ConfigureBackUpAnycastDNS

Configure your gentoo server as anycast DNS

System Prerequisities

We are assuming that on your system sshd is already installed and well configured

Disclaimer

Follow this guide critically!

Do not copy/paste things on your system without fully understanding what you are doing!

This guide can break your ssh server setup if followed as dogma!

Install the necessary software

Enable git useflag for layman editing

/etc/portage/package.use/layman

app-portage/layman      git

Enable monkeysphere

Add keyword to enable monkeysphere, at least 0.36 version, according to your architecture editing /etc/portage/package.keywords/monkeysphere

=app-crypt/monkeysphere-0.36 ~Y0urArch1t3cture

Install layman, monkeysphere, sudo and bind 9

Depending on your useflag configuration it will ask you other things, don't panic just read and try to understand

emerge -avq app-portage/layman
layman -S
layman -a eigenlay
emerge -avq app-crypt/monkeysphere net-dns/bind app-admin/sudo

Setup eigendns user

useradd eigendns
# This password isn't be important as ssh password should be disabled on your server, at least for this eigendns and root users
passwd eigendns 
mkdir /home/eigendns
usermod -a -G named eigendns
chmod -R 755 /home/eigendns
chown -R eigendns:eigendns /home/eigendns

Set correct permission on bind config

chown -R named:named /etc/bind
chmod -R 771 /etc/bind

Add Some trusted identity certifier

monkeysphere-authentication add-identity-certifier YOUR_PGP_FINGERPRINT
monkeysphere-authentication add-identity-certifier PHOENIX_MAINTAINER_PGP_FINGERPRINT

Setup monkeysphere autorized ids for eigendns

mkdir /home/eigendns/.monkeysphere
echo 'EigenLab DNS Updater <info@eigenlab.org>' > /home/eigendns/.monkeysphere/authorized_user_ids
chmod -R 755 /home/eigendns
chown -R eigendns:eigendns /home/eigendns

Change autorized_keys location for sshd

/etc/ssh/sshd_config

#AuthorizedKeysFile .ssh/authorized_keys
AuthorizedKeysFile /var/lib/monkeysphere/authorized_keys/%u

restart sshd

/etc/init.d/sshd restart

Update monkeysphere authorized users

monkeysphere-authentication update-users

It is suggested to do this operation periodical for example adding this line to your crontab

0 * * * *       root    monkeysphere-authentication update-users

Autorize eigendns to restart bind

echo 'eigendns ALL= (root) NOPASSWD: /etc/init.d/named restart' >> /etc/sudoers

Contact Phoenix Admin

Send an email to info _at_nospam_ eigenlab.org telling what you have done and requesting to be added to anycast dns automated update server list. The phoenix admin will answer to you how to complete the steps to be an anycast dns.