My Personal IT Infrastructure Knowledge Base

Monday, August 16, 2021

FreeBSD DHCP & DNS Server

FreeBSD OS Configuration

FILE /etc/rc.conf

hostname="fbsd01.dpasek.com"
ifconfig_vmx0="inet 192.168.58.1 netmask 255.255.255.0"
defaultrouter="192.168.58.254"

sshd_enable="YES"
ntpd_enable="YES"
ntpdate_enable="YES"

# VMware Tools
vmware_guest_vmblock_enable="YES"
vmware_guest_vmhgfs_enable="YES"
vmware_guest_vmmemctl_enable="YES"
vmware_guest_vmxnet_enable="YES"
vmware_guestd_enable="YES"

# DNS Server
named_enable="YES"
# DHCP Server
dhcpd_enable="YES"
dhcpd_ifaces="vmx0"

Restart the network configuration:
/etc/rc.d/netif restart
/etc/rc.d/routing restart

Software installation
pkg update
pkg install -y open-vm-tools-nox11
pkg install -y isc-dhcp44-server
pkg install -y bind916

OS Tuning

Edit FILE $HOME/.profile
PS1="[${LOGNAME}@$(hostname)]$ "; export PS1

FILE /usr/local/etc/dhcpd.conf

# dhcpd.conf
#
# Sample configuration file for ISC dhcpd
#

# option definitions common to all supported networks...
option domain-name "example.org";
option domain-name-servers ns1.example.org, ns2.example.org;

default-lease-time 600;
max-lease-time 7200;

# Use this to enble / disable dynamic dns updates globally.
#ddns-update-style none;

# If this DHCP server is the official DHCP server for the local
# network, the authoritative directive should be uncommented.
#authoritative;

# Use this to send dhcp log messages to a different log file (you also
# have to hack syslog.conf to complete the redirection).
log-facility local7;

####################################################
# DC-MGMT subnet declaration
####################################################
subnet 192.168.4.0 netmask 255.255.255.0 {
range 192.168.4.148 192.168.4.198;
option routers 192.168.4.254;
option domain-name-servers 192.168.4.5;
option domain-search "home.uw.cz";
option broadcast-address 192.168.4.255;
}

####################################################
# CAMPUS subnet declaration
####################################################
subnet 192.168.5.0 netmask 255.255.255.0 {
range 192.168.5.100 192.168.5.199;
option routers 192.168.5.254;
option domain-name-servers 192.168.4.5;
option domain-search "home.uw.cz";
option broadcast-address 192.168.5.255;
}

####################################################
# HOME-AUTOMATION subnet declaration
####################################################
subnet 192.168.7.0 netmask 255.255.255.0 {
range 192.168.7.100 192.168.7.199;
option routers 192.168.7.254;
option domain-name-servers 192.168.4.5;
option domain-search "home.uw.cz";
option broadcast-address 192.168.7.255;
}

####################################################
# STATIC ASIGNMENTS
####################################################

host printer {
# MX350 - lan
# hardware ethernet 00:1e:8f:89:59:4e;
# wifi
# MX350 - wifi
# hardware ethernet 00:1e:8f:df:e0:f5;
# MB2750 - lan
# hardware ethernet f8:0d:60:24:ab:85;
# MB2750 - wifi
hardware ethernet 00:1e:8f:89:59:4e;
fixed-address 192.168.5.10;
}

host apc01 {
hardware ethernet 00:C0:B7:CE:40:D9;
fixed-address 192.168.4.11;
option host-name "apc01";
option domain-name "home.uw.cz";
}

host apc02 {
hardware ethernet 00:C0:B7:60:D6:93;
fixed-address 192.168.4.12;
option host-name "apc02";
option domain-name "home.uw.cz";
}

FILE /usr/local/etc/namedb/named.conf

options {
        // All file and path names are relative to the chroot directory,
        // if any, and should be fully qualified.
        directory       "/usr/local/etc/namedb/working";
        pid-file        "/var/run/named/pid";
        dump-file       "/var/dump/named_dump.db";
        statistics-file "/var/stats/named.stats";
        allow-query     { any; };
        allow-transfer { any; };

// If named is being used only as a local resolver, this is a safe default.
// For named to be accessible to the network, comment this option, specify
// the proper IP address, or delete this option.
        listen-on       { 127.0.0.1; 192.168.4.5; };

// These zones are already covered by the empty zones listed below.
// If you remove the related empty zones below, comment these lines out.
        disable-empty-zone "255.255.255.255.IN-ADDR.ARPA";
        disable-empty-zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA";
        disable-empty-zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA";

// If you've got a DNS server around at your upstream provider, enter
// its IP address here, and enable the line below. This will make you
// benefit from its cache, thus reduce overall DNS traffic in the Internet.
        forwarders {
                8.8.8.8; 8.8.4.4;
        };
};

// The traditional root hints mechanism. Use this, OR the slave zones below.
zone "." { type hint; file "/usr/local/etc/namedb/named.root"; };

// RFCs 1912, 5735 and 6303 (and BCP 32 for localhost)
zone "localhost"        { type master; file "/usr/local/etc/namedb/master/localhost-forward.db"; };
zone "127.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/localhost-reverse.db"; };
zone "255.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };

// RFC 1912-style zone for IPv6 localhost address (RFC 6303)
zone "0.ip6.arpa"       { type master; file "/usr/local/etc/namedb/master/localhost-reverse.db"; };

// "This" Network (RFCs 1912, 5735 and 6303)
zone "0.in-addr.arpa"   { type master; file "/usr/local/etc/namedb/master/empty.db"; };

// Private Use Networks (RFCs 1918, 5735 and 6303)
zone "10.in-addr.arpa"     { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "16.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "17.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "18.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "19.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "20.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "21.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "22.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "23.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "24.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "25.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "26.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "27.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "28.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "29.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "30.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "31.172.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "168.192.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };

// Shared Address Space (RFC 6598)
zone "64.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "65.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "66.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "67.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "68.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "69.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "70.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "71.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "72.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "73.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "74.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "75.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "76.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "77.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "78.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "79.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "80.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "81.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "82.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "83.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "84.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "85.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "86.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "87.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "88.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "89.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "90.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "91.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "92.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "93.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "94.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "95.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "96.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "97.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "98.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "99.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "100.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "101.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "102.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "103.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "104.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "105.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "106.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "107.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "108.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "109.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "110.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "111.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "112.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "113.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "114.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "115.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "116.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "117.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "118.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "119.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "120.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "121.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "122.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "123.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "124.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "125.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "126.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "127.100.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };

// Link-local/APIPA (RFCs 3927, 5735 and 6303)
zone "254.169.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };

// IETF protocol assignments (RFCs 5735 and 5736)
zone "0.0.192.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };

// TEST-NET-[1-3] for Documentation (RFCs 5735, 5737 and 6303)
zone "2.0.192.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "100.51.198.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "113.0.203.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };

// IPv6 Example Range for Documentation (RFCs 3849 and 6303)
zone "8.b.d.0.1.0.0.2.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };

// Router Benchmark Testing (RFCs 2544 and 5735)
zone "18.198.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "19.198.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };

// IANA Reserved - Old Class E Space (RFC 5735)
zone "240.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "241.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "242.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "243.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "244.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "245.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "246.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "247.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "248.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "249.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "250.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "251.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "252.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "253.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "254.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };

// IPv6 Unassigned Addresses (RFC 4291)
zone "1.ip6.arpa"       { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "3.ip6.arpa"       { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "4.ip6.arpa"       { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "5.ip6.arpa"       { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "6.ip6.arpa"       { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "7.ip6.arpa"       { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "8.ip6.arpa"       { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "9.ip6.arpa"       { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "a.ip6.arpa"       { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "b.ip6.arpa"       { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "c.ip6.arpa"       { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "d.ip6.arpa"       { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "e.ip6.arpa"       { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "0.f.ip6.arpa"     { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "1.f.ip6.arpa"     { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "2.f.ip6.arpa"     { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "3.f.ip6.arpa"     { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "4.f.ip6.arpa"     { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "5.f.ip6.arpa"     { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "6.f.ip6.arpa"     { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "7.f.ip6.arpa"     { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "8.f.ip6.arpa"     { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "9.f.ip6.arpa"     { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "a.f.ip6.arpa"     { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "b.f.ip6.arpa"     { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "0.e.f.ip6.arpa"   { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "1.e.f.ip6.arpa"   { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "2.e.f.ip6.arpa"   { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "3.e.f.ip6.arpa"   { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "4.e.f.ip6.arpa"   { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "5.e.f.ip6.arpa"   { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "6.e.f.ip6.arpa"   { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "7.e.f.ip6.arpa"   { type master; file "/usr/local/etc/namedb/master/empty.db"; };

// IPv6 ULA (RFCs 4193 and 6303)
zone "c.f.ip6.arpa"     { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "d.f.ip6.arpa"     { type master; file "/usr/local/etc/namedb/master/empty.db"; };

// IPv6 Link Local (RFCs 4291 and 6303)
zone "8.e.f.ip6.arpa"   { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "9.e.f.ip6.arpa"   { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "a.e.f.ip6.arpa"   { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "b.e.f.ip6.arpa"   { type master; file "/usr/local/etc/namedb/master/empty.db"; };

// IPv6 Deprecated Site-Local Addresses (RFCs 3879 and 6303)
zone "c.e.f.ip6.arpa"   { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "d.e.f.ip6.arpa"   { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "e.e.f.ip6.arpa"   { type master; file "/usr/local/etc/namedb/master/empty.db"; };
zone "f.e.f.ip6.arpa"   { type master; file "/usr/local/etc/namedb/master/empty.db"; };

// IP6.INT is Deprecated (RFC 4159)
zone "ip6.int" { type master; file "/usr/local/etc/namedb/master/empty.db"; };

zone "home.uw.cz" {
type master;
file "/usr/local/etc/namedb/master/home.uw.cz.db";
};

zone "robo-p6.uw.cz" {
        type slave;
        file "/usr/local/etc/namedb/slave/robo-p6.uw.cz.slave";
        masters {
                192.168.162.250;
        };
        notify yes;
};

FILE /usr/local/etc/namedb/master/home.uw.cz.db

$TTL 10800
home.uw.cz.    IN      SOA      ns1.home.uw.cz. dpasek.home.uw.cz. (
                                2022011101      ; Serial
                                10800           ; Refresh
                                3600            ; Retry
                                604800          ; Expire
                                300             ; Negative Response TTL
                        )

; DNS Servers
                IN      NS      ns1.home.uw.cz.

; MX Records
;                IN      MX 10   mx.example.org.
;                IN      MX 20   mail.example.org.

; Segment VLAN 4 - 192.168.4.0/24
is01            IN      A       192.168.4.4
ns1             IN      A       192.168.4.5
apc01           IN      A       192.168.4.11
apc02           IN      A       192.168.4.12
;ns2             IN      A       192.168.4.20
nas-sata        IN      A       192.168.4.21
nas-ssd         IN      A       192.168.4.22
mwin01          IN      A       192.168.4.23
mwin02          IN      A       192.168.4.25
syslog          IN      A       192.168.4.51
vro             IN      A       192.168.4.53
vrepl           IN      A       192.168.4.54
backup          IN      A       192.168.4.55
temp-garage     IN      A       192.168.4.94
nsxm            IN      A       192.168.4.99
vc01            IN      A       192.168.4.100
esx01           IN      A       192.168.4.101
esx02           IN      A       192.168.4.102
esx03           IN      A       192.168.4.103
esx04           IN      A       192.168.4.104
esx21           IN      A       192.168.4.121
esx22           IN      A       192.168.4.122
esx23           IN      A       192.168.4.123
esx24           IN      A       192.168.4.124

esx01-oob       IN      A       192.168.4.201
esx02-oob       IN      A       192.168.4.202
esx03-oob       IN      A       192.168.4.203
esx04-oob       IN      A       192.168.4.204
esx21-oob       IN      A       192.168.4.221
esx22-oob       IN      A       192.168.4.222
esx23-oob       IN      A       192.168.4.223
esx24-oob       IN      A       192.168.4.224

sw-dc-access    IN      A       192.168.4.253
sw-dc-core      IN      A       192.168.4.254

; Segment VLAN 5 - 192.168.5.0/24
printer         IN      A       192.168.5.10

; Segment VLAN 8 - 192.168.8.0/24
tdm             IN      A       192.168.8.1
vha        IN    A    192.168.8.2
shd        IN    A    192.168.8.3

; Segment VLAN 31 - 192.168.31.0/24
n-vc01          IN      A       192.168.31.100
n-esx01         IN      A       192.168.31.101
n-esx02         IN      A       192.168.31.102
n-esx03         IN      A       192.168.31.103
n-esx04         IN      A       192.168.31.104
n-esx05         IN      A       192.168.31.105
n-esx06         IN      A       192.168.31.106
n-esx07         IN      A       192.168.31.107
n-esx08         IN      A       192.168.31.108
n-esx09         IN      A       192.168.31.109
n-esx10         IN      A       192.168.31.110

; Aliases
loginsight      IN      CNAME   syslog.home.uw.cz.

FILE /usr/local/etc/namedb/master/p6.uw.cz.db

$TTL 86400
@       IN      SOA     ns1.p6.uw.cz. admin.p6.uw.cz. (
                        2024030902 ; Serial
                        3600        ; Refresh
                        1800        ; Retry
                        1209600     ; Expire
                        86400 )     ; Minimum TTL

        IN      NS      ns1.p6.uw.cz.

gw1     IN      A       10.160.4.254
ns1     IN      A       10.160.4.254
mwin01 IN      A       10.160.4.24
mlin01 IN      A       10.160.4.26
nsxm    IN      A       10.160.4.99
vc01    IN      A       10.160.4.100
esx11   IN      A       10.160.4.111
esx12   IN      A       10.160.4.112
esx13   IN      A       10.160.4.113
esx14   IN      A       10.160.4.114

Friday, July 2, 2021

VMware Kubernetes Strategy

Kubernetes (K8s) Stack

Operations and Observability

Thursday, July 1, 2021

VMcrypt

Data At Rest Encryption with VM & vSAN Encryption

https://vault.vmware.com/group/vault-main-library/document-preview/-/document_library/6KC5yhh3TpWl/view_file/38417227

vSphere 6.5 - VM and vSAN Encryption FAQ

https://confluence.eng.vmware.com/display/VSPHERETECHRESOURCES/vSphere+6.5+-+VM+and+vSAN+Encryption+FAQ

VMcrypt

https://wiki.eng.vmware.com/VMcrypt

VMcrypt technicke podrobnosti

https://wiki.eng.vmware.com/TechPubs/9595VMcryptDocPlan

oficialna dokumentacia k vSphere

https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.security.doc/GUID-E6C5CE29-CD1D-4555-859C-A0492E7CB45D.html

Friday, June 25, 2021

likewise Active Directory - black list of domain controllers

1. Set the black listed DCs
/opt/likewise/bin/lwregshell set_value '[HKEY_THIS_MACHINE\Services\netlogon\Parameters]' BlacklistedDCs ip1,ip2 Eg # /opt/likewise/bin/lwregshell set_value '[HKEY_THIS_MACHINE\Services\netlogon\Parameters]' BlacklistedDCs 10.108.124.21,10.108.124.23

2. Restart the lwregistry.
# /opt/likewise/bin/lwsm restart lwreg

Wednesday, June 23, 2021

Meeting Minutes format

Dear Team,

Thank you for attending today’s regular bi-weekly call. As always, we really appreciate your update regarding the current status of all on-going activities connected with XXXXXXX.

Below you can find my very short meeting minutes:

Meeting: TBD

Participants: @

Recording: URL

Agenda / discussed topics:

Topic 1: description
Topic 2: description

Next steps / follow-ups:

step1
step2
step3

Thank you and have a great evening!

Kind Regards,

Friday, June 4, 2021

Google Cloud : TerraForm

Google Terraform Provider initialization

file provider.tf

provider "google" {}

In shell, run:

terraform init

NOW YOU CAN WORK ON TERRAFORM LOGICAL SPECIFICATIONS.

SEE EXAMPLE BELOW IN THE BOTTOM OF PAGE.

Other commands ...

To rewrite the Terraform configuration files to a canonical format and style, run the following command:

terraform fmt

To initialize Terraform, run the following command

terraform init

To create an execution plan, run the following command:

terraform plan

To apply the desired changes, run the following command:

terraform apply

RESOURCE TEMPLATE

TerraForm Google RESOURCE TEMPLATE

# Create the mynetwork network
resource [RESOURCE_TYPE] "mynetwork" {
name = [RESOURCE_NAME]
#RESOURCE properties go here
}

DOCUMENTATION

Google Cloud TerraForm provider documentation

https://registry.terraform.io/providers/hashicorp/google/latest/docs

Terraform Module variables

https://learn.hashicorp.com/tutorials/terraform/aws-variables

EXAMPLE OF GOOGLE INFRASTRUCTURE AS A CODE

mynetwork.tf

# Create the mynetwork network
resource "google_compute_network" "mynetwork" {
name = "mynetwork"
#RESOURCE properties go here
auto_create_subnetworks = "true"
}

# Add a firewall rule to allow HTTP, SSH, RDP and ICMP traffic on mynetwork
resource "google_compute_firewall" "mynetwork-allow-http-ssh-rdp-icmp" {
name = "mynetwork-allow-http-ssh-rdp-icmp"
#RESOURCE properties go here
network = google_compute_network.mynetwork.self_link
allow {
    protocol = "tcp"
    ports    = ["22", "80", "3389"]
    }
allow {
    protocol = "icmp"
    }
}

# Create the mynet-us-vm instance
module "mynet-us-vm" {
source           = "./instance"
instance_name    = "mynet-us-vm"
instance_zone    = "us-central1-a"
instance_network = google_compute_network.mynetwork.self_link
}

# Create the mynet-eu-vm" instance
module "mynet-eu-vm" {
source           = "./instance"
instance_name    = "mynet-eu-vm"
instance_zone    = "europe-west1-d"
instance_network = google_compute_network.mynetwork.self_link
}

instance/main.tf

variable "instance_name" {}
variable "instance_zone" {}
variable "instance_type" {
default = "n1-standard-1"
}
variable "instance_network" {}

resource "google_compute_instance" "vm_instance" {
name         = "${var.instance_name}"
zone         = "${var.instance_zone}"
machine_type = "${var.instance_type}"
boot_disk {
    initialize_params {
      image = "debian-cloud/debian-9"
      }
}
network_interface {
    network = "${var.instance_network}"
    access_config {
      # Allocate a one-to-one NAT IP to the instance
    }
}
}

Thursday, June 3, 2021

Google Cloud - how to get my IP address

Here is the command

curl -H "Metadata-Flavor: Google" http://169.254.169.254/computeMetadata/v1/instance/network-interfaces/0/access-configs/0/external-ip && echo

Pages