Konfigurasi DNS Public Master dan Slave

Berikut catatan saya mengenai DNS yang mengunakan IP Public.
Awalnya kita tidak memiliki DNS yang terhubung ke Public. DNS Public hanya ada di ISP dengan menggunakan control Panel.
Untuk memudahkan pengelolaan kita akan membuat DNS yang terhubung ke IP Public. Dan pengelolaan Domain tidak lagi di Control Panel ISP atau Situs Penjual Domain.

Sebelum merubah domain corporate, saya coba membeli domain baru contoh example.xyz Kebetulan domain tersebut tersebut lumayan murah hanya Rp. 16.000/tahun. Yah untuk coba2 dan testing.


Berikut gambarannya (bukan sebenarnya):

NS Godady : ns1.godaddy.com dan ns2.godaddy.com


Lokasi A (Master)
IP Public Mikrotik : 103.4.x.x
Server DNS :192.168.100.3

Lokasi B (Slave)
IP Public Mikrotik 117.102.x.x dan 112.78.x,x
Server DNS : 192,168.200.3



Domain yang saya beli di godaddy.com lantas saya coba rubah untuk NS (Name Server).

Di halaman godaddy sudah ada 2 alamat NS default. Anehnya NS tersebut tidak dapat diedit diganti dengan IP Public A. Jadi ketika kita menambahkan NS, maka NS yang kita buat akan hilang dan masih menggunakan NS default. Dan mungkin ada kesalahan dari saya perihal konfigurasinya.
Berikut konfigurasi setelah beberapa kali Trial Error.

Tahapan :
Lokasi A (Master) Centos 6.5
1. Setting di /etc/named.conf

options {
//      listen-on port 53 { 127.0.0.1; };
        listen-on port 53 { 192.168.100.3; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
//      allow-query     { localhost; };
        allow-query     { any; };
//      allow-recursion { 127.0.0.1; };
        allow-transfer  { 127.0.0.1; 117.102.x.x; };
        recursion no;

        dnssec-enable yes;
        dnssec-validation yes;
        dnssec-lookaside auto;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";

        managed-keys-directory "/var/named/dynamic";
        forwarders {180.131.144.144; 8.8.4.4; };
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "ithighpro.xyz" in {
        type master;
        file "example.xyz.zone";
        allow-update { none; };
};

zone "100.168.192.in-addr.arpa" in {
        type master;
        file "100.168.192.in-addr.arpa.zone";
        allow-update { none; };
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";


!!! Recursion disetting no untuk menghindari Ddos attack

2. Setting file zona /var/named/example.xyz.zone

$TTL 1d

@       600     IN      SOA     ns1.example.xyz. root.ithighpro.xyz. (
                                201611xx
                                28800
                                7200
                                604800
                                600
                                )

;Name server's
@       IN      NS      ns1.ithighpro.xyz.
@       IN      NS      ns2.ithighpro.xyz.

;Name server hostname to IP resolve
@       IN      A       103.4.x.x
@       IN      A       117.102.x.x

;MX Records
@       IN      MX      10      mail.example.xyz.
@       IN      MX      20      mail2.example.xyz.

;Hosts in this Domain

ns1             IN      A       103.4.x.x
ns2             IN      A       117.102.x.x

mail            IN      A       103.4.x.x
mail2           IN      A       117.102.x.x

www             IN      A       117.102.x.x
owncloud        IN      A       112.78.x.x

Untuk mengecek konfigurasi yang sudah pernah kita buat bisa menjalan perintah :

[root@mail named]#named-checkconf /etc/named.conf
[root@mail named]#named-checkzone example.xyz /var/named/example.xyz.zone
zone example.xyz/IN: loaded serial 201611xx
OK

Jika hasilnya sudah seperti diatas berarti konfigurasi sudah dianggap benar.


Lokasi B (Slave) Centos 7.2
1. Edit File /etc.named.conf
options {
        listen-on port 53 { 127.0.0.1; 192.168.200.3; };
#       listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { any; };
        allow-transfer  { 127.0.0.1; 103.4.x.x; };

        /*
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recurs                                                                                        ion.
         - If you are building a RECURSIVE (caching) DNS server, you need to ena                                                                                        ble
           recursion.
         - If your recursive DNS server has a public IP address, you MUST enable                                                                                         access
           control to limit queries to your legitimate users. Failing to do so w                                                                                        ill
           cause your server to become part of large scale DNS amplification
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface
        */
        recursion no;

        dnssec-enable yes;
        dnssec-validation yes;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};


zone "example.xyz" IN {
        type slave;
        file "slaves/example.xyz.zone";
        masters { 103.4.x.x; };
};


2. Edit File Zona /var/named/slaves/example.xyz.zone

$TTL 86400
@   IN  SOA     ns1.example.xyz. root.example.xyz. (
        201611xxx  ;Serial
        3600        ;Refresh
        1800        ;Retry
        604800      ;Expire
        86400       ;Minimum TTL
)
         NS             ns1.example.xyz.
         NS             ns2.example.xyz.

         A              103.4.x.x
;        A              192.168.200.3
         MX 10          mail.example.xyz.
         MX 20          mail2.example.xyz.


ns1      A              103.4.x.x
ns2      A              192.168.200.3

mail     A              103.4.x.x
mail2    A              117.102.x.x
www      A              117.102.x.x


Tools untuk membantu pengecekan konfigurasi :
- https://intodns.com/example.xyz

Di tools ini kita bisa melihat konfigurasi yang kurang tepat.



Beberapa hal penting :
1. Untuk serial di zona file harus disamakan antara master dan slaves
2. Pengeditan/penambahan NS di Godaddy disebabkan NS yang kita buat belum terbentuk. Dan minimal NS haru ada 2. Jika hanya 1 maka NS masih menggunakan Godaddy
3. Setelah DNS di 2 lokasi terbentuk maka secara otomatis pengelolaan domain ada di Lokasi kita bukan di Godaddy.

Zimbra Error Subject : ***UNCHECKED***

Beberapa hari yang lalu Subject email Zimbra selalu di tambahkan tulisan ***UNCHECKED***.
Padahal tidak ada perubahan konfigurasi mail server sebelumnya. Cari di google ada beberapa referensi yaitu merubah file /opt/zimbra/.

Tahapan :
#su root
#cd /opt/zimbra/amavisd/bin
#cp -pa amavisd amavid.org
#vi amavisd

Rubah isi file di baris :
#su zimbra
$undecipherable_subject_tag = '***UNCHECKED*** ';
menjadi
$undecipherable_subject_tag = '';  
$zmamavisdctl restart

Di hari berikutnya saya coba cek kembali utilisasi mail dengan 'top'. Terilhat penggunaan clamd sebesar 100%.

Coba dicek di log /var/log/zimbra.log |grep clamd hasilnya

mail amavis[26778]: (26778-07) ClamAV-clamd: All attempts (1) failed connecting to /opt/zimbra/data/clamav/clamav.sock, retrying (1)
Oct 24 10:10:43 mail amavis[26778]: (26778-07) (!)connect to /opt/zimbra/data/clamav/clamav.sock failed, attempt #1: Can't connect to UNIX socket /opt/zimbra/data/clamav/clamav.sock: Connection refused

Clamd running tetapi tidak dapat terkoneksi ke socketnya.
Saya coba restart $zmclamdctl restart
hasilnya clamav tidak bisa distop, akhirnya di kill manual.

Tahapan :
$ps -afx |grep clam
 2812 ?        Ssl    0:20 /opt/zimbra/clamav/sbin/clamd --config-file=/opt/zimbra/conf/clamd.conf

$kill -9 2812
$zmclamdctl restart

Setelah dicek kembali di 'top' normal. Dan di log juga tidak error clamav.sock.

Zimbra Tips : Copy account zimbra lama ke user zimbra baru

1. Menggunakan console di server

su – zimbra

zmmailbox -z -m userlama@domain.com getRestURL “//?fmt=tgz” > /tmp/v.tar.gz

zmmailbox -z -m userbaru@domain.com postRestURL “//?fmt=tgz&resolve=reset” /tmp/v.tar.gz

2. Menggunakan Browser

Source Account:

In Zimbra Webmail:

• click on the Preferences Tab, and select Import/Export in the left menu to open the Import/Export page.
• Under Export, leave "Account" selected to export mail messages, then either leave "All Folders" selected or click there and and select the folder you'd like to export.
• Click on Export. You will be prompted by your computer Archive software to either open the resulting file or save it to your computer. Select Save and select a location to save it on your computer.

Destination Account:

In Zimbra Webmail:

• click on the Preferences Tab, and select Import/Export in the left menu to open the Import/Export page.
• Under Import, select the file to import from your computer.
• Select the destination folder.
• Click on Import.

Moment

Postfix Roundcube to Zimbra

ADMINISTRATOR

Mekanisme Migrasi Email

1. Melakukan reset password kesemua email di Mail Server lama

2. Melakukan sinkronisasi email, dari mail server lama ke mail server baru. Dimana tools yang digunakan memerlukan password email lama dan password email yang baru

TAHAPAN MIGRASI

A. Instalasi Server Baru

1. Install Centos 6.4 64bit

2. Install Zimbra 8.0

3. Konfigurasi Zimbra dengan domain testdomain.com

4. Masukkan domain lain yaitu plastikinject.com dan rovega,net

B. Restore Nama Account Server Lama ke Server Baru

1. Copy file /etc/passwd dan /etc/shadow server lama ke server baru dan ke PC Desktop Administrator

2. Pengambilan data account email lama dari file /etc/passwd

- Buka file /etc/passwd di excel.

- Pisahkan domain testdomain dengan domain lain dengan cara menghapus tulisan testdomain

- Simpan file passwd.testdomain

- Kirim file tersebut ke server baru.

3. Jalankan script passwd2zmprov. Script ini akan mengambil data dari file passwd.testdomain dan mengisikannya dengan attribut lain agar bisa dimasukkan ke account zimbra yang baru

[root@mail script]# perl passwd2zmprov -domain testdomain.com passwd.testdomain > testdomain.zmp

Contoh file /etc/passwd

anton.prasetyo.testdomain:x:2165:1002:Anton Prasetyo:/home/testdomain/homes/anton.prasetyo:/dev/null

ryansetiawan.swhmedan.testdomain:x:2167:1002:Ryan Agus Setiawan:/home/testdomain/homes/ryansetiawan.swhmedan:/dev/null

Contoh file passwd.testdomain :

anton.prasetyo:x:2165:1002:Anton Prasetyo:/home/testdomain/homes/anton.prasetyo:/dev/null

ryansetiawan.swhmedan:x:2167:1002:Ryan Agus Setiawan:/home/testdomain/homes/ryansetiawan.swhmedan:/dev/null

Contoh file testdomain.zmp

ca "anton.prasetyo@testdomain.com" "" givenName "Anton" sn "Prasetyo" cn "anton.prasetyo" displayName "Anton Prasetyo" zimbraNotes "Migrated Wed Oct 23 11:25:55 2013" zimbraPasswordMustChange FALSE

ca "ryansetiawan.swhmedan@testdomain.com" "" givenName "Ryan" sn "Setiawan" cn "ryansetiawan.swhmedan" displayName "Ryan Agus Setiawan" zimbraNotes "Migrated Wed Oct 23 11:25:55 2013" zimbraPasswordMustChange FALSE

4. Buat account baru di server baru menggunakan file testdomain.zmp. Penggunaan command zmprov harus menggunakan user zimbra

[zimbra@mail script]$ zmprov -f testdomain.com

Account akan langsung otomatis terbuat dengan domain testdomain.com

5. Merestore password lama ke server zimbra yang baru.

- Edit file /etc/shadow. Pisahkan

- Jalankan script

[root@mail script]# ./shadow2zm.pl /etc/shadow > passwd.zm atau

[root@mail script]# ./shadow2zm.pl shadow.testdomain > shadow.testdomain.zm

[root@mail script]# chmod 755 passwd.zm atau

[root@mail script]# chmod 755 passwd.shadow.testdomain.zm

[root@mail script]# su zimbra

[zimbra@mail script]$ ./passwd.zm atau

[zimbra@mail script]$ ./passwd.shadow.testdomain.zm

Contoh file passwd .zm

zmprov ma yudi.handoko@testdomain.com userPassword '{crypt}$6$40186242$89MpB6dPuCOY8XssTdyj9xE78QIU0sDRV5qFfsc7gdgeBrwjvuJ8HA1bU/sWK9MoFKFS5v4tDf/YF1ZmxUuc0/'

C. Restore Mailbox Account Server Lama ke Server Baru

1. Siapkan user dan password setiap account di Server lama dan Server baru.

2. Jalankan script di Server lama

[root@mail1:~]# imapsync --host1 localhost --user1 anton.prasetyo.testdomain --password1 xxxx --authmech1 PLAIN --host2 117.102.94.158 --user2 anton.prasetyo@testdomain.com --password2 xxxx --authmech2 PLAIN --ssl2 --allowsizemismatch –-nofoldersizes --skipsize –-fast

script shadow2zm.pl =========================================================

#!/usr/bin/perl
# Usage: as root   # ./shadow2zm.pl /etc/shadow > shadow.zm
#        as zimbra # zmprov < shadow.zm

$domain="testdomain.com";

while(<>) {
    chomp;
    my ($uname,$pass) = split(/:/);

    print qq{zmprov ma $uname\@$domain userPassword '{crypt}$pass'\n};
    print qq{\n};
}

script passhadow2zm.pl =======================================================

#!/usr/bin/perl

#
# $Id: passwd2zmprov,v 1.2 2008/03/05 05:01:29 phil Exp $

=head1 NAME

passwd2zmprov - create zmprov commands from a passwd file

=head1 SYNOPSIS

  usage: passwd2zmprov [options] [[passwd_file] ...] > commands.zmp
     -help   show a brief help message
     -man    show the full documentation

     -domain      [REQUIRED]
     -cosid       [default "Default COS"]
     -password  [default ""]

  Getting a COS id:
    zimbra$ zmprov gc  | grep ^zimbraId:

  Example converting CSV to zmprov commands:
    $ ./passwd2zmprov -domain example.moc /etc/passwd > commands.zmp

  Example provisioning ZCS accounts as 'zimbra' user:
    zimbra$ zmprov -f commands.zmp

=head1 DESCRIPTION:

Tool to create commands suitable for zmprov from a UNIX passwd file.
We don't use getpwent etc., because we are likely working on a copy
and not running as root.

See Also:
  http://wiki.zimbra.com/index.php?title=Bulk_Create

=cut

use strict;
use warnings;
use File::Basename qw(basename);
use Getopt::Long qw(GetOptions);
use Pod::Usage qw(pod2usage);

my $prog = basename($0);
my ( @err, %option );

GetOptions( \%option, 'help|?', 'man', 'domain=s', 'cosid=s', 'password=s' )
  or pod2usage( -verbose => 0 );

pod2usage( -verbose => 1 ) if $option{help};
pod2usage( -verbose => 2 ) if $option{man};

push( @err, "-domain  is required" )
  unless $option{domain};

pod2usage( -verbose => 0, -message => map( "$prog: $_\n", @err ) )
  if @err;

warn("$prog: using Default COS\n") unless $option{cos_id};
warn("$prog: reading passwd like entries from STDIN\n") unless @ARGV;

my $date     = localtime;
my $cosid    = $option{cosid};
my $domain   = $option{domain};
my $password = defined $option{password} ? $option{password} : "";
my $MIN_UID = 500;      # skip system accounts like httpd
my $MAX_UID = 60000;    # skip other system accounts like nfsnobody

# sanitize password
$password =~ s/\"/\\\"/g;

while (<>) {
    chomp;
    next if /^\s*$/;    # skip empty lines

    my ( $uname, $x, $uid, $gid, $gecos, $dir, $shell ) = split( /:/, $_, 7 );

    if ( $uid < $MIN_UID or $uid > $MAX_UID ) {
        warn("$prog: skip $uname: $uid not between $MIN_UID and $MAX_UID\n");
        next;
    }

    # assuming gecos format is First [[MI] [Last]], sanitize a little
    $gecos =~ s/\"/\\\"/g;

    my ( $fullname, $description ) = split( /\s*,\s*/, $gecos, 2 );
    my ( $fname, $mname, $lname ) = split( " ", $fullname, 3 );
    unless ( defined($lname) ) {
        $lname = $mname;
        undef($mname);
    }
    my $displayname = $fname
      . ( defined($mname) ? " $mname" : "" )
      . ( defined($lname) ? " $lname" : "" );

    print(
        qq{ca "$uname\@$domain" "$password"},
        ( defined($cosid)       ? qq{ zimbraCOSid "$cosid"}       : () ),
        ( defined($fname)       ? qq{ givenName "$fname"}         : () ),
        ( defined($lname)       ? qq{ sn "$lname"}                : () ),
        ( defined($uname)       ? qq{ cn "$uname"}                : () ),
        ( defined($displayname) ? qq{ displayName "$displayname"} : () ),
        ( defined($description) ? qq{ description "$description"} : () ),
        qq{ zimbraNotes "Migrated $date"},
        qq{ zimbraPasswordMustChange TRUE},
        qq{\n},
    );
}

=head1 HISTORY

 2007/01/23, Version 1.0/1.1 Dlbewley
 2008/03/04, Version 1.2 Plobbes

=cut

D. Menampilkan List Address Book di semua Domain

su -l zimbra -c "zmprov mcf zimbraGalInternalSearchBase ROOT"

#Keane-Somewhere Only We Know

"Somewhere Only We Know"

 

I walked across an empty land
I knew the pathway like the back of my hand
I felt the earth beneath my feet
Sat by the river and it made me complete

Oh simple thing where have you gone?
I'm getting old and I need something to rely on
So tell me when you're gonna let me in
I'm getting tired and I need somewhere to begin

I came across a fallen tree
I felt the branches of it looking at me
Is this the place we used to love?
Is this the place that I've been dreaming of?

Oh simple thing where have you gone?
I'm getting old and I need something to rely on
So tell me when you're gonna let me in
I'm getting tired and I need somewhere to begin

And if you have a minute why don't we go
Talk about it somewhere only we know?
This could be the end of everything
So why don't we go
Somewhere only we know?
Somewhere only we know?

Oh simple thing where have you gone?
I'm getting old and I need something to rely on
So tell me when you're gonna let me in
I'm getting tired and I need somewhere to begin

And if you have a minute why don't we go
Talk about it somewhere only we know?
This could be the end of everything
So why don't we go?
So why don't we go?

 This could be the end of everything
So why don't we go
Somewhere only we know?
Somewhere only we know?
Somewhere only we know? 

Alternatif Remote TeamViewer

Siapa yang tidak tahu dengan Teamviewer.
Sebuah aplikasi yang digunakan untuk me-remote dari PC ke PC lain. Yang saya suka dari Teamviewer adalah kemampuannya untuk digunakan dibalik NAT.
Selama PC terhubung ke internet maka Teamviewer akan bisa berjalan.
Cara kerja Teamviewer adalah client yang melakukan koneksi via internet ke sebuah server Teamviewer. Client akan mendapatkan ID dan password yang unik dari server Teamviewer.

Jika kita akan melakukan remote ke PC lain, maka kita perlu masukkan ID dan password lawan.

Permasalahannya adalah kita tidak tahu alamat IP public yang dituju oleh Teamviewer. Sehingga jika kita menggunakan firewall untuk menutup akses ke beberapa PC untuk koneksi terbatas ke internet akan mengalami masalah, dimana PC tidak dapat terhubung ke Teamviewer.


NeoRouter adalah aplikasi alternatif pengganti Teamviewer. Tetapi yang dimaksud pengganti disini lebih ke arah proses koneksi jaringan. Dimana PC yang terhubung dengan Neo Router akan menjadi vpn client.
Aplikasi remote sendiri membutuhkan aplikasi tambahan yaitu TightVNC

Untuk membuat jaringan NeoRouter membutuhkan Neo Router Server dan Neo Router Client.


Source dapat diambil di http://www.neorouter.com/downloads.html











Testing di tempat saya.
NeoRouter Server
- Centos 5
- Aplikasi NeoRouter Server  : nrserver-2.1.1.4300-free-centos-i386.rpm
- Source : http://download.neorouter.com/Downloads/NRFree/Update_2.1.1.4300/Linux/CentOS/nrserver-2.1.1.4300-free-centos-i386.rpm


NeoRouter Client
- Windows Home Basic
- Aplikasi : NeoRouter-2.1.1.4300-free-Setup.exe
- Source : http://download.neorouter.com/Downloads/NRFree/Update_2.1.1.4300/Windows/NeoRouter-2.1.1.4300-free-Setup.exe