Installation
yum install -y --enablerepo=epel openswan xl2tpd
Background
In order to test different CommIT environments, it is necessary to override the authoritative DNS server(s) for the commonidtrust.org domain with one that directs the user to the front door (loadbalancer) for the CPR and IDP instances in the desired environment. To that end, we have set up separate DNS servers for the CommIT VPC-Dev and VPC-Prod environments. These are configured to serve up the A and/or CNAME records for account.commonidtrust.org and login.commonidtrust.org for the specific VPC environment.
Currently, the DNS server for VPC-Dev runs on the CommIT VPC Gitolite server in the VPC-Dev public subnet and is accessible at EIP address 54.68.170.122. The DNS server for VPC-Prod runs on a t2.micro instance in the VPC-Prod public subnet and is accessible at EIP address 54.149.84.152.
Installation
yum -y install bind
Configure /etc/named.conf and zone files, /var/named/masters/commonidtrust-dev.local and the zone file /var/named/masters/commonidtrust.org (see examples for VPC-Dev attached). Configure xl2tpd and Openswan.
chkconfig named on
chkconfig ipsec on
chkconfig xl2tpd on
Recursion is disabled and rate limiting is set at 5 per second. Since there are a total of 3 records, this is basically impossible to use in any form of attack, ever, and it's in a personal account anyway.
Logging
named logs to /var/log/messages
...
/etc/init.d/named start
/etc/init.d/named stop
Open Nameserver Protection
Since users who need to leverage the VPC DNS servers are speckled around the internet and not accessing them from a well-defined IP address or CIDR block, we needed to leave the VPC DNS servers open to serve requests from anywhere. This is done by configuring:
| No Format |
|---|
allow-query { all; };
|
Furthermore, once a client is configured to use these DNS servers, they may need to access additional name servers, for example, those for wisc.edu. We therefore configured:
| No Format |
|---|
recursion yes;
|
Of course, it didn't take very long for some nefarious outfit to realize this and set up a DNS amplification attack (see https://www.us-cert.gov/ncas/alerts/TA13-088A) ricocheting off of our open DNS server. To resolve this, we added the rate-limit option.
...
This is configured to serve up the A and/or CNAME records for account.commonidtrust.org, helpdesk.commonidtrust.org, and login.commonidtrust.org for the specific VPC environment.
VPN Docs:
pretty much just stole http://www.stormacq.com/build-a-private-vpn-server-on-amazons-ec2/