where the netmask is given..." Uncomment dhcp-range and change as follows dhcp-range= , , ,4h Now we also need to specify default-gw and name servers. Remember what we talked about DHCP options. below dhcp-range add dhcp-option=3, dhcp-option=6, The magic number 3 here is the DHCP standard option number for "router" which is specified in RFC "Magic" number 6 means dns-server. your changes and... STOP. Before you restart dnsmasq, you need to remove conflicting setting in router. R1 Login as vyos/student Go to configuration mode configure First look at the configuration show service dhcp-server shared-network-name srv As you can see, here is also a IP pool (range of addresses served + options). Default gateway and nameserver options. This is the bare minimum you need to give out via dhcp for clients to achieve normal connectivity. Now, remove this configuration.

2 delete service dhcp-server shared-network-name srv You have now removed dhcp server for server subnet Restart dnsmasq, sou you configuration will be active service dnsmasq restart S2 Check S2-s IP address ip addr restart network, to ask a new address service networking restart Note, that if you did everything right, the address should change. WHY it changed? enter service dnsmasq status Examine output log. It should report that one address is served. S2 As S2 is a "server" it needs a STATIC IP address. Enter following on S2 terminal ip addr To reserve an IP in DHCP server you need a client's MAC address (ethernet address). MAC address is 6 figure hex number behind link/ether in command's ip addr output It looks like this 08:00:27:9e:c5:38 Write it down! Add following line on your dhcp pool stanza in dnsmasq.conf (after option 6) dhcp-host=08:00:27:9e:c5:38, NB! use MAC address of "your" S2 Restart the networking on again, and note that now you get 200 address. Also you can check service status on (service dnsmasq status).

3 H1 On host H1 try to ping host s2.i803.zz You should get the answer. Why? Becase dnsmasq also registered the DNS name of S2 when it gave out DHCP lease. Now you have by yourself configure DHCP pool for "workstations" network. Follow the example above. First go into router R1 and examine the DHCP pool configuration there. Note pool size, default gateway, and DNS addresses. On server add another dhcp-range stanza. As done in previous part of the exercize add options for dns and gateway. Remove DHCP pool in router. delete service dhcp-server Restart dnsmasq on. Restart networking on H1. Did you got new configuration from. NO! Why? Remember what we discussed in lecture. DHCP relys on BROADCASTS. Broadcasts do not propagate outside the subnet. For things to work you also need a DHCP relay between workstations and server subnet. You have to configure dhcp realy on router R1 set service dhcp-relay interface eth1 set service dhcp-relay interface eth2 set service dhcp-relay server H1 restart networking. Now you should be able to obtain address. check service status. service dnsmasq status Note, how it complains about duplicate options. Even though it works as intended, it complains. As

4 GOOD admins we wnat to avoid situations like that, because those may introduce hard-to-debug errors in the future configuration changes. Dnsmasq is a little bit different beast than other DHCP servers. Usually, on DHCP server's configuration one "pool" are grouped together with some sort of "stanza". For example isc-dhcpserver one "pool" are grouped between {}. Vyos uses shared-network-name to determine whitch settings belong to whitch pool. Dnsmasq, on the other hand, uses concept of "tags". So, you have to "tag" your options, so dnsmasq will not complain any more. Use following illustration as an example and add tags to your dnsmasq configuration: restart dnsmasq, restart networking on H1, check server status. It wont complain any more. Finally let's implement a better name resolution solution so we can get rid of DNS forwarder in our router. /H1 At first change DNS server address (option 6) in "worksation" DHCP pool to restart dnsmasq In H1 restart networking to obtain new configuration. Try to ping some host. Note that name resolution is now broken. Check service status on. Note message "ignoring query from non-local network" So, how to get rid of it. Yet another way to do this, is set dnsmasq "listen address" find the line #listen-address in dnsmasq.conf and set it to listen-address= restart dnsmasq Now the name resolution on host1 starts working again. remove now un-needed dns-forwarder service on router. R1 delete service dns forwarding

5 Congratz! You have now configured quite respectable small network model. You have DNS server that can resolve local names. You have DHCP server that can serve both subnets. You have your "servers" configured to obtain fixed IP via DHCP And also your DNS "automagically" registers names of DHCP clients. Try it out, you can also ping H1 via name form S2 :) Good work! NTP Lets set up as local NTP server. check time with command its probably quite wrong Use apt to install ntp daemon apt-get up apt-get install ntp Modify configuration file /etc/ntp.conf and add two servers suitable for use in Estonia server 0.europe.pool.ntp.org server 1.europe.pool.ntp.org at the beginning of server list. Also un-comment local subnet broadcasting option #broadcast... and set correct network address. (What should it be?) restart the ntp service. service ntp restart Check again. It is probably still wrong. Remember what we talked in lecture. NTP and "clock discipline" routines avoid very huge "time leaps". It should take some time, but it will be correct soon. Until then go on and check back after you have configured S2. S2 In case when we have broadcasting NTP server in given subnet, one can use ntp daemon as client. For this, one installs ntp as described above, comments out all ntp servers /etc/ntp.conf in and comments in following lines #disable auth #broadcastclient...but WAIT... there is a better option:

6 systemd-timesyncd is a daemon that has been added for synchronizing the system clock across the network. It implements an SNTP client. In contrast to NTP implementations such as chrony or the NTP reference server this only implements a client side, and does not bother with the full NTP complexity, focusing only on querying time from one remote server and synchronizing the local clock to it. Unless you intend to serve NTP to networked clients or want to connect to local hardware clocks this simple NTP client should be more than appropriate for most installations. The daemon runs with minimal privileges, and has been hooked up with networkd to only operate when network connectivity is available. The daemon s the current clock to disk every time a new NTP sync has been acquired, and uses this to possibly correct the system clock early at bootup, in order to accommo for systems that lack an RTC such as the Raspberry Pi and embedded devices, and make sure that time monotonically progresses on these systems, even if it is not always correct. To make use of this daemon a new system user and group "systemd-timesync" needs to be created on installation of systemd. So, lets use built-in tools with S2 first check time then enable systemd ntp client timectl set-ntp true then, check its status timectl status remember, NTP is not IMMEDIATE protocol. first you see something like that in log NTP synchronized: no after a minute or so, it should change NTP synchronized: yes check time. Is it changed? Take a look to the configuration file less /etc/systemd/timesyncd.conf you see, that in default configuration all servers are commented out. Obvious conclusion is that the timesyncd listens to broadcasts. H1 We can not do that with worksations subnet. Remember... broadcasts! So, we have a plenty of options there. We can install and configure ntp client manually (Debian has plethora of different NTP clients.) We want to keep things as simple and "zeroconf" as possible. So lets take another approach First add ntp server (dhcp-option 42) to our workstations DHCP pool. It should now look like this

7 Now you should already be familiar with the drill. Restart dnsmasq, restart networking on H1. Check time on H1. Enable systemd ntp client on H1. Check ntp status, check time again. timectl set-ntp true timectl ntp status Done. When you get "ntp synchronized yes", and computers time are correct, you are done. So, it was really THAT simple. Finally you have a reasonably good small network model. Two subnets, firefall, working core services. Of course it needs some fine tuning from here and there, but believe me, in the wild there are plenty of production (company) networks configured much worse.