CentOS7|8簡單搭建DNS服務

阿新 • • 發佈：2021-01-23

參考：https://blog.51cto.com/14156658/2411379

一、DNS系統在網路中的作用就是維護一個地址資料庫，其中記錄了各種主機域名與IP地址的對應關係，以便為客戶程式提供正向或反向的地址查詢服務，即正向解析和反向解析
1.解析的型別

正向解析：將域名解析為IP地址，也是最長用的功能

反向解析：將IP地址解析為域名，不是很常用，一些特殊場合會用到
2.DNS系統的型別
1）快取記憶體伺服器
快取使用者解析過的資料，加快訪問速度，節約頻寬資源
2）主名稱伺服器
儲存DNS區域的正本資料，可以新增刪除修改區域中的資料
3）從名稱伺服器
也被稱為輔助DNS伺服器，儲存的DNS區域的副本資料，不能新增修改刪除區域資料只能讀取，主DNS故障輔助DNS接替工作

二、安裝配置DNS
1.安裝DNS配置主配置檔案 dnf install bind bind-utils
1）yum安裝DNS.

[[email protected] ~]# dnf install bind bind-utils
[[email protected] ~]# rpm -qa | grep bind
bind-license-9.11.20-5.el8.noarch
bind-export-libs-9.11.20-5.el8.x86_64
bind-libs-lite-9.11.20-5.el8.x86_64
bind-9.11.20-5.el8.x86_64
python3-bind-9.11.20-5.el8.noarch
bind-libs-9.11.20-5.el8.x86_64
bind-utils-9.11.20-5.el8.x86_64
[ 
[email protected] ~]#

2）修改主配置檔案

[[email protected] ~]# cat /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

options {
	listen-on port 53 { any; };  #修改any
	listen-on-v6 port 53 { ::1; };
	directory 	"/var/named";
	dump-file 	"/var/named/data/cache_dump.db";
	statistics-file "/var/named/data/named_stats.txt";
	memstatistics-file "/var/named/data/named_mem_stats.txt";
	secroots-file	"/var/named/data/named.secroots";
	recursing-file	"/var/named/data/named.recursing";
	allow-query     { any; };  #修改any，允許所有網段使用dns，192.168.100.0.24：只允許100網段使用

	/* 
	 - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
	 - If you are building a RECURSIVE (caching) DNS server, you need to enable 
	   recursion. 
	 - If your recursive DNS server has a public IP address, you MUST enable access 
	   control to limit queries to your legitimate users. Failing to do so will
	   cause your server to become part of large scale DNS amplification 
	   attacks. Implementing BCP38 within your network would greatly
	   reduce such attack surface 
	*/
	recursion yes;

	dnssec-enable yes;
	dnssec-validation yes;

	managed-keys-directory "/var/named/dynamic";

	pid-file "/run/named/named.pid";
	session-keyfile "/run/named/session.key";

	/* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
	include "/etc/crypto-policies/back-ends/bind.config";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
	type hint;
	file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.superred.zones";  #新增自己的zones檔案
include "/etc/named.root.key";

3）新增zone檔案

[[email protected] ~]# cat /etc/named.superred.zones 
zone "superred.org" IN {      #正向解析區域名為superred.org
	type master;              #主DNS伺服器
	file "superred.org.zone"; #正向解析區域配置檔名
	allow-update { none; };
};
zone "3.10.10.in-addr.arpa" IN {  #反向解析區域名
	type master;
	file "10.10.3.arpa";          #反向解析區域配置檔名
	allow-update { none; };      
};

4)檢查DNS主配置檔案時候又錯誤

[[email protected] ~]# named-checkconf -z /etc/named.conf
zone localhost.localdomain/IN: loaded serial 0
zone localhost/IN: loaded serial 0
zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 0
zone 1.0.0.127.in-addr.arpa/IN: loaded serial 0
zone 0.in-addr.arpa/IN: loaded serial 0
zone superred.org/IN: loaded serial 0
zone 3.10.10.in-addr.arpa/IN: loaded serial 0

2.配置正向解析區域配置檔案

1）編輯正向解析區域配置檔案

[[email protected] ~]# cat /var/named/superred.org.zone 
$TTL 1D                                               解析資源記錄有效時間24小時 86400=1D 一天一夜
@	IN SOA	superred.org. root.superred.org. (# 域名為superred.org
					0	; serial
					1D	; refresh            #更新序列號     
					1H	; retry              #重新整理時間24小時
                    15M ;                    #重試時間15分鐘
					1W	; expire             #失效時間1周
					3H ); minimum        #無效解析記錄儲存時間3小時   
	    NS	dns1.superred.org.           #權威伺服器是DNS的完全格式域名
dns1	A	10.10.3.193                  #記錄正向條目
koji	A	10.10.3.157                  #記錄正向條目
ftp	    CNAME	koji                     #記錄某(koji)正向條目的其他名稱
	AAAA	::1

2）新增執行許可權，修改屬主和屬組，檢查配置是否有誤

[[email protected] ~]# cd /var/named
[[email protected] ~]# chmod 755 superred.org.zone 10.10.3.arpa
[[email protected] ~]# chown -R named.named .
[[email protected] named]# named-checkzone superred.org superred.org.zone 
zone superred.org/IN: loaded serial 0
OK

3.配置反向解析區域配置檔案

1）通過正向解析檔案生成反向解析檔案

[[email protected] named]# cat 10.10.3.arpa 
$TTL 1D
@	IN SOA	superred.org. root.superred.org. (
					0	; serial
					1D	; refresh
					1H	; retry
					1W	; expire
					3H )	; minimum
	NS	dns1.superred.org.
193	PTR	dns1.superred.org.
157	PTR	koji.superred.org.

3）檢查反向DNS解析檔案是否錯誤

[[email protected] named]# named-checkzone 3.10.10.in-addr.arpa 10.10.3.arpa 
zone 3.10.10.in-addr.arpa/IN: loaded serial 0
OK

4）啟動DNS伺服器，設定開機自動啟動

[[email protected] named]# systemctl enable named --now

5）使用客戶端驗證是否可以解析

[[email protected] ~]# cat /etc/resolv.conf 
# Generated by NetworkManager
search superred.org
nameserver 10.10.3.193
nameserver 180.76.76.76
nameserver 119.29.29.29
nameserver 223.5.5.5


[[email protected] ~]# nslookup koji.superred.org
Server:		10.10.3.193
Address:	10.10.3.193#53

Name:	koji.superred.org
Address: 10.10.3.157
Name:	koji.superred.org
Address: ::