|
|
NetBSD 문서:기본적인 NetBSD 네트워킹 |
이 페이지는 아직 작성중입니다. 비평이나 제안은 언제든지 환영합니다.
search subdomain.yourdomain.tld yourdomain.tld nameserver 192.168.253.10 nameserver 192.168.253.11
다음은 네트워크 구성 방법의 간단한 예입니다. 여기서는 ex라는 네트워크 인터페이스와 192.168.253.2라는 IP가 있다고 가정했고, 기본 라우트 주소로 192.168.253.1을 사용했습니다:
# ifconfig lo0 127.0.0.1 # ifconfig ex0 192.168.253.2 netmask 255.255.255.0 # route add default 192.168.253.1
/etc/hosts:
192.168.1.2 host2.mydomain.org.au host2
정방향 존 파일 항목
host2 A 192.168.1.2
역방향 존 파일 항목
2 PTR host2.mydomain.org.au.
/etc/ifconfig.we1
192.168.2.30 netmask 0xffffff00 media 10base2/BNC
PPP를 설정하는 방법은 여러 가지가 있습니다. 사용중인 ISP(서비스 제공업체)에 연결하는 한가지 간단한 방법은 다음과 같습니다:
/etc/ppp/peers/myisp
# Example pppd options
# Specific for myisp
/dev/tty01
local_IP_address:remote_IP_address
connect '/usr/sbin/chat -v -f /etc/ppp/peers/myisp.chat'
defaultroute
persist
ipparam myisp
asyncmap 0
noauth
/etc/ppp/options.{ttyname}
# Example pppd options
# Specific for ttyname
lock
crtscts
57600
modem
/etc/ppp/peers/myisp.chat
# Example chat file
# Specific for myisp
ABORT BUSY ABORT 'NO CARRIER' ""
\da\ptz0 OK
\da\ptdt8887776655 CONNECT
pppd call myisp
ppp_peers="myisp" 그러면 부트시에 자동으로 연결됩니다.
자동 연결 ppp를 사용하고 있는데 특정 전송으로 ppp가 연결되는 것(에를 들어 xntpd(8)같은 ntp 전송)을 막고 싶다면, pppd.conf 파일에 active-filter를 사용하면 됩니다.
active-filter 'not udp port ntp'
/dev/tty00
57600
noauth
crtscts
passive
<local_IP_address>:<remote_IP_address>
debug
netmask 255.255.255.255
proxyarp
위에서 <local_IP_address>와 <remote_IP_address>를 네트워크에 알맞은 값으로 바꿔 줍니다 (<local_IP_address>는 이더넷과 같아도 되지만, <remote_IP_address>는 반드시 이더넷 세그먼트로 적합한 주소여야 합니다).
클라이언트쪽에서는 /etc/ppp/options을 다음과 같이 만듭니다:
/dev/tty00
57600
noauth
crtscts
defaultroute
debug
그런 다음 양쪽에서 /dev/tty00을 직렬 포트 이름에 맞게 조정합니다.
TA의 모드는 헤이즈 모뎀의 몇 가지 "AT" 명령을 써서 설정할 수 있습니다. 정확한 명령은 매뉴얼을 참조하시기 바랍니다. 일반 (아날로그) 모뎀에서 하는 것처럼 이 "AT" 명령들을 PPP 전화걸기에 사용하는 챗 스크립트에 추가해도 됩니다.
그러나 이 패키지는 아직 베타 시험 단계로 간주되고 있다는 점을 참고하십시오.
또한 이 패키지는 ISDN 카드와 관련된 것이지 ISDN 모뎀에 관련된 것이 아니라는 점도 유의하시기 바랍니다. 후자의 경우 일반 모뎀처럼 사용하면 됩니다.
options PFIL_HOOKS # pfil(9) packet filter hooks pseudo-device ipfilter # IP filter (firewall) and NAT
pass in from any to any pass out from any to any
map ppp0 10.0.0.0/24 -> 0/32 proxy port ftp ftp/tcp map ppp0 10.0.0.0/24 -> 0/32 portmap tcp/udp 40000:60000 map ppp0 10.0.0.0/24 -> 0/32
ipfilter=YES # uses /etc/ipf.conf ipnat=YES # uses /etc/ipnat.conf
net.inet.ip.forwarding=1
네트워크 주소 변환(NAT)이나 PPPoE(DSL에서 주로 사용함)를 쓰고 있다면 MSS 클램핑을 쓰는 것도 고려해 보십시오.
/usr/sbin/named-bootconf < named.boot > named.conf
또한 NetBSD 정식 릴리즈에 통합된 BIND와 별도로, 8.x과 9.x 릴리즈를 NetBSD 패키지 컬렉션에서 구할 수 있습니다. 자세한 것은 각각 bind8 와 bind9 패키지를 참조하세요.
이제부터 BIND 4는 더 이상 지원되지 않으므로 업그레이드를 반드시 하는 것이 좋습니다. 그러나 예전 4.x 릴리즈를 계속해서 사용해야 할 필요가 꼭 있다면, bind4 패키지를 사용하기 바랍니다.
NetBSD 1.5 and later ship with the KTH Heimdal Kerberos 5 implementation.
This section provides some simple instructions to get your NetBSD systems configured to use Kerberos. For those not familiar with Kerberos, this serves as a basic how-to. For those of you familar with Kerberos, it may document some differences between NetBSD's Kerberos and the Kerberos on other systems you may have used in the past.
For the purpose of these instructions, let's assume your DNS domain name is "foo.com". Let's also assume that there are two machines in the foo.com domain, called mach1.foo.com and mach2.foo.com.
A Kerberos administrative domain is called a realm. A realm can be named anything you like, although the convention is to use the organization's DNS domain name in upper-case letters. So, for your example domain of "foo.com", the Kerberos realm would be called "FOO.COM".
An identity in Kerberos is called a principal. Users, hosts, and even individual services on hosts are all principals. Principal names have the form "name@REALM". If the "@REALM" portion is omitted, the default realm is assumed. Service principal names have the form "service/hostname@REALM". The hostname should be the fully-qualified name of the host. All hosts have a "host/..." service principal. The "host/..." principal is generally used by login programs (e.g. telnetd(8), sshd(8)) and other things that want to authenticate the host to another principal (e.g. certain IPsec key management protocols).
An instance of a Kerberos credential is called a ticket. There is a special kind of ticked called a ticket granting ticket, or TGT. The TGT is your initial set of credentials, acquired for you when you log in using the login(1) program, or by running kinit(1). The TGT is used to acquire service tickets that allow you to use services that use Kerberos for authentication. Tickets are stored in a special database called a credential cache. For login sessions, the credential cache is generally stored in a file in /tmp. The credential cache should be destroyed when you log out by the kdestroy(1) command. It is important to keep your credential cache safe! If you don't someone else could use your credentials to gain access to services they might not otherwise have.
Credentials are centrally managed by the Key Distribution Center, or KDC. A user authenticates with the KDC by providing a password when acquiring a TGT. Services authenticate with the KDC using a similar mechanism, although the service's "password" comes from a key table, or keytab, stored on the host.
Note that Kerberos requires that all hosts within a realm have synchronized time. The best way to achieve this is to use NTP on your network.
The following is a step-by-step description of how to get your network configured to use Kerberos.
The KDC system will also play the role of the Kerberos administration server and the Kerberos password change server.
The easiest way to provide information about the KDC is through DNS SRV records. If you wish to do this, these are the entries that would be required for our sample FOO.COM realm:
_kerberos._udp IN SRV 01 00 88 mach1.foo.com.
_kerberos._tcp IN SRV 01 00 88 mach1.foo.com.
_kpasswd._udp IN SRV 01 00 464 mach1.foo.com.
_kerberos-adm._tcp IN SRV 01 00 749 mach1.foo.com.
_kerberos IN TXT FOO.COM
To understand the format of the SRV record, look at RFC 2782. Note that you can configure this information manually on each host in the realm if you don't wish to use the DNS method.
# cat > /etc/krb5.conf
[libdefaults]
default_realm = FOO.COM
^D
#
If you are not using DNS SRV records to configure your realm, you must also list the KDC, kadmin, and kpasswd servers in your /etc/krb5.conf, like so:
# cat >> /etc/krb5.conf
[realms]
FOO.COM = {
kdc = mach1.foo.com
admin_server = mach1.foo.com
# optional, defaults to admin_server
kpasswd_server = mach1.foo.com
}
^D
#
Note that if you bring a mobile host into another realm in which it participates, the _kerberos TXT record from DNS will override the default realm in the /etc/krb5.conf file.
mach1# ls -ld /var/heimdal
1 drwxr-xr-x 2 root wheel 512 Nov 30 15:21 /var/heimdal/
mach1#
mach1# kstash
Master key:
Verifying password - Master key:
mach1#
mach1# kadmin -l
kadmin> init FOO.COM
Realm max ticket life [unlimited]:
Realm max renewable ticket life [unlimited]:
kadmin>
kadmin> add --random-key host/mach1.foo.com
Max ticket life [1 day]:
Max renewable life [1 week]:
Principal expiration time [never]:
Password expiration time [never]:
Attributes []:
kadmin>
Now that the principal has been created, you should extract its key into the KDC system's keytab.
kadmin> ext -k /etc/krb5.keytab host/mach1.foo.com
kadmin>
You can list the keys in the keytab using the ktutil(8) command:
mach1# ktutil list
Vno Type Principal
1 des-cbc-crc host/mach1.foo.com
1 des-cbc-md4 host/mach1.foo.com
1 des-cbc-md5 host/mach1.foo.com
1 des3-cbc-sha1 host/mach1.foo.com
kadmin> add joe
Max ticket life [1 day]:
Max renewable life [1 week]:
Principal expiration time [never]:
Attributes []:
joe@FOO.COM's Password:
Verifying password - joe@FOO.COM's Password:
kadmin>
mach1# echo "kdc=YES" >> /etc/rc.conf
mach1# /etc/rc.d/kdc start
Starting kdc.
mach1#
kerberos-adm stream tcp nowait root /usr/libexec/kadmind kadmind
kerberos-adm stream tcp6 nowait root /usr/libexec/kadmind kadmind
kpasswd dgram udp wait root /usr/libexec/kpasswdd kpasswdd
kpasswd dgram udp6 wait root /usr/libexec/kpasswdd kpasswdd
Make inetd(8) reload it's configuration.
mach1# /etc/rc.d/inetd reload
Reloading inetd config files.
mach1#
mach1:joe$ kinit
joe@FOO.COM's Password:
joe$ klist
Credentials cache: FILE:/tmp/krb5cc_100
Principal: joe@FOO.COM
Issued Expires Principal
Nov 30 14:10:16 Dec 1 00:10:16 krbtgt/FOO.COM@FOO.COM
Nov 30 14:10:16 Dec 1 00:10:16 krbtgt/FOO.COM@FOO.COM
mach1:joe$ telnet -ax mach1.foo.com
Trying 10.0.0.1
Connected to mach1.foo.com.
Escape character is '^]'.
[ Trying KERBEROS5 ... ]
[ Kerberos V5 accepts you as ``joe@FOO.COM'' ]
Last login: Thu Nov 30 14:08:33 2000 from mach1
...
mach1:joe$ exit
Connection closed by foreign host.
mach1:joe$
mach1# kadmin -l
kadmin> add --random-key host/mach2.foo.com
Max ticket life [1 day]:
Max renewable life [1 week]:
Principal expiration time [never]:
Password expiration time [never]:
Attributes []:
kadmin>
mach1# kadmin -l
kadmin> add root/admin
Max ticket life [1 day]:
Max renewable life [1 week]:
Principal expiration time [never]:
Password expiration time [never]:
Attributes []:
root/admin@FOO.COM's Password:
Verifying password - root/admin@FOO.COM's Password:
kadmin>
Make sure you add the principal to the kadmind ACL:
mach1# echo "root/admin@FOO.COM all" >> /var/heimdal/kadmind.acl
mach1#
mach2# kadmin
kadmin> ext -k /etc/krb5.keytab host/mach2.foo.com
root/admin@FOO.COM's Password:
kadmin>
Test this by attempting to log into the machine using Kerberos.
mach1:joe$ telnet -ax mach2.foo.com
Trying 10.0.0.2
Connected to mach2.foo.com.
Escape character is '^]'.
[ Trying KERBEROS5 ... ]
[ Kerberos V5 accepts you as ``joe@FOO.COM'' ]
Last login: Thu Nov 30 16:26:51 2000 from mach1
...
mach2:joe$ exit
Connection closed by foreign host.
mach1:joe$
For those of you using Windows 2000, it is also possible to use your NetBSD KDC has an authentication server for your Windows 2000 hosts. Windows 2000 uses Kerberos to authenticate Windows Domain logins. NetBSD cannot act as a Windows 2000 Domain Controller, but using Samba, it can act as a Workgroup server.
For the purpose of these instructions, we assume you have already configured Samba on your server, and configured your Windows 2000 hosts to use it.
mach1# kadmin -l
kadmin> add host/win2k.foo.com
Max ticket life [1 day]:
Max renewable life [1 week]:
Principal expiration time [never]:
Password expiration time [never]:
Attributes []:
host/win2k.shagadelic.org@SHAGADELIC.ORG's Password:
Verifying password - host/win2k.shagadelic.org@SHAGADELIC.ORG's Password:
kadmin>
REMEMBER THE PASSWORD YOU ENTER! You must type this password in again later on the Windows 2000 host.
C:> ksetup /setdomain FOO.COM
C:> ksetup /addkdc FOO.COM mach1.foo.com
C:> ksetup /setmachpassword password
C:> ksetup /mapuser * *
You may also map specific users to specific Kerberos principals like so:
C:> ksetup /mapuser user@FOO.COM localuser
Using these steps, you will now be able to select to log into a Kerberos realm when logging into your Windows 2000 system. Note that for the most seamless user experience, the Samba password should be kept in-sync with the user's Kerberos password.
For more information about Kerberos, refer to these links:
Your login is now all three parts put in a row, with no seperator ("AAAAAAAAAAAATTTTTTTTTTTTMMMM"), e.g. 0001201234563200123456#0001. Use this for the "user"-line in your PPP options file.
ABORT BUSY '' AT
OK ATZ
OK ATL1
OK ATD0191011
CONNECT '.'
Without this trailing dot, you may be disconnected
immediately without an answer from the T-Online dialin
server after your side has sent out the first LCP
ConfReq frame.
|
|
