Cyber Drops

Nowadays a lot of which can be used to create a vpn server from starting a direct form of hardware up to the only form of application, from the expensive to the free.

OpenVPN is a VPN application is free (opensource) is quite reliable. Some sources say OpenVPN is in fact not the safest but if the data must be transferred between two or more networks are not too sensitive like more than enough moreover OpenVPN OpenVPN is also very easy to install.

Here I will just tell you about the installation steps OpenVPN on FreeBSD. Although probably could have used some of his tricks on Linux or * nix like any other OS.

Ok long story rather than let's start it.

First OpenVPN on FreeBSD can be found in the folder / usr / ports / security / openvpn, which is required usually lzo library lib but since I installed it through the ports, then all the dependencies will automatically be installed.

For installation please follow these steps (all performed by root)

cd / usr / ports / security / openvpn
make config
Make the build
make install clean

Performed the above steps so that you have a chance to see what happens at each step. Actually you can just change directory and typing make install clean immediately.

After the installation process goes wrong and no significant errors, then input the following line to / etc / rc.conf with your favorite text editor.

openvpn_enable = "YES"

Now we will create a config file to be placed in the folder / usr / local / etc / openvpn if the folder does not exist yet please make advance with the command

mkdir / usr / local / etc / openvpn

Then please move to the folder and start creating openvpn.conf file with your favorite text editor.

cd / usr / local / etc / openvpn
pico openvpn.conf

Now please enter the following sample config.

# Specify device
dev tun

# # The server and client IP Pool
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt

# Certificates for VPN Authentication
ca / usr / local / etc / openvpn / keys / ca.crt
cert / usr / local / etc / openvpn / keys / server.crt
key / usr / local / etc / openvpn / keys / server.key
dh / usr/local/etc/openvpn/keys/dh1024.pem

# Routes to client
push "route 192.168.0.0 255.255.255.0"
# Compression VPN link
comp-lzo

keepalive 10 60
ping-timer-rem
persist-tun
persist-key

# Run OpenVPN as a daemon and drop privileges to user / group nobody user nobody
group nobody
daemon

Save the file above, and we continue with cerificates. Copy the script to create a certificate from the folder / usr / local / share / doc / openvpn manner as follows (examples copied it to the folder / home / giest please be replaced with your user).

cp-r / usr / local / share / doc / openvpn / easy-rsa / home / guest /
cd / home / guest / easy-rsa

After successfully copying easy-rsa scripts then please adan edit the vars file with your favorite editor and adjust purposes (without dieditpun no problems then you will be given only a few questions over and over again). Here are examples of parts that you need to edit.

export KEY_COUNTRY = ID
export KEY_PROVINCE = "ENGLAND"
export KEY_CITY = LONDON
export KEY_ORG = "GUEST-VPN"
export KEY_EMAIL = "admin@guest.org"

Then we moved from the FreeBSD default shell (usually tcsh) to sh or bash first. If you do not move the shell I guarantee you will not succeed in making certificates for openvpn.

To switch to sh or bash please type the following command.

sh

Once you move the shell follow the steps below.

. vars
NOTE: Pls you run. / Clean-all, I Will be doing a rm-rf on / usr / home / Guest / easy-rsa / keys
. / Clean-all
. / Build-ca
Generating a 1024 bit RSA private key
....................................++++++
..............++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information That Will be incorporated
into your certificate request.
What you are about to enter is what is Called a Distinguished Name or a DN.
There are quite a Few fields but you can leave some blank
For some fields there Will be a default value,
If you enter '.,' Will the field be left blank.
-----
Country Name (2 letter code) [ID]:
State or Province Name (full name) [ENLAND]:
Locality Name (eg, city) [LONDON]:
Organization Name (eg, company) [GUEST-VPN]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address [admin@guest.org]:

Ok as you can see you are required to answer some questions, but because previously I've edit the file vars so I can just hit enter to use the default answer.

Next is to build certificate and key follow the steps below

. / Build-key-server server
Generating a 1024 bit RSA private key
..........++++++
.................................................. ++++++
writing new private key to 'server.key'
-----
You are about to be asked to enter information That Will be incorporated
into your certificate request.
What you are about to enter is what is Called a Distinguished Name or a DN.
There are quite a Few fields but you can leave some blank
For some fields there Will be a default value,
If you enter '.,' Will the field be left blank.
-----
Country Name (2 letter code) [ID]:
State or Province Name (full name) [ENGLAND]:
Locality Name (eg, city) [LONDON]:
Organization Name (eg, company) [GUEST-VPN]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []: SERVER
Email Address [admin@guest.org]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: 123456
An optional company name []: ARSENAL
Using configuration from / usr / home / Guest / easy-rsa / openssl.cnf
Check That the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName : P RINTABLE: 'ID'
stateOrProvinceName: P RINTABLE: 'ENGLAND'
localityName : RINTABLE: 'LONDON'
OrganizationName : RINTABLE: 'GUEST-VPN'
commonName : RINTABLE: 'SERVER'
emailAddress : IA5STRING: 'admin@guest.org'
Certificate is to be certified until July 12 18:04:29 2019 GMT (3650 days)
Sign the certificate? [Y / n]: y

1 out of 1 certificate requests certified, commit? [Y / n] y
Write out database with 1 new entries
Data Base Updated

See if we do not edit the file vars we need to answer that question once again. now we will build certificate and key for use by the client. I emulated this will make the client certificate for 2 only. if you have more than two clients please adjusted.

. / Build-key client1
Generating a 1024 bit RSA private key
.........++++++
....................................++++++
writing new private key to 'client1.key'
-----
You are about to be asked to enter information That Will be incorporated
into your certificate request.
What you are about to enter is what is Called a Distinguished Name or a DN.
There are quite a Few fields but you can leave some blank
For some fields there Will be a default value,
If you enter '.,' Will the field be left blank.
-----
Country Name (2 letter code) [ID]:
State or Province Name (full name) [ENGLAND]:
Locality Name (eg, city) [LONDON]:
Organization Name (eg, company) [GUEST-VPN]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []: CLIENT1
Email Address [admin@giest.org]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: 123456
An optional company name []: ARSENAL
Using configuration from / usr / home / Guest / easy-rsa / openssl.cnf
DEBUG [load_index]: unique_subject = "yes"
Check That the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName: P RINTABLE: 'ID'
stateOrProvinceName: P RINTABLE: 'england'
localityName: P RINTABLE: 'london'
OrganizationName: P RINTABLE: 'GUEST-VPN'
commonName: P RINTABLE: 'CLIENT1'
emailAddress: IA5STRING: 'admin@guest.org'
Certificate is to be certified until July 12 18:10:43 2019 GMT (3650 days)
Sign the certificate? [Y / n]: y

1 out of 1 certificate requests certified, commit? [Y / n] y
Write out database with 1 new entries
Data Base Updated

To client2 just typing

. / Build-key client2

you should replace only the part

[Source] Common Name (eg, your name or your server's hostname) []: CLIENT2 [/ source]

If you do not make changes here the certificates and keys for the client to the two would not formed.

Next we build dh parameters with a command like the following

1. #. / Build-dh
2. Generating DH parameters, 1024 bit long safe prime, generator 2
3. This is going to take a long time
4.

ok now completed the process of making key right now you just exit back to your default shell with the command exit

Now copied keys folder to / usr / local / etc / openvpn with the command

cp-r keys / usr / local / etc / openvpn /

Before we start running the openvpn server we first prepare a file for the log. Please edit the file / etc / syslog.conf and add the following line at the bottom of the syslog.conf file.

! Openvpn
.* / Var / log / openvpn.log

then create the file and restart syslog openvpn.log ny

touch / var / log / openvpn.log
killall-HUP syslogd

Now we load the first module tun / tap tun device that could arise later.

kldload if_tun
kldload if_tap

if you find errors kldload: can not load if_tun: File exists mean tun or tap and it was too load so do not worry.

In order to tun and tap was loaded each time the boot please edit the file / boot / defaults / loader.conf then locate the following lines and change to YES

if_tap_load = "YES" # Ethernet tunnel software network interface
if_tun_load = "YES" # Tunnel driver (user process ppp)

Ok lah is now complete we are ready to run the OpenVPN server for the first time. To run OpenVPN please type the following command.

/ Usr / local / etc / rc.d / openvpn start

Next we check whether everything is ready or not we check first with the command ifconfig tun device

tun0: flags = 8051 mtu 1500
inet 10.8.0.1 -> 10.8.0.2 netmask 0xffffffff
Opened by PID 10147

If you've seen a display like the above means that the OpenVPN server is already successful path.

It remains to add the following rules for your pf.conf

# VPN Interface
vpn_if = "tun0"

# VPN Network
vpn_network = "10.8.0.0/24"

# NAT VPN connections
nat on $ ext_if from $ vpn_network to any -> ($ ext_if)

# Inbound VPN connections
pass in on $ ext_if proto udp from any to port 1194 keep state
pass quick on $ vpn_if

WiFi HotSpot As we know, hotspots or wireless internet access with standard 802.11b / g are not familiar stuff our ears, and when we go in public places like the Mall, Cafe, hotels and offices, with our easy to find the facility ..

Unfortunately not all providers offer wireless Internet facilities for free, or if free. extremely limited.
One of the protection used wireless service providers is to restrict Internet access based on MAC Address.
What is MAC Address?
In computer networking a Media Access Control address (MAC address) or Ethernet Hardware Address (EHA) or hardware address or adapter address is a quasi-unique identifier attached to most network adapters (NICs) ..
Okay so the conclusion MAC Address is a unique number that distinguishes each network device that is attached dikomputer us.
An example is the hotspot in hotel hilton. At hilton hotspot The Wireless Internet service providers, limiting the use of the Internet is free only for 3 hours, after that you can not access the Internet again, and would not be able to access again tomorrow. Type of protection used is MAC Address Filtering.
How to break through the protection with a MAC Address?

There is a very useful tool for anda.Tools was named K-MAC Download Dicini
With this tool you will be able to change your MAC-Address instantly and what does it mean? You can break the MAC Address Protection!. Each share of Internet access you run out in 3 hours, you need to do is change your MAC address, and do the connection.
I add more for info. WEP/WPA/WPA-2 cracking passwords using
programs are available in packages of OS backtrack
kismet
Kismet is a security tool that runs Linux, Kismet is used to eavesdrop on data traffic in the Internet network.
Aircrak-Aircrak-PTW PTW is a tool used to crack wireless protected. Each of these notebooks with different specs, so any way to use aircrack different.
One trick is also used to search for passwords which are used by someone to access hotspots that use prepaid cards.
Simple tool that prepared aja sih:
Software required:
1. Angry IP Scanner
2. Technitium MAC Address
Immediately wrote now to how:
# Find the location of the hotspot service provider, certainly in the area of ​​affordable hotspot network is ..
# Turn on your laptop, and also turn on your wireless network and see the wireless network system tray icon, then right click and select view avalible wireless network, and of course after that you must connect to a wireless hotspot your destination.
# After connect, right click the system tray and select status> choose details tab> look there ip given to us. Write down the ip.
# Open the program AngryIP Scanner 2.21 and enter the ip range that we will scan (ip data used were we) at the top. For example: 135.125.1.13 IP that we can then enter the ip in the first column of our range in accordance with an earlier but instead of ip numbers at the end of the first to be 135.125.1.1 and the second column write the same but the number one end was replaced with 255 to 135 125 .1.255. result is 135.125.1.1 to 135.125.1.255 and click start (red button).
# After scanning then we'll get a live ip data connected with these hotspots. after scanning is complete then see the ip of the living (alive hosts) blue right click on the live ip ip Right-click on the blue color was right click> show> mac address and there will be a code mac address (mac addresses sometimes there does not appear, select Just the other ip). Write down the mac address that we get.
# Open the program Technitium MAC Address v5 release 3 which we have prepared. There is a mac address field. well now just change the mac address with which we got earlier and press change mac id.
# Wait for our mac will be replaced and a temporary connection and connect again automatically disconnected itself.
# Go to the firefox web browser, or anything goes. Enjoy Free Internet.
One thing to remember is that our system is the transfer of passenger data to hack an account that we had.
It can outsmart the status of hotspot login page enter it (to account). For example status and so go there it looks prepaid card code number and we simply keep track of, then logout and log back into the hotspot's login page quickly enter the password earlier. This will make us can directly access the Internet without a ride again (because that make us prepaid card code) so if anyone wants to login to use the card (which had a code) when you log in using the card of course he can not enter because prepaid cards.
"Already logged".
How about it, interesting is not it?
But I suggest, as I do is to ride alone, because I do not want to go too far, like the way I Tell to log off and log in again will surely make the owner can not log in. Request permission directly is also a possibility that had not refused, the origin of his interests is urgent.
For Ip Scanning can also use the application Dude, download it here, to determine the condition of the computers connect to the hotspot. Can be tried too ya ..
Hmm, i have some usefull tools again, check it.
WEP and WPA KeyGenerator
Wireless Key Generator
run it live programs generate,, and coffee directly into the network key. ...
Or also you used this application "wifi password finder"
seach it self in search engine :D, all this is just for learning, as long as we are still able to use the legal why not wrote. And this can also be used by the hotspot owner, if in this way can still be used to break into. So it needs more security.

Internet Speed ​​Booster is an easy way to speed up your internet connection. With Internet Speed ​​Booster you can speed up your internet connection, utilize your memory, utilize your internet connection and change your windows settings. The main window consists of the following items: Speed ​​Booster, Net Pinger, Ram Booster and System Settings. Speed ​​Booster contais Wizard mode, Advanced mode, and Backup manager. Net Pinger contains settings Pingr. Ram Booster consists of Ram System status and configuration. System Settings contains Internet properties, System Settings, Modem Settings and Network Settings. To speed up your connection just choose one of the default connection settings and click the Optimize Now. In Backup manager every time you change your program settings will keep your old settings. You can select the backup file you want to restore or delete. PING utility helps you keep getting your modem connection is disconnected by the service provider. Most Internet Service Providers Disconnect users after a fixed period of modem activity. Ram Booster System Status option allows you to monitor your system resources. And you can optimize memory with one click. You can adjust the ram booster settings from Ram Configuration form Ram Booster. All the tools you need to be efficient on the Web! Improve and optimize your Internet connection speed with this set of tools. Net Pinger prevents you from being disconnected from your ISP. Speed ​​Booster how to optimize your PC to send and receive data over the Internet. RAM Booster allows you to free physical memory or RAM on your PC
To complete the writing of tricks internet connection, here I inform a program that can optimize your internet connection speed be it with a usb modem phone modem, or modem and other connections. This software is the Internet Speed ​​Booster, a free program developed by Onestopsoft. Internet Speed ​​Booster offers some functionality in it, namely the Speed ​​Booster, Net Pinger, Ram Booster and.

Speed ​​Booster.
Speed ​​Booster optimizes your Windows system function in terms of data transfer (upload and download). Optimization here is almost the same with some software that had previously informed me (TCPSpeed, TCP / IP Optimizer, FullSpeed, SpeedConnect, and some other software).
To optimize the speed of internet connections with Speed ​​Booster can be in two ways: the Wizard mode and Normal mode. In Wizard mode is already available optimalisasinya choice, we just select one and execute the Optimize Now button.
A second way to Normal mode, for this way, we will do the setup in a few steps (a total of 8 steps), start by selecting a type of Internet connection that we use. If we are confused fill it, do not worry, because this software will give you the option with the default answer, so stay just follow the process (unless we want to change it).

Net Pinger
Function Net Pinger is anticipating that the connection is lost (usually if you open a web page, and do not perform any activity within a certain time then the connection we would stop / cut off), Net Pinger is almost the same function as the Connection Keeper.
To enable Net Pinger, simply by checking the Enable Pinger, while for the choice of configuration (Configuration), we can choose the Automatic Mode (every one minute to ping), or Manual Mode (you set yourself how long the time interval to ping)

Ram Boosterhttp://www.blogger.com/img/blank.gif
From the name Ram Booster've seen that here serves to optimize memory usage in our PC. In the menu there are 2 Ram Booster menu options, namely the System status that indicates the use of our computer processor and memory in the form of real-time graph and the Ram Config governing the use (optimize) the existing resources automatically.

Internet Speed ​​Booster can be run automatically when you enter Windows and run it in the System tray (bottom right corner of the monitor), by selecting Settings. Mark Run Main Courses Pls Windows start-up and Run program in system tray.

download here

VDSL/VHDSL (Very High Bitrate Digital Subscriber Line) is an improved version of the technology, ADSL or Asymmetric Digital Subscriber Line, which we use to connect to the internet. They are different in how they are implemented so you probably cannot use the equipment of one for the other. The most significant difference between the two technologies that is most relevant to the use is speed. ADSL can reach maximum speeds of 8mbps download and 1mbps for upload. In comparison, VDSL can have up to 52mbps for download and 16mbps for upload.

Because of the extremely high speeds that VDSL can accommodate, it is being looked at as a good prospective technology for accommodating high bandwidth applications like VoIP telephony and even HDTV transmission, which ADSL is not capable of. Another very useful feature of VDSL stems from the fact that it uses 7 different frequency bands for the transmission of data. The user then has the power to customize whether each frequency band would be used for download or upload. This kind of flexibility is very nice in case you need to host certain files that are to be downloaded by a lot of people.

The most major drawback for VDSL is the distance it needs to be from the telephone exchange. Within 300m, you may still get close to maximum speed but beyond that, the line quality and the speed deteriorates rather quickly. Because of this, ADSL is still preferable unless you live extremely close to the telephone exchange of the company that you are subscribed to. Most VDSL subscribers are companies who need a very fast server and would often place their own servers in very close proximity.

Due to the limitations of VDSL and its high price, its expansion is not as prolific as that of ADSL. VDSL is only widespread in countries like South Korea and Japan. While other countries also have VDSL offerings, it is only handled from a few companies; mostly one or two in most countries. In comparison, ADSL is very widely used and all countries that offer high speed internet offer ADSL.
DSL technology known as very high bit-rate DSL (VDSL) is seen by many as the next step in providing a complete home-communications/entertainment package. There are already some companies, such as U.S. West (part of Qwest now), that offer VDSL service in selected areas. VDSL provides an incredible amount of bandwidth, with speeds up to about 52 megabits per second (Mbps). Compare that with a maximum speed of 8 to 10 Mbps for ADSL or cable modem and it's clear that the move from current broadband technology to VDSL could be as significant as the migration from a 56K modem to broadband. As VDSL becomes more common, you can expect that integrated packages will be cheaper than the total amount for current separate services.

In this article, you'll learn about VDSL technology, why it's important and how it compares to other DSL technologies. But first, let's take a look at the basics of DSL.

A standard telephone installation in the United States consists of a pair of copper wires that the phone company installs in your home. A pair of copper wires has plenty of bandwidth for carrying data in addition to voice conversations. Voice signals use only a fraction of the available capacity on the wires. DSL exploits this remaining capacity to carry information on the wire without disturbing the line's ability to carry conversations.

Standard phone service limits the frequencies that the switches, telephones and other equipment can carry. Human voices, speaking in normal conversational tones, can be carried in a frequency range of 400 to 3,400 Hertz (cycles per second). In most cases, the wires themselves have the potential to handle frequencies of up to several-million Hertz. Modern equipment that sends digital (rather than analog) data can safely use much more of the telephone line's capacity, and DSL does just that.
VDSL could change the face of E-commerce by allowing all types of media to run smoothly and beautifully through your computer.

computers as exhibiting the same slow connectivity, chances are good it has something to do with the WiFi. For example, perhaps the router got moved to a location that's blocking some of the signal.
It could also be that the router is failing, or that more library patrons are sharing a fixed amount of bandwidth (like more cars on a highway leading to slow-moving traffic). Without having more information, it can be tricky to troubleshoot a problem like this.
However, there's one step worth trying for anyone vexed by sluggish WiFi: try a direct connection to the router. (Actually, that should be your second step; the first is to reset both the modem and router.)

In other words, disable your PC's WiFi, then connect it directly to the router using an Ethernet cable. Windows should automatically detect the new connection and get you online accordingly, though you may have to reboot.

Problem solved? If so, you know there's some kind of WiFi issue to blame. If not, the culprit is probably a bad router, bad router settings, or the Internet connection itself (check with your service provider). Space doesn't permit me to address all these possibilities here, but at least you'll have narrowed down the problem.

If someone need to connect your branch offices, remote workers and telecommuters to your corporate network. They need secure access, 24 hours a day. You know you're going to use some sort of VPN - the question is, which one? IPSec was the big thing until recently, but SSL VPNs have been gaining in popularity in the past while. And are there any other options?

Unfortunately, the answer to which is best is 'it depends', and it's likely that you'll need more than one type to handle all your requirements. So let's do a quick round-up of the pros and cons of your main choices.

SSL
We've written about the benefits of SSL VPN before, but in a nutshell, it creates a secure session from your PC browser to the application server you're accessing. Actually, in most cases, to a proxy server, rather than to the end application.

Using SSL VPNs to enable mobility | Linksys Wireless N Draft 2.0 Wi-Fi Gigabit Security Router with VPN WRVS4400N | Taking the Cisco route to a VPN

Remember that if you're SSL-encrypting traffic end to end, it can't be seen by your firewall, Intrusion Prevention Systems, load balancing devices or any other network management systems. SSL on your servers also adds a fair bit of overhead, so it's probably best to offload this to a proxy anyway, and then route the traffic through your secure corporate LAN.

The upside is that as far as your users are concerned, it's just web access. There's no client software to load, and it can be used anywhere. On the minus side, if you need access to applications that aren't webified, you'll need something to act as an intermediary - that may include your email.

Also, it's all web traffic, so you can forget about Quality of Service or voice, and things like FTP and telnet aren't natively supported, though you should be able to use an applet to forward traffic to the right TCP port number and get access that way. Multicast won't work, and it's not a site-to-site option.

IPSec
Tried and (almost) trusted, IPSec sets up a tunnel from the remote site - either a single user with client software on their PC or a network device terminating the tunnel for a whole office of users - into your central site. Once connected, you access your applications as normal, and it's immaterial whether they're web apps or not.

As the name suggests, it's designed for IP traffic, though that's not so much of an issue nowadays, but if you do have non-IP data, you'd need to configure up GRE tunnels separately and run IPSec over them, as you would to support multicast traffic.

Hybrids
A few companies have managed to combine features of SSL and IPSec, for example Net6 which is now owned by Citrix. Others are working to do the same.

MPLS
Let's not forget MPLS VPNs. They're no good for remote access for individual users, but for site-to-site connectivity, they're the most flexible and scalable option. All the work is at the network level - users just see standard network connectivity - and they support QoS and multicast, so you don't have to worry about which apps people need access to. Of course, an MPLS network isn't as easy to set up or add to as the others, and it's bound to be more expensive.

Remote Users
So for individual users, who may well be travelling, or need access from hotels and Internet cafes, forget MPLS. IPSec is good if you have control over your users' PCs and can manage VPN client downloads and updates. It's also probably the only option for IT support staff, or anyone who needs to be able to access a wide range of applications and services. It scales quite well, and VPN concentrators at the central sites make it reasonably manageable.

SSL comes into its own where you have people accessing your network from non-corporate PCs: partners, suppliers, public Internet-connected PCs, that sort of thing, since there's no client software needed. Where your users just need access to web applications, it's easy, quick and cheap. If you can get an Internet connection, you can get to your data. But it may not handle all the applications your enterprise needs.

Remote Offices
As soon as you have multiple users in one place, though, SSL may not be a good option. More efficient is to have one secure link from your remote site into the central office. If your traffic flows are such that all remote sites access your central site, in a hub-and-spoke arrangement, then IPSec is a good enough option. Your users don't have to bother with any client software, since it's all done in the network.

However, if every branch needs to communicate with every other, building a meshed arrangement is a real pain - especially if you need to set up GRE tunnels for non-IP or multicast traffic. Bear in mind that if you're deploying this and connecting over the Internet, you'll have no QoS guarantees, and your SLAs may not be suitable for business needs.

For large offices, or ones with complex requirements for connectivity or QoS, an MPLS VPN is likely to be your best bet. Even then, you'll need to make sure that your provider can support the levels of QoS you need, knows how to cater for multicast traffic, and can make changes in a sensible timeframe.

It's likely you're going to end up with a mix of VPN types to match your mix of network users. Don't try and force everyone to use the same access method, or you'll end up making life difficult for them and stressful for you. Define several categories of users, match each to the technology that suits it best, and you should find it becomes relatively straightforward to suit most needs.

The Domain Name System is the software that lets you have name to number mappings on your computers. The name decel.ecel.uwa.edu.au is the number 130.95.4.2 and vice versa. This is achieved through the DNS. The DNS is a heirarchy. There are a small number of root domain name servers that are responsible for tracking the top level domains and who is under them. The root domain servers between them know about all the people who have name servers that are authoritive for domains under the root.

Being authoritive means that if a server is asked about something in that domain, it can say with no ambiguity whether or not a given piece of information is true. For example. We have domains x.z and y.z. There are by definition authoritive name servers for both of these domains and we shall assume that the name server in both of these cases is a machine called nic.x.z and nic.y.z but that really makes no difference.

If someone asks nic.x.z whether there is a machine called a.x.z, then nic.x.z can authoritively say, yes or no because it is the authoritive name server for that domain. If someone asks nic.x.z whether there is a machine called a.y.z then nic.x.z asks nic.y.z whether such a machine exists (and caches this for future requests). It asks nic.y.z because nic.y.z is the authoritive name server for the domain y.z. The information about authoritive name servers is stored in the DNS itself and as long as you have a pointer to a name server who is more knowledgable than yourself then you are set.

When a change is made, it propogates slowly out through the internet to eventually reach all machines. The following was supplied by Mark Andrews Mark.Andrews@syd.dms.csiro.au.

If both the primary and all secondaries are up and talking when a zone update occurs and for the refresh period after the update the old data will live for max(refresh + mininum) average (refresh/2 +mininum) for the zone. New information will be available from all servers after refresh.

So with a refresh of 3 hours and a minimum of a day, you can expect everything to be working a day after it is changed. If you have a longer minimum, it may take a couple of days before things return to normal.

There is also a difference between a zone and a domain. The domain is the entire set of machines that are contained within an organisational domain name. For example, the domain uwa.edu.au contains all the machines at the University of Western Australia. A Zone is the area of the DNS for which a server is responsible. The University of Western Australia is a large organisation and trying to track all changes to machines at a central location would be difficult. The authoritive name server for the zone uwa.edu.au delegates the authority for the zone ecel.uwa.edu.au to decel.ecel.uwa.edu.au. Machine foo.ecel.uwa.edu.au is in the zone that decel is authoritive for. Machine bar.uwa.edu.au is in the zone that uniwa.uwa.edu.au is authoritive for.

2 Installing the DNS:

First I'll assume you already have a copy of the Domain Name Server software. It is probably called named or in.named depending on your flavour of unix. I never had to get a copy, but if anyone thinks that information should be here then by all means tell me and I'll put it in. If you intend on using the package called BIND, then you should be sure that you get version 4.9.x, which is the most recent version at this point in time.

For more information on the latest version of BIND you should take a look at Internet Software Consortium which sponsors the development of BIND. - Kavli

2.1 The Boot File:

First step is to create the file named.boot. This describes to named (we'll dispense with the in.named. Take them to be the same) where the information that it requires can be found. This file is normally found in /etc/named.boot and I personally tend to leave it there because then I know where to find it. If you don't want to leave it there but place it in a directory with the rest of your named files, then there is usually an option on named to specify the location of the boot file.

An alternative is of course to make a symbolic link from /etc/named.boot to the wanted directory. - Kavli

Your typical boot file will look like this if you are an unimportant leaf node and there are other name servers at your site.

directory /etc/namedfiles

cache . root.cache
primary ecel.uwa.edu.au ecel.uwa.domain
primary 0.0.127.in-addr.arpa 0.0.127.domain
primary 4.95.130.in-addr.arpa 4.95.130.domain
forwarders 130.95.128.1

Here is an alternative layout used by Christophe Wolfhugel <Christophe.Wolfhugel@grasp.insa-lyon.fr> He finds this easier because of the large number of domains he has. The structure is essentially the same, but the file names use the domain name rather than the IP subnet to describe the contents.

directory /usr/local/etc/bind
cache . p/root
forwarders 134.214.100.1 192.93.2.4
;
; Primary servers
;
primary fr.net p/fr.net
primary frmug.fr.net p/frmug.fr.net
primary 127.in-addr.arpa p/127
;
; Secondary servers
;
secondary ensta.fr 147.250.1.1 s/ensta.fr
secondary gatelink.fr.net 134.214.100.1 s/gatelink.fr.net
secondary insa-lyon.fr 134.214.100.1 s/insa-lyon.fr
secondary loesje.org 145.18.226.21 s/loesje.org
secondary nl.loesje.org 145.18.226.21 s/nl.loesje.org
secondary pcl.ac.uk 161.74.160.5 s/pcl.ac.uk
secondary univ-lyon1.fr 134.214.100.1 s/univ-lyon1.fr
secondary wmin.ac.uk 161.74.160.5 s/wmin.ac.uk
secondary westminster.ac.uk 161.74.160.5 s/westminster.ac.uk
;
;
; Secondary for addresses
;
secondary 74.161.in-addr.arpa 161.74.160.5 s/161.74
secondary 214.134.in-addr.arpa 134.214.100.1 s/134.214
secondary 250.147.in-addr.arpa 147.250.1.1 s/147.250
;
; Classes C
;
secondary 56.44.192.in-addr.arpa 147.250.1.1 s/192.44.56
secondary 57.44.192.in-addr.arpa 147.250.1.1 s/192.44.57

The lines in the named.boot file have the following meanings.

directory

This is the path that named will place in front of all file names referenced from here on. If no directory is specified, it looks for files relative to /etc.

cache

This is the information that named uses to get started. Named must know the IP number of some other name servers at least to get started. Information in the cache is treated differently depending on your version of named. Some versions of named use the information included in the cache permenantly and others retain but ignore the cache information once up and running.

Be sure you get an up-to-date cache-file. An obsolete cache file is a good source of problems. - Kavli

primary

This is one of the domains for which this machine is authorative for. You put the entire domain name in. You need forwards and reverse lookups. The first value is the domain to append to every name included in that file. (There are some exceptions, but they will be explained later) The name at the end of the line is the name of the file (relative to /etc of the directory if you specified one). The filename can have slashes in it to refer to subdirectories so if you have a lot of domains you may want to split it up.

BE VERY CAREFUL TO PUT THE NUMBERS BACK TO FRONT FOR THE REVERSE LOOK UP FILE. The example given above is for the subnet ecel.uwa.edu.au whose IP address is 130.95.4.*. The reverse name must be 4.95.130.in-addr.arpa. It must be backwards and it must end with .in-addr.arpa. If your reverse name lookups don't work, check this. If they still don't work, check this again.

forwarders

This is a list of IP numbers for forward requests for sites about which we are unsure. A good choice here is the name server which is authoritive for the zone above you.

secondary (This line is not in the example, but is worth mentioning.)

A secondary line indicates that you wish to be a secondary name server for this domain. You do not need to do this usually. All it does is help make the DNS more robust. You should have at least one secondary server for your site, but you do not need to be a secondary server for anyone else. You can by all means, but you don't need to be. If you want to be a secondary server for another domain, then place the line

secondary gu.uwa.edu.au 130.95.100.3 130.95.128.1 sec/gu.uwa.edu.au

in your named.boot. This will make your named try the servers on both of the machines specified to see if it can obtain the information about those domains. You can specify a number of IP addresses for the machines to query that probably depends on your machine. Your copy of named will upon startup go and query all the information it can get about the domain in question and remember it and act as though it were authoritive for that domain.

Next you will want to start creating the data files that contain the name definitions.

2.2 The cache file:

You should always use the latest cache file. The simplest way to do this is by using dig(1) this way:

dig @ns.internic.net . ns > root.cache

You can also get a copy of the cache file by ftp'ing FTP.RS.INTERNIC.NET.

An example of a cache file is located in Appendix A.

2.3 The Forward Mapping file:

The file ecel.uwa.edu.au. will be used for the example with a couple of machines left in for the purpose of the exercise. Here is a copy of what the file looks like with explanations following.

; Authoritative data for ecel.uwa.edu.au
;
@ IN SOA decel.ecel.uwa.edu.au. postmaster.ecel.uwa.edu.au. (
93071200 ; Serial (yymmddxx)
10800 ; Refresh 3 hours
3600 ; Retry 1 hour
3600000 ; Expire 1000 hours
86400 ) ; Minimum 24 hours
IN A 130.95.4.2
IN MX 100 decel
IN MX 150 uniwa.uwa.edu.au.
IN MX 200 relay1.uu.net.
IN MX 200 relay2.uu.net.

localhost IN A 127.0.0.1

decel IN A 130.95.4.2
IN HINFO SUN4/110 UNIX
IN MX 100 decel
IN MX 150 uniwa.uwa.edu.au.
IN MX 200 relay1.uu.net
IN MX 200 relay2.uu.net

gopher IN CNAME decel.ecel.uwa.edu.au.

accfin IN A 130.95.4.3
IN HINFO SUN4/110 UNIX
IN MX 100 decel
IN MX 150 uniwa.uwa.edu.au.
IN MX 200 relay1.uu.net
IN MX 200 relay2.uu.net

chris-mac IN A 130.95.4.5
IN HINFO MAC-II MACOS

The comment character is ';' so the first two lines are just comments indicating the contents of the file.

All values from here on have IN in them. This indicates that the value is an InterNet record. There are a couple of other types, but all you need concern yourself with is internet ones.

The IN type is default and can safely be omitted. It looks better without them I think.
- Kavli

The SOA record is the Start Of Authority record. It contains the information that other nameservers will learn about this domain and how to treat the information they are given about it. The '@' as the first character in the line indicates that you wish to define things about the domain for which this file is responsible. The domain name is found in the named.boot file in the corresponding line to this filename. All information listed refers to the most recent machine/domain name so all records from the '@' until 'localhost' refer to the '@'. The SOA record has 5 magic numbers. First magic number is the serial number. If you change the file, change the serial number. If you don't, no other name servers will update their information. The old information will sit around for a very long time.

Refresh is the time between refreshing information about the SOA. Retry is the frequency of retrying if an authorative server cannot be contacted. Expire is how long a secondary name server will keep information about a zone without successfully updating it or confirming that the data is up to date. This is to help the information withstand fairly lengthy downtimes of machines or connections in the network without having to recollect all the information. Minimum is the default time to live value handed out by a nameserver for all records in a zone without an explicit TTL value. This is how long the data will live after being handed out. The two pieces of information before the 5 magic numbers are the machine that is considered the origin of all of this information. Generally the machine that is running your named is a good one for here. The second is an email address for someone who can fix any problems that may occur with the DNS. Good ones here are postmaster, hostmaster or root. NOTE: You use dots and not '@' for the email address.

eg: root.decel.ecel.uwa.edu.au is correct
and
root@decel.ecel.uwa.edu.au is incorrect.

If your name contains a dot: E.g. Ronny.Kavli@mailhost.somedomain.there. - you must escape the dot -> Ronny\.Kavli.mailhost.somedomain.there. - But, if possible, you should create a mailalias instead. That way, related mail can go to more than one person. - Kavli

We now have an address to map ecel.uwa.edu.au to. The address is 130.95.4.2 which happens to be decel, our main machine. If you try to find an IP number for the domain ecel.uwa.edu.au it will get you the machine decel.ecel.uwa.edu.au's IP number. This is a nicety which means that people who have non-MX record mailers can still mail fred@ecel.uwa.edu.au and don't have to find the name of a machine name under the domain to mail.

Now we have a couple of MX records for the domain itself. The MX records specify where to send mail destined for the machine/domain that the MX record is for. In this case we would prefer if all mail for fred@ecel.uwa.edu.au is sent to decel.ecel.uwa.edu.au. If that does not work, we would like it to go to uniwa.uwa.edu.au because there are a number of machines that might have no idea how to get to us, but may be able to get to uniwa. And failing that, try the site relay1.uu.net. A small number indicates that this site should be tried first. The larger the number the further down the list of sites to try the site is. NOTE: Not all machines have mailers that pay attention to MX records. Some only pay attention to IP numbers, which is really stupid. All machines are required to have MX-capable Mail Transfer Agents (MTA) as there are many addresses that can only be reached via this means.

Do not point an MX record to a CNAME record. A lot of mailers don't handle this. Add another A-record to it instead, but let the reverse table point to the real name. In other words: Don't add a PTR record to it. - Kavli

There is an entry for localhost now. Note that this is somewhat of a kludge and should probably be handled far more elegantly. By placing localhost here, a machine comes into existance called localhost.ecel.uwa.edu.au. If you finger it, or telnet to it, you get your own machine, because the name lookup returns 127.0.0.1 which is the special case for your own machine. I have used a couple of different DNS packages. The old BSD one let you put things into the cache which would always work, but would not be exported to other nameservers. In the newer Sun one, they are left in the cache and are mostly ignored once named is up and running. This isn't a bad solution, its just not a good one.

Decel is the main machine in our domain. It has the IP number 130.95.4.2 and that is what this next line shows. It also has a HINFO entry. HINFO is Host Info which is meant to be some sort of an indication of what the machine is and what it runs. The values are two white space seperated values. First being the hardware and second being the software. HINFO is not compulsory, its just nice to have sometimes. We also have some MX records so that mail destined for decel has some other avenues before it bounces back to the sender if undeliverable.

It is a good idea to give all machines capable of handling mail an MX record because this can be cached on remote machines and will help to reduce the load on the network.

gopher.ecel.uwa.edu.au is the gopher server in our division. Now because we are cheapskates and don't want to go and splurge on a seperate machine just for handling gopher requests we have made it a CNAME to our main machine. While it may seem pointless it does have one main advantage. When we discover that our placing terrabytes of popular quicktime movies on our gopher server (no we haven't and we don't intend to) causes an unbearable load on our main machine, we can quickly move the CNAME to point at a new machine by changing the name mentioned in the CNAME. Then the slime of the world can continue to get their essential movies with a minimal interuption to the network. Other good CNAMEs to maintain are things like ftp, mailhost, netfind, archie, whois, and even dns (though the most obvious use for this fails). It also makes it easier for people to find these services in your domain.

Regarding CNAME from dns: NS records must point to A records. Same for MX records. - Kavli

We should probably start using WKS records for things like gopher and whois rather than making DNS names for them. The tools are not in wide circulation for this to work though. (Plus all those comments in many DNS implementation of "Not implemented" next to the WKS record)

WKS == Well Known Services. - The different services a host is providing
- Kavli

Finally we have a macintosh which belongs to my boss. All it needs is an IP number, and we have included the HINFO so that you can see that it is in fact a macII running a Mac System. To get the list of preferred values, you should get a copy of RFC 1340. It lists lots of useful information such as /etc/services values, ethernet manufacturer hardware addresses, HINFO defualts and many others. I will include the list as it stands at the moment, but if any RFC superceeds 1340, then it will have a more complete list. See Appendix B for that list.

NOTE: If Chris had a very high profile and wanted his mac to appear like a fully connected unix machine as far as internet services were concerned, he could simply place an MX record such as

IN MX 100 decel

after his machine and any mail sent to chris@chris-mac.ecel.uwa.edu.au would be automatically rerouted to decel.

2.4 The Reverse Mapping File

The reverse name lookup is handled in a most bizarre fashion. Well it all makes sense, but it is not immediately obvious.

All of the reverse name lookups are done by finding the PTR record associated with the name w.x.y.z.in-addr.arpa. So to find the name associated with the IP number 1.2.3.4, we look for information stored in the DNS under the name 4.3.2.1.in-addr.arpa. They are organised this way so that when you are allocated a B class subnet for example, you get all of the IP numbers in the domain 130.95. Now to turn that into a reverse name lookup domain, you have to invert the numbers or your registered domains will be spread all over the place. It is a mess and you need not understand the finer points of it all. All you need to know is that you put the reverse name lookup files back to front.

Here is the sample reverse name lookup files to go with our example.

0.0.127.in-addr.arpa
--
; Reverse mapping of domain names 0.0.127.in-addr.arpa
; Nobody pays attention to this, it is only so 127.0.0.1 -> localhost.
@ IN SOA decel.ecel.uwa.edu.au. postmaster.ecel.uwa.edu.au. (
91061801 ; Serial (yymmddxx)
10800 ; Refresh 3 hours
3600 ; Retry 1 hour
3600000 ; Expire 1000 hours
86400 ) ; Minimum 24 hours
;
1 IN PTR localhost.ecel.uwa.edu.au.
--

4.95.130.in-addr.arpa
--
; reverse mapping of domain names 4.95.130.in-addr.arpa
;
@ IN SOA decel.ecel.uwa.edu.au. postmaster.ecel.uwa.edu.au. (
92050300 ; Serial (yymmddxx format)
10800 ; Refresh 3hHours
3600 ; Retry 1 hour
3600000 ; Expire 1000 hours
86400 ) ; Minimum 24 hours
2 IN PTR decel.ecel.uwa.edu.au.
3 IN PTR accfin.ecel.uwa.edu.au.
5 IN PTR chris-mac.ecel.uwa.edu.au.
--

It is important to remember that you must have a second start of authority record for the reverse name lookups. Each reverse name lookup file must have its own SOA record. The reverse name lookup on the 127 domain is debatable seeing as there is likely to be only one number in the file and it is blatantly obvious what it is going to map to.

In general: Each primary file pointed to in named.boot should have one - and only one - SOA record.
- Kavli

The SOA details are the same as in the forward mapping.

Each of the numbers listed down the left hand side indicates that the line contains information for that number of the subnet. Each of the subnets must be the more significant digits. eg the 130.95.4 of an IP number 130.95.4.2 is implicit for all numbers mentioned in the file.

The PTR must point to a machine that can be found in the DNS. If the name is not in the DNS, some versions of named just bomb out at this point.

Reverse name lookups are not compulsory, but nice to have. It means that when people log into machines, they get names indicating where they are logged in from. It makes it easier for you to spot things that are wrong and it is far less cryptic than having lots of numbers everywhere. Also if you do not have a name for your machine, some brain dead protocols such as talk will not allow you to connect.

Since I had this I had one suggestion of an alternative way to do the localhost entry. I think it is a matter of personal opinion so I'll include it here in case anyone things that this is a more appropriate method.

The following is courtesy of jep@convex.nl (JEP de Bie)

The way I did it was:

1) add in /etc/named.boot:

primary . localhost primary 127.in-addr.ARPA. IP127

(Craig: It has been suggested by Mark Andrews that this is a bad practice particularly if you have upgraded to Bind 4.9. You also run the risk of polluting the root name servers. This comes down to a battle of idealogy and practicality. Think twice before declaring yourself authorative for the root domain.)

So I not only declare myself (falsely? - probably, but nobody is going to listen anyway most likely [CPR]:-) athorative in the 127.in-addr.ARPA domain but also in the . (root) domain.

2) the file localhost has:

$ORIGIN .
localhost IN A 127.0.0.1

3) and the file IP127:

$ORIGIN 127.in-addr.ARPA.
1.0.0 IN PTR localhost.

4) and I have in my own domain file (convex.nl) the line:

$ORIGIN convex.nl.
localhost IN CNAME localhost.

The advantage (elegancy?) is that a query (A) of localhost. gives the reverse of the query of 1.0.0.127.in-addr.ARPA. And it also shows that localhost.convex.nl is only a nickname to something more absolute. (While the notion of localhost is of course relative :-)).

And I also think there is a subtle difference between the lines

primary 127.in-addr.ARPA. IP127
and
primary 0.0.127.in-addr.ARPA. 4.95.130.domain
=============
JEP de Bie
jep@convex.nl
=============


3 Delegating authority for domains within your domain

When you start having a very big domain that can be broken into logical and seperate entities that can look after their own DNS information, you will probably want to do this. Maintain a central area for the things that everyone needs to see and delegate the authority for the other parts of the organisation so that they can manage themselves.

Another essential piece of information is that every domain that exists must have its NS records associated with it. These NS records denote the name servers that are queried for information about that zone. For your zone to be recognised by the outside world, the server responsible for the zone above you must have created a NS record for your machine in your domain. For example, putting the computer club onto the network and giving them control over their own part of the domain space we have the following:

The machine authorative for gu.uwa.edu.au is mackerel and the machine authorative for ucc.gu.uwa.edu.au is marlin.

in mackerel's data for gu.uwa.edu.au we have the following

@ IN SOA ...
IN A 130.95.100.3
IN MX mackerel.gu.uwa.edu.au.
IN MX uniwa.uwa.edu.au.

marlin IN A 130.95.100.4

ucc IN NS marlin.gu.uwa.edu.au.
IN NS mackerel.gu.uwa.edu.au.

Marlin is also given an IP in our domain as a convenience. If they blow up their name serving there is less that can go wrong because people can still see that machine which is a start. You could place "marlin.ucc" in the first column and leave the machine totally inside the ucc domain as well.

The second NS line is because mackerel will be acting as secondary name server for the ucc.gu domain. Do not include this line if you are not authorative for the information included in the sub-domain.

4 Troubleshooting your named:

4.1 Named doesn't work! What is wrong?

Step 1: Run nslookup and see what nameserver it tries to connect you to. If nslookup connects you to the wrong nameserver, create a /etc/resolv.conf file that points your machine at the correct nameserver. If there is no resolv.conf file, the the resolver uses the nameserver on the local machine.

Step 2: Make sure that named is actually running.

Step 3: Restart named and see if you get any error messages on the console and in also check /usr/adm/messages.

Step 4: If named is running, nslookup connects to the appropriate nameserver and nslookup can answer simple questions, but other programs such as 'ping' do not work with names, then you need to install resolv+ most likely.

4.2 Local has noticed change, but nobody else has new info

I changed my named database and my local machine has noticed, but nobody else has the new information?

Change the serial number in the SOA for any domains that you modified and restart named. Wait an hour and check again. The information propogates out. It won't change immediately.

4.3 I can see their info, but they can't see mine

My local machine knows about all the name server information, but no other sites know about me?

Find an upstream nameserver (one that has an SOA for something in your domain) and ask them to be a secondary name server for you. eg if you are ecel.uwa.edu.au, ask someone who has an SOA for the domain uwa.edu.au. Get NS records (and glue) added to your parent zone for your zone. This is called delegating. It should be done formally like this or you will get inconsistant answers out of the DNS. ALL NAMSERVERS FOR YOUR ZONE SHOULD BE LISTED IN THIS MANNER.

4.4 Forward domain works, but not backwards

My forward domain names work, but the backward names do not?

Make sure the numbers are back to front and have the in-addr.arpa on the end.

Make sure your reverse zone is registered. For Class C nets this can be done by mailing to hostmaster@internic.net. For class A & B nets make sure that you are registeres with the primary for your net and that the net itself is registered with hostmaster@internic.net.

5 How to get useful information from nslookup:

Nslookup is a very useful program but I'm sure there are less than 20 people worldwide who know how to use it to its full usefulness. I'm most certainly not one of them. If you don't like using nslookup, there is at least one other program called dig, that has most/all(?) of the functionality of nslookup and is a hell of a lot easier to use.

I won't go into dig much here except to say that it is a lot easier to get this information out of. I won't bother because nslookup ships with almost all machines that come with network software.

To run nslookup, you usually just type nslookup. It will tell you the server it connects to. You can specify a different server if you want. This is useful when you want to tell if your named information is consistent with other servers.

5.1 Getting name to number mappings

Type the name of the machine. Typing 'decel' is enough if the machine is local.

(Once you have run nslookup successfully)

> decel
Server: ecel.uwa.edu.au
Address: 130.95.4.2

Name: decel.ecel.uwa.edu.au
Address: 130.95.4.2

>

One curious quirk of some name resolvers is that if you type a machine name, they will try a number of permutations. For example if my machine is in the domain ecel.uwa.edu.au and I try to find a machine called fred, the resolver will try the following.

fred.ecel.uwa.edu.au.
fred.uwa.edu.au.
fred.edu.au.
fred.au.
fred.

This can be useful, but more often than not, you would simply prefer a good way to make aliases for machines that are commonly referenced. If you are running resolv+, you should just be able to put common machines into the host file.

DIG: dig <machine name>

5.2 Getting number to name mappings

Nslookup defaults to finding you the Address of the name specified. For reverse lookups you already have the address and you want to find the name that goes with it. If you read and understood the bit above where it describes how to create the number to name mapping file, you would guess that you need to find the PTR record instead of the A record. So you do the following.

> set type=ptr
> 2.4.95.130.in-addr.arpa
Server: decel.ecel.uwa.edu.au
Address: 130.95.4.2

2.4.95.130.in-addr.arpa host name = decel.ecel.uwa.edu.au
>

nslookup tells you that the ptr for the machine name 2.4.95.130.in-addr.arpa points to the host decel.ecel.uwa.edu.au.

DIG: dig -x <machine number>

5.3 Finding where mail goes when a machine has no IP number

When a machine is not IP connected, it needs to specify to the world, where to send the mail so that it can dial up and collect it every now and then. This is accomplished by setting up an MX record for the site and not giving it an IP number. To get the information out of nslookup as to where the mail goes, do the following.

> set type=mx
> dialix.oz.au
Server: decel.ecel.uwa.oz.au
Address: 130.95.4.2

Non-authoritative answer:
dialix.oz.au preference = 100, mail exchanger = uniwa.uwa.OZ.AU
dialix.oz.au preference = 200, mail exchanger = munnari.OZ.AU
Authoritative answers can be found from:
uniwa.uwa.OZ.AU inet address = 130.95.128.1
munnari.OZ.AU inet address = 128.250.1.21
munnari.OZ.AU inet address = 192.43.207.1
mulga.cs.mu.OZ.AU inet address = 128.250.35.21
mulga.cs.mu.OZ.AU inet address = 192.43.207.2
dmssyd.syd.dms.CSIRO.AU inet address = 130.155.16.1
ns.UU.NET inet address = 137.39.1.3

You tell nslookup that you want to search for mx records and then you give it the name of the machine. It tells you the preference for the mail (small means more preferable), and who the mail should be sent to. It also includes sites that are authorative (have this name in their named database files) for this MX record. There are multiple sites as a backup. As can be seen, our local public internet access company dialix would like all of their mail to be sent to uniwa, where they collect it from. If uniwa is not up, send it to munnari and munnari will get it to uniwa eventually.

NOTE: For historical reasons Australia used to be .oz which was changed to .oz.au to move to the ISO standard extensions upon the advent of IP. We are now moving to a more normal heirarchy which is where the .edu.au comes from. Pity, I liked having oz.

DIG: dig <zone> mx

5.4 Getting a list of machines in a domain from nslookup

Find a server that is authorative for the domain or just generally all knowing. To find a good server, find all the SOA records for a given domain. To do this, you set type=soa and enter the domain just like in the two previous examples.

Once you have a server type

> ls gu.uwa.edu.au.
[uniwa.uwa.edu.au]
Host or domain name Internet address
gu server = mackerel.gu.uwa.edu.au
gu server = uniwa.uwa.edu.au
gu 130.95.100.3
snuffle-upagus 130.95.100.131
mullet 130.95.100.2
mackerel 130.95.100.3
marlin 130.95.100.4
gugate 130.95.100.1
gugate 130.95.100.129
helpdesk 130.95.100.180
lan 130.95.100.0
big-bird 130.95.100.130

To get a list of all the machines in the domain.

If you wanted to find a list of all of the MX records for the domain, you can put a -m flag in the ls command.

> ls -m gu.uwa.edu.au.
[uniwa.uwa.edu.au]
Host or domain name Metric Host
gu 100 mackerel.gu.uwa.edu.au
gu 200 uniwa.uwa.edu.au

This only works for a limited selection of the different types.

DIG: dig axfr <zone> @<server>

6 Appendicies

6.2 Appendix B

An Excerpt from
RFC 1340 Assigned Numbers July 1992


MACHINE NAMES

These are the Official Machine Names as they appear in the Domain Name
System HINFO records and the NIC Host Table. Their use is described in
RFC-952 [53].

A machine name or CPU type may be up to 40 characters taken from the
set of uppercase letters, digits, and the two punctuation characters
hyphen and slash. It must start with a letter, and end with a letter
or digit.

ALTO DEC-1080
ALTOS-6800 DEC-1090
AMDAHL-V7 DEC-1090B
APOLLO DEC-1090T
ATARI-104ST DEC-2020T
ATT-3B1 DEC-2040
ATT-3B2 DEC-2040T
ATT-3B20 DEC-2050T
ATT-7300 DEC-2060
BBN-C/60 DEC-2060T
BURROUGHS-B/29 DEC-2065
BURROUGHS-B/4800 DEC-FALCON
BUTTERFLY DEC-KS10
C/30 DEC-VAX-11730
C/70 DORADO
CADLINC DPS8/70M
CADR ELXSI-6400
CDC-170 EVEREX-386
CDC-170/750 FOONLY-F2
CDC-173 FOONLY-F3
CELERITY-1200 FOONLY-F4
CLUB-386 GOULD
COMPAQ-386/20 GOULD-6050
COMTEN-3690 GOULD-6080
CP8040 GOULD-9050
CRAY-1 GOULD-9080
CRAY-X/MP H-316
CRAY-2 H-60/68
CTIWS-117 H-68
DANDELION H-68/80
DEC-10 H-89
DEC-1050 HONEYWELL-DPS-6
DEC-1077 HONEYWELL-DPS-8/70
HP3000 ONYX-Z8000
HP3000/64 PDP-11
IBM-158 PDP-11/3
IBM-360/67 PDP-11/23
IBM-370/3033 PDP-11/24
IBM-3081 PDP-11/34
IBM-3084QX PDP-11/40
IBM-3101 PDP-11/44
IBM-4331 PDP-11/45
IBM-4341 PDP-11/50
IBM-4361 PDP-11/70
IBM-4381 PDP-11/73
IBM-4956 PE-7/32
IBM-6152 PE-3205
IBM-PC PERQ
IBM-PC/AT PLEXUS-P/60
IBM-PC/RT PLI
IBM-PC/XT PLURIBUS
IBM-SERIES/1 PRIME-2350
IMAGEN PRIME-2450
IMAGEN-8/300 PRIME-2755
IMSAI PRIME-9655
INTEGRATED-SOLUTIONS PRIME-9755
INTEGRATED-SOLUTIONS-68K PRIME-9955II
INTEGRATED-SOLUTIONS-CREATOR PRIME-2250
INTEGRATED-SOLUTIONS-CREATOR-8 PRIME-2655
INTEL-386 PRIME-9955
INTEL-IPSC PRIME-9950
IS-1 PRIME-9650
IS-68010 PRIME-9750
LMI PRIME-2250
LSI-11 PRIME-750
LSI-11/2 PRIME-850
LSI-11/23 PRIME-550II
LSI-11/73 PYRAMID-90
M68000 PYRAMID-90MX
MAC-II PYRAMID-90X
MASSCOMP RIDGE
MC500 RIDGE-32
MC68000 RIDGE-32C
MICROPORT ROLM-1666
MICROVAX S1-MKIIA
MICROVAX-I SMI
MV/8000 SEQUENT-BALANCE-8000
NAS3-5 SIEMENS
NCR-COMTEN-3690 SILICON-GRAPHICS
NEXT/N1000-316 SILICON-GRAPHICS-IRIS
NOW SGI-IRIS-2400
SGI-IRIS-2500 SUN-3/50
SGI-IRIS-3010 SUN-3/60
SGI-IRIS-3020 SUN-3/75
SGI-IRIS-3030 SUN-3/80
SGI-IRIS-3110 SUN-3/110
SGI-IRIS-3115 SUN-3/140
SGI-IRIS-3120 SUN-3/150
SGI-IRIS-3130 SUN-3/160
SGI-IRIS-4D/20 SUN-3/180
SGI-IRIS-4D/20G SUN-3/200
SGI-IRIS-4D/25 SUN-3/260
SGI-IRIS-4D/25G SUN-3/280
SGI-IRIS-4D/25S SUN-3/470
SGI-IRIS-4D/50 SUN-3/480
SGI-IRIS-4D/50G SUN-4/60
SGI-IRIS-4D/50GT SUN-4/110
SGI-IRIS-4D/60 SUN-4/150
SGI-IRIS-4D/60G SUN-4/200
SGI-IRIS-4D/60T SUN-4/260
SGI-IRIS-4D/60GT SUN-4/280
SGI-IRIS-4D/70 SUN-4/330
SGI-IRIS-4D/70G SUN-4/370
SGI-IRIS-4D/70GT SUN-4/390
SGI-IRIS-4D/80GT SUN-50
SGI-IRIS-4D/80S SUN-100
SGI-IRIS-4D/120GTX SUN-120
SGI-IRIS-4D/120S SUN-130
SGI-IRIS-4D/210GTX SUN-150
SGI-IRIS-4D/210S SUN-170
SGI-IRIS-4D/220GTX SUN-386i/250
SGI-IRIS-4D/220S SUN-68000
SGI-IRIS-4D/240GTX SYMBOLICS-3600
SGI-IRIS-4D/240S SYMBOLICS-3670
SGI-IRIS-4D/280GTX SYMMETRIC-375
SGI-IRIS-4D/280S SYMULT
SGI-IRIS-CS/12 TANDEM-TXP
SGI-IRIS-4SERVER-8 TANDY-6000
SPERRY-DCP/10 TEK-6130
SUN TI-EXPLORER
SUN-2 TP-4000
SUN-2/50 TRS-80
SUN-2/100 UNIVAC-1100
SUN-2/120 UNIVAC-1100/60
SUN-2/130 UNIVAC-1100/62
SUN-2/140 UNIVAC-1100/63
SUN-2/150 UNIVAC-1100/64
SUN-2/160 UNIVAC-1100/70
SUN-2/170 UNIVAC-1160
UNKNOWN
VAX-11/725
VAX-11/730
VAX-11/750
VAX-11/780
VAX-11/785
VAX-11/790
VAX-11/8600
VAX-8600
WANG-PC002
WANG-VS100
WANG-VS400
WYSE-386
XEROX-1108
XEROX-8010
ZENITH-148

SYSTEM NAMES

These are the Official System Names as they appear in the Domain Name
System HINFO records and the NIC Host Table. Their use is described
in RFC-952 [53].

A system name may be up to 40 characters taken from the set of upper-
case letters, digits, and the three punctuation characters hyphen,
period, and slash. It must start with a letter, and end with a
letter or digit.

AEGIS LISP SUN OS 3.5
APOLLO LISPM SUN OS 4.0
AIX/370 LOCUS SWIFT
AIX-PS/2 MACOS TAC
BS-2000 MINOS TANDEM
CEDAR MOS TENEX
CGW MPE5 TOPS10
CHORUS MSDOS TOPS20
CHRYSALIS MULTICS TOS
CMOS MUSIC TP3010
CMS MUSIC/SP TRSDOS
COS MVS ULTRIX
CPIX MVS/SP UNIX
CTOS NEXUS UNIX-BSD
CTSS NMS UNIX-V1AT
DCN NONSTOP UNIX-V
DDNOS NOS-2 UNIX-V.1
DOMAIN NTOS UNIX-V.2
DOS OS/DDP UNIX-V.3
EDX OS/2 UNIX-PC
ELF OS4 UNKNOWN
EMBOS OS86 UT2D
EMMOS OSX V
EPOS PCDOS VM
FOONEX PERQ/OS VM/370
FUZZ PLI VM/CMS
GCOS PSDOS/MIT VM/SP
GPOS PRIMOS VMS
HDOS RMX/RDOS VMS/EUNICE
IMAGEN ROS VRTX
INTERCOM RSX11M WAITS
IMPRESS RTE-A WANG
INTERLISP SATOPS WIN32
IOS SCO-XENIX/386 X11R3
IRIX SCS XDE
ISI-68020 SIMP XENIX
ITS SUN


6.3 Appendix C

Appendix C Installing DNS on a Sun when running NIS

====================
2) How to get DNS to be used when running NIS ?

First setup the appropriate /etc/resolv.conf file.
Something like this should do the "trick".

;
; Data file for a client.
;
domain local domain
nameserver address of primary domain nameserver
nameserver address of secondary domain nameserver

where: "local domain" is the domain part of the hostnames.
For example, if your hostname is "thor.ece.uc.edu"
your "local domain" is "ece.uc.edu".

You will need to put a copy of this resolv.conf on
all NIS(YP) servers including slaves.

Under SunOS 4.1 and greater, change the "B=" at the top
of the /var/yp/Makefile to "B=-b" and setup NIS in the
usual fashion.

You will need reboot or restart ypserv for these changes
to take affect.

Under 4.0.x, edit the Makefile or apply the following "diff":

*** Makefile.orig Wed Jan 10 13:22:11 1990
--- Makefile Wed Jan 10 13:22:01 1990
***************
*** 63 ****
! | $(MAKEDBM) - $(YPDBDIR)/$(DOM)/hosts.byname; \
--- 63 ----
! | $(MAKEDBM) -b - $(YPDBDIR)/$(DOM)/hosts.byname; \
***************
*** 66 ****
! | $(MAKEDBM) - $(YPDBDIR)/$(DOM)/hosts.byaddr; \
--- 66 ----
! | $(MAKEDBM) -b - $(YPDBDIR)/$(DOM)/hosts.byaddr; \
====================

--
Craig Richmond. Computer Officer - Dept of Economics (morning) 380 3860
University of Western Australia Dept of Education (afternoon) 2368
craig@ecel.uwa.edu.au Dvorak Keyboards RULE! "Messes are only acceptable
if users make them. Applications aren't allowed this freedom" I.M.VI 2-4

Creating a Skin for Firefox, there are three things you need to know: how to edit images, how to extract zip files, and how to modify CSS. Firefox uses standard GIF, PNG, and JPEG images for the buttons and CSS to style everything else in the interface.

A skin does not totally change the interface; instead, it just defines how the interface looks. You can't change what happens when the user right clicks on an image, but you can change the look of the right click menu (Make it blue with pink polka dots, for example). If you want to change the functionality of Firefox, you'll have to look into modifying the chrome, which is beyond the scope of this document.

Download the latest version of Firefox and install it. Be sure to install the DOM Inspector extension as well.

Extract Theme

While you can hypothetically begin with any theme already designed for Firefox, for the sake of consistency we'll speak as though everyone is editing the default Firefox theme. This is located in the file classic.jar found in the Firefox installation directory. A .jar file is in reality a renamed zip archive. Opening the .jar files in your archive manager of choice should result in the file being automatically detected as being a zip archive. However, if your application doesn't detect classic.jar as a standard zip archive, rename the file classic.zip and continue extraction.
Classic.jar locations

Linux: /usr/lib/MozillaFirefox/chrome/classic.jar or /usr/lib/firefox-*.*.*/chrome/classic.jar

Windows: \Program Files\Mozilla Firefox\chrome\classic.jar

For Mac OS X:

* Go to your applications folder
* Control click application icon(Firefox icon), choose Show Package Contents.
* Go to contents/MacOS/Chrome/classic.jar

Copy classic.jar to another easily accessible folder -- Classic is recommended -- extract the contents of that folder, being sure to maintain the directory structure.
Directories

Inside classic.jar is one directory, skin, as well as two files, preview.png and icon.png.

skin
skin simply contains another directory, classic which holds all the good stuff.
skin\classic
classic contains the following directories.
skin\classic\browser
browser contains all the toolbar icons, as well as the icons for the bookmark manager and the preferences window.
skin\classic\communicator
Doesn't do a whole lot and can typically be forgotten about promptly.
skin\classic\global
global contains almost all of the important CSS files that define the appearance of the browser. This is the most critical directory in a theme.
skin\classic\help
help contains all the files for theming the help dialog window.
skin\classic\mozapps
mozapps contains all the styles and icons for the browser peripherals, such as the extension manager or update wizard.

Install Your New Theme

Before you can see the changes you make to a Firefox theme (since live edits are restrictively difficult to set up) you must first learn how to repackage the classic theme to make it installable. For the sake of this discussion we will call your theme "My_Theme", though you can replace that with any name.
Copying The Necessary Files

The first step is to move all the files into the right directory structure. So create a new directory called My_Theme. Into this directory put the browser, global, communicator, help, and mozapps directories from above, as well as the icon.png and preview.png files. (Yes, this means that the structure of your new directory and classic.jar will be slightly different.)
Creating the Install Files
Contents.rdf

Make a copy of contents.rdf and place it in \My_Theme and open it up in your text editor. This file is a small XML Database which is used to describe the skin.

In the code search for all instances of "My_Theme" and replace them with the name of your theme.

The packages section lists which components of the browser you're modifying. If we also had skins for Chatzilla, we would need to add another line resembling the other ones and change it to point to Chatzilla. But this list includes everything that we changed, so just modify the blue text to point to match the name/version that you used in the sections before this.

Save the file and exit the text editor.
install.rdf

Make a copy of install.rdf and place it in the My_Theme directory, then open it up in your text editor. This file is a small XML database that describes the skin.


{Themes_UUID}
Themes_Version

The first section requires that you establish a UUID for your theme and that you give your theme a version number. Once you've done this, insert the information as above, and scroll down.

You will also have to update the minimum and maximum compatible versions for the target application (Firefox) in the following section:




{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
Min_FF_Version
Max_FF_Version



Establishing both minimum and maximum compatible versions lets you avoid conflicts with versions of Firefox your theme wasn't designed for -- or wasn't tested on.

See Install Manifests for the reference information about the install.rdf file.
CSS Files

The CSS files in these directories tell the browser how to display the buttons and other controls, where to put the images, what border and padding it should put around them, and so on.

As an example, let's change the standard button.

Go into the global global directory and open button.css in your favorite text editor. Scroll down to button {. This section defines the normal button in its basic state (There is no mouse over it, it's not disabled, and it's not selected).

Change the background-color: to DarkBlue and the color: to White, and save the file.

more after I get done with some tests
Repackaging JAR

Now all you need to do is repackage a JAR file with the following directory structure, using your favorite archive manager to create a zip archive:

/browser/*
/communicator/*
/global/*
/help/*
/mozapps/*
/contents.rdf
/install.rdf
/icon.png
/preview.png


Make sure not to just zip up the My_Theme parent directory since that will cause the drag and drop install in the next section to fail without error messages. Once you have put the files in the zip folder, rename it to My_Theme.jar
Triggering the install from the web

To install the theme's JAR file directly from the web, you need to run some JavaScript.

Download torrent merupakan salah satu alternatif download yang banyak digunakan oleh para netter, terutama yang doyan sekali download file berukuran besar. Apa itu torrent? torrent merupakan metafile kecil yang berisi informasi tentang file yang ingin anda download. Biasanya kita harus menggunakan software atau torrent client untuk dapat mengunduh file yang asli. Tanpa software torrent mana mungkin kita bisa mendownloadnya. Software Client Torrent (bittorrent, utorrent, dsb) akan menghubungkan kita dengan banyak pc yang sedang online (seeder) yang menyediakan file yang ingin kita download sehingga proses download menjadi lebih cepat.

Namun, tidak semuanya berjalan lancar. Entah kenapa saya sendiri hampir selalu gagal mendownload file torrent via Software client torrent seperti bittorrent, utorrent, dsb. Hampir semua software client torrent populer sudah pernah saya coba tapi masih saja gagal untuk mendownload file. Apakah ada solusi untuk download torrent tanpa client software? Mungkin kita berpikir tidak ada. Tapi untungnya ada torrent2exe.com yang menjadikan proses download file torrent menjadi lebih mudah. Dengan torrent2exe.com kita tidak perlu menginstall software client torrent untuk mendownload file torrent karena proses download bisa dilakukan via web torrent2exe.com.

Caranya sangat mudah:

1. Copy Paste link file torrent pada web torrent2exe.com dan klik tombol “Start Download”

2. Anda akan menerima file dengan extensi .exe, misal 123456.exe yang berukuran kecil

3. Double klik file tersebut yang akan menampilkan windows proses download file yang Anda inginkan, tunggu hingga proses download selesai

4. Setelah download selesai maka akan muncul window ke 2 yang akan memberitahu supaya jangan menutup koneksi torrent yang sedang berlangsung. Hal ini berguna agar Anda tidak dianggap sebagai leecher sehingga menjadikan Anda diblack list dan Anda tidak bisa mendownload torrent lagi.

Perlu diingat bahwa cara kerja torrent adalah berbagi. Jadi kita perlu tetap membuka koneksi agar orang lain juga dapat mendownload file yang baru saja kita download melalui komputer kita. Lama koneksi ini bisa kita set, misalnya 1 jam setelah itu koneksi akan terputus secara otomatis. Namun apa salahnya kita mencoba trik download torrent tanpa client software tersebut.

Anda mungkin sudah tahu apa itu keylogger. Keylogger memang sebuah tool yang sangat berbahaya, terutama jika sudah menginfeksi komputer yang terkoneksi ke internet dan anda tidak menyadarinya. Dampak terburuknya yaitu semua password penting anda seperti password paypal, libertyreserve, klikbca, Facebook dapat dicuri oleh orang lain. Apakah itu artinya tidak ada langkah antisipasi untuk hal tersebut? Tentu saja tidak, ada sebuah trik untuk mengetahui serangan keylogger pada komputer anda. Semuanya akan saya jabarkan disini.

Cara mengetahui serangan keylogger ini berbeda dengan cara mengatasinya, karena trik ini hanya untuk melihat apakah komputer kita terkena serangan keylogger atau tidak. Untuk cara mengatasi keylogger, akan saya berikan pada postingan yang lain.

Cara mudah mengetahui serangan keylogger adalah sebagai berikut :

1. Buka command prompt. Masuk ke accessories >> command prompt

2. Ketikkan dir kemudian tekan enter

3. Jika sudah sekarang brur ingat angka yang muncul di command prompt (Silahkan catat nomornya di kertas atau di notepad agar anda tidak lupa).

4. Kemudian sekarang buka program notepad ketik sembarangan dan usahakan agak banyak, tetapi jangan disave

5. Ulangi langkah 1 s/d 3, setelah itu lihat angka yang muncul. Apakah angkanya berubah atau enggak? Bilamana angkanya berubah berarti komputer atau PC brur terkena serangan keylogger.

Sekian. Sekarang seharusnya anda sudah tahu apakah komputer anda terkena infeksi keylogger atau tidak. Sebenarnya ini adalah cara paling mudah untuk mengetahui serangan keylogger di PC atau komputer. Keylogger yang aktif akan memakan memori komputer saat saat kita beraktivitas seperti mengetik password dll, walaupun hasil ketikan itu tidak kita save, karena programnya tersembunyi dan langsung otomatis eksekusi begitu komputer dinyalakan. Selamat mencoba dan semoga bermanfaat!

Kecepatan download adalah hal mutlak yang wajib dibutuhkan oleh anda para downloaders. Sekarang ini telah banyak dibuat software downloaders yang diklaim dapat meningkatkan kecepatan download, namun dalam tanda kutip "direct download". Software downloaders kebanyakan hanya dapat digunakan saat kita mendapatkan direct link nya, sedangkan sekarang ini kebanyakan link direct download sudah jarang, kebanyakan orang meng-upload file mereka pada file hosting seperti rapidshare, megaupload, 4shared dan yang lokal adalah indowebster. Nah, sekarang yang saya bicarakan adalah bagaimana kita bisa mendapatkan premium download 4shared. Karena 4shared merupakan file hosting termudah dan paling diminati di dunia. Hampir semua yang kita inginkan ada di dalamnya. Alangkah senangnya jika kita dapat mendapatkan premium download 4shared tersebut.


Premium download 4shared yang saya maksud adalah bagaimana kita dapat menggunakan fasilitas download 4shared tanpa harus menunggu timer dan tentunya meningkatkan speed download 4shared anda. Bagaimana caranya? apakah sangat rumit mengingat 4shared adalah file hosting kelas atas? Jawabannya adalah tidak. Kita akan menggunakan 4shared premium download generator, yaitu dengan men-generate link download yang kita inginkan menjadi sebuah premium link download. Hasilnya, speed download 4shared kita meningkat dibandingkan kita mendownload biasa. Ini sudah dibuktikan banyak rekan2 di-forum2 diskusi, cara ini benar2 bisa meningkatkan speed download 4shared anda.

Oke, langsung saja begini caranya:

1. Buka link disini
2. Silahkan anda buka file yang anda inginkan pada 4shared, dan copy-kan link download yang ada pada address bar browser anda.
3. Paste link tersebut pada kolom link generator tadi, lihat gambar dibawah ini:

4. Setelah itu klik generate, maka akan muncul link yang baru dan tombol download, klik tombol tersebut.
5. Selesai. Kini saya jamin speed download 4shared anda akan bertambah dibandingkan sebelumnya. Link yang baru tadi juga dapat anda copy ke idm atau fdm anda. Dengan begitu, kita dapat menggunakan 4shared premium download secara cuma-cuma. :D

Demikian trik ini saya tulis, semoga harapan anda untuk mendapatkan download speed 4shared yang tinggi dapat terwujud :o.

Semoga bermanfaat,