CentOS通過bind配置DNS伺服器
阿新 • • 發佈：2018-11-06
一、建立DNS主伺服器
1、安裝bind並配置主配置檔案
主伺服器為CentOS 7，主服務地址為172.16.11.55
安裝bind
[[email protected] ~]# yum install bind
安裝完成後檢視是否存在/var/named/named.ca
這個檔案包含了網際網路上根伺服器對應的名字和地址
備份一下/etc/named.conf
配置主配置檔案/etc/named.conf
[[email protected] named]# vim /etc/named.conf // // named.conf // // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS // server as a caching only nameserver (as a localhost DNS resolver only). // // See /usr/share/doc/bind*/sample/ for example named configuration files. // options { listen-on port 53 { 172.16.11.55; 127.0.0.1; }; #這裡要加入對外監聽53埠的主機地址 // listen-on-v6 port 53 { ::1; }; #註釋掉ipv6的設定 directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; allow-query { any; }; #將這裡改為any，表示伺服器允許所有地址來查詢 /* - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. - If you are building a RECURSIVE (caching) DNS server, you need to enable recursion. - If your recursive DNS server has a public IP address, you MUST enable access control to limit queries to your legitimate users. Failing to do so will cause your server to become part of large scale DNS amplification attacks. Implementing BCP38 within your network would greatly reduce such attack surface */ recursion yes; #這裡為yes表示允許遞迴查詢 // dnssec-enable yes; // dnssec-validation yes; /* Path to ISC DLV key */ // bindkeys-file "/etc/named.iscdlv.key"; // managed-keys-directory "/var/named/dynamic"; #從dnssec開始到此全部註釋掉 pid-file "/run/named/named.pid"; session-keyfile "/run/named/session.key"; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "." IN { type hint; file "named.ca"; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key";
改完之後重啟服務，檢視53號埠是否對外監聽
[[email protected] named]# systemctl restart named.service [[email protected] named]# ss -tunl | grep 53 udp UNCONN 0 0 172.16.11.55:53 *:* udp UNCONN 0 0 127.0.0.1:53 *:* tcp LISTEN 0 10 172.16.11.55:53 *:* tcp LISTEN 0 10 127.0.0.1:53 *:* tcp LISTEN 0 128 127.0.0.1:953 *:* tcp LISTEN 0 128 ::1:953 :::* #可以看到已經監聽到53號埠上了
在主配置檔案中定義區域，編輯/etc/named.rfc1912.zones
[[email protected] named]# vim /etc/named.rfc1912.zones // named.rfc1912.zones: // // Provided by Red Hat caching-nameserver package // // ISC BIND named zone configuration for zones recommended by // RFC 1912 section 4.1 : localhost TLDs and address zones // and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt // (c)2007 R W Franks // // See /usr/share/doc/bind*/sample/ for example named configuration files. // zone "localhost.localdomain" IN { type master; file "named.localhost"; allow-update { none; }; }; zone "localhost" IN { type master; file "named.localhost"; allow-update { none; }; }; zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN { type master; file "named.loopback"; allow-update { none; }; }; zone "1.0.0.127.in-addr.arpa" IN { type master; file "named.loopback"; allow-update { none; }; }; zone "0.in-addr.arpa" IN { type master; file "named.empty"; allow-update { none; }; }; #在最後增加了一個區域叫xinfeng.com zone "xinfeng.com" IN { #type是伺服器型別，master表示為主伺服器 type master; #file是區域解析庫檔案的名稱，這個檔案放在/var/named/下 file "xinfeng.com.zone"; };
2、配置正向區域解析，並用dig測試
編輯完後儲存，然後到/var/named/下面去建立一個xinfeng.com.zone的檔案
[[email protected] named]# vim xinfeng.com.zone $TTL 86400 #TTL表示客戶端得到結果後的可快取時長，單位是秒，這裡是1天，可從全域性繼承 $ORIGIN xinfeng.com. #ORIGIN定義為xinfeng.com.【注意最後有一個點】，這裡定義之後，就可用後面@代替xinfeng.com. @ IN SOA ns1.xinfeng.com. admin.xinfeng.com. ( #SOA表示起始授權紀錄，之後跟上當前區域主DNS的名稱，然後跟上當前主區域的管理員郵箱，郵箱中的@用.替換 2016041718 #2016041718表示序列號，編輯一次此檔案就必須手動加1 1H #1H表示重新整理時間為1消失 5M #5M表示重試時間為5分鐘 7D #7D表示過期時間為7天，也可以寫成1W 1D ) #1D表示否定答案的時間為1天 IN NS ns1 #NS專用於表示當前區域的DNS伺服器，之後必須跟一個A紀錄 ns1 IN A 172.16.11.55 #A表示ipv4正向解析，ipv6為AAAA，這裡解析ns1.xinfeng.com到172.16.11.55 www IN A 172.16.11.55 #這裡解析www.xinfeng.com到172.16.11.55 ftp IN CNAME www #CNAME表示別名，這裡解析ftp.xinfeng.com到www.xinfeng.com，最終解析到172.16.11.55
儲存之後用named-check來檢查主配置檔案和區域解析檔案是否有語法錯誤
[[email protected] named]# named-checkconf [[email protected] named]# named-checkzone "xinfeng.com" /var/named/xinfeng.com.zone zone xinfeng.com/IN: loaded serial 2016041718 OK
OK表示沒有語法錯誤
之後一定要記得改變檔案/var/named/xinfeng.com.zone的屬組為named，並改變許可權為640
[[email protected] named]# ll -rw-r--r--. 1 root root 190 4月 14 02:42 xinfeng.com.zone [[email protected] named]# chown :named xinfeng.com.zone [[email protected] named]# chmod 640 xinfeng.com.zone [[email protected] named]# ll -rw-r-----. 1 root named 190 4月 14 02:42 xinfeng.com.zone
然後重啟named服務
[[email protected] named]# systemctl restart named.service
安裝dig測試，dig在bind-utils包內
[[email protected] named]# yum install bind-utils [[email protected] named]# dig -t A xinfeng.com @172.16.11.55 ; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7_2.3 <<>> -t A xinfeng.com @172.16.11.55 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7034 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;xinfeng.com. IN A ;; AUTHORITY SECTION: xinfeng.com. 86400 IN SOA ns1.xinfeng.com. admin.xinfeng.com.xinfeng.com. 2016041719 3600 300 604800 86400 ;; Query time: 0 msec ;; SERVER: 172.16.11.55#53(172.16.11.55) ;; WHEN: 四 4月 14 04:24:15 CST 2016 ;; MSG SIZE rcvd: 98 [[email protected] named]# dig -t A www.xinfeng.com @172.16.11.55 ; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7_2.3 <<>> -t A www.xinfeng.com @172.16.11.55 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36364 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;www.xinfeng.com. IN A ;; ANSWER SECTION: www.xinfeng.com. 86400 IN A 172.16.11.55 ;; AUTHORITY SECTION: xinfeng.com. 86400 IN NS ns1.xinfeng.com. ;; ADDITIONAL SECTION: ns1.xinfeng.com. 86400 IN A 172.16.11.55 ;; Query time: 1 msec ;; SERVER: 172.16.11.55#53(172.16.11.55) ;; WHEN: 四 4月 14 04:24:56 CST 2016 ;; MSG SIZE rcvd: 94
可以看到測試能成功解析
3、配置反向區域解析
依然要在主配置檔案定義區域，編輯/etc/named.rfc1912.zone
[[email protected] named]# vim /etc/named.rfc1912.zones zone "xinfeng.com" IN { type master; file "xinfeng.com.zone"; }; #在剛才的正向解析之後加入下面的內容，注意網路地址要反寫 zone "11.16.172.in-addr.arpa" IN { type master; file "172.16.11.zone"; };
儲存之後在/var/named/中增加172.16.11.zone的區域解析庫檔案
[[email protected] named]# vim 172.16.11.zone $TTL 86400 $ORIGIN 11.16.172.in-addr.arpa. @ IN SOA ns1.xinfeng.com. admin.xinfeng.com. ( 2016041720 1H 5M 7D 1D ) IN NS ns1.xinfeng.com. 55 IN PTR ns1.xinfeng.com. 55 IN PTR www.xinfeng.com. #這裡的不能有A或者AAAA紀錄，PTR就是反向解析的意思，注意地址反寫，其他的和正向解析沒有區別
儲存之後記得改屬組和許可權，並檢查語法
[[email protected] named]# chmod 640 172.16.11.zone [[email protected] named]# chown :named 172.16.11.zone [[email protected] named]# named-checkzone "11.16.172.in-addr.arpa" /var/named/172.16.11.zone zone 11.16.172.in-addr.arpa/IN: loaded serial 2016041720 OK [[email protected] named]# named-checkconf
顯示OK語法檢測OK，重啟服務，並用dig測試
[[email protected] named]# systemctl restart named.service [[email protected] named]# dig -x 172.16.11.55 @172.16.11.55 ; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7_2.3 <<>> -x 172.16.11.55 @172.16.11.55 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50285 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;55.11.16.172.in-addr.arpa. IN PTR ;; ANSWER SECTION: 55.11.16.172.in-addr.arpa. 86400 IN PTR www.xinfeng.com. 55.11.16.172.in-addr.arpa. 86400 IN PTR ns1.xinfeng.com. ;; AUTHORITY SECTION: 11.16.172.in-addr.arpa. 86400 IN NS ns1.xinfeng.com. ;; ADDITIONAL SECTION: ns1.xinfeng.com. 86400 IN A 172.16.11.55 ;; Query time: 0 msec ;; SERVER: 172.16.11.55#53(172.16.11.55) ;; WHEN: 四 4月 14 04:09:54 CST 2016 ;; MSG SIZE rcvd: 131
可以看到測試正常
4、配置泛域名解析
編輯正向區域解析檔案/var/nemad/xinfeng.com.zone，在其中加入*的A紀錄，並且序列號加1
[[email protected] named]# vim /var/named/xinfeng.com.zone $TTL 86400 $ORIGIN xinfeng.com. @ IN SOA ns1.xinfeng.com. admin.xinfeng.com. ( 2016041719 1H 5M 7D 1D ) IN NS ns1 ns1 IN A 172.16.11.55 www IN A 172.16.11.55 ftp IN CNAME www * IN A 172.16.11.55
檢查語法錯誤
[[email protected] named]# named-checkzone "xinfeng.com" /var/named/xinfeng.com.zone zone xinfeng.com/IN: loaded serial 2016041719 OK
過載檔案並用dig測試
[[email protected] named]# rndc reload server reload successful [[email protected] named]# dig -t A nfs.xinfeng.com @172.16.11.55 ; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7_2.3 <<>> -t A nfs.xinfeng.com @172.16.11.55 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37887 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;nfs.xinfeng.com. IN A ;; ANSWER SECTION: nfs.xinfeng.com. 86400 IN A 172.16.11.55 ;; AUTHORITY SECTION: xinfeng.com. 86400 IN NS ns1.xinfeng.com. ;; ADDITIONAL SECTION: ns1.xinfeng.com. 86400 IN A 172.16.11.55 ;; Query time: 0 msec ;; SERVER: 172.16.11.55#53(172.16.11.55) ;; WHEN: 四 4月 14 04:21:13 CST 2016 ;; MSG SIZE rcvd: 94
測試正常
二、配置從伺服器進行主從複製
新建一臺從伺服器，伺服器系統為CentOS 6，地址為172.16.11.57
1、安裝bind和bind-utils，並用dig測試看是否能解析到剛才我們配置的主服務
[[email protected] ~]# yum install bind [[email protected] ~]# yum install bind-utils [[email protected] ~]# service named start [[email protected] ~]# ss -tunl | grep 53 udp UNCONN 0 0 127.0.0.1:53 *:* tcp LISTEN 0 3 127.0.0.1:53 *:* tcp LISTEN 0 128 ::1:953 :::* tcp LISTEN 0 128 127.0.0.1:953 *:* [[email protected] ~]# dig -t axfr xinfeng.com @172.16.11.55 ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.37.rc1.el6_7.7 <<>> -t axfr xinfeng.com @172.16.11.55 ;; global options: +cmd xinfeng.com. 86400 IN SOA ns1.xinfeng.com. admin.xinfeng.com.xinfeng.com. 2016041719 3600 300 604800 86400 xinfeng.com. 86400 IN NS ns1.xinfeng.com. ftp.xinfeng.com. 86400 IN CNAME www.xinfeng.com. ns1.xinfeng.com. 86400 IN A 172.16.11.55 www.xinfeng.com. 86400 IN A 172.16.11.55 xinfeng.com. 86400 IN SOA ns1.xinfeng.com. admin.xinfeng.com.xinfeng.com. 2016041719 3600 300 604800 86400 ;; Query time: 1 msec ;; SERVER: 172.16.11.55#53(172.16.11.55) ;; WHEN: Thu Apr 14 12:31:13 2016 ;; XFR size: 6 records (messages 1, bytes 191) dig -t axfr xinfeng.com @172.16.11.55
測試結果是正常的
2、配置從伺服器的主配置檔案
在/etc/named.conf中按照主服務配置一樣修改，對外監聽埠換成本機的也就是172.16.11.57
[[email protected] ~]# vim /etc/named.conf // // named.conf // // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS // server as a caching only nameserver (as a localhost DNS resolver only). // // See /usr/share/doc/bind*/sample/ for example named configuration files. // options { listen-on port 53 { 172.16.11.57; 127.0.0.1; }; // listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; allow-query { any; }; recursion yes; // dnssec-enable yes; // dnssec-validation yes; // dnssec-lookaside auto; /* Path to ISC DLV key */ // bindkeys-file "/etc/named.iscdlv.key"; // managed-keys-directory "/var/named/dynamic"; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "." IN { type hint; file "named.ca"; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key"; "/etc/named.conf" 43L, 1027C
編輯/etc/named.rfc1912.zone檔案，在最後加入
[[email protected] ~]# vim /etc/named.rfc1912.zones zone "xinfeng.com" IN { type slave; masters { 172.16.11.55; }; file "slaves/xinfeng.com.zone"; }; 也就是說他的區域解析庫檔案放置在/var/named/slaves/下叫xinfeng.com.zone，這裡我們不需要去建立編輯這個區域解析庫檔案，因為之後主從同步之後，會自動獲得這個檔案，重啟服務 [[email protected] ~]# service named restart Stopping named: . [ OK ] Starting named: [ OK ]
3、在主伺服器上定義從伺服器的正向解析庫檔案
編輯主DNS伺服器的/var/named/xinfeng.com.zone檔案在其中加入從伺服器的A紀錄和NS紀錄，這裡是ns2
[[email protected] named]# vim /var/named/xinfeng.com.zone $TTL 86400 $ORIGIN xinfeng.com. @ IN SOA ns1.xinfeng.com. admin.xinfeng.com. ( 2016041720 1H 5M 7D 1D ) IN NS ns1 IN NS ns2 ns1 IN A 172.16.11.55 ns2 IN A 172.16.11.57 www IN A 172.16.11.55 ftp IN CNAME www
主伺服器過載服務
[[email protected] named]# rndc reload server reload successful
到從伺服器也就是172.16.11.57下檢視區域解析庫檔案是否同步
[[email protected] ~]# cd /var/named/slaves/ [[email protected] slaves]# ls xinfeng.com.zone
可以看到區域解析庫檔案已同步成功
4、在從伺服器上定義主配置檔案，定義反向解析庫檔案位置
編輯主伺服器也就是172.16.11.55的反向解析檔案，加入ns2的A紀錄和NS紀錄，然後過載服務
[[email protected] named]# vim /var/named/172.16.11.zone $TTL 86400 $ORIGIN 11.16.172.in-addr.arpa. @ IN SOA ns1.xinfeng.com. admin.xinfeng.com. ( 2016041720 1H 5M 7D 1D ) IN NS ns1.xinfeng.com. IN NS ns2.xinfeng.com. 55 IN PTR ns1.xinfeng.com. 57 IN PTR ns2.xinfeng.com. 55 IN PTR www.xinfeng.com. [[email protected] named]# rndc reload server reload successful
在從伺服器上也就是172.16.11.57上編輯/etc/named.rfc1912.zone檔案，在最後加入
[[email protected] ~]# vim /etc/named.rfc1912.zones zone "11.16.172.in-addr.arpa" IN { type slave; masters { 172.16.11.55; }; file "slaves/172.16.11.zone"; };
完成後過載從伺服器，就會同步主伺服器上的反向解析庫檔案
[[email protected] ~]# rndc reload server reload successful [[email protected] ~]# cd /var/named/slaves/ [[email protected] slaves]# ls 172.16.11.zone xinfeng.com.zone [[email protected] slaves]# cat 172.16.11.zone $ORIGIN . $TTL 86400 ; 1 day 11.16.172.in-addr.arpa IN SOA ns1.xinfeng.com. admin.xinfeng.com. ( 2016041720 ; serial 3600 ; refresh (1 hour) 300 ; retry (5 minutes) 604800 ; expire (1 week) 86400 ; minimum (1 day) ) NS ns1.xinfeng.com. $ORIGIN 11.16.172.in-addr.arpa. 55 PTR ns1.xinfeng.com. PTR www.xinfeng.com.
區域解析庫檔案同步成功
需要注意的是，主從伺服器的bind版本需要一致，而且一定不要更改從伺服器的區域解析庫檔案，只需要改主伺服器的區域解析庫檔案。
三、子域授權
父域為172.16.11.55，子域為172.16.9.9
1、定義父域
進入父域伺服器172.16.11.55，編輯/var/named/xinfeng.com.zone也就是父域的正向解析庫檔案，在其中加入子域的NS紀錄和A紀錄
[[email protected] ~]# vim /var/named/xinfeng.com.zone $TTL 86400 $ORIGIN xinfeng.com. @ IN SOA ns1.xinfeng.com. admin.xinfeng.com. ( 2016041720 1H 5M 7D 1D ) IN NS ns1 IN NS ns2 ns1 IN A 172.16.11.55 ns2 IN A 172.16.11.57 www IN A 172.16.11.55 ftp IN CNAME www tv IN NS ns1.ops ns1.ops IN A 172.16.9.9 [[email protected] ~]# named-checkzone "xinfeng.com" /var/named/xinfeng.com.zone zone xinfeng.com/IN: loaded serial 2016041720 OK [[email protected] ~]# rndc reload server reload successful
檢查語法正確，並重載後，
2、定義子域
進入子域伺服器172.16.9.9
新伺服器重新編輯/etc/named.conf，之後開起服務
[[email protected] ~]# vim /etc/named.conf [[email protected] ~]# systemctl start named.service [[email protected] ~]# ss -tunl | grep 53 udp UNCONN 0 0 172.16.9.9:53 *:* udp UNCONN 0 0 127.0.0.1:53 *:* tcp LISTEN 0 10 172.16.9.9:53 *:* tcp LISTEN 0 10 127.0.0.1:53 *:* tcp LISTEN 0 128 127.0.0.1:953 *:* tcp LISTEN 0 128 ::1:953 :::*
編輯子域172.16.9.9的/etc/named.rfc1912.zones ，在後面加入
[[email protected] ~]# vim /etc/named.rfc1912.zones zone "tv.xinfeng.com" IN { type master; file "tv.xinfeng.com.zone"; }; [[email protected] ~]# rndc reload server reload successful
編輯子域172.16.9.9的/var/named/tv.xinfeng.com.zone
[[email protected] ~]# vim /var/named/tv.xinfeng.com.zone $TTL 1d $ORIGIN tv.xinfeng.com. @ IN SOA ns1.tv.xinfeng.com. admin.tv.xinfeng.com. ( 2016041722 1H 10M 3D 1D ) IN NS ns1 ns1 IN A 172.16.9.9 www IN A 172.16.9.9 [[email protected]]# chown :named tv.xinfeng.com.zone [[email protected]]# chmod 640 tv.xinfeng.com.zone [[email protected] ~]# rndc reload server reload successful
3、測試解析
測試子域能否解析自己範圍的