[f0s@mail] /usr/local/etc/rc.d/> ./slapd restart

dn: ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: organizationalUnit ou: dns description: Domain Zones # zone artpaint dn: zoneName=artpaint,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone zoneName: artpaint relativeDomainName: artpaint # SOA dn: relativeDomainName=@,zoneName=artpaint,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone zoneName: artpaint relativeDomainName: @ nSRecord: mail.artpaint. sOARecord: mail.artpaint. root.mail.artpaint. 1 8H 2H 1W 1D # mail IN A 192.168.10.8 dn: relativeDomainName=mail,zoneName=artpaint,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone zoneName: artpaint relativeDomainName: mail dNSClass: IN aRecord: 192.168.10.8 # router IN A 192.168.10.7 dn: relativeDomainName=router,zoneName=artpaint,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone zoneName: artpaint relativeDomainName: router dNSClass: IN aRecord: 192.168.10.7 # fileserver IN A 192.168.10.6 dn: relativeDomainName=fileserver,zoneName=artpaint,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone zoneName: artpaint relativeDomainName: fileserver dNSClass: IN aRecord: 192.168.10.6 # gate IN A 192.168.10.5 dn: relativeDomainName=gate,zoneName=artpaint,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone zoneName: artpaint relativeDomainName: gate dNSClass: IN aRecord: 192.168.10.5 # terminal01 IN A 192.168.10.1 dn: relativeDomainName=terminal01,zoneName=artpaint,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone zoneName: artpaint relativeDomainName: terminal01 dNSClass: IN aRecord: 192.168.10.1 # terminal02 IN A 192.168.10.2 dn: relativeDomainName=terminal02,zoneName=artpaint,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone zoneName: artpaint relativeDomainName: terminal02 dNSClass: IN aRecord: 192.168.10.2 # terminal03 IN A 192.168.10.3 dn: relativeDomainName=terminal03,zoneName=artpaint,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone zoneName: artpaint relativeDomainName: terminal03 dNSClass: IN aRecord: 192.168.10.3 # addr-arpa dn: zoneName=10.168.192.in-addr.arpa,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone zoneName: 10.168.192.in-addr.arpa relativeDomainName: 10.168.192.in-addr.arpa # SOA for addr-arpa dn: relativeDomainName=@,zoneName=10.168.192.in-addr.arpa,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone zoneName: 10.168.192.in-addr.arpa relativeDomainName: @ nSRecord: mail.artpaint. sOARecord: mail.artpaint. root.mail.artpaint. 1 8H 2H 1W 1D # PTR for .8 dn: relativeDomainName=8,zoneName=10.168.192.in-addr.arpa,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone zoneName: 10.168.192.in-addr.arpa relativeDomainName: 8 pTRRecord: mail.artpaint. # PTR for .7 dn: relativeDomainName=7,zoneName=10.168.192.in-addr.arpa,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone zoneName: 10.168.192.in-addr.arpa relativeDomainName: 7 pTRRecord: router.artpaint. # PTR for .6 dn: relativeDomainName=6,zoneName=10.168.192.in-addr.arpa,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone zoneName: 10.168.192.in-addr.arpa relativeDomainName: 6 pTRRecord: fileserver.artpaint. # PTR for .5 dn: relativeDomainName=5,zoneName=10.168.192.in-addr.arpa,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone zoneName: 10.168.192.in-addr.arpa relativeDomainName: 5 pTRRecord: gate.artpaint. # PTR for .1 dn: relativeDomainName=1,zoneName=10.168.192.in-addr.arpa,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone zoneName: 10.168.192.in-addr.arpa relativeDomainName: 1 pTRRecord: terminal01.artpaint. # PTR for .2 dn: relativeDomainName=2,zoneName=10.168.192.in-addr.arpa,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone zoneName: 10.168.192.in-addr.arpa relativeDomainName: 2 pTRRecord: terminal02.artpaint. # PTR for .3 dn: relativeDomainName=3,zoneName=10.168.192.in-addr.arpa,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone zoneName: 10.168.192.in-addr.arpa relativeDomainName: 3 pTRRecord: terminal03.artpaint.

вот лдифы для локалхоста localhost.ldif:

dn: relativeDomainName=localhost,zoneName=artpaint,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone zoneName: artpaint relativeDomainName: localhost dNSClass: IN aRecord: 127.0.0.1

и обратная зона локалхоста localhost-rev.ldif

dn: zoneName=0.0.127.in-addr.arpa,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone relativeDomainName: 0.0.127.in-addr.arpa zoneName: 0.0.127.in-addr.arpa dn: relativeDomainName=@,zoneName=0.0.127.in-addr.arpa,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone relativeDomainName: @ zoneName: 0.0.127.in-addr.arpa nSRecord: mail.artpaint. sOARecord: mail.artpaint. root.mail.artpaint. 1 3H 1H 12W 1H dn: relativeDomainName=1,zoneName=0.0.127.in-addr.arpa,ou=dns,dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dNSZone relativeDomainName: 1 pTRRecord: localhost.artpaint. zoneName: 0.0.127.in-addr.arpa

   Добавляем записи в лдап:

[f0s@mail] /home/> ldapadd -x -D "cn=root,dc=artpaint,dc=spb,dc=ru" \ ? -W -f dnszone.ldif [f0s@mail] /home/> ldapadd -x -D "cn=root,dc=artpaint,dc=spb,dc=ru" \ ? -W -f localhost.ldif [f0s@mail] /home/> ldapadd -x -D "cn=root,dc=artpaint,dc=spb,dc=ru" \ ? -W -f localhost-rev.ldif

   Теперь устанавливаем bind, который поддерживаем работу с лдап:

[f0s@mail] /home/> cd /usr/ports/dns/bind9-sdb-ldap [f0s@mail] /usr/ports/dns/bind9-sdb-ldap/> make install clean

   Создаем конфигурационный файл named.conf:

[f0s@mail] /home/> more /etc/namedb/named.conf acl lan { 192.168.10.0/24; 192.168.20.0/24; 192.168.0.0/24; }; acl transfers { 127.0.0.1; }; acl trusted { 192.168.100.0/24; }; key "rndc-key" { algorithm hmac-md5; secret "JW/YeNtwZo+uxKqIsWtpUZ=="; }; controls { inet 127.0.0.1 port 953 allow { 127.0.0.1; } keys { "rndc-key"; }; }; options { directory "/etc/namedb"; pid-file "/var/run/named/pid"; dump-file "/var/dump/named_dump.db"; statistics-file "/var/stats/named.stats"; version "Windows 95"; listen-on { 127.0.0.1; 192.168.10.8; }; forward only; forwarders { 80.177.122.1; 80.177.123.1; }; allow-query { lan; trusted; }; allow-recursion { trusted; lan; }; query-source address * port 53; }; zone "." { type hint; file "named.root"; }; zone "artpaint" { type master; // след. две строки - одна без пробелов - невлезло database "ldap ldap://192.168.10.8/zoneName=artpaint, ou=dns,dc=artpaint,dc=spb,dc=ru 178600"; allow-query { lan; trusted; }; allow-transfer { transfers; }; }; zone "10.168.192.in-addr.arpa" { type master; // след. две строки - одна без пробелов - невлезло database "ldap ldap://192.168.10.8/zoneName=10.168.192.in-addr.arpa, ou=dns,dc=artpaint,dc=spb,dc=ru 178600"; allow-query { lan; trusted; }; allow-transfer { transfers; }; }; zone "0.0.127.in-addr.arpa" { type master; // след. две строки - одна без пробелов - невлезло database "ldap ldap://192.168.10.8/zoneName=0.0.127.in-addr.arpa, ou=dns,dc=artpaint,dc=spb,dc=ru 178600"; allow-query { lan; trusted; }; allow-transfer { transfers; }; };

   Обратите внимание, rndc-key нужно сконфигурировать. Для этого запускаем rndc-confgen, и там смотрим что он нам за информацию выдаст на экран, и делаем по этой инструкции. Описываю подробнее:

[f0s@mail] /home/f0s/> rndc-confgen > tmp [f0s@mail] /home/f0s/> cat tmp # Start of rndc.conf key "rndc-key" { algorithm hmac-md5; secret "IK0mpNGfZ82o8IrRuJRN2A=="; }; options { default-key "rndc-key"; default-server 127.0.0.1; default-port 953; }; # End of rndc.conf # Use with the following in named.conf, adjusting the allow list as needed: # key "rndc-key" { # algorithm hmac-md5; # secret "IK0mpNGfZ82o8IrRuJRN2A=="; # }; # # controls { # inet 127.0.0.1 port 953 # allow { 127.0.0.1; } keys { "rndc-key"; }; # }; # End of named.conf [f0s@mail] /home/f0s/>

   Тоесть нам надо создать файлик rndc.conf с таким содержимым:

key "rndc-key" { algorithm hmac-md5; secret "IK0mpNGfZ82o8IrRuJRN2A=="; }; options { default-key "rndc-key"; default-server 127.0.0.1; default-port 953; };

а остаток, что закоментарено в файле tmp дописать в named.conf (все эти файлы должны лежать в /etc/namedb/)
   Добавляем в rc.conf:

[f0s@mail] /home/> more /etc/rc.conf | grep named named_enable="YES" named_flags="-c /etc/namedb/named.conf" named_program="/usr/local/sbin/named"

   Устанавливаем права:

[f0s@mail] /var/named/> chown -R bind:bind var [f0s@mail] /var/named/> chown bind:bind /var/named/etc/namedb/master [f0s@mail] /var/named/> chown bind:bind /var/named/etc/namedb/dynamic [f0s@mail] /etc/namedb/> ll total 34 -rw-r--r-- 1 bind bind 173 25 июн 17:32 10.168.192.rev -rw-r--r-- 1 bind bind 173 25 июн 17:27 64.52.84.rev -rw-r--r-- 1 bind bind 423 12 янв 2007 PROTO.localhost-v6.rev -rw-r--r-- 1 bind bind 423 12 янв 2007 PROTO.localhost.rev -rw-r--r-- 1 bind bind 564 25 июн 17:25 artpaint.spb.ru drwxr-xr-x 2 bind bind 512 12 янв 2007 dynamic -rw-r--r-- 1 bind bind 446 22 июн 10:07 localhost-v6.rev -rw-r--r-- 1 bind bind 446 25 июн 17:28 localhost.rev -rw-r--r-- 1 bind bind 1089 12 янв 2007 make-localhost drwxr-xr-x 2 bind bind 512 22 июн 10:08 master -rw-r--r-- 1 bind bind 4318 3 июл 11:12 named.conf -rw-r--r-- 1 bind bind 2600 12 янв 2007 named.root -rw-r--r-- 1 root wheel 479 29 июн 13:52 rndc.conf drwxr-xr-x 2 bind bind 512 12 янв 2007 slave [f0s@mail] /etc/namedb/>

   Стартуемся (стартует первый раз возможно долго.. минут 5):

[f0s@mail] /var/named/> /etc/rc.d/named start

   Переходим к настройке DHCP (проверьте чтобы в опциях сборки было выбрано LDAP):

[f0s@mail] /var/named/> cd /usr/ports/net/isc-dhcp3-server [f0s@mail] /usr/ports/net/isc-dhcp3-server/> make install clean

   Создаем файлик dhcp.ldif такого содержания (в нем хранятся все параметры области, в будущем можно редактировать через ldapadmin):

[f0s@mail] /usr/local/etc/openldap/> ee dhcp.ldif dn: ou=dhcp, dc=artpaint,dc=spb,dc=ru ou: dhcp description: configuration information for DHCP objectClass: top objectClass: organizationalUnit dn: cn=conf, ou=dhcp, dc=artpaint,dc=spb,dc=ru dhcpSecondaryDN: cn=mail.artpaint, ou=dhcp, dc=artpaint,dc=spb,dc=ru dhcpStatements: ddns-update-style none dhcpStatements: ddns-updates off dhcpStatements: client-updates off dhcpStatements: use-host-decl-names on dhcpStatements: always-reply-rfc1048 on dhcpStatements: default-lease-time 86400 dhcpStatements: max-lease-time 129600 #dhcpStatements: authoritative objectClass: top objectClass: dhcpService objectClass: dhcpOptions dhcpPrimaryDN: ou=dhcp, dc=artpaint,dc=spb,dc=ru dhcpOption: domain-name "artpaint" dhcpOption: netbios-scope "" dhcpOption: netbios-node-type 8 dhcpOption: time-offset 10800 dhcpOption: ip-forwarding off #dhcpOption: option-150 code 150 = ipaddress dhcpOption: netbios-name-servers 192.168.10.8 cn: conf dn: cn=mail.artpaint, ou=dhcp, dc=artpaint,dc=spb,dc=ru dhcpServiceDN: cn=conf, ou=dhcp, dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dhcpServer cn: mail.artpaint dn: cn=192.168.10.0, cn=conf, ou=dhcp, dc=artpaint,dc=spb,dc=ru objectClass: top objectClass: dhcpSubnet objectClass: dhcpOptions dhcpNetMask: 24 dhcpRange: 192.168.10.50 192.168.10.150 dhcpOption: domain-name-servers 192.168.10.8 dhcpOption: routers 192.168.10.7 # для tftp #dhcpOption: bootfile-name "pxelinux.0"; #dhcpOption: tftp-server-name "192.168.10.8"; # dhcpOption: ntp-servers 192.168.10.7 dhcpOption: broadcast-address 192.168.10.255 dhcpOption: default-ip-ttl 64 dhcpOption: default-tcp-ttl 64 cn: 192.168.10.0 dn: cn=print-export, cn=192.168.10.0, cn=conf, ou=dhcp, dc=artpaint, dc=spb, dc=ru dhcpHWAddress: ethernet 00:00:aa:99:b2:bd dhcpStatements: fixed-address 192.168.10.15 objectClass: top objectClass: dhcpHost objectClass: dhcpOptions cn: print-export # ниже резервирование по макадресу. юзаю для принтеров сетевых. dn: cn=print-buh, cn=192.168.10.0, cn=conf, ou=dhcp, dc=artpaint, dc=spb, dc=ru dhcpHWAddress: ethernet 00:00:aa:99:b0:7f dhcpStatements: fixed-address 192.168.10.16 objectClass: top objectClass: dhcpHost objectClass: dhcpOptions cn: print-buh dn: cn=print-sales-kanc, cn=192.168.10.0, cn=conf, ou=dhcp, dc=artpaint, dc=spb, dc=ru dhcpHWAddress: ethernet 00:00:aa:99:b0:cd dhcpStatements: fixed-address 192.168.10.17 objectClass: top objectClass: dhcpHost objectClass: dhcpOptions cn: print-sales-kanc dn: cn=print-sales-hudozh, cn=192.168.10.0, cn=conf, ou=dhcp, dc=artpaint, dc=spb, dc=ru dhcpHWAddress: ethernet 00:14:38:5a:1d:c3 dhcpStatements: fixed-address 192.168.10.18 objectClass: top objectClass: dhcpHost objectClass: dhcpOptions cn: print-sales-hudozh dn: cn=print-mark-color, cn=192.168.10.0, cn=conf, ou=dhcp, dc=artpaint, dc=spb, dc=ru dhcpHWAddress: ethernet 00:00:f0:ab:8f:64 dhcpStatements: fixed-address 192.168.10.19 objectClass: top objectClass: dhcpHost objectClass: dhcpOptions cn: print-mark-color dn: cn=print-mark-black, cn=192.168.10.0, cn=conf, ou=dhcp, dc=artpaint, dc=spb, dc=ru dhcpHWAddress: ethernet 00:00:b4:c9:ee:a2 dhcpStatements: fixed-address 192.168.10.20 objectClass: top objectClass: dhcpHost objectClass: dhcpOptions cn: print-mark-black

   Добавляем в лдап:

[f0s@mail] /var/named/> ldapadd –x –D "cn=root,dc=artpaint,dc=spb,dc=ru" –W –f dhcp.ldif

   Далее редактируем dhcpd.conf

[f0s@mail] /var/named/> more /usr/local/etc/dhcpd.conf ldap-server "127.0.0.1"; ldap-port 389; ldap-username "cn=root,dc=artpaint,dc=spb,dc=ru"; ldap-password "password"; ldap-base-dn "ou=dhcp,dc=artpaint,dc=spb,dc=ru"; ldap-method dynamic;

   Проверяем права на файл:

-rw-r----- 1 dhcpd dhcpd 187 4 июл 13:28 dhcpd.conf

   Добавляем автозапуск dhcp и стартуем его:

[f0s@mail] /var/named/> echo dhcpd_enable=\"YES\" >> /etc/rc.conf [f0s@mail] /var/named/> echo dhcpd_ifaces=\"nve0\" >> /etc/rc.conf [f0s@mail] /var/named/> /usr/local/etc/rc.d/isc-dhcpd start

   Для динамического обновления зон нам потребуется мега-скрипт.

[f0s@mail] /root/> fetch http://www.venaas.no/ldap/bind-sdb/dhcp2ldapd-1.1.gz [f0s@mail] /root/> gunzip dhcp2ldapd-1.1.gz [f0s@mail] /root/> mkdir dhcp

   Распакованый файл переименовываем в dhcpd2ldap.pl и копируем в /root/dhcp/, затем редактируем:

[f0s@mail] /root/> more /root/dhcp/dhcpd2ldap.pl #!/usr/bin/perl $LEASES = "/var/db/dhcpd/dhcpd.leases"; $DOMAIN = "artpaint"; $REVERSE = "10.168.192.in-addr.arpa"; $FORWARD_BASE = "zoneName=artpaint,ou=dns,dc=artpaint,dc=spb,dc=ru"; $REVERSE_BASE = "zoneName=10.168.192.in-addr.arpa,ou=dns,dc=artpaint,dc=spb,dc=ru"; $USER = 'cn=root,dc=artpaint,dc=spb,dc=ru'; $PASSWORD = "password"; $LDAP_HOST = '192.168.10.8'; $UPDATE_TIME = 30; $AUTO_VERIFY = 0;

   И еще надо будет подправить строку ~ 172 и 174:
меняем там $fourth.$third на $fourth.

$result = $ldap->delete("relativeDomainName=$fourth.$third," . $REVERSE_BASE); $result->code && warn "failed to remove entry: ", $result->error ; $result = $ldap->add( "relativeDomainName=$fourth.$third," . $REVERSE_BASE, attr => [ 'relativeDomainName'=> "$fourth.$third",

получаем это:

$result = $ldap->delete("relativeDomainName=$fourth," . $REVERSE_BASE); $result->code && warn "failed to remove entry: ", $result->error ; $result = $ldap->add( "relativeDomainName=$fourth," . $REVERSE_BASE, attr => [ 'relativeDomainName'=> "$fourth",

   Создаем скрипт /usr/local/etc/rc.d/dhcp2ldap.sh запуска dhcp2ldap.pl:

#!/bin/sh case "$1" in start) if [ -f /var/run/dhcpd2ldap.pid ] then echo "Script already launched. PID: "\ `cat /var/run/dhcpd2ldap.pid` else echo "Starting dhcpd2ldap..." daemon -f -p /var/run/dhcpd2ldap.pid \ /root/dhcp/dhcpd2ldap.pl && echo "...Done!" fi ;; stop) if [ -f /var/run/dhcpd2ldap.pid ] then echo "Shutting down dhcpd2ldap..." kill -TERM `cat /var/run/dhcpd2ldap.pid` && \ rm -f /var/run/dhcpd2ldap.pid && echo "...Done!" else echo "dhcpd2ldap not launched." fi ;; *) echo "Use start script for: { start | stop }" >&2 exit 64 ;; esac

   Выставляем права

[f0s@mail] /usr/local/etc/rc.d/> chmod 0755 dhcpd2ldap.sh [f0s@mail] /usr/local/etc/rc.d/> chown root:wheel dhcpd2ldap.sh [f0s@mail] /usr/local/etc/rc.d/> ./dhcpd2ldap.sh start [f0s@mail] /usr/local/etc/rc.d/> ps -ax | grep dhcp 585 ?? Is 0:00,03 /usr/local/sbin/dhcpd -cf /usr/local/etc/dhcpd.conf - 40200 ?? Ss 0:00,14 /usr/bin/perl /root/dhcp/dhcpd2ldap.pl (perl5.8.8) 40227 p0 RV 0:00,00 grep dhcp (csh)

   Ну вот и все :)