OS Builder/Add OpenDNS Configuration

Using OS Builder, you can install a script on the XO that will force DNS resolution through a DNS server that blocks servers with inappropriate content when users are connected via a conventional ISP outside of school. This complements a filtering solution applied on the School Server.

This has some pre-requisites:

• You must have one or two DNS servers with public IP addresses.
• Local ISPs must not block DNS traffic to other servers. In other words, they must allow connected clients to use an alternative DNS service.
• Your school servers (if any) must have a common "base" to their FQDN.

Steps

• Create your OpenDNS account
• Configure your public DNS server
• Customize the script to your server and "base domain name"
• Create the OS image with the script

Create your OpenDNS account

If you have not done so yet, create your OpenDNS account!

Configure your public DNS server

• Install one or more DNS servers with a public IP address. Make sure you can use that IP address for a long time -- if you later need to change the IP address of the DNS server it will be a major problem.
• Configure the DNS service (for example, BIND) to only be a "forwarder" -- serving no names of its own, only forwarding to the OpenDNS servers.
• Configure your OpenDNS account to associate the IP address of your DNS server to your account, so that any custom filtering options are applied to your traffic.
• Test that custom filtering options are working (for example, by temporarily blacklisting a given domain name for the test).

Customize script

Overview: The script gets called when Network Manager establishes a connection. It must determine whether we are in the school network (controlled by the XS) or not. If we are not in the school network, then it must force-apply the DNS server configuration, overwriting the configuration from NM (which in turn is usually obtained via DHCP).

The script must be stored at /etc/NetworkManager/dispatcher.d/000-override-nameserver, and be executable.

#!/bin/sh
# Copyright (C) 2010 One Laptop Per Child Association, Inc.
# Licensed under the terms of the GNU GPL v2 or later; see COPYING for details.
# Written by Martin Langhoff <martin@laptop.org>

# REPLACE with the base domain for your servers
basedomain="xs\.base\.domain\.tld"

# REPLACE with IP addresses of your DNS servers
PRIMARYDNS="208.67.222.222"
SECONDARYDNS="208.67.220.220" 

if="$1"
updown="$2"

if [ "$updown" = "up" ]; then
    # 
    # no confundirse con iparatodos como ISP
    if ! grep -q "^search [0-9]*\.$basedomain" /etc/resolv.conf; then
        # reemplazar resolv.conf
        echo "# Overwritten by 000-override-nameserver" > /etc/resolv.conf
        echo nameserver $PRIMARYDNS   >> /etc/resolv.conf
        echo nameserver $SECONDARYDNS >> /etc/resolv.conf  
    fi
fi

If you do not have local School Servers, it is still recommended that you define a "base" domain name and configure it. This allows you to deploy School Servers later if desired.

Create the OS image

Use OS Builder's "custom_scripts" to install the above script into your OS image. In your olpc-os-builder configuration file, add a "custom_scripts" section, or add to the existing one...

[custom_scripts]
custom_scripts1=/home/xobuilds/scripts/install-000-override-nameserver

And now create that installer script, which should look like:

#!/bin/sh
set -e

cat > "$INSTALLROOT/etc/NetworkManager/dispatcher.d/000-override-nameserver" <<'EOF'
{ Here, place the content of the 001-nameserver-override script,
  edited to have the correct configuration for your deployment.  } 

EOF
chmod 755 "$INSTALLROOT/etc/NetworkManager/dispatcher.d/000-override-override"

Alternative: Use OpenDNS "Nomad" service

See OpenDNS Nomad. This can potentially save you from the hassle of running your own forwarding DNS servers. Using the Nomad service requires

• prior arrangement with OpenDNS
• good local connectivity to the OpenDNS servers
• installing and configuring the client software

This alternative involves more work and will probably be significantly slower for deployments outside USA.