DNS web管理之NamedManager
阿新 • • 發佈：2018-04-30
DNS一、下載NamedManager的RPM包
[root@dns ~]# hostname dns.test.cn [root@dns named]# cat /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 192.168.10.206 dns.test.cn [root@dns ~]# ifconfig |grep 192.168 inet addr:192.168.10.206 Bcast:192.168.10.255 Mask:255.255.255.0 [root@dns named]# ping dns.test.cn PING dns.test.cn (192.168.10.206) 56(84) bytes of data. 64 bytes from dns.test.cn (192.168.10.206): icmp_seq=1 ttl=64 time=0.027 ms 64 bytes from dns.test.cn (192.168.10.206): icmp_seq=2 ttl=64 time=0.043 ms ...... [root@dns ~]# cd /usr/local/src/ [root@dns src]# wget http://repos.jethrocarr.com/pub/amberdms/linux/centos/6/amberdms-custom/i386/namedmanager-bind-1.8.0-1.el6.noarch.rpm [root@dns src]# wget http://repos.jethrocarr.com/pub/amberdms/linux/centos/6/amberdms-custom/i386/namedmanager-www-1.8.0-1.el6.noarch.rpm [root@dns src]# ll total 1352 -rw-r--r--. 1 root root 109584 Dec 22 2013 namedmanager-bind-1.8.0-1.el6.noarch.rpm -rw-r--r--. 1 root root 1270108 Dec 22 2013 namedmanager-www-1.8.0-1.el6.noarch.rpm
二、安裝NamedManager
[root@dns src]# yum install perl httpd mod_ssl mysql-server php php-intl php-ldap php-mysql php-soap php-xml 修改/etc/httpd/conf/httpd.conf [root@dns src]# vim /etc/httpd/conf/httpd.conf ...... ServerName dns.test.cn:80 [root@dns src]# service mysqld start [root@dns src]# service httpd start [root@dns src]# lsof -i:3306 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME mysqld 16589 mysql 10u IPv4 77732 0t0 TCP *:mysql (LISTEN) [root@dns src]# lsof -i:80 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME httpd 16621 root 4u IPv6 77759 0t0 TCP *:http (LISTEN) httpd 16623 apache 4u IPv6 77759 0t0 TCP *:http (LISTEN) httpd 16624 apache 4u IPv6 77759 0t0 TCP *:http (LISTEN) httpd 16625 apache 4u IPv6 77759 0t0 TCP *:http (LISTEN) httpd 16626 apache 4u IPv6 77759 0t0 TCP *:http (LISTEN) httpd 16627 apache 4u IPv6 77759 0t0 TCP *:http (LISTEN) httpd 16628 apache 4u IPv6 77759 0t0 TCP *:http (LISTEN) httpd 16629 apache 4u IPv6 77759 0t0 TCP *:http (LISTEN) httpd 16630 apache 4u IPv6 77759 0t0 TCP *:http (LISTEN) [root@dns src]# chkconfig mysqld on [root@dns src]# chkconfig httpd on [root@dns src]# mysqladmin -u root password 123456 [root@dns src]# rpm -Uvh namedmanager-www-1.8.0-1.el6.noarch.rpm [root@dns src]# cd /usr/share/namedmanager/resources/ [root@dns resources]# ./autoinstall.pl autoinstall.pl This script setups the NamedManager database components: * NamedManager MySQL user * NamedManager database * NamedManager configuration files THIS SCRIPT ONLY NEEDS TO BE RUN FOR THE VERY FIRST INSTALL OF NAMEDMANAGER. DO NOT RUN FOR ANY OTHER REASON Please enter MySQL root password (if any): 123456 //輸入mysql密碼 Searching ../sql/ for latest install schema... ../sql//version_20131222_install.sql is the latest file and will be used for the install. Importing file ../sql//version_20131222_install.sql Creating user... Updating configuration file... DB installation complete! You can now login with the default username/password of setup/setup123 at http://localhost/namedmanager [root@dns resources]# cd /usr/local/src/ [root@dns src]# yum install bind php-process [root@dns src]# rpm -Uvh namedmanager-bind-1.8.0-1.el6.noarch.rpm 修改/etc/named.conf [root@dns src]# cp /etc/named.conf /etc/named.conf.bak [root@dns src]# vim /etc/named.conf options { listen-on port 53 { any; }; // listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; allow-query { any; }; allow-query-cache { any; }; //DNS查詢的緩存功能。實際上不建議開啟此功能，即刪除這一行配置。如果打開了，當DNS解析修改後，因為緩存原因，需等待一段時間才能生效。 recursion yes; forward first; forwarders { 223.5.5.5; 223.6.6.6; 8.8.8.8; 8.8.4.4; }; dnssec-enable yes; dnssec-validation yes; dnssec-lookaside auto; bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic"; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "." { type hint; file "named.ca"; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key"; include "/etc/named.namedmanager.conf";
如果要bind可以在chroot的模式下運行
[root@dns src]# yum install bind-chroot
建立“/etc/named.namedmanager.conf”文件的硬連接
[root@dns src]# ln /etc/named.namedmanager.conf /var/named/chroot/etc/named.namedmanager.conf如果不建立硬連接named啟動時，會提示找不到“/etc/named.namedmanager.conf”。
這是因為：
bind-chroot是bind的一個功能，使bind可以在一個chroot的模式下運行。也就是說,bind運行時的/(根)目錄,並不是系統真正的/(根)目錄，只是系統中的一個子目錄而已。
chroot可以改變程序運行時所參考的根目錄(/)位置，即將某個特定的子目錄作為程序的虛擬根目錄，並且對程序運行時可以使用的系統資源，用戶權限和所在目錄進行嚴格控制，程序只在這個虛擬的根目錄下具有權限，一旦跳出該目錄就無任何權限。例如在centos中，/var/name/chroot實際上是根目錄(/)的虛擬目錄，所以虛擬目錄中的/etc目錄實際上是/var/named/chroot/etc目錄，而/var/named目錄實際上是/var/named/chroot/var/named目錄。chroot功能的優點是：如果有黑客通過Bind侵入系統，也只能被限定在chroot目錄及其子目錄中，其破壞力也僅局限在該虛擬目錄中，不會威脅到整個服務器的安全。
三、啟動Named服務
[root@dns src]# service named start
[root@dns src]# chkconfig named on
[root@dns src]# lsof -i:53
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
named 16864 named 20u IPv4 81946 0t0 TCP localhost:domain (LISTEN)
named 16864 named 21u IPv4 81948 0t0 TCP 192.168.10.206:domain (LISTEN)
named 16864 named 512u IPv4 81945 0t0 UDP localhost:domain
named 16864 named 513u IPv4 81947 0t0 UDP 192.168.10.206:domain
修改/etc/namedmanager/config-bind.php
[root@dns src]# cp /etc/namedmanager/config-bind.php /etc/namedmanager/config-bind.php.bak
[root@dns src]# vim /etc/namedmanager/config-bind.php
.......
$config["api_url"] = "http://192.168.10.206/namedmanager"; // 應用程序的安裝位置
$config["api_server_name"] = "dns.test.cn"; // 此處必須與httpd配置裏的Name Server名稱一致
$config["api_auth_key"] = "Dns";
......四、設置防火墻
namedmanager部署機本機要麽關閉iptables，要麽安裝如下設置：
[root@dns src]# setenforce 0
[root@dns src]# getenforce
[root@dns src]# vim /etc/sysconfig/selinux
.......
SELINUX=disabled
[root@dns src]# iptables -F
[root@dns src]# iptables -P INPUT DROP
[root@dns src]# iptables -P FORWARD DROP
[root@dns src]# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
[root@dns src]# iptables -A INPUT -i lo -p all -j ACCEPT
[root@dns src]# iptables -A INPUT -p icmp -j ACCEPT
[root@dns src]# iptables -A INPUT -p tcp --dport 22 -j ACCEPT
[root@dns src]# iptables -A INPUT -p tcp --dport 53 -j ACCEPT
[root@dns src]# iptables -A INPUT -p udp --dport 53 -j ACCEPT
[root@dns src]# iptables -A INPUT -p tcp --dport 80 -j ACCEPT
[root@dns src]# iptables -A INPUT -p tcp --dport 443 -j ACCEPT
禁用IPV6。添加域名記錄（正向解析與反向解析）。設置開機啟動服務，並重啟服務器。
[root@dns src]# vim /etc/modprobe.d/dist.conf //文件結尾添加如下內容：
......
alias net-pf-10 off
alias ipv6 off
chkconfig ip6tables off
[root@dns src]# chkconfig httpd on
[root@dns src]# chkconfig mysqld on
[root@dns src]# chkconfig named on
[root@dns src]# init 6 //或者執行"reboot"五、web端設置
訪問http://192.168.10.206/namedmanager，
默認用戶名和密碼（setup，setup123）。
不要忘記在用戶管理中修改用戶名和密碼。
1、設置API KEY（Configuration）
2、添加Name Servers
3、添加正向解析
4、添加反向解析
驗證：
[root@dns ~]# cd /var/named/
[root@dns named]# ll
total 40
-rw-r--r--. 1 root root 490 Apr 7 14:48 10.168.192.in-addr.arpa.zone
drwxr-x---. 7 root named 4096 Apr 7 13:37 chroot
drwxrwx---. 2 named named 4096 Apr 7 13:39 data
drwxrwx---. 2 named named 4096 Apr 7 14:40 dynamic
-rw-r--r--. 1 root root 455 Apr 7 14:45 test.cn.zone
-rw-r-----. 1 root named 3289 Apr 11 2017 named.ca
-rw-r-----. 1 root named 152 Dec 15 2009 named.empty
-rw-r-----. 1 root named 152 Jun 21 2007 named.localhost
-rw-r-----. 1 root named 168 Dec 15 2009 named.loopback
drwxrwx---. 2 named named 4096 Jan 22 20:57 slaves
A記錄的正向解析配置為：
[root@dns named]# cat test.cn.zone
$ORIGIN test.cn.
$TTL 120
@ IN SOA dns.test.cn. admin.kevin.com. (
2018040703 ; serial
21600 ; refresh
3600 ; retry
604800 ; expiry
120 ; minimum ttl
)
; Nameservers
test.cn. 86400 IN NS dns.test.cn.
; Mailservers
; Reverse DNS Records (PTR)
; CNAME
; HOST RECORDS
db01 120 IN A 192.168.10.205
db02 120 IN A 192.168.10.209
dns 120 IN A 192.168.10.206
web01 120 IN A 192.168.10.202
web02 120 IN A 192.168.10.203
PTR記錄的反向解析配置為：
[root@dns named]# cat 10.168.192.in-addr.arpa.zone
$ORIGIN 10.168.192.in-addr.arpa.
$TTL 120
@ IN SOA dns.test.cn. admin.kevin.com. (
2018040704 ; serial
21600 ; refresh
3600 ; retry
604800 ; expiry
120 ; minimum ttl
)
; Nameservers
10.168.192.in-addr.arpa. 86400 IN NS dns.test.cn.
; Mailservers
; Reverse DNS Records (PTR)
202 120 IN PTR web01.test.cn.
203 120 IN PTR web02.test.cn.
205 120 IN PTR db01.test.cn.
206 120 IN PTR dns.test.cn.
209 120 IN PTR db02.test.cn.
; CNAME
; HOST RECORDS六、客戶端DNS設置
將namedmanager本機以及所有的客戶機的DNS地址都設置成192.168.10.206（即namedmanager部署機的ip地址）
[root@storage01 ~]# ifconfig|grep 192
inet addr:192.168.10.202 Bcast:192.168.10.255 Mask:255.255.255.0
[root@storage01 ~]# cat /etc/resolv.conf
domain test.cn
search test.cn
nameserver 192.168.10.206
[root@storage01 ~]# ping www.baidu.com //這裏走的是DNS配置中的forwarders轉發的解析
PING www.a.shifen.com (14.215.177.38) 56(84) bytes of data.
64 bytes from 14.215.177.38: icmp_seq=1 ttl=49 time=37.6 ms
64 bytes from 14.215.177.38: icmp_seq=2 ttl=49 time=37.5 ms
64 bytes from 14.215.177.38: icmp_seq=3 ttl=49 time=37.4 ms
.....
[root@storage01 ~]# ping web02.test.cn
PING web02.test.cn (192.168.10.203) 56(84) bytes of data.
64 bytes from web02.test.cn (192.168.10.203): icmp_seq=1 ttl=64 time=0.136 ms
64 bytes from web02.test.cn (192.168.10.203): icmp_seq=2 ttl=64 time=0.212 ms
64 bytes from web02.test.cn (192.168.10.203): icmp_seq=3 ttl=64 time=0.132 ms
.....
在客戶機上檢查下正反向解析是否成功：
[root@storage01 ~]# host 192.168.10.209
209.10.168.192.in-addr.arpa domain name pointer db02.test.cn.
[root@storage01 ~]# host db01.test.cn
db01.test.cn has address 192.168.10.205建議在搭建多臺NamedManager以實現高可用。
DNS web管理之NamedManager