GAM: 用 cli 管理 Google G-Suite (apps)

gam

Google g-suite 的管理介面真是出了名的難用
使用者列表是用 js 去讀出來的 最扯的是卷軸向下拉裡面的資料竟然會循環
稱了很久都沒去處理 直到今天才把 GAM 裝起來 以後改用這個管理

安裝步驟是又簡單又麻煩
打這行指令 就安裝完成了 不過這裡面很多步驟

bash <(curl -s -S -L https://raw.githubusercontent.com/jay0lee/GAM/master/src/gam-install.sh)

(debian 沒有 curl 要先 sudo apt-get install curl 一下)

依照步驟說明動作 有很多要用瀏覽器完成 所以要仔細看 貼網址 還有回來按 enter (記得複製不要按 ctrl-c 太爽 就給他中斷掉了)
因為步驟太多 就不貼了 不過都不需要看文件 應該可以完成

補一下參考資料
GAM 官方文件
批次操作文件

debian 安裝 softether VPN server

筆記一下 在 debian 上面安裝 softether VPN Server

很可惜的 softether 並沒有在 debian packages 裡面
必須手動安裝
為了方便追蹤版本 來使用 git 抓官方的 repo 過來安裝
先確認自己系統有沒有 git 沒有的話先去裝一下

首先先安裝 softether 會使用到的套件

sudo apt-get install libreadline6-dev libssl-dev lib32ncurses5-dev

然後用 git 抓官方的 repo 下來

git clone https://github.com/SoftEtherVPN/SoftEtherVPN.git

再來做編譯前的設定

cd SoftEtherVPN
./configure

依照自己的系統選擇

Welcome to the corner-cutting configure script !

Select your operating system below:
 1: Linux
 2: FreeBSD
 3: Solaris
 4: Mac OS X
 5: OpenBSD

Which is your operating system (1 - 5) ? : 1

Select your CPU bits below:
 1: 32-bit
 2: 64-bit

Which is the type of your CPU (1 - 2) ? : 2

編譯並安裝

make
make install

寫個 service 檔餵 systemd

vi /etc/systemd/system/softether.service

內容如下

[Unit]
Description=SoftEther VPN Server
After=network.target

[Service]
Type=forking
ExecStart=/usr/bin/vpnserver start
ExecStop=/usr/bin/vpnserver stop

[Install]
WantedBy=multi-user.target

啟動服務

systemctl start softether.service

加入開機自動啟動

systemctl enable softether.service

其他設定就去 官網下載 SoftEther VPN Server Manager 來連線到 剛裝好的 server
第一次 密碼空白 進去後會有密碼變更提示

其他設定就看個人需求 去官方的 Tutorials 找一下設定就好了

批次清除 AD 上使用者的主資料夾

依序測試一下
然後最後一步驟批次下去

查詢 AD 上所有使用者 列出 cn / 登入帳號 / 說明 / 主資料夾

dsquery * domainroot -filter "(&(objectClass=person)(objectClass=user)(!objectClass=computer)(cn=*))" -attr cn sAMAccountName description homeDirectory -uco -limit 0 

測試是否能查到帳號: kerker

dsquery * domainroot -filter "(&(objectClass=person)(objectClass=user)(!objectClass=computer)(sAMAccountName=kerker))" -attr cn sAMAccountName description homeDirectory -uco -limit 0

測試清除 kerker 的主資料夾

dsquery * domainroot -filter "(&(objectClass=person)(objectClass=user)(!objectClass=computer)(sAMAccountName=kerker))"| DSMod user -hmdir "" -hmdrv ""

清除所有主資料夾含有 ftp 的帳號的主資料夾(真饒舌)

dsquery * domainroot -filter "(&(objectClass=person)(objectClass=user)(!objectClass=computer)(homedirectory=*ftp*))" -limit 0 | DSMod user -hmdir "" -hmdrv ""

搞定收工

解決 安裝 win7 鍵盤滑鼠不會動

今天在新電腦安裝 windows 7 的時候 鍵盤滑鼠不會動
可是在 BIOS 時明明會動 開機開到安裝畫面就不會動了
原來是因為 新的主機板是 usb3 控制晶片 win7 的安裝光碟沒辦法支援
所以我們得要把 usb3 的驅動程式 塞進安裝光碟(USB)裡面

以下以 win7 sp1 64bit enterprise 為例

建立 1 個資料夾(例如 c:\users\kerker\desktop\prep)

裡面再建立下列2個資料夾

  • usb3
  • mount

找到安裝光碟的

  • sources\boot.wim
  • sources\install.wim

把這兩個丟進 prep 資料夾 也就是你建的最上層資料夾

然後下載 intel USB3 driver

解開後把

  • USB_3.0_Win7_64_4.0.0.36\Intel USB 3.0 eXtensible Host Controller Driver PV 4.0.0.36\Drivers\Win7\x64
  • USB_3.0_Win7_64_4.0.0.36\Intel USB 3.0 eXtensible Host Controller Driver PV 4.0.0.36\Drivers\HCSwitch\x64

兩個資料夾中所有的資料丟進 自建的 usb3 資料夾

用系統管理員開啟 cmd

切換到你的 perp 資料夾

cd c:\users\kerker\desktop\prep

掛載 boot.wim 寫入 usb3 的驅動

dism /mount-wim /wimfile:boot.wim /index:2 /mountdir:mount
dism /image:mount /add-driver:"usb3" /recurse
dism /unmount-wim /mountdir:mount /commit

掛載 install.wim 寫入 usb3 的驅動

dism /mount-wim /wimfile:install.wim /index:1 /mountdir:mount
dism /image:mount /add-driver:"usb3" /recurse
dism /unmount-wim /mountdir:mount /commit

如果掛載出錯 可用dismGUI查詢 index 掛載的號碼(通常是 install.wim 可能會不同)
如果卸載第一個出錯 掛第二個會掛不上 就自己建一個 mount2 改掛 mount2 就好了

完成後再把 boot.wim 和 install.wim 寫回你的安裝光碟(USB)就可以了


windows 安裝 USB 可用 Rufus 製作

製作 win10 sysprep answer file

安裝 Windows System Image Manager

下載 windows ADK

安裝時勾選部署工具

準備 windows 安裝檔案

把 windows10 iso 檔解開丟到硬碟裡 如:c:\Users\kerker\desktop\win10\
打開裡面 找到 resources 資料夾 確定裡面有一個 install.wim 檔案
先不用動他 等一下會用到

Windows 系統映像管理員

執行 windows 映像管理員
檔案 / 選取 Windows 映像…

選取 先前準備好的 windows 安裝資料夾\sources\install.wim

跳出這個就選是
接著等一陣子
好了之後左下 windows 映像會有一堆東西出現
接著選 左上選單 檔案 / 建立回應檔案
左下 windows 映像

找到 Windows 10 Enterprise\Components\amd64_Microsoft-Windows-Shell-Setup_10.0.14393.0_neutral\OOBE
右鍵 將設定新增至 pass7 oobeSystem(7)
右上方回應檔案區就會出現對應的設定

接著就把 OOBE 裡面的設一設

HideEULAPage
HideLocalAccountScreen
HideOEMRegistrationScreen
HideOnlineAccountScreens
HideWirelessSetupInOOBE

SkipMachineOOBE
SkipUserOOBE

都改為 true
(後來實測好多次發現 其實只需要 SkipMachineOOBE 就可以了)

存檔 檔名隨便 這邊先存在 c:\w10ans.xml

sysprep /generalize /oobe /unattend:c:\w10ans.xml

跑完會自動關機
做映像檔搞定收工

當然裡面還有很多可以設定
例如自動新增使用者之類的
有需要的自己翻吧

延伸閱讀:
OOBE 設定 Microsoft-Windows-Shell-Setup/OOBE
自動加入網域 Microsoft-Windows-UnattendedJoin/Identification/JoinDomain

[Firefox] youtube 部分影片跑不出來

最近看一些 youtube 發現 Firefox 跑不出來 可是 google chrome 可以
真是怪了 後來才發現是 vp9 格式問題

首先 先到 youtube html5 相容性檢查網頁 檢查

螢幕快照 2016-04-14 上午10.26.38

我的 MSE & WebM VP9 是驚嘆號
問題就出在這邊

螢幕快照 2016-04-14 上午10.31.24

要修正他 請進入 firefox 組態設定模式( 網址打 about:config )
找到 media.mediasource.webm.enabled
改為 true 就搞定了

ref: https://forum.moztw.org/viewtopic.php?f=2&t=41887

[Mac] OpenCV + Python

openCV 2.x + Python 2.x on MacOS

brew 安裝 python

$ brew install python

安裝 cmake

$ brew install cmake

安裝 openCV 2.x

$ brew install homebrew/science/opencv

會有警告訊息

Warning: opencv dependency gcc was built with a different C++ standard
library (libstdc++ from clang). This may cause problems at runtime.

不理他 可以用

安裝 numpy

$ pip install numpy

安裝完 /Library/Caches/Homebrew/opencv-2.4.11.tar.gz 有範例

$ mkdir dev
$ cd dev
$ tar xvfz /Library/Caches/Homebrew/opencv-2.4.11.tar.gz
$ cd opencv-2.4.11/sample/python2
$ python demo.py

如果用人臉辨識 特徵在 data/haarcascades

[研習] 校園兒童安全瀏覽網路設定 BIND9 RPZ

要讓校園內學生使用的電腦強制開啟 Google 安全搜尋或是啟用 youtube 嚴格搜尋
就需要用到 DNS CNAME 功能
以下就來從無到有做一台學生專用的 DNS 為示範

測試環境

安裝 BIND

sudo apt-get update
sudo apt-get install bind9

( 如果光碟安裝 記得改 /etc/apt/sources.list 把光碟 cdrom 那行註解掉 )

設定 BIND

切換到 bind 設定檔目錄

cd /etc/bind

編輯 named.conf.options

sudo vi named.conf.options
options {
        directory "/var/cache/bind";
        response-policy { zone "rpz"; };

建立 zone.rpz

sudo vi zone.rpz
zone "rpz" IN {
 type master;
 file "/etc/bind/db.rpz.zone";
 allow-query {none;};
};

修改 named.conf.local 讓系統把 zone.rpz 吃進來

sudo vi named.conf.local
//上略
//include "/etc/bind/zones.rfc1918";
include "/etc/bind/zone.rpz";

建立 db.rpz.zone

sudo vi db.rpz.zone
$TTL 1H
$ORIGIN rpz.
@   IN  SOA localhost. nobody.localhost (
            2015103102
            1h
            15m
            30d
            2h )
            NS localhost.

; google safe search
www.google.com          IN CNAME forcesafesearch.google.com.
www.google.com.tw       IN CNAME forcesafesearch.google.com.

BIND 基本操作

啟用服務

sudo systemctl start bind9

停用服務

sudo systemctl stop bind9

或用 sudo rndc stop

重啟服務

sudo systemctl restart bind9

sudo rndc reload

檢測 conf 檔

named-checkconf -z /etc/bind/named.conf

檢測 zone db 檔

named-checkzone -d rpz db.rpz.zone

一開始安裝完預設 BIND 是啟用的
改好設定檔之後檢測無誤 就可以 restart 一下就搞定了

youtube 嚴格(安全)搜尋

依照官方設定可以強迫啟用嚴格搜尋
可以過濾掉大部分的敏感內容

; youtube safe search
www.youtube.com         IN CNAME restrict.youtube.com.
m.youtube.com           IN CNAME restrict.youtube.com.
youtubei.googleapis.com IN CNAME restrict.youtube.com.
www.youtube-nocookie.com    IN CNAME restrict.youtube.com.

阻擋 IP 規則

Policy Trigger (LH name) 採用: prefix.a4.a3.a2.a1.rpz-ip (沒有點.)

例如 阻擋 IP 12.23.34.45 讓他回報 NXDOMAIN 為例 db.rpz.zone 裡面要寫

32.45.34.23.12.rpz-ip    IN CNAME .

例如 阻擋 IP 12.23.34.* 讓他回報 NXDOMAIN 為例 db.rpz.zone 裡面要寫

24.45.34.23.12.rpz-ip    IN CNAME .

範例

本文的設定檔都放在 github 需要的請自取

google ccTLD 問題

Google 區段要滴水不漏的話 得要把全部的 Google ccTLD subbomains 都吃進來

www.google.com       IN CNAME forcesafesearch.google.com.
www.google.ad        IN CNAME forcesafesearch.google.com.
www.google.ae        IN CNAME forcesafesearch.google.com.
www.google.com.af    IN CNAME forcesafesearch.google.com.
www.google.com.ag    IN CNAME forcesafesearch.google.com.
www.google.com.ai    IN CNAME forcesafesearch.google.com.
www.google.al        IN CNAME forcesafesearch.google.com.
www.google.am        IN CNAME forcesafesearch.google.com.
www.google.co.ao     IN CNAME forcesafesearch.google.com.
www.google.com.ar    IN CNAME forcesafesearch.google.com.
www.google.as        IN CNAME forcesafesearch.google.com.
www.google.at        IN CNAME forcesafesearch.google.com.
www.google.com.au    IN CNAME forcesafesearch.google.com.
www.google.az        IN CNAME forcesafesearch.google.com.
www.google.ba        IN CNAME forcesafesearch.google.com.
www.google.com.bd    IN CNAME forcesafesearch.google.com.
www.google.be        IN CNAME forcesafesearch.google.com.
www.google.bf        IN CNAME forcesafesearch.google.com.
www.google.bg        IN CNAME forcesafesearch.google.com.
www.google.com.bh    IN CNAME forcesafesearch.google.com.
www.google.bi        IN CNAME forcesafesearch.google.com.
www.google.bj        IN CNAME forcesafesearch.google.com.
www.google.com.bn    IN CNAME forcesafesearch.google.com.
www.google.com.bo    IN CNAME forcesafesearch.google.com.
www.google.com.br    IN CNAME forcesafesearch.google.com.
www.google.bs        IN CNAME forcesafesearch.google.com.
www.google.bt        IN CNAME forcesafesearch.google.com.
www.google.co.bw     IN CNAME forcesafesearch.google.com.
www.google.by        IN CNAME forcesafesearch.google.com.
www.google.com.bz    IN CNAME forcesafesearch.google.com.
www.google.ca        IN CNAME forcesafesearch.google.com.
www.google.cd        IN CNAME forcesafesearch.google.com.
www.google.cf        IN CNAME forcesafesearch.google.com.
www.google.cg        IN CNAME forcesafesearch.google.com.
www.google.ch        IN CNAME forcesafesearch.google.com.
www.google.ci        IN CNAME forcesafesearch.google.com.
www.google.co.ck     IN CNAME forcesafesearch.google.com.
www.google.cl        IN CNAME forcesafesearch.google.com.
www.google.cm        IN CNAME forcesafesearch.google.com.
www.google.cn        IN CNAME forcesafesearch.google.com.
www.google.com.co    IN CNAME forcesafesearch.google.com.
www.google.co.cr     IN CNAME forcesafesearch.google.com.
www.google.com.cu    IN CNAME forcesafesearch.google.com.
www.google.cv        IN CNAME forcesafesearch.google.com.
www.google.com.cy    IN CNAME forcesafesearch.google.com.
www.google.cz        IN CNAME forcesafesearch.google.com.
www.google.de        IN CNAME forcesafesearch.google.com.
www.google.dj        IN CNAME forcesafesearch.google.com.
www.google.dk        IN CNAME forcesafesearch.google.com.
www.google.dm        IN CNAME forcesafesearch.google.com.
www.google.com.do    IN CNAME forcesafesearch.google.com.
www.google.dz        IN CNAME forcesafesearch.google.com.
www.google.com.ec    IN CNAME forcesafesearch.google.com.
www.google.ee        IN CNAME forcesafesearch.google.com.
www.google.com.eg    IN CNAME forcesafesearch.google.com.
www.google.es        IN CNAME forcesafesearch.google.com.
www.google.com.et    IN CNAME forcesafesearch.google.com.
www.google.fi        IN CNAME forcesafesearch.google.com.
www.google.com.fj    IN CNAME forcesafesearch.google.com.
www.google.fm        IN CNAME forcesafesearch.google.com.
www.google.fr        IN CNAME forcesafesearch.google.com.
www.google.ga        IN CNAME forcesafesearch.google.com.
www.google.ge        IN CNAME forcesafesearch.google.com.
www.google.gg        IN CNAME forcesafesearch.google.com.
www.google.com.gh    IN CNAME forcesafesearch.google.com.
www.google.com.gi    IN CNAME forcesafesearch.google.com.
www.google.gl        IN CNAME forcesafesearch.google.com.
www.google.gm        IN CNAME forcesafesearch.google.com.
www.google.gp        IN CNAME forcesafesearch.google.com.
www.google.gr        IN CNAME forcesafesearch.google.com.
www.google.com.gt    IN CNAME forcesafesearch.google.com.
www.google.gy        IN CNAME forcesafesearch.google.com.
www.google.com.hk    IN CNAME forcesafesearch.google.com.
www.google.hn        IN CNAME forcesafesearch.google.com.
www.google.hr        IN CNAME forcesafesearch.google.com.
www.google.ht        IN CNAME forcesafesearch.google.com.
www.google.hu        IN CNAME forcesafesearch.google.com.
www.google.co.id     IN CNAME forcesafesearch.google.com.
www.google.ie        IN CNAME forcesafesearch.google.com.
www.google.co.il     IN CNAME forcesafesearch.google.com.
www.google.im        IN CNAME forcesafesearch.google.com.
www.google.co.in     IN CNAME forcesafesearch.google.com.
www.google.iq        IN CNAME forcesafesearch.google.com.
www.google.is        IN CNAME forcesafesearch.google.com.
www.google.it        IN CNAME forcesafesearch.google.com.
www.google.je        IN CNAME forcesafesearch.google.com.
www.google.com.jm    IN CNAME forcesafesearch.google.com.
www.google.jo        IN CNAME forcesafesearch.google.com.
www.google.co.jp     IN CNAME forcesafesearch.google.com.
www.google.co.ke     IN CNAME forcesafesearch.google.com.
www.google.com.kh    IN CNAME forcesafesearch.google.com.
www.google.ki        IN CNAME forcesafesearch.google.com.
www.google.kg        IN CNAME forcesafesearch.google.com.
www.google.co.kr     IN CNAME forcesafesearch.google.com.
www.google.com.kw    IN CNAME forcesafesearch.google.com.
www.google.kz        IN CNAME forcesafesearch.google.com.
www.google.la        IN CNAME forcesafesearch.google.com.
www.google.com.lb    IN CNAME forcesafesearch.google.com.
www.google.li        IN CNAME forcesafesearch.google.com.
www.google.lk        IN CNAME forcesafesearch.google.com.
www.google.co.ls     IN CNAME forcesafesearch.google.com.
www.google.lt        IN CNAME forcesafesearch.google.com.
www.google.lu        IN CNAME forcesafesearch.google.com.
www.google.lv        IN CNAME forcesafesearch.google.com.
www.google.com.ly    IN CNAME forcesafesearch.google.com.
www.google.co.ma     IN CNAME forcesafesearch.google.com.
www.google.md        IN CNAME forcesafesearch.google.com.
www.google.me        IN CNAME forcesafesearch.google.com.
www.google.mg        IN CNAME forcesafesearch.google.com.
www.google.mk        IN CNAME forcesafesearch.google.com.
www.google.ml        IN CNAME forcesafesearch.google.com.
www.google.com.mm    IN CNAME forcesafesearch.google.com.
www.google.mn        IN CNAME forcesafesearch.google.com.
www.google.ms        IN CNAME forcesafesearch.google.com.
www.google.com.mt    IN CNAME forcesafesearch.google.com.
www.google.mu        IN CNAME forcesafesearch.google.com.
www.google.mv        IN CNAME forcesafesearch.google.com.
www.google.mw        IN CNAME forcesafesearch.google.com.
www.google.com.mx    IN CNAME forcesafesearch.google.com.
www.google.com.my    IN CNAME forcesafesearch.google.com.
www.google.co.mz     IN CNAME forcesafesearch.google.com.
www.google.com.na    IN CNAME forcesafesearch.google.com.
www.google.com.nf    IN CNAME forcesafesearch.google.com.
www.google.com.ng    IN CNAME forcesafesearch.google.com.
www.google.com.ni    IN CNAME forcesafesearch.google.com.
www.google.ne        IN CNAME forcesafesearch.google.com.
www.google.nl        IN CNAME forcesafesearch.google.com.
www.google.no        IN CNAME forcesafesearch.google.com.
www.google.com.np    IN CNAME forcesafesearch.google.com.
www.google.nr        IN CNAME forcesafesearch.google.com.
www.google.nu        IN CNAME forcesafesearch.google.com.
www.google.co.nz     IN CNAME forcesafesearch.google.com.
www.google.com.om    IN CNAME forcesafesearch.google.com.
www.google.com.pa    IN CNAME forcesafesearch.google.com.
www.google.com.pe    IN CNAME forcesafesearch.google.com.
www.google.com.pg    IN CNAME forcesafesearch.google.com.
www.google.com.ph    IN CNAME forcesafesearch.google.com.
www.google.com.pk    IN CNAME forcesafesearch.google.com.
www.google.pl        IN CNAME forcesafesearch.google.com.
www.google.pn        IN CNAME forcesafesearch.google.com.
www.google.com.pr    IN CNAME forcesafesearch.google.com.
www.google.ps        IN CNAME forcesafesearch.google.com.
www.google.pt        IN CNAME forcesafesearch.google.com.
www.google.com.py    IN CNAME forcesafesearch.google.com.
www.google.com.qa    IN CNAME forcesafesearch.google.com.
www.google.ro        IN CNAME forcesafesearch.google.com.
www.google.ru        IN CNAME forcesafesearch.google.com.
www.google.rw        IN CNAME forcesafesearch.google.com.
www.google.com.sa    IN CNAME forcesafesearch.google.com.
www.google.com.sb    IN CNAME forcesafesearch.google.com.
www.google.sc        IN CNAME forcesafesearch.google.com.
www.google.se        IN CNAME forcesafesearch.google.com.
www.google.com.sg    IN CNAME forcesafesearch.google.com.
www.google.sh        IN CNAME forcesafesearch.google.com.
www.google.si        IN CNAME forcesafesearch.google.com.
www.google.sk        IN CNAME forcesafesearch.google.com.
www.google.com.sl    IN CNAME forcesafesearch.google.com.
www.google.sn        IN CNAME forcesafesearch.google.com.
www.google.so        IN CNAME forcesafesearch.google.com.
www.google.sm        IN CNAME forcesafesearch.google.com.
www.google.sr        IN CNAME forcesafesearch.google.com.
www.google.st        IN CNAME forcesafesearch.google.com.
www.google.com.sv    IN CNAME forcesafesearch.google.com.
www.google.td        IN CNAME forcesafesearch.google.com.
www.google.tg        IN CNAME forcesafesearch.google.com.
www.google.co.th     IN CNAME forcesafesearch.google.com.
www.google.com.tj    IN CNAME forcesafesearch.google.com.
www.google.tk        IN CNAME forcesafesearch.google.com.
www.google.tl        IN CNAME forcesafesearch.google.com.
www.google.tm        IN CNAME forcesafesearch.google.com.
www.google.tn        IN CNAME forcesafesearch.google.com.
www.google.to        IN CNAME forcesafesearch.google.com.
www.google.com.tr    IN CNAME forcesafesearch.google.com.
www.google.tt        IN CNAME forcesafesearch.google.com.
www.google.com.tw    IN CNAME forcesafesearch.google.com.
www.google.co.tz     IN CNAME forcesafesearch.google.com.
www.google.com.ua    IN CNAME forcesafesearch.google.com.
www.google.co.ug     IN CNAME forcesafesearch.google.com.
www.google.co.uk     IN CNAME forcesafesearch.google.com.
www.google.com.uy    IN CNAME forcesafesearch.google.com.
www.google.co.uz     IN CNAME forcesafesearch.google.com.
www.google.com.vc    IN CNAME forcesafesearch.google.com.
www.google.co.ve     IN CNAME forcesafesearch.google.com.
www.google.vg        IN CNAME forcesafesearch.google.com.
www.google.co.vi     IN CNAME forcesafesearch.google.com.
www.google.com.vn    IN CNAME forcesafesearch.google.com.
www.google.vu        IN CNAME forcesafesearch.google.com.
www.google.ws        IN CNAME forcesafesearch.google.com.
www.google.rs        IN CNAME forcesafesearch.google.com.
www.google.co.za     IN CNAME forcesafesearch.google.com.
www.google.co.zm     IN CNAME forcesafesearch.google.com.
www.google.co.zw     IN CNAME forcesafesearch.google.com.
www.google.cat       IN CNAME forcesafesearch.google.com.

常見錯誤

IPv6 查詢錯誤

Nov 12 02:25:44 tt named[453]: error (network unreachable) resolving './NS/IN': 2001:200:5f::f#53
Nov 12 02:25:44 tt named[453]: error (network unreachable) resolving './NS/IN': 2001:303:a27::2:30#53
Nov 12 02:25:44 tt named[453]: error (network unreachable) resolving './NS/IN': 2001:abc::35#53
Nov 12 02:25:44 tt named[453]: error (network unreachable) resolving './NS/IN': 2001:def::53#53
Nov 12 02:25:44 tt named[453]: error (network unreachable) resolving './NS/IN': 2001:7cc::1#53

這就直接把 bind 強制用 IPv4 模式跑
編輯 /lib/systemd/system/bind9.service

上略
[Service]
ExecStart=/usr/sbin/named -f -4 -u bind
ExecReload=/usr/sbin/rndc reload
ExecStop=/usr/sbin/rndc stop
systemctl daemon-reload
systemctl restart bind9

RRSIG 問題

如果沒有時間不對 可能造成簽章驗證檢查不過

Nov 12 02:44:57 tt named[2114]: validating @0x7f317c044810: . NS: no valid signature found
Nov 12 02:44:57 tt named[2114]: error (no valid RRSIG) resolving './NS/IN': 123.234.123.234#53
Nov 12 02:44:57 tt named[2114]: validating @0x7f317c044810: . NS: verify failed due to bad signature (keyid=62530): RRSIG validity period has not begun

解決方法: 把時間修正
以下兩步驟

  • 檢查時區設定

    dpkg-reconfigure tzdata

  • 網路校時

    sudo apt-get install ntpdate
    ntpdate clock.stdtime.gov.tw

error (no valid DS) 問題

關閉 DNSSEC
編輯 /etc/bind/named.conf.options

//dnssec-validation auto;
dnssec-validation no;

ref:
http://www.cwssoft.com/?p=1577
https://support.google.com/websearch/answer/186669
https://www.nic.ad.jp/ja/materials/iw/2011/proceedings/d1/d1-07.pdf
http://dnsops.jp/event/20130718/20130718-kume-jipo-blocking-kume-1.pdf