GnuPG (GPG) 是一套完全免費的軟體( GnuPG is the GNU project's complete and free implementation of the OpenPGP standard as defined by RFC4880 . )，也有在實務的商務中使用，安全性很高值得一用。
GnuPG 概念：
GPG, like PGP (Pretty Good Privacy), uses a key pair. This means that
when you generate a key, you will create a public copy as well as
private copy. The private copy is your copy used to decrypt an incoming
file as well sign an outgoing file (but for our purposes, we are only
using it to decrypt). The public key is the key you give to the public,
which is used to encrypt the files coming to you. First we will create
your own key.
These keys are stored in key rings. For GPG, they
are stored in the directory that the GPG files were copied into. They
are both named with a .GPG extension, and are called pubring.GPG and secring.GPG(to denote the public key ring and the private key ring, respectively).
Installing bind (9.6.1.3-4) to root...
Downloading http://ipkg.nslu2-linux.org/feeds/optware/cs08q1armel/cross/unstable/bind_9.6.1.3-4_arm.ipk
Installing openssl (0.9.8v-2) to root...
Downloading http://ipkg.nslu2-linux.org/feeds/optware/cs08q1armel/cross/unstable/openssl_0.9.8v-2_arm.ipk
Installing psmisc (22.17-1) to root...
Downloading http://ipkg.nslu2-linux.org/feeds/optware/cs08q1armel/cross/unstable/psmisc_22.17-1_arm.ipk
Configuring bind
Running post-install
You must now create your named.conf file
When it is installed in /opt/etc/named/named.conf, execute
/opt/etc/init.d/S09named start
to start service
You will probably also want to create rndc.conf by running
rndc-confgen. Of course, you may want to set your name server
in the GUI to 127.0.0.1 or your local ip-address
Configuring openssl
Configuring psmisc
update-alternatives: Linking //opt/bin/killall to /opt/bin/psmisc-killall
update-alternatives: Linking //opt/bin/pidof to /opt/bin/psmisc-killall
Successfully terminated.
// log to /var/log/named/example.log all events from info UP in severity (no debug)
// defaults to use 3 files in rotation
// BIND 8.x logging MUST COME FIRST in this file
// BIND 9.x parses the whole file before using the log
// failure messages up to this point are in (syslog) /var/log/messages
//
//logging {
// channel weidns_log {
// file "/var/log/weidns.log" versions 3 size 2m;
// severity info;
// print-severity yes;
// print-time yes;
// print-category yes;
//};
//category default {
// weidns_log;
//};
//};
// Add local zone definitions here.
zone "localhost" {
type master;
file "db.localhost";
allow-update { none; };
notify no;
};
zone "0.0.127.in-addr.arpa" {
type master;
file "db.localhost.rev";
allow-update { none; };
notify no;
};
zone "weidns.com" {
type master;
file "db.weidns.com";
allow-update { key "rndc-key"; };
notify yes;
};
zone "2.168.192.in-addr.arpa" {
type master;
file "db.192.168.2.rev";
allow-update { key "rndc-key"; };
notify yes;
};
zone "." {
type hint;
file "root.servers";
};
include "/opt/etc/named/rndc.key";
db.localhost
;Goes in /opt/etc/named/db.localhost
$TTL 86400 ; 24 hours could have been written as 24h
$ORIGIN localhost.
; line below = localhost 1D IN SOA localhost root.localhost
@ 1D IN SOA @ root (
2013030301 ; serial
3H ; refresh
15 ; retry
1w ; expire
3h ; minimum
)
@ 1D IN NS @
1D IN A 127.0.0.1
db.localhost.rev
;Goes in /opt/etc/named/db.localhost.rev
$TTL 86400 ;
; could use $ORIGIN 0.0.127.IN-ADDR.ARPA.
@ IN SOA localhost. root.localhost. (
2013030301 ; Serial
3h ; Refresh
15 ; Retry
1w ; Expire
3h ) ; Minimum
IN NS localhost.
1 IN PTR localhost.
db.weidns.com
; weidns.com
;Goes in /opt/etc/named/db.weidns.com
$TTL 604800
@ IN SOA ns1.weidns.com. root.weidns.com. (
2013030301 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800) ; Negative Cache TTL
;
@ IN NS ns1
IN MX 10 mail
IN A 192.168.2.3
ns1 IN A 192.168.2.3
mail IN A 192.168.2.3
db.192.168.2.rev
;Goes in /opt/etc/named/db.192.168.2.rev
$TTL 86400 ; 1 day
$ORIGIN 2.168.192.in-addr.arpa.
@ 1D IN SOA ns1.weidns.com. root.weidns.com. (
2006080801 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800) ; Negative Cache TTL
;
; Name servers
3 IN NS ns1.weidns.com.
;
; Fixed host mappings allegedly inserted by DDNS
root.servers
Step 6：啟動 DNS
/opt/etc/init.d/S09named start /opt/etc/init.d/S09named restart /opt/etc/init.d/S09named status
Step 7： 驗證 DNS
可以使用 dig 的指令來利用此 DNS 服務，來反查是否正常運作
dig @ polinwei.blogspot.com
可以使用 named -g 來偵錯
讓 DNS 在開機時自動執行
DNS 既然要提供服務，自然希望QNAP開機時可以自動執行。這裡您會發現QNAP系統跟其它主流Linux發行版本其中一個很不一樣的地方：它沒有完整支援upstart或者init.d來啟動服務。根據QNAPedia的這篇文章，節錄相關步驟：
查看 /etc/config/qpkg.conf 這個檔案：
# cat /etc/config/qpkg.conf
宣告一個autorun套件來利用ipkg自動啟動機制：
[autorun]
Name = autorun
Version = 0.1
Author = PolinWei
Date = 2013-06-08
Shell = /share/MD0_DATA/.qpkg/autorun/autorun.sh
Install_Path = /share/MD0_DATA/.qpkg/autorun
Enable = TRUE
Country Name為國籍鍵入TW
State or Province Name為省份鍵入Taiwan
Locality Name為所在地
Organization Name為組織名稱
Organizational Unit Name為組織內單位
Common Name為domain name
Email Address為管理者的電子信箱
剩餘兩項可不填入
-genkey：在用戶主目錄中創建一個預設檔".keystore",還會產生一個mykey的別名，mykey中包含用戶的公開金鑰、私密金鑰和證書(在沒有指定生成位置的情況下,keystore會存在使用者系統預設目錄，如：對於windows系統，會生成在系統的C:\Documents and Settings\UserName\檔案名為“.keystore”)
