5:24 p.m.
Hi all. The last few days I've attempted to setup a DHCP server
on our small SOHO network, and went round in a big circle to where I
started.
What I would like to achieve is:
/-> eth0 192.168.1.? -> DSL router 192.168.1.254 -> internet.
Server \
(dell.local)\->eth1 192.168.1.1 -> LAN
To begin with the Linksys router was serving addresses so I
turned this function off. From the sample .conf, various howtos and
posts to this list I came up with a very simple dhcpd.conf which could
be added to later as extra functionality is needed, as follows:
[root@dell ~]# cat /etc/dhcpd.conf
#Sample /etc/dhcpd.conf
# (add your comments here)
default−lease−time 600;
max−lease−time 7200;
option subnet−mask 255.255.255.0;
option broadcast−address 192.168.1.255;
option routers 192.168.1.254;
#option domain−name−servers 192.168.1.1, 192.168.1.2;
#option domain−name "mydomain.org";
authoritative;
subnet 192.168.1.0 netmask 255.255.255.0 {
range 192.168.1.100 192.168.1.199;
host dell.local {
hardware ethernet 00:1F:1F:09:38:A2;
fixed-address 192.168.1.1;
}
}
[root@dell ~]#
The first problem is, should eth0 take an address via dhcp or be
set one? Should it be bound to a MAC address in the dhcpd.conf? Does
this file look okay?
The second situation is that:
[root@dell ~]# service dhcpd start
Starting dhcpd: [FAILED]
[root@dell ~]#
with a Selinux denial:
SELinux is preventing dhcpd (dhcpd_t) "read write" unconfined_t.
with SEtroubleshooter giving no suggestions for a fix. How should I
progress here?
I have set things back to the way they were after install ( I
think). The /var/lib/dhcpd.leases file exists. Ports 67 & 68 are
allowed through the firewall and all eth* devices are trusted (using
system-config-firewall). Any advice will be most thankfully welcomed.
--
Regards,
Simon Slater
Registered Linux User #463789. Be counted at: http://counter.li.org/
5:41 p.m.
On Thu, 2009-01-29 at 10:24 +1100, Simon Slater wrote:
Hi all. The last few days I've attempted to setup a DHCP server
on our small SOHO network, and went round in a big circle to where I
started.
What I would like to achieve is:
/-> eth0 192.168.1.? -> DSL router 192.168.1.254 -> internet.
Server \
(dell.local)\->eth1 192.168.1.1 -> LAN
To begin with the Linksys router was serving addresses so I
turned this function off. From the sample .conf, various howtos and
posts to this list I came up with a very simple dhcpd.conf which could
be added to later as extra functionality is needed, as follows:
[root@dell ~]# cat /etc/dhcpd.conf
#Sample /etc/dhcpd.conf
# (add your comments here)
default−lease−time 600;
max−lease−time 7200;
option subnet−mask 255.255.255.0;
option broadcast−address 192.168.1.255;
option routers 192.168.1.254;
#option domain−name−servers 192.168.1.1, 192.168.1.2;
#option domain−name "mydomain.org";
authoritative;
subnet 192.168.1.0 netmask 255.255.255.0 {
range 192.168.1.100 192.168.1.199;
host dell.local {
hardware ethernet 00:1F:1F:09:38:A2;
fixed-address 192.168.1.1;
}
}
[root@dell ~]#
The first problem is, should eth0 take an address via dhcp or be
set one? Should it be bound to a MAC address in the dhcpd.conf? Does
this file look okay?
The second situation is that:
[root@dell ~]# service dhcpd start
Starting dhcpd: [FAILED]
[root@dell ~]#
with a Selinux denial:
SELinux is preventing dhcpd (dhcpd_t) "read write" unconfined_t.
with SEtroubleshooter giving no suggestions for a fix. How should I
progress here?
I have set things back to the way they were after install ( I
think). The /var/lib/dhcpd.leases file exists. Ports 67 & 68 are
allowed through the firewall and all eth* devices are trusted (using
system-config-firewall). Any advice will be most thankfully welcomed.
----
if Dell.local is your dhcp server, don't include it in dhcp but fix it's
ip address in setup (system-config-network).
thus, I would remove this section...
host dell.local {
hardware ethernet 00:1F:1F:09:38:A2;
fixed-address 192.168.1.1;
}
lease time is really short, probably would recommend that you increase to 3600
I think you need to declare ddns-update-style which at this point, might just as well be
none.
as for SELinux, I would suspect that 'restorecon /etc/dhcpd.conf' should do the
trick.
Craig
6:25 p.m.
On Wed, 28 Jan 2009 16:41:53 -0700
Craig White wrote:
I think you need to declare ddns-update-style which at this point,
might just as well be none.
I spent days once attempting to get dynamic DNS update to work. I
finally found it less work to hack up a C program that used inotify
to notice when the leases file was modified, and run a perl script
to update the DNS info and tell bind to reread its files :-).
6:48 p.m.
On Wed, 2009-01-28 at 19:25 -0500, Tom Horsley wrote:
On Wed, 28 Jan 2009 16:41:53 -0700
Craig White wrote:
> I think you need to declare ddns-update-style which at this point, might just as
well be none.
I spent days once attempting to get dynamic DNS update to work. I
finally found it less work to hack up a C program that used inotify
to notice when the leases file was modified, and run a perl script
to update the DNS info and tell bind to reread its files :-).
----
I always set it up with ddns and perhaps I was just lucky but it works
well. I thought the documentation seemed clear enough and it expires
ddns entries too. I even got it working with multiple domain names.
Craig
7:04 p.m.
On Wed, 2009-01-28 at 16:41 -0700, Craig White wrote:
if Dell.local is your dhcp server, don't include it in dhcp but
fix
it's
ip address in setup (system-config-network).
thus, I would remove this section...
host dell.local {
hardware ethernet 00:1F:1F:09:38:A2;
fixed-address 192.168.1.1;
}
lease time is really short, probably would recommend that you increase
to 3600
I think you need to declare ddns-update-style which at this point,
might just as well be none.
as for SELinux, I would suspect that 'restorecon /etc/dhcpd.conf'
should do the trick.
Craig
Thanks Craig, I'll make those changes & see. This is where I'm
sending/receiving mail at the moment so I may be a while before
reporting what happens.
So I'll fix eth1's ip in setup, what about eth0 which connects to the
DSL router? Can I leave it set to fetch its ip from dhcp?
--
Regards,
Simon Slater
Registered Linux User #463789. Be counted at: http://counter.li.org/
7:24 p.m.
On Thu, 2009-01-29 at 12:04 +1100, Simon Slater wrote:
On Wed, 2009-01-28 at 16:41 -0700, Craig White wrote:
> if Dell.local is your dhcp server, don't include it in dhcp but fix
> it's
> ip address in setup (system-config-network).
>
> thus, I would remove this section...
> host dell.local {
> hardware ethernet 00:1F:1F:09:38:A2;
> fixed-address 192.168.1.1;
> }
>
> lease time is really short, probably would recommend that you increase
> to 3600
>
> I think you need to declare ddns-update-style which at this point,
> might just as well be none.
>
> as for SELinux, I would suspect that 'restorecon /etc/dhcpd.conf'
> should do the trick.
>
> Craig
>
Thanks Craig, I'll make those changes & see. This is where I'm
sending/receiving mail at the moment so I may be a while before
reporting what happens.
So I'll fix eth1's ip in setup, what about eth0 which connects to the
DSL router? Can I leave it set to fetch its ip from dhcp?
----
My theory is that a 'server' should have fixed ip addresses if at all
possible.
I don't see what is to be gained by having two ethernet interfaces on
the same network but I do on occasion make extra virtual ethernet
devices for things like apache myself. I am just wondering what it is
that you hope to accomplish by doing that.
Craig
7:31 p.m.
On Wed, 2009-01-28 at 18:24 -0700, Craig White wrote:
My theory is that a 'server' should have fixed ip addresses
if at all
possible.
I don't see what is to be gained by having two ethernet interfaces on
the same network but I do on occasion make extra virtual ethernet
devices for things like apache myself. I am just wondering what it is
that you hope to accomplish by doing that.
I want to set this server up as the main interface to the internet so
one NIC (eth0) connects to the Linksys DSL router & internet, the other
NIC in the same box (eth1) connects to the internal LAN.
--
Regards,
Simon Slater
Registered Linux User #463789. Be counted at: http://counter.li.org/
7:39 p.m.
On Thu, 2009-01-29 at 12:31 +1100, Simon Slater wrote:
On Wed, 2009-01-28 at 18:24 -0700, Craig White wrote:
> My theory is that a 'server' should have fixed ip addresses if at all
> possible.
>
> I don't see what is to be gained by having two ethernet interfaces on
> the same network but I do on occasion make extra virtual ethernet
> devices for things like apache myself. I am just wondering what it is
> that you hope to accomplish by doing that.
>
I want to set this server up as the main interface to the internet so
one NIC (eth0) connects to the Linksys DSL router & internet, the other
NIC in the same box (eth1) connects to the internal LAN.
----
since dhcp sets 192.168.1.254 as the 'router' address, I presume that
all internal LAN will use the Linksys DSL router and thus both eth0 and
eth1 will have a path to the Linksys DSL router ensuring duplicity.
You probably will want to identify...
GATEWAYDEV=eth0
in /etc/sysconfig/network because it's a crapshoot otherwise
Craig
7:43 p.m.
On Wed, 28 Jan 2009 17:48:35 -0700
Craig White wrote:
> I spent days once attempting to get dynamic DNS update to work.
I
> finally found it less work to hack up a C program that used inotify
> to notice when the leases file was modified, and run a perl script
> to update the DNS info and tell bind to reread its files :-).
----
I always set it up with ddns and perhaps I was just lucky but it works
well. I thought the documentation seemed clear enough and it expires
ddns entries too. I even got it working with multiple domain names.
I think there was some magic I never decrypted because I wanted
the DHCP server to provide the name as well as the IP addr and
bind didn't want to dynamically update both forward and reverse
lookup tables (or something like that :-).
The inotify thing turned out to be useful for other stuff as well.
Since the machines involved are all virtual machines, I had
inotify notice when a new virtual machine description file appeared
and automatically update the DHCP config to serve a host name that
matches the virtual machine config file name (which worked really well
till NetworkManager started appearing on my virtual machines and
refusing to accept a hostname from DHCP at boot time :-).
10:51 p.m.
On Wed, 2009-01-28 at 18:39 -0700, Craig White wrote:
On Thu, 2009-01-29 at 12:31 +1100, Simon Slater wrote:
> On Wed, 2009-01-28 at 18:24 -0700, Craig White wrote:
> > My theory is that a 'server' should have fixed ip addresses if at all
> > possible.
> >
> > I don't see what is to be gained by having two ethernet interfaces on
> > the same network but I do on occasion make extra virtual ethernet
> > devices for things like apache myself. I am just wondering what it is
> > that you hope to accomplish by doing that.
> >
> I want to set this server up as the main interface to the internet so
> one NIC (eth0) connects to the Linksys DSL router & internet, the other
> NIC in the same box (eth1) connects to the internal LAN.
----
since dhcp sets 192.168.1.254 as the 'router' address, I presume that
all internal LAN will use the Linksys DSL router and thus both eth0 and
eth1 will have a path to the Linksys DSL router ensuring duplicity.
You probably will want to identify...
GATEWAYDEV=eth0
in /etc/sysconfig/network because it's a crapshoot otherwise
Craig
Well progress is better than yesterday, dhcpd fails but today I still
have internet. Following are the amended dhcpd.conf and the avc denials
in case they give a clue to what's happening.
[root@dell ~]# cat /etc/dhcpd.conf
#Sample /etc/dhcpd.conf
# (add your comments here)
ddns-update-style none;
default−lease−time 600;
max−lease−time 7200;
option subnet−mask 255.255.255.0;
option broadcast−address 192.168.1.255;
option routers 192.168.1.254;
#option domain−name−servers 192.168.1.1, 192.168.1.2;
#option domain−name "mydomain.org";
authoritative;
subnet 192.168.1.0 netmask 255.255.255.0 {
range 192.168.1.100 192.168.1.199;
}
[root@dell ~]#
[root@dell ~]# service dhcpd start
Starting dhcpd: [FAILED]
[root@dell ~]#
When running restorecon /etc/dhcpd.conf the avc message is:
SELinux is preventing restorecon (setfiles_t) "read write"
unconfined_t.
When restarting the network there are 3 messages:
SELinux is preventing pppd (pppd_t) "read write" unconfined_t.
SELinux is preventing arping (netutils_t) "read write" unconfined_t.
SELinux is preventing ip (ifconfig_t) "read write" unconfined_t.
When starting dhcpd :
SELinux is preventing dhcpd (dhcpd_t) "read write" unconfined_t.
I hope this means something to someone.
--
Regards,
Simon Slater
Registered Linux User #463789. Be counted at: http://counter.li.org/
11:03 p.m.
On Thu, 2009-01-29 at 15:51 +1100, Simon Slater wrote:
On Wed, 2009-01-28 at 18:39 -0700, Craig White wrote:
> On Thu, 2009-01-29 at 12:31 +1100, Simon Slater wrote:
> > On Wed, 2009-01-28 at 18:24 -0700, Craig White wrote:
> > > My theory is that a 'server' should have fixed ip addresses if at
all
> > > possible.
> > >
> > > I don't see what is to be gained by having two ethernet interfaces on
> > > the same network but I do on occasion make extra virtual ethernet
> > > devices for things like apache myself. I am just wondering what it is
> > > that you hope to accomplish by doing that.
> > >
> > I want to set this server up as the main interface to the internet so
> > one NIC (eth0) connects to the Linksys DSL router & internet, the other
> > NIC in the same box (eth1) connects to the internal LAN.
> ----
> since dhcp sets 192.168.1.254 as the 'router' address, I presume that
> all internal LAN will use the Linksys DSL router and thus both eth0 and
> eth1 will have a path to the Linksys DSL router ensuring duplicity.
>
> You probably will want to identify...
>
> GATEWAYDEV=eth0
>
> in /etc/sysconfig/network because it's a crapshoot otherwise
>
> Craig
>
Well progress is better than yesterday, dhcpd fails but today I still
have internet. Following are the amended dhcpd.conf and the avc denials
in case they give a clue to what's happening.
[root@dell ~]# cat /etc/dhcpd.conf
#Sample /etc/dhcpd.conf
# (add your comments here)
ddns-update-style none;
default−lease−time 600;
max−lease−time 7200;
option subnet−mask 255.255.255.0;
option broadcast−address 192.168.1.255;
option routers 192.168.1.254;
#option domain−name−servers 192.168.1.1, 192.168.1.2;
#option domain−name "mydomain.org";
authoritative;
subnet 192.168.1.0 netmask 255.255.255.0 {
range 192.168.1.100 192.168.1.199;
}
[root@dell ~]#
[root@dell ~]# service dhcpd start
Starting dhcpd: [FAILED]
[root@dell ~]#
When running restorecon /etc/dhcpd.conf the avc message is:
SELinux is preventing restorecon (setfiles_t) "read write"
unconfined_t.
When restarting the network there are 3 messages:
SELinux is preventing pppd (pppd_t) "read write" unconfined_t.
SELinux is preventing arping (netutils_t) "read write" unconfined_t.
SELinux is preventing ip (ifconfig_t) "read write" unconfined_t.
When starting dhcpd :
SELinux is preventing dhcpd (dhcpd_t) "read write" unconfined_t.
I hope this means something to someone.
----
Fedora 10?
as root, run 'fixfiles onboot'
and then restart, take a break because it will take some time but it
will relabel everything which should clean all this up.
Craig
11:13 p.m.
On Wed, 2009-01-28 at 22:03 -0700, Craig White wrote:
Fedora 10?
as root, run 'fixfiles onboot'
and then restart, take a break because it will take some time but it
will relabel everything which should clean all this up.
Craig
Here goes...
--
Hooroo,
Simon
Registered Linux User #463789. Be counted at: http://counter.li.org/
11:43 p.m.
On Thu, 2009-01-29 at 16:13 +1100, Simon Slater wrote:
> Fedora 10?
>
> as root, run 'fixfiles onboot'
>
> and then restart, take a break because it will take some time but it
> will relabel everything which should clean all this up.
>
> Craig
>
Here goes...
Still getting the denial:
SELinux is preventing dhcpd (dhcpd_t) "read write" unconfined_t.
when starting dhcpd. Everything else seems good though.
--
Hooroo,
Simon
Registered Linux User #463789. Be counted at: http://counter.li.org/
5587
days inactive
5588
days old
12 comments
3 participants
participants (3)
-
Craig White -
Simon Slater -
Tom Horsley