I have 2 types of industrial computers, and I want to install debian automatically :
- 1 PC with ssd mapped on sda
- 1 PC with ssd mapped on sdb
I have a preseeded debian iso on usb drive for installations.
So, the problem is : when I configure my preseed file, I need to set what is the target disk (sda or sdb), so it cannot work for both, and I didn't find any solution to set "the biggest disk will be the target" (my ssd is 64 GB, my usb drive is 4 GB) or something like this.
I have tried to include udev rules in iso image to always map the ssd on sda, but it does not take in account...
udev rules included (000-install.rules), I have tried those 2 :
KERNEL=="sda*",ENV{ID_FS_LABEL}=="CDROM",NAME="sdb%n"
KERNEL=="sdb*",ENV{ID_FS_LABEL}!="CDROM",NAME="sda%n"
and :
KERNEL=="sda",ENV{DEVTYPE}=="disk",ENV{ID_FS_LABEL}=="CDROM",NAME="sdb"
KERNEL=="sdb",ENV{DEVTYPE}=="disk",ENV{ID_FS_LABEL}!="CDROM",NAME="sda"
My preseed conf file :
#### Contents of the preconfiguration file
### Localization
# Preseeding only locale sets language, country and locale.
# Debian 9 & 10
d-i debian-installer/locale string fr_FR
d-i partman-auto/disk string /dev/sda
d-i partman-auto/method string regular
d-i partman-lvm/device_remove_lvm boolean true
d-i partman-md/device_remove_md boolean true
d-i partman-auto/choose_recipe select multi
d-i partman-partitioning/confirm_write_new_label boolean true
d-i partman/choose_partition select finish
d-i partman/confirm boolean true
d-i partman/confirm_nooverwrite boolean true
## Controlling how partitions are mounted
# The default is to mount by UUID, but you can also choose "traditional" to
# use traditional device names, or "label" to try filesystem labels before
# falling back to UUIDs.
d-i partman/mount_style select label
Result (the file above works when ssd is mapped as sda, but not when it is sdb): installer tell me there is no enough space on sda (so on usb drive...)
First of all i want to tell you "udev was created to respond to hotplug type of events"
for example if you want to trigger a specific script when a specific device is plugged you can use this daemon.
another example of using this daemon is when you want to refuse a specific device to insert to your target machine.
in the other hand the biggest problem for using this approach to solve your issue is this:
The times when udevd is active are:
1: at startup, it parses all the config files and rule files and
builds a rules database in memory.
2: When an event happens, it checks its rule database and performs the
appropriate actions.
please look at this reference
The system initialization
so when codes for partitioning of your device is executed by debien-installer your root filesystem already mounted. therefore you cant unmount a root deivce that was already mounted and simply mount it to another device.
if you want to find the biggest device I suggest you looking at "debian-installer" that can execute udeb packages ( this type of packages can only execute in debian-installer). if you can create a udeb package that can execute a script in which it can detect which disk must be mounted in root system, before mounting root system by partman package you can solve your problem.
look at this reference below in which you can see order of udeb package installation existed in debian installer.
https://d-i.debian.org/doc/internals/apa.html
I expect to be able to resolve the DNS name www.foobar.dev using a DNS server that's running in a VM on my OS/X (High Sierra) system because I have created an /etc/resolver/dev file containing the following one line: (specifying the VM's virtual address)
nameserver ww.xx.yy.zz
... but dig www.foobar.dev continues to consult the Internet nameserver,
while dig #ww.xx.yy.zz www.foobar.dev successfully retrieves the entry from the VM's DNS.
I've used the dscacheutil command to be sure that an errant entry is not in the DNS resolver cache.
So, why isn't the presence of an /etc/resolver/dev file with the specified contents sufficient to direct "anything.dev" to the specified DNS server?
Interestingly – sometimes it seems to work. Also, the command scutil --dns produces the following expected entry, which seems to indicate that the /etc/resolver/dev file is being detected!
resolver #8
domain : dev
nameserver[0] : ww.xx.yy.zz
flags : Request A records
reach : 0x00020002 (Reachable,Directly Reachable Address)
It's probably working fine, you're just testing it wrong. dig (and host and nslookup) don't use the system resolver, nor do they fully implement the system resolver's lookup policy. As a result, they're useful for testing the DNS system itself, but not for testing how the OS uses DNS. The official way to test the system resolver is dscacheutil (e.g. dscacheutil -q host -a name www.foobar.dev), but that's annoyingly verbose, so I tend to just use ping and look at the IP it reports.
As #GordonDavisson in other answer said - ping command is useful for the system resolver testing. My addition is that it also may fail because of DNS cache. Do not forget to clear it:
sudo killall -HUP mDNSResponder
Better replace /etc/resolver files with true DNS config, as just like /etc/resolv.conf this is all legacy stuff kept only for backward compatibility (and maybe because POSIX requires it?).
Here's how you can do it from command line using scutil, it's really simple.
Of course, there is also a programmatic interface to all this.
See Apple's SystemConfiguration Framework.
I'm using Mac OS X 10.10.3 Yosemite. Very recently upgraded from Snow Leopard (10.6.8) to Yosemite.
Step A
On my MacBook, I login into an Admin type privileged account. I installed the latest free XCode from the Apple App Store. With XCode, I also installed Command Line Tools, etc.
Step B
I installed Homebrew from https://brew.sh/. This is the command-line code I ran in Terminal, from the Homebrew website:
ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
The script above checks for the presence of various necessary software & settings, and it showed (info & status inside Terminal window, on) what other commands or tools are needed to be obtained or executed. I followed those.
Step C
When Homebrew & related installation steps were done, I then installed openssl & unbound with the brew tool, via command-lines in Terminal:
brew help
brew update
brew install unbound openssl
sudo cp -fv /usr/local/opt/unbound/*.plist /Library/LaunchDaemons
sudo chown root /Library/LaunchDaemons/homebrew.mxcl.unbound.plist
sudo launchctl load -w /Library/LaunchDaemons/homebrew.mxcl.unbound.plist
brew upgrade --all
Step D
I restarted my MacBook once, and then tried the dig commands below. They did not show the ad flags in DNS query result, which indicates that DNSSEC authenticated DNS resolving is still not working and disabled!
dig #127.0.0.1 in TLSA _443._tcp.www.dnssec-validator.cz. +dnssec
dig #127.0.0.1 in TLSA _443._tcp.www.isc.org. +dnssec
dig #192.168.10.1 in TLSA _443._tcp.www.dnssec-validator.cz. +dnssec
dig #192.168.10.1 in TLSA _443._tcp.www.isc.org. +dnssec
The 192.168.10.1 is my (internet router) gateway for my primary network interface/adapter which is connected to the internet. My net adapter is currently using 192.168.10.50, a dynamic (not fixed) DHCP based IP address.
Unfortunately, the developers at https://unbound.net/ do not provide a standalone Unbound .pkg or .dmg installer file for Mac OS X. They do not actively develop the DNSSEC-Trigger app, either. In Snow Leopard, I was only using the Unbound portion of the DNSSEC-Trigger bundle. I was able to disable the DNSSEC-Trigger portion, and kept the Unbound portion running, after following tips shown in their mailing-list archive. In that way, I did not need to install any XCode command-line tools or Homebrew.
What should I do now so that all apps on my MacBook can use the Unbound DNSSEC resolver for all apps/clients? I want Unbound's resolver to be listening on 127.0.0.1 port 53 for DNSSEC & DNS queries.
These set of steps worked on Mac OS X Yosemite MacBook.
I'm self-answering with general elaboration to make it more clear for newbies, if you are not newbie then please skip whatever is unnecessary for you.
If you don't want to install very large installation of XCode, then see Step E below, first. Otherwise, start with the steps in the original question.
Step E
E1
My own account in Mac OS is Erik-user. It is a standard user account, which I generally use for general purposes.
But the Erik account is for administrative purposes. It is an "Admin" type, privileged user account. I'm using the Erik account.
E2
To enable showing hidden files inside Finder file browser, use the commands below in Terminal:
defaults write com.apple.Finder AppleShowAllFiles TRUE
defaults write com.apple.finder AppleShowAllFiles TRUE
and then log out & log back into your MacOS user account, or restart MacOS. Now "Finder" should show you all files & folders, in [ | | ] column mode.
If you have already installed "XCode" and homebrew, then skip the rest of Step E and continue from Step F.
E3
If you want to avoid installing the multi-gigabyte XCode,
Run this command inside Terminal: xcode-select --install and a new window will appear. In it, select only "Command Line Tools" (CLT) option/portion, even though it suggests that you install full XCode.
Then verify CLT installation: so in Terminal, run: xcode-select -p
If it displays: /Library/Developer/CommandLineTools then CLT installation succeeded.
Mac OS X Yosemite allows you to install only the CLT portion. Some previous Mac OS X versions did not allow CLT without XCode.
Also check if the gcc tool is now present or not: in Terminal, run: gcc --version
E4
Install Homebrew. In Terminal run:
ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
Please see https://brew.sh/ website for the actual & current ruby command.
Then in Terminal, run these commands:
brew help
brew update
brew install unbound openssl
E5
sudo cp -fv /usr/local/opt/unbound/*.plist /Library/LaunchDaemons
sudo chown root:wheel /Library/LaunchDaemons/homebrew.mxcl.unbound.plist
sudo launchctl load -w /Library/LaunchDaemons/homebrew.mxcl.unbound.plist
If you followed Steps E3 to E5, then skip Step F, and start to follow from Step G.
Step F
The homebrew.mxcl.unbound.plist file (which starts the Unbound DNS server) specifically needs to have proper ownership, so that Mac OS X's system itself can start it during boot or restart. Execute this command in Terminal:
sudo chown root:wheel /Library/LaunchDaemons/homebrew.mxcl.unbound.plist
Note: After upgrading Homebrew apps, we may need to execute this command again, if Unbound fails to start after a reboot.
Step G
Download Lingon from SourceForge. Install it. Start Lingon.
Step H
Inside Lingon, locate homebrew.mxcl.unbound under "USER DAEMONS."
In the "What" textbox, it is supposed to show like below:
/usr/local/opt/unbound/sbin/unbound -d -c /usr/local/etc/unbound/unbound.conf
Select & copy that last portion /usr/local/etc/unbound/unbound.conf.
Step I
Open /usr/local/etc/unbound/unbound.conf with your favorite text editor.
Step J: unbound.conf file content
The unbound.conf file has many pages of configuration info & config-command examples.
See below codes, add only these below config-command code lines at bottom of unbound.conf file or in appropriate section.
server:
verbosity: 1
num-threads: 2
interface: 127.0.0.1
interface: ::1
port: 53
do-ip4: yes
do-ip6: yes
do-udp: yes
do-tcp: yes
do-daemonize: yes
#module-config: "[dns64] [validator] iterator"
module-config: "validator iterator"
auto-trust-anchor-file: "/usr/local/etc/unbound/root.key"
#dlv-anchor-file: "/usr/local/etc/unbound/dlv.isc.org.key"
Note: I skipped showing instruction for DLV DNSSEC, so added the (shown-above) # symbol in front of the dlv-anchor-file line, to disable it. And one of the module-config lines is also disabled, as I don't want DNS64 related resolution, for now.
Step K: unbound.conf file permissions
Set file ownership:
sudo chown root /usr/local/etc/unbound/unbound.conf
Set file permissions for different ownerships:
sudo chmod 644 /usr/local/etc/unbound/unbound.conf
A short discourse on file permission and ownership
Permission level 4 = read, 2 = write, 1 = execute. 3-digit number is for 3-types of ownership: Owner-Group-Other.
By using Finder's GUI interface, you can also set permissions & ownerships of a file, instead of using command-lines in Terminal: select a file in Finder, press Cmd+i buttons together, go below in "Sharing & Permissions" section, the "Name" column shows list of users/groups who owns ownership, the "Privilege" column shows file's read/write permissions level for different ownership. Change into recommended choices & preference level shown here.
Except for very reliable person, and only-this computer's core (operating-system) system components, no one else (and no other entity) should have the ability to (edit & change or) write, into some of the sensitive files & folders, that is why we need to set "Permissions-level" on files & folders. The "6" in "644" (which is used in "chmod" command-line) is indicating current-user's (aka "Me") permissions-level, and current user ("Me") has ("6" can be broken down into 4+2) read+write level permissions. The middle "4" in "644" is permission for user-type or user-group, and that group/type of users have ("4") read level permissions. Then right-most side "4" in "644" is permission for Everyone/Other/World users and they have ("4") read level permissions.
Step L: Verify unbound.conf
Check if unbound.conf file configuration has any error, by using this command, in Terminal:
sudo /usr/local/opt/unbound/sbin/unbound-checkconf "/usr/local/etc/unbound/unbound.conf"
Step M: Obtaining a root.key anchor
Follow instruction shown in OPTION-1, if you dont have a "root.key" file for "unbound" DNS server/Resolver, and you want to manually create an "initial" root.key file by yourself with very thorough checking, and if you want unbound DNS Server daemon to update that initial root.key, with a working full root.key code & timestamps.
Follow instruction shown in OPTION-2, if you dont have a (initial or working) "root.key" file, and if you want the "unbound-anchor" tool to QUICKLY create it for you.
Follow instruction shown in OPTION-3, if you dont have a (initial or working) "root.key" file, but you have securely obtained "icannbundle.pem" file, from IANA/ICANN authority website, and you want "unbound-anchor" tool to create it (full working root.key) very securely.
Follow instruction shown in OPTION-4, if you don't have a (initial or working) "root.key" file, but you have access to another "safe" or "secured" computer, where you can securely obtain files from authority websites, or you can copy a working "root.key" file from it, for your MacOSX computer.
M option 1: Manually creating a new root.key
A regular user may want to view or obtain (or manually create) correct "initial" "root.key" (aka, initial root-trust-anchor) via HTTPS (encrypted & non-eavesdropped & secured) connection from IANA authority website: root-anchors.xml, or obtain initial anchor from ICANN authority website, and then regular user MUST compare+verify xml file's content code, with local initial root.key file.
Click on the above xml URL-link, and then check presence of a LOCK-icon shown in web-browser's url-bar (which is an indicative that a HTTPS encrypted connection is being used), and also check color of "DNSSEC-Validator" (and "TLSA-Validator") status icon, (it must display a picture of green-colored KEY-icon).
Either download the xml file or copy-paste the content shown in xml file, into the "root-anchors.xml" file, and place/move it in same folder where "unbound.conf" file is located.
And now copy the file "root-anchors.xml" file in same folder, and rename the "root-anchors Copy.xml" file into "root.key".
And edit this "root.key" file (by using nano or Bluefish text-editor app). And change/re-arrange existing XML syntax/format, into the format shown in below "DS" code line. Make sure all numbers & hash codes in "root.key" are exactly same number & hash, shown on that IANA authority webpage "root-anchors.xml" file. Format/Syntax will be different in those two files, but code & hash numbers must be same.
Currently (June, 2015), the 2010-2011 initial trust anchor (initial root.key) for the root zone, looks like below.
. IN DS 19036 8 2 49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5
And then set file ownership: sudo chown root /usr/local/etc/unbound/root.key
and set permissions: sudo chmod 644 /usr/local/etc/unbound/root.key
Codes shown in above "DS" code-line, (which must also be present in INITIAL "root.key" file), is known as "Initial Anchor". Unbound server daemon or "unbound-anchor" tool can update initial file with a working full root.key, with appropriate codes & timestamps.
M option 2: Creating a new root.key with unbound-anchor using local certificates
Another QUICK (short) way (and not very secure/trustworthy way) to obtain+create the "root.key" file, is to, use the unbound tool "unbound-anchor", via a command in Terminal:
sudo /usr/local/opt/unbound/sbin/unbound-anchor -a "/usr/local/etc/unbound/root.key"
With above command, unbound-anchor tool obtains appropriate codes or files from authority websites (if a newer version is found) by using internal certificates, and then creates the "root.key" file, containing working codes & timestamps.
And then set file ownership on it: sudo chown root /usr/local/etc/unbound/root.key
and set permissions: sudo chmod 644 /usr/local/etc/unbound/root.key
M option 3: Creating a new root.key with unbound-anchor using ICANN certificates
unbound-anchor can also obtain and create a working root.key even more securely, if an icannbundle.pem file is supplied/used.
So 1st obtain icannbundle.pem file securely from the IANA authority website (and make sure your web browser's address bar is showing LOCK-icon & green-colored dnssec KEY-icon), and download the pem file into this directory: /usr/local/etc/unbound
And then set file ownership: sudo chown root /usr/local/etc/unbound/icannbundle.pem
and set permissions: sudo chmod 644 /usr/local/etc/unbound/icannbundle.pem
Then obtain+create a working root.key very securely, by using this command in Terminal:
sudo /usr/local/opt/unbound/sbin/unbound-anchor -a "/usr/local/etc/unbound/root.key" -c "/usr/local/etc/unbound/icannbundle.pem"
With above command, unbound-anchor tool obtains appropriate codes or files from authority websites (if a newer version is found) by using internal certificates, and then checks authenticity of received code by using the icannbundle.pem cryptographic key file, and then creates the "root.key" file, containing working codes & timestamps.
And now we can set file ownership on root.key: sudo chown root /usr/local/etc/unbound/root.key
and set permissions: sudo chmod 644 /usr/local/etc/unbound/root.key
For more detail info, goto: https://unbound.net/documentation/howto_anchor.html and also check https://unbound.net/documentation/unbound-anchor.html
M option 4: Obtaining a root.key from another computer where it has been created
Note: User/visitor suppose to use already pre-setup safe computer & web-browser software to "securely" obtain/download those files (root-anchors.xml, or, icannbundle.pem, etc) from ICANN or IANA authority website. Web-browser software, MUST have "DNSSEC-Validator" (and "TLSA-Validator") (also known as DNSSEC/TLSA-Validator) extension/addon (from this https://www.dnssec-validator.cz/ website), and that computer must also have a local full DNSSEC supported DNS Server or resolver.
And then in such web-browser, a user/visitor can see correct DNSSEC & DANE/TLSA status icon (green-colored KEY-icon), for each visiting websites (which are appropriately DNSSEC-Signed).
If an "unbound" DNS Server/Resolver is used in that "SAFE" & "SECURED" computer, then you can copy that "root.key" file from it, into your MacOSX computer, when you want to avoid going into authority websites & want to avoid checking very thoroughly, and when you want to quickly configure a 2nd/other computer.
Also load these firefox extensions/addons, and then enable "add-on bar" (similar to statusbar) at bottomside of firefox, for viewing more info on web server location & reverse DNS address, and more info on server's TLS/SSL certificate:
CipherFox, Cert Viewer Plus, Calomel SSL Validation, HTTPS-Everywhere, WorldIP, Classic Theme Restorer, etc.
Step N
In your Mac OS X computer, goto "System Preferences" > Network > choose each "WiFi" and each "Ethernet" Network Interface Card/Adapter, which is/are connected with internet in your Apple MacBook computer > goto/click "Advanced" > goto "DNS" tab > (write-down which adapter has which set of DNS Servers in a paper, and then, one by one adapter) remove the DNS-servers which are listed there, and make sure, that, only one DNS server is listed/specified: 127.0.0.1
Above steps will create+add "nameserver 127.0.0.1" code, inside /etc/resolv.conf file.
Step O
If you are using 10.10.3 or earlier, then keep mDNS (mDNSResponder) completely disabled. By using "Lingon" app, look for mDNS ("com.apple.mDNSResponder"), check all 4 sections inside Lingon, specially under SYSTEM DAEMONS, click on the text "Show" next to each section, to view full list.
mDNS is re-included back in 10.10.4 (by Apple updates), so if you are using 10.10.4 then disable it temporarily just for these steps-o.
If it is active or found in 10.10.3 or earlier, then uncheck/unselect the "Enabled" option in Lingon to disable it, enter administrative user pass, save/ok.
When mDNS is active, it starts to resolve DNS and it also does bunch of other activity automatically, (like, discovering & configuring UPnP IGD & NAT-PMP, etc) without taking computer-owner's permission or without showing any info (or table of info) to computer's owner, what exactly its doing. So mDNS does not show computer's owner, any information on which apps are allowed by it, to do what, and what port/traffic activities are going on on or through your computer, etc, none are displayed to computer's owner, so mDNS is not an app with some good technologies for people & their computer's safety & security & privacy in mind. And mDNS by itself does not support full DNSSEC either, unless at-least one local/remote BIND or Unbound full dnssec dns server is used.
Step P
If you are using 10.10.3 or earlier, then disable it temporarily just for these steps-p. By using Lingon, find "com.apple.networking.discoveryd" under SYSTEM DAEMONS. Uncheck/unselect the "Enabled" option in Lingon to disable it temporarily, enter administrative user pass, save/ok. We are disabling it, so that it can completely forget the previous/old DNS Servers, which were obtained from network adapter's DNS setting, (it will forget after one restart from this stage).
Discoveryd is removed from 10.10.4 (by Apple updates), so if you are using 10.10.4 then disable it completely, if still exists.
Step Q
By using Lingon, find "com.apple.dnsextd" under SYSTEM DAEMONS. Uncheck/unselect the "Enabled" option in Lingon to disable/de-activate it, enter administrative user pass, save/ok.
Step R
In Terminal, run
dig #127.0.0.1 in TLSA _443._tcp.www.isc.org. +dnssec
And open "App Store" and see if it can pull homepage contents/items.
Reboot/restart MacOSX once.
Step S
S1
If you are using 10.10.3 or earlier, then enable "discoveryd" back, now, at this stage of this instruction steps-s. Again use Lingon, find the "com.apple.networking.discoveryd". Select/checkmark the "Enabled" option, enter administrative user pass, save/ok.
Discoveryd is removed from 10.10.4 (by Apple updates), so if you are using 10.10.4, then still keep "discoveryd" disabled, if still exists.
S2
If you are using 10.10.4 or later, then enable "mDNS" back, now, at this stage. Again use Lingon, find the "com.apple.mDNSResponder" under SYSTEM DAEMONS. Select/checkmark the "Enabled" option, enter administrative user pass, save/ok.
S3
Many apps use system/default DNS resolving when allowed & serviced by the (above shown) "discoveryd" daemon (aka, Discovery Daemon), in 10.10.3 & earlier Mac OS X, or DNS resolving service is allowed to be accessed by mDNS daemon in 10.10.4 or later Mac OS X. Either of this daemon should be now able to learn & allow other apps to use the new DNSSEC DNS Server service running at 127.0.0.1 port-53, which is specified in Network adapter's DNS settings, (after one restart from this stage).
Step T
In Terminal, run
dig #127.0.0.1 in TLSA _443._tcp.www.isc.org. +dnssec
And open "App Store" and see if it can pull homepage contents/items.
Reboot/restart one more time again.
Step U
Now in Terminal, run below "dig" commands, and check if query results are showing "ad" in flag, and status is showing "NOERROR". If those indicators are present, then full dnssec dns resolving is working from a local dnssec resolver, running-at & listening-on 127.0.0.1 port 53/DNS. :)
dig #127.0.0.1 in TLSA _443._tcp.www.dnssec-validator.cz. +dnssec
dig #127.0.0.1 in TLSA _443._tcp.www.isc.org. +dnssec
dig #127.0.0.1 in TLSA _443._tcp.www.statdns.net. +dnssec
ping yahoo.com
nslookup yahoo.com
If nslookup or ping worked, then it indicates that the default DNS Server is working.
Remove the "#127.0.0.1" portion from above "dig" commands, and check if results are same (that is, "ad" flag is still shown, and if dig results are still showing it has by-default used the 127.0.0.1 as DNS server), then it is indicating, by default local 127.0.0.1 DNS Server is being used as system-wide DNS Server/Resolver (for allmost all apps/tools), and dnssec based resolving is also working.
Step V
Some tools & apps do not completely use other DNS servers, they contain their own internal full DNSSEC/DNS resolving library & related codes or contains partial library-codes, so checking DNS with only such tools are not enough.
You must check it via other apps (which you daily use or) which are known to use system network adapter's DNS servers.
So you must fireup Firefox and Apple App Store, and check if you can see & visit all websites normally, as those apps will be using the "default" (aka, "system") DNS resolver/server, which is now set-to 127.0.0.1 by us, what we have specified inside network adapter configuration.
Step W
Firewall based restrictions & assistance:
By using application-aware firewall + network port/packet control firewall, if we set firewall-rules shown below, then entire system can be FORCED TO USE, only ONE full dnssec DNS Server/Resolver 127.0.0.1 & nothing else:
system-wide/global firewall rule #1: only "unbound" app can connect with any other DNS-Server's port 53/DNS using TCP or UDP connection.
system-wide/global firewall rule #2: any app/software which is NOT-"unbound", can only use one "unbound" DNS-Server running-at & listening-on 127.0.0.1 port 53/DNS using TCP or UDP connection. (So all other port 53 traffics are dropped for non-unbound app/software).
Steps X and Y
(Deleted)
Step Z: Notes, Disclaimers, and References
I have followed (and borrowed instructions, and discussion comments from) various other websites, (and copy-pasted instructions & comments here with slight modifications done by me). Some references i showed, under the paragraph, when related content was first mentioned, in this article/answer page. So, for even more detail understanding, please search in ddg/yahoo/bing/google engines with terms/words taken from here.
Different computer may & very likely to have different versions and configurations and components. So you MUST research & use your own best educated knowledge & judgement, before using any of these shown instructions on your own computer at your own risk.
From the command-line, I need to list all the AFP shares available from a given server on a local network.
I can browse the available servers that provides AFP as follow:
iMac:bin me$ dns-sd -B _afpovertcp._tcp
Browsing for _afpovertcp._tcp
Timestamp A/R Flags if Domain Service Type Instance Name
10:36:36.531 Add 3 4 local. _afpovertcp._tcp. iMac
10:36:36.547 Add 3 5 local. _afpovertcp._tcp. iMac
10:36:36.547 Add 3 4 local. _afpovertcp._tcp. box
10:36:36.547 Add 2 5 local. _afpovertcp._tcp. box
^C
And now I want to know what shares are available from "iMac" for instance (the ones that are displayed by the Finder when you clic on the server icon in the "Shares" left-column view) ?
PS I already found many threads about this (here and here), but they are unanswered for this specific topic.
Have alook at this one:
https://nmap.org/nsedoc/scripts/afp-showmount.html
I could get the info about available afp-shares with nmap...
My command:
nmap -p 548 --script afp-showmount --script-args afp.username=yourusername,afp.password=yourpassword yourserveraddress
I ended up here looking for this answer:
sudo sharing -l
Well, either you want the list of the mounted afp shares, then you can issue a mount command and you will get something like:
//someUser#someServer._afpovertcp._tcp.local/path on /Volumes/path (afpfs, nodev, nosuid, mounted by someUser)
Or you want to know what shares could be available for mounting… and unfortunately that's not easy since you first need to log in as a user to list the available shares for you to mount. Different users may see different shares for the same server.