Hi,
Here's how I've setup to have DNS updated automatically when people connect there computers in your office's network, and also to have it's own internal domain (like office.internal at the end of each connected computer, this allows you connect via VPN connections from your home).
At a glance:
- Set internal server name via OS X Lion Server "Server" app to "macserver.office.internal"
- Set the internal IP address to 192.168.64.0/24, e.g macserver.office.internal IP address: 192.168.64.100
- Set DHCP range from 192.168.64.190 to 192.168.64.250
- DHCP is turned off in "Server Admin" and we use Macports isc-dhcp implementation
- Edit DNS settings and start on by OS X Lion Server normally
Here's my quick install guide (tested on OS X Lion Server 10.7.4 and Xcode 4.3.2 with Macports 2.1.1)
1. Change your Mac OS X Lion Server hostname to "macserver.office.internal" with Server app:
Select Hardware then select "Host name": "Edit ..." > "Host name for private network"
Set it to "macserver.office.internal"
Check if everything is OK with the hostname:
2. Install Macports
Macports allows you to install command-line utilities and software via the port command (similar to apt-get on Linux). Check out it's Webpage: http://www.macports.org
After you have installed Macports 2.1.1 or later for OS X Server, open Terminal.app and:
Note that most of the files are installed in the /opt/local/ directory
3. Install isc-dhcp from Macports
First update your port database to have the latest package definitions:
#sudo port selfupdate
Now install dhcp
#sudo port install dhcp
The configuration file of dhcp is located in /opt/local/etc/dhcp/dhcpd.conf
The dhcpd binary is installed in /opt/local/bin/
4. Generate the DNS Key to allow DNS to update the connected hostnames
dnssec-keygen is a tool to create dnssec keys, much like ssh-keygen creates ssh keys. Pick a name for your key, it can be any name. I usually name it appropriately. For this example, I will call our key dhcpupdate.
#sudo dnssec-keygen -r /dev/urandom -a HMAC-MD5 -b 128 -n USER dhcp-update
The output should be written to /var/named/dhcp-update.key
Don't forget to set permissions to "read-only" for root:
#sudo chmod ugo-w /var/named/dhcp-update.key
For example my key looks like:
#sudo cat /var/named/dhcp-update.key
key DHCP-UPDATE-KEY {
algorithm hmac-md5;
secret "a9hXeJ31ALVsW/19Rx9OXQ==";
};
5. Edit /opt/local/etc/dhcp/dhcpd.conf
A good tutorial on how to setup a dhcp server with automagically updating DNS is here
http://lani78.wordpress.com/2008/08/12/dhcp-server-update-dns-records/
So my /opt/local/etc/dhcp/dhcpd.conf looks like this:
# You need the next line or you won't actually be a DHCP server!
authoritative;
# DDNS stuff - these are the bits that get your DHCP server talking with your DNS server
ddns-update-style interim;
ddns-updates on;
ddns-ttl 600;
server-identifier macserver.local;
ddns-domainname "office.internal.";
ddns-rev-domainname "64.168.192.in-addr.arpa.";
# this is the file with your shared key in it
#include "/var/named/dhcp-update.key";
key DHCP-UPDATE-KEY {
algorithm hmac-md5;
secret "a9hXeJ31ALVsW/19Rx9OXQ==";
};
# this generates a client's DNS name from the hostname the give or the leased IP address
# ddns-hostname = pick-first-value(ddns-hostname, option host-name, binary-to-ascii(10,8, "-", leased-address));
# Normal DHCP stuff
option domain-name "office.internal";
option domain-name-servers 192.168.64.100;
option ip-forwarding off;
#default-lease-time 600;
#max-lease-time 7200;
# New lease-time
default-lease-time 86400;
max-lease-time 86400;
# My Network - this is the set of addresses that you're handing out
subnet 192.168.64.0 netmask 255.255.255.0 {
range 192.168.64.190 192.168.64.250;
option broadcast-address 192.168.64.255;
option subnet-mask 255.255.255.0;
option routers 192.168.64.1;
allow unknown-clients;
allow client-updates;
zone office.internal. {
primary 192.168.64.100;
key DHCP-UPDATE-KEY;
}
zone 64.168.192.in-addr.arpa. {
primary 192.168.64.100;
# this key name matches the name you gave it in the key file
key DHCP-UPDATE-KEY;
}
}
6. Setup DNS Service (but don't start it yet)
- Startup DNS normally via "Server Admin" and add the primary zone: here "office.internal" and
- add the nameserver hostname:
macserver.office.internal
The reverse DNS will automatically be added by "Server Admin".
Save it but don't start it yet since we need to configure /etc/named.conf
7. Edit /etc/named.conf
To allow DNS to update it's hostnames edit /etc/named.conf:
- add the dns-sec key at the top of the file, like here
- Add the line allow-update { key DHCP-UPDATE-KEY; };
#cat /etc/named.conf
key DHCP-UPDATE-KEY {
algorithm hmac-md5;
secret "a9hXeJ31ALVsW/19Rx9OXQ==";
};
options {
directory "/var/named";
allow-transfer {
none;
};
};
acl "com.apple.ServerAdmin.DNS.public" {
localhost;
localnets;
};
logging {
channel _default_log {
file "/Library/Logs/named.log";
severity info;
print-time yes;
};
category "default" {
"_default_log";
};
};
view "com.apple.ServerAdmin.DNS.public" {
zone "office.internal" IN {
type master;
file "db.office.internal";
allow-transfer {
none;
};
allow-update { key DHCP-UPDATE-KEY; };
};
zone "64.168.192.in-addr.arpa" IN {
type master;
file "db.64.168.192.in-addr.arpa";
allow-transfer {
none;
};
allow-update { key DHCP-UPDATE-KEY; };
};
allow-recursion {
com.apple.ServerAdmin.DNS.public;
};
};
6. Reboot and start DNS Service from "Server Admin" app:
Reboot OS X Lion Server and check that dhcpd from Macports is running (with command /opt/local/bin/daemondo
Start DNS Service with "Server Admin" and normally it should work ;-)
Log files to watch:
DHCP /opt/local/var/db/dhcpd/dhcpd.leases
See if you get a journal file for DNS (.jnl) in /var/named/
Hope this helps (someone)...
This is the complete edit (my previous post was not saved since the Discussions site switched to maintenance mode... grrr...)
