Remastering Knoppix to be a simple DNS server

Using DNSMASQ

I originally created this document to help me remember how to set up Knoppix to be a simple, secure DNS server. However, every time I search for such a document, I can't really find one that tells me everything I need. The Knoppix forums have a lot of info and howto's, but it's not necessarily all in one place.

If you think anything needs to be changed or added to this document, please email me at {sawall -[at]- gmail -[dot]- com}.

The following two sites provide the majority of information for remastering the KNOPPIX live CD.

http://www.knoppix.net/docs/index.php/KnoppixRemasteringHowto

http://gnubox.dyndns.org:8080/~sunil/knoppix.php

Setting up the Knoppix Filesystem

To make things easier to follow, I've added some of the content from the above web sites. All of the "bulleted" items in System Requirements and Instructions are from the Knoppix Howto web site. I've added my comments or additions in grey. See their sites for expanded details.

System Requirements:

at least 1 GB of FREE RAM+Swap total (i.e 256M ram, and 750M swap AVAILABLE) (unless you use a different compression program - look in this page for compressloop)
3 GB free on a Linux filesystem (ext2/3, xfs, etc.) formatted disk partition

Instructions:

Boot from Knoppix CD
Configure your Internet connection (we'll need this later)
Open a root shell (Kmenu->Knoppix->Root Shell) - all commands below are run from this root shell
Find the partition you will use to work on. In this example it is called hda1 . The partition should have a minimum of 3 GB free space

Note: Before the next step, su to root.

Mount the partition: mount -rw /dev/hda1 /mnt/hda1 (do it like this or you'll get errors when you later chroot)
Create a root directory to work in: mkdir /mnt/hda1/knx (put all your files here and it will be easy to clean up)
If you don't have 1 GB RAM (cat /proc/meminfo (physical+swap)) then you will need a swapfile: cd /mnt/hda1/knx ; dd if=/dev/zero of=swapfile bs=1M count=750 ; mkswap swapfile ; swapon swapfile
Make 2 directories, one for your new Master CD, one for the source, on a disk partition: mkdir /mnt/hda1/knx/master; mkdir /mnt/hda1/knx/source

mkdir /mnt/hda1/knx/source/KNOPPIX
- now, copy the KNOPPIX files to your source directory : cp -Rp /KNOPPIX/* /mnt/hda1/knx/source/KNOPPIX that will take a little while :)
mkdir /mnt/hda1/knx/master/KNOPPIX
cp /cdrom/index.html /mnt/hda1/knx/master/
- (For Knoppix 3.4), copy everything in /cdrom/ to /mnt/hda1/knx/master/ except the ~700 Mb KNOPPIX file. ( cd /cdrom;find . -size -10000k -type f -exec cp -p --parents {} /mnt/hda1/knx/master/ \; )
- Now you can "chroot" into the copied KNOPPIX : chroot /mnt/hda1/knx/source/KNOPPIX
- You are now chrooted. "/" is actually "/mnt/hda1/knx/source/KNOPPIX"
- To use the internet you need to mount proc mount -t proc /proc proc
- now edit /etc/resolv.conf and add your nameserver or cp /etc/dhcpc/resolv.conf to /mnt/hda1/knx/source/KNOPPIX/etc/dhcpc/resolv.conf
- Also change smb.conf to your MS group if you want smbd support (MSHOME is XP Home ed. usually, and WORKGROUP is 9x Windows.
- check your chrooted internet connection : ping google.com
- Update your package list with apt-get update

The following methods described in the Knoppix Howto can be followed or a GUI package manager can be installed. Remove all unnecessary applications.

"apt-get install synaptic"

I remove items I will not need such as Open Office, GIMP, AcroRead, etc.

Before you can add stuff, you will probably need to remove some packages. To get a list of packages installed, type this:
dpkg-query -l
If you want that list sorted by size (this way you can get rid of the biggies), type this:
dpkg-query -W --showformat='${Installed-Size} ${Package}\n' | sort -n
To remove a package (and all packages dependant on it), type this:
apt-get remove <name-of-package-to-remove>
To check for orphaned packages, type this:
deborphan
Want to save more space by getting rid of those pesky orphans (how cruel!), type this (Warning, you won't be prompted yes/no to remove these packages. When you press Enter after this command, those packages will be gone):
deborphan | xargs apt-get -y remove
If you're uncertain about the previous command and want to see what will happen without making any changes, just add the -s option to the apt-get command like this (you can do this with all of the apt-get commands, and it's a good habit to use this option before mass operations like this one):
deborphan | xargs apt-get -s -y remove
Now the good stuff. If you wish to add a package, type this:
apt-get install <name-of-package-to-install>

Now the DNS server will need to be installed. An excellent, small DNS server is DNSMASQ. Which can be found here: http://thekelleys.org.uk/dnsmasq/doc.html

DNSMASQ allows the server to simply use the system's /etc/hosts file or any other specified hosts file.

"apt-get install dnsmasq"

After installation, the startup script will be placed in the initd and rc folders, the DNSMASQ config file will be /etc/dnsmasq.conf. Any of the command line options that could be used can be configured within the configuration file.

See the dnsmasq.conf configuration file at the end of this document with comments.

What, don't know what packages to install? Type this. When the list appears, you can peruse (over 13k lines!) or search for things using /<search-term>:
apt-cache search .* | sort | less
When you're done removing and adding packages, a good way to clean up is by typing this:
COLUMNS=200 dpkg -l |grep ^rc |awk '{print $2} ' | xargs dpkg -P
Also, because the Debian package system keeps a cache of downloaded packages, you may want to run the following to clear out those spare files:
apt-get clean
user settings are in /etc/skel
Unmount /proc - very important! umount /proc
Press CTRL+D to leave being chrooted

Configure Host information

The following section contains items that I did to customize the host before creating an ISO image.

If it is not necessary to run the windowing system, disable it. Edit the /etc/inittab file and change the runlevel to 3. It should end up looking like this:

#The default runlevel.

id:3:initdefault:

Edit the system to use a static IP address.

This information was taken from the following post on the Knoppix forums: http://www.knoppix.net/forum/viewtopic.php?p=19004.

Edit the /etc/init.d/knoppix-autoconfig file. Search for "pump" and comment out the following line: pump -i $DEVICE > /dev/null 2>&1 &

And add the following line immediately below the pump statement:

/etc/init.d/networking restart

Edit the /etc/network/interfaces file and add the following for a static IP (obviously using a proper IP for your network):

iface eth0 inet static

address 10.10.10.54

netmask 255.255.255.0

network 10.10.10.0

broadcast 10.10.10.255

gateway 10.10.10.1

Modify the /etc/hosts file:

127.0.0.1 localhost

10.10.10.54 yourhost yourhost.yourdomain.com

Modify the /etc/hostname file:

yourhost

Boot Options

There are many different options (cheats) that could be used when booting Knoppix. These help with various hardware / device differences. All of these "cheat codes" can be found here: http://www.knoppix.net/docs/index.php/CheatCodes

To help with auto-booting the system when "cheat codes" are necessary, the isolinux.cfg file can be modified. This file is in the /mnt/hda1/knx/master/boot/isolinux folder. Notice the first few lines:

DEFAULT linux24

APPEND ramdisk_size=100000 init=/etc/init lang=us apm=power-off vga=791 initrd=minirt24.gz nomce quiet BOOT_IMAGE=knoppix

TIMEOUT 300

If any options need to be added, just add them into the APPEND line. For example, I must disable a certain type of hardware detection, so I must use the nodma option:

DEFAULT linux24

APPEND ramdisk_size=100000 init=/etc/init lang=us apm=power-off vga=791 initrd=minirt24.gz nomce nodma quiet BOOT_IMAGE=knoppix

TIMEOUT 300

Knoppix allows for a special file (cdrom/KNOPPIX/knoppix.sh) to exist and run at boot time. Below, I use this file to call up a Perl script to start a few other applications. I will discuss these options after the scripts.

knoppix.sh

#run a special startup script

/cdrom/KNOPPIX/knoppix_startup.pl

knoppix_startup.pl

#!/usr/bin/perl

use Term::ANSIColor qw(:constants);

print "\nStarting IP Tables config...\n";

`iptables -F`;

`iptables -N NEWTABLENAME`;

`iptables -A INPUT -j NEWTABLENAME`;

`iptables -A NEWTABLENAME -p udp -m udp --dport 53 -j ACCEPT`;

`iptables -A NEWTABLENAME -p tcp -m tcp --dport 22 --syn -j ACCEPT`;

`iptables -A NEWTABLENAME -i lo -j ACCEPT`;

`iptables -A NEWTABLENAME -p tcp -m tcp --syn -j REJECT`;

`iptables -A NEWTABLENAME -p udp -m udp -j REJECT`;

print "\nDone setting IP Tables.\n";

print BLUE, "Gathering info, please wait...\n", RESET;

@getipt = `iptables -L`;

@getipa = `ifconfig -a eth0`;

@getrt = `route`;

$tempfile = "/tmp/ipinfo.txt";

open(CFGFILE, ">>$tempfile");

print GREEN, "IP Tables Configuration\n", RESET;

print CFGFILE "IP Tables Configuration\n";

print "@getipt\n";

print CFGFILE "@getipt\n";

print GREEN, "ETH0 Information\n", RESET;

print CFGFILE "ETH0 Information\n";

print "@getipa\n";

print CFGFILE "@getipa\n";

print GREEN, "Routing Information\n", RESET;

print CFGFILE "Routing Information\n";

print "@getrt\n";

print CFGFILE "@getrt\n";

close (CFGFILE);

print "\n"x4;

print GREEN, "Starting SSH Services.\n", RESET;

`/etc/init.d/ssh start`;

print "\n"x9;

print BLUE, " SOME TITLE\n", RESET;

print GREEN, " REST OF TILE\n", RESET;

print "\n"x20;

About the Custom Scripts

The knoppix.sh script file simply calls a Perl script. The Perl script does a few things:

Creates rules for the iptables firewall
Gathers info about the network configuration
Starts the SSH service

The iptables rules are fairly straight forward. They allow DNS queries and connectivity via SSH. Then a few simple system commands are run to verify current network settings. The settings are both displayed on the console and written to a text file

Finally, the SSH service is started. There is really just one other step that must be taken in order for the SSH service to be usable. The user "knoppix" must have it's password set.

chroot /mnt/hda1/knx/source/KNOPPIX

su -

passwd knoppix

{set the password}

exit

CTRL + D (to exit chroot environment).

Creating the ISO Image

Again, the following section is taken from the Knoppix howto with my comments in grey.

first do some cleanup : remove .bash_history files, tmp files etc

rm -rf /mnt/hda1/knx/source/KNOPPIX/.rr_moved
- Now we'll make the big KNOPPIX file which is a cloop compressed ISO 9660 filesystem : mkisofs -R -U -V "KNOPPIX.net filesystem" -P "KNOPPIX www.knoppix.net" -hide-rr-moved -cache-inodes -no-bak -pad /mnt/hda1/knx/source/KNOPPIX | nice -5 /usr/bin/create_compressed_fs - 65536 > /mnt/hda1/knx/master/KNOPPIX/KNOPPIX

Note that there are spaces in the above command between the fs - 65536.

The "www.knoppix.net" and "Knoppix.net filesystem" can be changed to what you want to call the file. You will get an error that it doesn't conform to ISO standards, you can ignore this.

In Knoppix 3.4 the create_compressed_fs script has been updated so be sure to use it to obtain the best result. It has a new option -b (best), which enables the best compression by using different compression schemes and tries to optimize that way, but be careful, because that option is slow (10x slower).

I ran into a few issues with the above statement and therefore did not use the b command.

if all went well, onto making the final CD-ROM Image :

cd /mnt/hda1/knx/master
- rm -f KNOPPIX/md5sums; find -type f -not -name md5sums -not -name boot.cat -exec md5sum {} \; >> KNOPPIX/md5sums (this will update the md5 hashes of the files included in the ISO, used for integrity checking)
- For Knoppix 3.4 or other isolinux based distributions do: mkisofs -pad -l -r -J -v -V "KNOPPIX" -no-emul-boot -boot-load-size 4 -boot-info-table -b boot/isolinux/isolinux.bin -c boot/isolinux/boot.cat -hide-rr-moved -o /mnt/hda1/knx/knoppix.iso /mnt/hda1/knx/master (the ISO is stored in /mnt/hda1/knx/knoppix.iso)

DONE. Copy the ISO and burn to CD.

The dnsmasq.conf File

# Configuration file for dnsmasq.

# Format is one option per line, legal options are the same

# as the long options legal on the command line. See

# "/usr/sbin/dnsmasq --help" or "man 8 dnsmasq" for details.

# Change these lines if you want dnsmasq to serve MX records.

# Only one of mx-host and mx-target need be set, the other defaults

# to the name of the host running dnsmasq.

#mx-host=

#mx-target=

#selfmx

#localmx

# The following three options make you a better netizen, since they

# tell dnsmasq to filter out queries which the public DNS cannot

# answer, and which load the servers (especially the root servers)

# uneccessarily. If you have a dial-on-demand link they also stop

# these requests from bringing up the link uneccessarily.

# Never forward plain names (with a dot or domain part)

domain-needed

# Reply to reverse queries for addresses in the non-routed address

# space with the dotted.quad address

bogus-priv

# Filter useless windows-originated DNS requests

filterwin2k

# Change this line if you want dns to get its upstream servers from

# somewhere other that /etc/resolv.conf

#resolv-file=

I set up our resolv.conf file to use our appropriate domains and DNS servers.

# By default, dnsmasq will send queries to any of the upstream

# servers it knows about and tries to favour servers to are known

# to be up. Uncommenting this forces dnsmasq to try each query

# with each server strictly in the order they appear in

# /etc/resolv.conf

#strict-order

# If you don't want dnsmasq to read /etc/resolv.conf or any other

# file, getting its servers for this file instead (see below), then

# uncomment this

no-resolv

Even though I set up our resolv.conf file, in this scenario, I do not need it to use that information so I told it NOT to read the resolv.conf file.

# If you don't want dnsmasq to poll /etc/resolv.conf or other resolv

# files for changes and re-read them then uncomment this.

no-poll

Since we're not reading the file, there's no reason to poll it.

# Add other name servers here, with domain specs if they are for

# non-public domains.

#server=/localnet/192.168.0.1

server=SERVERONE

server=SERVERTWO

As described further down in this document, we'll be using the /etc/hosts file to define hosts and their IP addresses. However, if you need to forward some requests to an external (or any) DNS server, add them here. If your DNS server can't respond, it will forward the request.

# Add local-only domains here, queries in these domains are answered

# from /etc/hosts or DHCP only.

#local=/localnet/

# Add domains which you want to force to an IP address here.

# The example below send any host in doubleclick.net to a local

# webserver.

#address=/doubleclick.net/127.0.0.1

# You no longer (as of version 1.7) need to set these to enable

# dnsmasq to read /etc/ppp/resolv.conf since dnsmasq now uses the

# "dip" group to achieve this.

#user=

#group=

# If you want dnsmasq to listen for requests only on specified interfaces

# (and the loopback) give the name of the interface (eg eth0) here.

# Repeat the line for more than one interface.

#interface=

# Or you can specify which interface _not_ to listen on

#except-interface=

# Or which to listen on by address (remember to include 127.0.0.1 if

# you use this.)

#listen-address=

# On systems which support it, dnsmasq binds the wildcard address,

# even when it is listening on only some interfaces. It then discards

# requests that it shouldn't reply to. This has the advantage of

# working even when interfaces come and go and change address. If you

# want dnsmasq to really bind only the interfaces it is listening on,

# uncomment this option. About the only time you may need this is when

# running another nameserver on the same machine.

#bind-interfaces

# If you don't want dnsmasq to read /etc/hosts, uncomment the

# following line.

#no-hosts

By leaving this commented out, DNSMASQ will read the entries from your local /etc/hosts file.

# or if you want it to read another file, as well as /etc/hosts, use

# this.

#addn-hosts=/etc/banner_add_hosts

# Set this (and domain: see below) if you want to have a domain

# automatically added to simple names in a hosts-file.

expand-hosts

Depending on what your users are used to, this is a nice feature. So if a user types in HOSTA, DNSMASQ will add in whatever you define as the domain and it will end up being HOSTA.DOMAIN.COM.

# Set the domain for dnsmasq. this is optional, but if it is set, it

# does the following things.

# 1) Allows DHCP hosts to have fully qualified domain names, as long

# as the domain part matches this setting.

# 2) Sets the "domain" DHCP option thereby potentially setting the

# domain of all systems configured by DHCP

# 3) Provides the domain part for "expand-hosts"

#domain=thekelleys.org.uk

domain=yourdomain.com

This tells the expand-hosts option what domain name to add.

# Uncomment this to enable the integrated DHCP server, you need

# to supply the range of addresses available for lease and optionally

# a lease time. If you have more than one network, you will need to

# repeat this for each network on which you want to supply DHCP

# service.

#dhcp-range=192.168.0.50,192.168.0.150,12h

# This is an example of a DHCP range where the netmask is given. This

# is needed for networks we reach the dnsmasq DHCP server via a relay

# agent. If you don't know what a DHCP relay agent is, you probably

# don't need to worry about this.

#dhcp-range=192.168.0.50,192.168.0.150,255.255.255.0,12h

# This is an example of a DHCP range with a network-id, so that

# some DHCP options may be set only for this network.

#dhcp-range=red,192.168.0.50,192.168.0.150

# Supply parameters for specified hosts using DHCP. There are lots

# of valid alternatives, so we will give examples of each. Note that

# IP addresses DO NOT have to be in the range given above, they just

# need to be on the same network. The order of the parameters in these

# do not matter, it's permissble to give name,adddress and MAC in any order

# Always allocate the host with ethernet address 11:22:33:44:55:66

# The IP address 192.168.0.60

#dhcp-host=11:22:33:44:55:66,192.168.0.60

# Always set the name of the host with hardware address

# 11:22:33:44:55:66 to be "fred"

#dhcp-host=11:22:33:44:55:66,fred

# Always give the host with ethernet address 11:22:33:44:55:66

# the name fred and IP address 192.168.0.60 and lease time 45 minutes

#dhcp-host=11:22:33:44:55:66,fred,192.168.0.60,45m

# Give the machine which says it's name is "bert" IP address

# 192.168.0.70 and an infinite lease

#dhcp-host=bert,192.168.0.70,infinite

# Always give the host with client identifier 01:02:02:04

# the IP address 192.168.0.60

#dhcp-host=id:01:02:02:04,192.168.0.60

# Always give the host with client identifier "marjorie"

# the IP address 192.168.0.60

#dhcp-host=id:marjorie,192.168.0.60

# Enable the address given for "judge" in /etc/hosts

# to be given to a machine presenting the name "judge" when

# it asks for a DHCP lease.

#dhcp-host=judge

# Never offer DHCP service to a machine whose ethernet

# address is 11:22:33:44:55:66

#dhcp-host=11:22:33:44:55:66,ignore

# Ignore any client-id presented by the machine with ethernet

# address 11:22:33:44:55:66. This is useful to prevent a machine

# being treated differently when running under different OS's or

# between PXE boot and OS boot.

#dhcp-host=11:22:33:44:55:66,id:*

# Send extra options which are tagged as "red" to

# the machine with ethernet address 11:22:33:44:55:66

#dhcp-host=11:22:33:44:55:66,net:red

# Send extra options which are tagged as "red" to any machine whose

# DHCP vendorclass string includes the substring "Linux"

#dhcp-vendorclass=red,Linux

# Send extra options which are tagged as "red" to any machine one

# of whose DHCP userclass strings includes the substring "accounts"

#dhcp-userclass=red,accounts

# If this line is uncommented, dnsmasq will read /etc/ethers and act

# on the ethernet-address/IP pairs found there just as if they had

# been given as --dhcp-host options. Useful if you keep

# MAC-address/host mappings there for other purposes.

#read-ethers

# Send options to hosts which ask for a DHCP lease.

# See RFC 2132 for details of available options.

# Note that all the common settings, such as netmask and

# broadcast address, DNS server and default route, are given

# sane defaults by dnsmasq. You very likely will not need any

# any dhcp-options. If you use Windows clients and Samba, there

# are some options which are recommended, they are detailed at the

# end of this section.

# For reference, the common options are:

# subnet mask - 1

# default router - 3

# DNS server - 6

# broadcast address - 28

# Set the NTP time server addresses to 192.168.0.4 and 10.10.0.5

#dhcp-option=42,192.168.0.4,10.10.0.5

# Set the NTP time server address to be the same machine as

# is running dnsmasq

#dhcp-option=42,0.0.0.0

# Set the NIS domain name to "welly"

#dhcp-option=40,welly

# Set the default time-to-live to 50

#dhcp-option=23,50

# Set the "all subnets are local" flag

#dhcp-option=27,1

# Send the etherboot magic flag and then etherboot options (a string).

#dhcp-option=128,e4:45:74:68:00:00

#dhcp-option=129,NIC=eepro100

# Specify an option which will only be sent to the "red" network

# (see dhcp-range for the declaration of the "red" network)

#dhcp-option=red,42,192.168.1.1

# The following DHCP options set up dnsmasq in the same way as is specified

# for the ISC dhcpcd in

# http://www.samba.org/samba/ftp/docs/textdocs/DHCP-Server-Configuration.txt

# adapted for a typical dnsmasq installation where the host running

# dnsmasq is also the host running samba.

# you may want to uncomment them if you use Windows clients and Samba.

#dhcp-option=19,0 # option ip-forwarding off

#dhcp-option=44,0.0.0.0 # set netbios-over-TCP/IP nameserver(s) aka WINS server(s)

#dhcp-option=45,0.0.0.0 # netbios datagram distribution server

#dhcp-option=46,8 # netbios node type

#dhcp-option=47 # empty netbios scope.

# Set the boot filename and tftpd server name and address

# for BOOTP. You will only need this is you want to

# boot machines over the network.

#dhcp-boot=/var/ftpd/pxelinux.0,boothost,192.168.0.3

# Set the limit on DHCP leases, the default is 150

#dhcp-lease-max=150

# The DHCP server needs somewhere on disk to keep its lease database.

# This defaults to a sane location, but if you want to change it, use

# the line below.

#dhcp-leasefile=/var/lib/misc/dnsmasq.leases

# Set the cachesize here.

#cache-size=150

# If you want to disable negative caching, uncomment this.

#no-negcache

# Normally responses which come form /etc/hosts and the DHCP lease

# file have Time-To-Live set as zero, which conventionally means

# do not cache further. If you are happy to trade lower load on the

# server for potentially stale date, you can set a time-to-live (in

# seconds) here.

#local-ttl=

# If you want dnsmasq to detect attempts by Verisign to send queries

# to unregistered .com and .net hosts to its sitefinder service and

# have dnsmasq instead return the correct NXDOMAIN response, uncomment

# this line. You can add similar lines to do the same for other

# registries which have implemented wildcard A records.

#bogus-nxdomain=64.94.110.11

# If you want to fix up DNS results from upstream servers, use the

# alias option. This only works for IPv4.

# This alias makes a result of 1.2.3.4 appear as 5.6.7.8

#alias=1.2.3.4,5.6.7.8

# and this maps 1.2.3.x to 5.6.7.x

#alias=1.2.3.0,5.6.7.0,255.255.255.0

# For debugging purposes, log each DNS query as it passes through

# dnsmasq.

#log-queries

# Include a another lot of configuration options.

#conf-file=/etc/dnsmasq.more.conf