Customer purchased Comcast Business cable for their primary internet provider. They also purchase a domain name through godaddy. I used to think godaddy was a horrible/awful/pile of dung, but now that I’m starting to find out where everything is hidden they’re turning out to be moderately OK.

Background:
Ubuntu 10.04 x32 Server LAMP
BIND 9.7.0
Webmin 1.510
Sonicwall TZ180W Enhanced
Godaddy account information and domain name

I updated their ubuntu server from 9.04 to 9.10, then now to 10.04. I installed webmin as the customer wanted a GUI to be able to edit the config files. And, despite resistance from CLI users, webmin is a pretty powerful suite. I secured the server as much as I could. I then made sure that port 53 for UDP and TCP was opened for DNS to/from the server.

Now the fun part begins. Login on your webmin server (usually https://webminserver’sIPaddress:10000) and navigate to Servers > Bind DNS Server.

Create BIND Master Zone
Under Existing DNS Zones, Click on Create Master Zone.

Zone type: Forward
Domain Name/Network: yourdomain.tld
Records file: Automatic
Master server: yourdomain.tld, uncheck Add NS record for master server
Email address: admin@yourdomain.tld
Use zone template: No
IP Address for template records: Your PUBLIC IP address
Add reverses for template addresses: Yes
Leave the TTL as is, unless you want longer/shorter timeouts
Click Create

Add Name Records
Now you should be in the Address Records for your new domain. If not, navigate to Servers > BIND DNS Server > Existing DNS Zones > Yourdomain.tld > Address.
NOTE: Notice the ‘.’ at the end of the names.

Name: ns1.yourdomain.tld.
Time-To-Live: default
Address: Your PUBLIC IP address
Update reverse: Yes
Create
Name: ns2.yourdomain.tld.
Time-To-Live: default
Address: Your PUBLIC IP address
Update reverse: Yes
Create
Name: yourdomain.tld.
Time-To-Live: default
Address: Your PUBLIC IP address
Update Reverse: Yes
Create
Name: www.yourdomain.tld.
Time-To-Live: default
Address: Your PUBLIC IP address
Update Reverse: Yes
Create

Add Name Servers
Return to Record Types. Now click on Name Server.

Zone Name:
Time-To-Live: 300
Name Server: ns1.yourdomain.tld.
Create
Zone Name:
Time-To-Live: 300
Name Server: ns2.yourdomain.tld.
Create

Restart BIND
You have two ways to do this (well, more than that, but you know how it is):

1.) Login as root using SSH to your BIND Server. Run:
sudo /etc/init.d/bind9 restart
2.) On Webmin, Click on System > Bootup and Shutdown > bind9
Click on the Restart Now button

Test your configuration:

Login to your BIND Server using SSH
nano /etc/resolv.conf
search yourdomain.tld
nameserver 127.0.0.1
Add ‘#’ to any other name servers in the list
Save and Exit Nano
dig yourdomain.tld
Make sure the HEADER Flags have: qr aa rd ra. Well, the ‘aa’ is the most important part – that shows it’s that authority for this domain.

Change the DNS Servers of your Godaddy account

Login on your godaddy domain manager
I added the DNS entries for ns1.yourdomain.tld and ns2.yourdomain.tld in the custom DNS area. Point those both to your public IP address.
In the lower left corner of the Domain Manager screen (after you click on the domain you want to manage) you will see a Host Summary area.
Add NS1.yourdomain.tld with your PUBLIC IP
Add NS2.yourdomain.tld with your PUBLIC IP
I had to wait 5 minutes or so before everything was happy.

Now change the DNS servers from NSxx.DOMAINCONTROL.COM to NS1.YOURDOMAIN.TLD AND NS2.YOURDOMAIN.TLD.

If you get a message about your name servers not being registered, you probably forgot to add the domains into the Host Summary area. Either that or you haven’t waited long enough.

I needed to give access to a user (a web developer) but didn’t want them to be able to go anywhere but their home directory. The server is running Ubuntu 9.10 x32. No GUI.

A brief search found a shell called Iron Bars restricted SHell for linux (IBSH). This also allows you to prohibit certain commands from running.

wget http://downloads.sourceforge.net/project/ibsh/ibsh-binary/ibsh_debian_binary/debian_ibsh.deb?use_mirror=cdnetworks-us-1
dpkg -i debian_ibsh.deb
apt-get install -f
nano /etc/ibsh/globals.cmds

You can put whatever commands you want to allow in that file. Save it.

nano /etc/passwd
Change the shell of the user to /bin/ibsh

Login as the user and test it out. Try to cd /etc or rm -rf / and see what happens.

***EDIT***
The Link is http://downloads.sourceforge.net/project/ibsh/ibsh/ibsh-0.3a/ibsh-0.3a-i386-linuxbsd-src.tar.gz?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Fibsh%2F&ts=1288626692&use_mirror=iweb

I downloaded the DVD torrent for CentOS 5.4. It’s large. 3.72GB large. It’s the i386 version.

I needed it for testing as it’s closer to RHEL than Debian is. 🙂

So I selected install – generic install – but ONLY install the server portion. I don’t need that crazy GUI. Or do I?

After installation I ran the usual:
yum update
yum -y install httpd php mysql mysql-server php-mysql
/sbin/chkconfig httpd on
/sbin/chkconfig --add mysqld
/sbin/chkconfig mysqld on

Then I started the services:
/sbin/service httpd start
/sbin/service mysqld start

Opened up my browser to the IP of the new server. Page not found. Damn.

OK, let’s see if the server can access itself:
lynx http://127.0.0.1
Command not found

Damn. Install lynx:
yum install lynx
lynx http://127.0.0.1
Default CentOS page! Yay!

Well, by default, CentOS installs SELinux. I don’t care for MAC security as this is a pure test dev machine, so I’ll remove that:
nano /etc/selinux/config
SELINUX = disabled
Save, Reboot.

Page not found. Argh, must be the default firewall crap that is on by default. I shall remove that as well:
/sbin/service iptables save
/sbin/service iptables stop
/sbin/chkconfig iptables off
I rebooted once again by accident as I hit the power button on the wrong virtual machine. Oh well.

Default CentOS Page! Yay!