OS Builder/Add OpenDNS Configuration

Using OS Builder, you can install a script on the XO that will force DNS resolution through a DNS server that blocks servers with inappropriate content when users are connected via a conventional ISP outside of school. This complements a filtering solution applied on the School Server.

This has some pre-requisites:

• You must have one or two DNS servers with public IP addresses.
• Local ISPs must not block DNS traffic to other servers. In other words, they must allow connected clients to use an alternative DNS service.
• Your school servers (if any) must have a common "base" to their FQDN.

Steps

• Create your OpenDNS account
• Configure your public DNS server
• Customize the script to your server and "base domain name"
• Create the OS image with the script

Create your OpenDNS account

If you have not done so yet, create your OpenDNS account!

Configure your public DNS server

• Install one or more DNS servers with a public IP address. Make sure you can use that IP address for a long time -- if you later need to change the IP address of the DNS server it will be a major problem.
• Configure the DNS service (for example, BIND) to only be a "forwarder" -- serving no names of its own, only forwarding to the OpenDNS servers.
• Configure your OpenDNS account to associate the IP address of your DNS server to your account, so that any custom filtering options are applied to your traffic.
• Test that custom filtering options are working (for example, by temporarily blacklisting a given domain name for the test).

Customize script

Overview: The script gets called when Network Manager establishes a connection. It must determine whether we are in the school network (controlled by the XS) or not. If we are not in the school network, then it must force-apply the DNS server configuration, overwriting the configuration from NM (which in turn is usually obtained via DHCP).

The script must be stored at /etc/NetworkManager/dispatcher.d/000-override-nameserver, and be executable.

#!/bin/sh
# Copyright (C) 2010 One Laptop Per Child Association, Inc.
# Licensed under the terms of the GNU GPL v2 or later; see COPYING for details.
# Written by Martin Langhoff <martin@laptop.org>

# REPLACE with the base domain for your servers
basedomain="xs\.base\.domain\.tld"

# REPLACE with IP addresses of your DNS servers
PRIMARYDNS="208.67.222.222"
SECONDARYDNS="208.67.220.220" 

if="$1"
updown="$2"

if [ "$updown" = "up" ]; then
    # 
    # no confundirse con iparatodos como ISP
    if ! grep -q "^search [0-9]*\.$basedomain" /etc/resolv.conf; then
        # reemplazar resolv.conf
        echo "# Overwritten by 000-override-nameserver" > /etc/resolv.conf
        echo nameserver $PRIMARYDNS   >> /etc/resolv.conf
        echo nameserver $SECONDARYDNS >> /etc/resolv.conf  
    fi
fi

Notes

The configuration hereuses

Alternative: Use OpenDNS "Nomad" service

See [1]. Using the Nomad service requires an arrangement with OpenDNS, and installing the client software.