Onnowpurbo at 10:20, 23 August 2017

2017-08-23T10:20:08Z

← Older revision		Revision as of 10:20, 23 August 2017
Line 136:		Line 136:

	sudo rndc reload srpz.zone		sudo rndc reload srpz.zone



			==make-shalla-rpz.pl==


			#!/usr/bin/perl -w
			#
			# Shallalist to DNS RPZ
			# Author: Mark Page [m.e.page_at_gmail.com]
			# Modified: Sun May 11 06:19:05 CDT 2014
			#
			# Examples:
			# perl make-shalla-rpz.pl (no arg, creates NXDOMAIN CNAME ".")
			# perl make-shalla-rpz.pl A 192.168.2.1 (creates "A" redirect)
			# perl make-shalla-rpz.pl CNAME nowhere.local (creates "CNAME" redirect)
			# perl make-shalla-rpz.pl CNAME CATEGORY.local (creates category "CNAME" redirect)
			#
			use strict;
			use warnings;

			my ($urls);
			my @categories = ('porn','warez','anonvpn','spyware','redirector',);

			for my $c (0 .. (scalar(@categories) - 1)) {
			open (my $list,'<',"/tmp/BL/$categories[$c]/domains");
			chomp(my @domains = <$list>);
			close($list);

			for my $d (0 .. (scalar(@domains) - 1)) {
			$urls->{lc($domains[$d])} = $categories[$c];
			}
			}

			open (my $db,'>',"./db.srpz.local");
			print $db '$TTL 604800
			@ IN SOA localhost.local. hostmaster.local. (
			2 ; Serial
			604800 ; Refresh
			86400 ; Retry
			2419200 ; Expire
			604800 ) ; Negative Cache TTL
			;
			@ IN NS localhost.local.
			@ IN A 127.0.0.1
			@ IN AAAA ::1
			;
			';

			while (my ($key, $value) = each(%$urls) ) {
			my $redirect = 'CNAME .';

			if (defined($ARGV[0]) and defined($ARGV[1])) {
			$redirect = uc($ARGV[0]) . ' ' . $ARGV[1];
			if ($ARGV[1] =~ m/CATEGORY/) {
			$redirect =~ s/CATEGORY/$value/;
			}
			}

			if (substr($key,0,1) ne '.') {
			print $db $key . ' IN ' . $redirect . "\n";
			print $db '*.' . $key . ' IN ' . $redirect . "\n";
			}
			}
			close($db);

			exit;

			__END__

Onnowpurbo at 09:58, 23 August 2017

2017-08-23T09:58:12Z

← Older revision		Revision as of 09:58, 23 August 2017
Line 15:		Line 15:
	This is a sample of a BIND options configuration file (/etc/bind/named.conf.options). We'll be using Google's DNS servers as our forwarders, and a zone named "srpz.zone" for our response policy. Our actual RPZ DB file will be "db.srpz.local":		This is a sample of a BIND options configuration file (/etc/bind/named.conf.options). We'll be using Google's DNS servers as our forwarders, and a zone named "srpz.zone" for our response policy. Our actual RPZ DB file will be "db.srpz.local":

	options {		options {
	directory "/var/cache/bind";		directory "/var/cache/bind";

	forwarders {		forwarders {
	8.8.8.8;		8.8.8.8;
	8.8.4.4;		8.8.4.4;
	};		};

	dnssec-validation auto;		dnssec-validation auto;
	auth-nxdomain no;		auth-nxdomain no;
	listen-on-v6 { any; };		listen-on-v6 { any; };

	check-names master ignore;		check-names master ignore;
	check-names slave ignore;		check-names slave ignore;

	response-policy { zone "srpz.zone"; };		response-policy { zone "srpz.zone"; };
	};		};

	zone "srpz.zone" {		zone "srpz.zone" {
	type master;		type master;
	file "/etc/bind/db.srpz.local";		file "/etc/bind/db.srpz.local";
	allow-query { any; };		allow-query { any; };
	allow-update { none; };		allow-update { none; };
	};		};

	Note: Setting the "check-names" options to "ignore" is not generally recommended for use on DNS servers as these are used to check compliance with the RFCs defining valid host names. We need to disable this checking to deal with inconsistencies in the blacklists we'll be converting later. For our purposes, this will not create any security issues as we're not allowing zone transfers.		Note: Setting the "check-names" options to "ignore" is not generally recommended for use on DNS servers as these are used to check compliance with the RFCs defining valid host names. We need to disable this checking to deal with inconsistencies in the blacklists we'll be converting later. For our purposes, this will not create any security issues as we're not allowing zone transfers.
Line 51:		Line 51:
	First, we'll setup the header for our zone file (/etc/bind/zone.srpz.local):		First, we'll setup the header for our zone file (/etc/bind/zone.srpz.local):

	$TTL 604800		$TTL 604800
	@ IN SOA localhost.local. hostmaster.local. (		@ IN SOA localhost.local. hostmaster.local. (
	2 ; Serial		2 ; Serial
	604800 ; Refresh		604800 ; Refresh
	86400 ; Retry		86400 ; Retry
	2419200 ; Expire		2419200 ; Expire
	604800 ) ; Negative Cache TTL		604800 ) ; Negative Cache TTL
	;		;
	@ IN NS localhost.local.		@ IN NS localhost.local.
	@ IN A 127.0.0.1		@ IN A 127.0.0.1
	@ IN AAAA ::1		@ IN AAAA ::1
	;		;

	Further entries will consist of CNAME records to redirect the requested domain, and domain wildcards. Here's an example of the two lines needed to configure the RPZ to return NXDOMAIN:		Further entries will consist of CNAME records to redirect the requested domain, and domain wildcards. Here's an example of the two lines needed to configure the RPZ to return NXDOMAIN:

	badsite.com IN CNAME .		badsite.com IN CNAME .
	*.badsite.com IN CNAME .		*.badsite.com IN CNAME .

	Should we wish to redirect the user to a block page, we would add an entry for a host known by our secondary or upstream resolver:		Should we wish to redirect the user to a block page, we would add an entry for a host known by our secondary or upstream resolver:

	badsite.com IN CNAME goodsite.com.		badsite.com IN CNAME goodsite.com.
	*.badsite.com IN CNAME goodsite.com.		*.badsite.com IN CNAME goodsite.com.

	Or use an A record pointing to an IP Address:		Or use an A record pointing to an IP Address:

	badsite.com IN A 192.168.2.1		badsite.com IN A 192.168.2.1
	*.badsite.com IN A 192.168.2.1		*.badsite.com IN A 192.168.2.1


Line 107:		Line 107:
	To use this script, download the above to your server using:		To use this script, download the above to your server using:

	wget "https://gist.githubusercontent.com/voodoojello/38e979a3b130aa9262af/raw/5cf74542dbe5b3af9d62ea07e31f724a13921bf7/make-shalla-rpz.pl"		wget "https://gist.githubusercontent.com/voodoojello/38e979a3b130aa9262af/raw/5cf74542dbe5b3af9d62ea07e31f724a13921bf7/make-shalla-rpz.pl"

	To output an NXDOMAIN return (site not found) to the client, run this script with no arguments:		To output an NXDOMAIN return (site not found) to the client, run this script with no arguments:

	perl make-shalla-rpz.pl		perl make-shalla-rpz.pl

	To output redirection to a specific CNAME destination (block page) to the client, use "CNAME" and the host name as arguments:		To output redirection to a specific CNAME destination (block page) to the client, use "CNAME" and the host name as arguments:

	perl make-shalla-rpz.pl CNAME some.redirect.host		perl make-shalla-rpz.pl CNAME some.redirect.host

	To output redirection to a specific CNAME destination based on the category in which the URL was found, use the CATEGORY macro (case sensitive):		To output redirection to a specific CNAME destination based on the category in which the URL was found, use the CATEGORY macro (case sensitive):

	perl make-shalla-rpz.pl CNAME CATEGORY.redirect.host		perl make-shalla-rpz.pl CNAME CATEGORY.redirect.host

	To output redirection to a specific IP address to the client ("A" record), use "A" and the address as the arguments:		To output redirection to a specific IP address to the client ("A" record), use "A" and the address as the arguments:

	perl make-shalla-rpz.pl A 192.168.2.1		perl make-shalla-rpz.pl A 192.168.2.1

	Install the RPZ zone file using:		Install the RPZ zone file using:

	sudo cp ./db.srpz.local /etc/bind/.		sudo cp ./db.srpz.local /etc/bind/.

	Since we may be loading BIND for the first time with our new zone changes, we'll need to restart the service:		Since we may be loading BIND for the first time with our new zone changes, we'll need to restart the service:

	sudo /etc/init.d/bind9 restart		sudo /etc/init.d/bind9 restart

	For future updates, have BIND reload the zone using rndc:		For future updates, have BIND reload the zone using rndc:

	sudo rndc reload srpz.zone		sudo rndc reload srpz.zone

Onnowpurbo at 03:30, 13 May 2015

2015-05-13T03:30:38Z

Show changes

Onnowpurbo: New page: ==Referensi== * http://www.zytrax.com/books/dns/ch7/rpz.html * http://www.zytrax.com/books/dns/ch9/rpz.html * http://jpmens.net/2011/04/26/how-to-configure-your-bind-resolvers-to-lie-us...

2015-05-13T03:29:51Z

New page: ==Referensi== * http://www.zytrax.com/books/dns/ch7/rpz.html * http://www.zytrax.com/books/dns/ch9/rpz.html * http://jpmens.net/2011/04/26/how-to-configure-your-bind-resolvers-to-lie-us...

New page

==Referensi==

* http://www.zytrax.com/books/dns/ch7/rpz.html
* http://www.zytrax.com/books/dns/ch9/rpz.html
* http://jpmens.net/2011/04/26/how-to-configure-your-bind-resolvers-to-lie-using-response-policy-zones-rpz/
* https://sites.google.com/site/thingsoflittleconsequence/home/using-domain-name-service-response-policy-zones-dns-rpz-with-shallalists

BIND: RPZ - Revision history

Onnowpurbo at 10:20, 23 August 2017

Onnowpurbo at 09:58, 23 August 2017

Onnowpurbo at 03:30, 13 May 2015

Onnowpurbo: New page: ==Referensi== * http://www.zytrax.com/books/dns/ch7/rpz.html * http://www.zytrax.com/books/dns/ch9/rpz.html * http://jpmens.net/2011/04/26/how-to-configure-your-bind-resolvers-to-lie-us...