1. 程式人生 > >Linux裡DNS伺服器的主從搭建以及mariadb編譯安裝實現

Linux裡DNS伺服器的主從搭建以及mariadb編譯安裝實現

1、簡述DNS伺服器原理,並搭建主-輔伺服器。

   DNS伺服器的工作原理

  DNS(Domain Name Service)它是應用層協議,C/S架構,預設工作在TCP和UDP的53號埠,伺服器軟體bind是由美國伯克利大學研發,它的主要作用是把網際網路域名解析成對應的ip地址,從而實現訪問遠端主機的需求。以訪問www.baidu.com為例來說說DNS的工作流程;首先瀏覽器訪問www.baidu.com,它會先去本機的/etc/hosts檔案中檢視有沒有www.baidu.com記錄,如果有,它就會拿著對應的ip去訪問,如沒有那麼它就會去問我們主機上配置的DNS伺服器(比如小區DNS伺服器,各個網路運營上的DNS伺服器),如果在主機指定的DNS伺服器上能夠查到對應的ip,DNS伺服器會把對應的ip告訴瀏覽器,從而瀏覽器拿著給定這個ip去訪問;如果指定的DNS伺服器上沒有對應的ip記錄,那麼指定的DNS會去根伺服器問,說根伺服器,我要訪問www.baidu.com這臺主機,請問你那裡有它的ip記錄嗎?根查看了資料庫檔案後告訴來查的DNS服務說 我這裡沒有,但是com是我的子域我有com域的ip地址,你去問下com這個域吧,接著我們指定的那個DNS伺服器又會拿著根給的com域的ip去問com,說com呀,我要訪問www.baidu.com這臺主機,請問你那裡有它的ip記錄嗎?com查了下自己的資料庫檔案說,我這裡沒有,但是baidu這個域是我的子域,我把baidu這個域的地址給你,你去問下它吧;我們指定的DNS伺服器又拿著com給的baidu.com的ip地址,去問baidu.com這個域,說我要訪問www.baidu.com,請問你那裡有它的ip記錄嗎?baidu.com一聽,www.baidu.com不就是我本域的主機嗎,它立馬就告訴我們指定的DNS伺服器說,我這裡有www.baidu.com主機的地址,然後baidu.com就把對應的ip地址給了我們指定的DNS伺服器,這時DNS伺服器就把自己最後得到的ip地址在本機上快取一份,然後把地址告訴我們瀏覽器,瀏覽器拿著這個地址直接去訪問,這時瀏覽器拿到IP地址後就可以正常的訪問到www.baidu.com這臺主機後臺的web服務。這就是DNS工作的大概流程,簡單講就是我們要去訪問某臺主機(非ip地址訪問),首先會去/etc/hosts檔案中查詢是否有對應的ip記錄,如果有,就拿著這個地址去訪問,如果沒有就會去找我們指定的DNS伺服器問,如果指定的DNS伺服器沒有,它會幫著我們去根上問,去對應子域上問,問上一圈,如果還是沒有,那麼我們指定的DNS伺服器就會告訴我們說沒有你要訪問的地址,如果有就告訴我們。

  權威DNS主伺服器的搭建

  1)安裝BIND包

[root@test ~]#yum install -y bind
已載入外掛:fastestmirror
Loading mirror speeds from cached hostfile
 * base: mirrors.aliyun.com
 * extras: mirrors.aliyun.com
 * updates: mirrors.aliyun.com
base                                                                                                                 | 3.6 kB  00:00:00     
dockerrepo                                                                                                           | 2.9 kB  00:00:00     
epel                                                                                                                 | 5.4 kB  00:00:00     
extras                                                                                                               | 2.9 kB  00:00:00     
updates                                                                                                              | 2.9 kB  00:00:00     
正在解決依賴關係
--> 正在檢查事務
---> 軟體包 bind.x86_64.32.9.11.4-9.P2.el7 將被 安裝
--> 正在處理依賴關係 bind-libs-lite(x86-64) = 32:9.11.4-9.P2.el7,它被軟體包 32:bind-9.11.4-9.P2.el7.x86_64 需要
--> 正在處理依賴關係 bind-libs(x86-64) = 32:9.11.4-9.P2.el7,它被軟體包 32:bind-9.11.4-9.P2.el7.x86_64 需要
--> 正在處理依賴關係 liblwres.so.160()(64bit),它被軟體包 32:bind-9.11.4-9.P2.el7.x86_64 需要
--> 正在處理依賴關係 libisccfg.so.160()(64bit),它被軟體包 32:bind-9.11.4-9.P2.el7.x86_64 需要
--> 正在處理依賴關係 libisccc.so.160()(64bit),它被軟體包 32:bind-9.11.4-9.P2.el7.x86_64 需要
--> 正在處理依賴關係 libisc.so.169()(64bit),它被軟體包 32:bind-9.11.4-9.P2.el7.x86_64 需要
--> 正在處理依賴關係 libdns.so.1102()(64bit),它被軟體包 32:bind-9.11.4-9.P2.el7.x86_64 需要
--> 正在處理依賴關係 libbind9.so.160()(64bit),它被軟體包 32:bind-9.11.4-9.P2.el7.x86_64 需要
--> 正在檢查事務
---> 軟體包 bind-libs.x86_64.32.9.11.4-9.P2.el7 將被 安裝
--> 正在處理依賴關係 bind-license = 32:9.11.4-9.P2.el7,它被軟體包 32:bind-libs-9.11.4-9.P2.el7.x86_64 需要
---> 軟體包 bind-libs-lite.x86_64.32.9.9.4-74.el7_6.2 將被 升級
--> 正在處理依賴關係 libdns-export.so.100()(64bit),它被軟體包 12:dhclient-4.2.5-68.el7.centos.1.x86_64 需要
--> 正在處理依賴關係 libisc-export.so.95()(64bit),它被軟體包 12:dhclient-4.2.5-68.el7.centos.1.x86_64 需要
---> 軟體包 bind-libs-lite.x86_64.32.9.11.4-9.P2.el7 將被 更新
--> 正在檢查事務
---> 軟體包 bind-license.noarch.32.9.9.4-74.el7_6.2 將被 升級
---> 軟體包 bind-license.noarch.32.9.11.4-9.P2.el7 將被 更新
---> 軟體包 dhclient.x86_64.12.4.2.5-68.el7.centos.1 將被 升級
---> 軟體包 dhclient.x86_64.12.4.2.5-77.el7.centos 將被 更新
--> 正在處理依賴關係 dhcp-libs(x86-64) = 12:4.2.5-77.el7.centos,它被軟體包 12:dhclient-4.2.5-77.el7.centos.x86_64 需要
--> 正在處理依賴關係 dhcp-common = 12:4.2.5-77.el7.centos,它被軟體包 12:dhclient-4.2.5-77.el7.centos.x86_64 需要
--> 正在處理依賴關係 libisc-export.so.169()(64bit),它被軟體包 12:dhclient-4.2.5-77.el7.centos.x86_64 需要
--> 正在處理依賴關係 libdns-export.so.1102()(64bit),它被軟體包 12:dhclient-4.2.5-77.el7.centos.x86_64 需要
--> 正在檢查事務
---> 軟體包 bind-export-libs.x86_64.32.9.11.4-9.P2.el7 將被 安裝
---> 軟體包 dhcp-common.x86_64.12.4.2.5-68.el7.centos.1 將被 升級
---> 軟體包 dhcp-common.x86_64.12.4.2.5-77.el7.centos 將被 更新
---> 軟體包 dhcp-libs.x86_64.12.4.2.5-68.el7.centos.1 將被 升級
---> 軟體包 dhcp-libs.x86_64.12.4.2.5-77.el7.centos 將被 更新
--> 解決依賴關係完成

依賴關係解決

============================================================================================================================================
 Package                              架構                       版本                                        源                        大小
============================================================================================================================================
正在安裝:
 bind                                 x86_64                     32:9.11.4-9.P2.el7                          base                     2.3 M
為依賴而安裝:
 bind-export-libs                     x86_64                     32:9.11.4-9.P2.el7                          base                     1.1 M
 bind-libs                            x86_64                     32:9.11.4-9.P2.el7                          base                     154 k
為依賴而更新:
 bind-libs-lite                       x86_64                     32:9.11.4-9.P2.el7                          base                     1.1 M
 bind-license                         noarch                     32:9.11.4-9.P2.el7                          base                      88 k
 dhclient                             x86_64                     12:4.2.5-77.el7.centos                      base                     285 k
 dhcp-common                          x86_64                     12:4.2.5-77.el7.centos                      base                     176 k
 dhcp-libs                            x86_64                     12:4.2.5-77.el7.centos                      base                     133 k

事務概要
============================================================================================================================================
安裝  1 軟體包 (+2 依賴軟體包)
升級           ( 5 依賴軟體包)

總下載量:5.3 M
Downloading packages:
Delta RPMs disabled because /usr/bin/applydeltarpm not installed.
(1/8): bind-export-libs-9.11.4-9.P2.el7.x86_64.rpm                                                                   | 1.1 MB  00:00:00     
(2/8): bind-libs-9.11.4-9.P2.el7.x86_64.rpm                                                                          | 154 kB  00:00:00     
(3/8): bind-9.11.4-9.P2.el7.x86_64.rpm                                                                               | 2.3 MB  00:00:00     
(4/8): bind-libs-lite-9.11.4-9.P2.el7.x86_64.rpm                                                                     | 1.1 MB  00:00:00     
(5/8): dhclient-4.2.5-77.el7.centos.x86_64.rpm                                                                       | 285 kB  00:00:00     
(6/8): bind-license-9.11.4-9.P2.el7.noarch.rpm                                                                       |  88 kB  00:00:00     
(7/8): dhcp-common-4.2.5-77.el7.centos.x86_64.rpm                                                                    | 176 kB  00:00:00     
(8/8): dhcp-libs-4.2.5-77.el7.centos.x86_64.rpm                                                                      | 133 kB  00:00:00     
--------------------------------------------------------------------------------------------------------------------------------------------
總計                                                                                                        3.9 MB/s | 5.3 MB  00:00:01     
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  正在更新    : 12:dhcp-libs-4.2.5-77.el7.centos.x86_64                                                                                1/13 
  正在更新    : 32:bind-license-9.11.4-9.P2.el7.noarch                                                                                 2/13 
  正在更新    : 32:bind-libs-lite-9.11.4-9.P2.el7.x86_64                                                                               3/13 
  正在安裝    : 32:bind-libs-9.11.4-9.P2.el7.x86_64                                                                                    4/13 
  正在更新    : 12:dhcp-common-4.2.5-77.el7.centos.x86_64                                                                              5/13 
  正在安裝    : 32:bind-export-libs-9.11.4-9.P2.el7.x86_64                                                                             6/13 
  正在更新    : 12:dhclient-4.2.5-77.el7.centos.x86_64                                                                                 7/13 
  正在安裝    : 32:bind-9.11.4-9.P2.el7.x86_64                                                                                         8/13 
  清理        : 12:dhclient-4.2.5-68.el7.centos.1.x86_64                                                                               9/13 
  清理        : 12:dhcp-common-4.2.5-68.el7.centos.1.x86_64                                                                           10/13 
  清理        : 32:bind-libs-lite-9.9.4-74.el7_6.2.x86_64                                                                             11/13 
  清理        : 32:bind-license-9.9.4-74.el7_6.2.noarch                                                                               12/13 
  清理        : 12:dhcp-libs-4.2.5-68.el7.centos.1.x86_64                                                                             13/13 
  驗證中      : 12:dhcp-common-4.2.5-77.el7.centos.x86_64                                                                              1/13 
  驗證中      : 32:bind-license-9.11.4-9.P2.el7.noarch                                                                                 2/13 
  驗證中      : 32:bind-export-libs-9.11.4-9.P2.el7.x86_64                                                                             3/13 
  驗證中      : 32:bind-libs-9.11.4-9.P2.el7.x86_64                                                                                    4/13 
  驗證中      : 32:bind-libs-lite-9.11.4-9.P2.el7.x86_64                                                                               5/13 
  驗證中      : 32:bind-9.11.4-9.P2.el7.x86_64                                                                                         6/13 
  驗證中      : 12:dhclient-4.2.5-77.el7.centos.x86_64                                                                                 7/13 
  驗證中      : 12:dhcp-libs-4.2.5-77.el7.centos.x86_64                                                                                8/13 
  驗證中      : 12:dhcp-common-4.2.5-68.el7.centos.1.x86_64                                                                            9/13 
  驗證中      : 12:dhclient-4.2.5-68.el7.centos.1.x86_64                                                                              10/13 
  驗證中      : 32:bind-license-9.9.4-74.el7_6.2.noarch                                                                               11/13 
  驗證中      : 32:bind-libs-lite-9.9.4-74.el7_6.2.x86_64                                                                             12/13 
  驗證中      : 12:dhcp-libs-4.2.5-68.el7.centos.1.x86_64                                                                             13/13 

已安裝:
  bind.x86_64 32:9.11.4-9.P2.el7                                                                                                            

作為依賴被安裝:
  bind-export-libs.x86_64 32:9.11.4-9.P2.el7                               bind-libs.x86_64 32:9.11.4-9.P2.el7                              

作為依賴被升級:
  bind-libs-lite.x86_64 32:9.11.4-9.P2.el7        bind-license.noarch 32:9.11.4-9.P2.el7        dhclient.x86_64 12:4.2.5-77.el7.centos      
  dhcp-common.x86_64 12:4.2.5-77.el7.centos       dhcp-libs.x86_64 12:4.2.5-77.el7.centos      

完畢!
[root@test ~]#

  2)檢視bind包所有檔案的位置

[root@test ~]#rpm -ql bind
/etc/logrotate.d/named
/etc/named
/etc/named.conf
/etc/named.iscdlv.key
/etc/named.rfc1912.zones
/etc/named.root.key
/etc/rndc.conf
/etc/rndc.key
/etc/rwtab.d/named
/etc/sysconfig/named
/run/named
……省略部分內容
/var/log/named.log
/var/named
/var/named/data
/var/named/dynamic
/var/named/named.ca
/var/named/named.empty
/var/named/named.localhost
/var/named/named.loopback
/var/named/slaves
[root@test ~]#

  說明:從上面查出來的資訊看,大概可以瞭解bind的配置檔案是/etc/named.conf

   3)修改配置檔案,修改 listen-on port 53 { 127.0.0.1; };為listen-on port 53 { localhost; }; 和修改allow-query     { localhost; }; 為allow-query     { any; };

[root@test ~]#grep -v "^\//" /etc/named.conf

options {
        listen-on port 53 { localhost; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
        allow-query     { any; };

        /* 
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable 
           recursion. 
         - If your recursive DNS server has a public IP address, you MUST enable access 
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification 
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface 
        */
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.root.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

[root@test ~]#

  說明:也可以選擇註釋listen-on port 53 { 127.0.0.1; };和allow-query     { localhost; }; 這兩行,這個配置檔案的註釋同C語言註釋一樣,用"//"來註釋 

  4)增加區域資料庫檔案的配置,從上面的配置檔案中我們主要到最後兩個include 的指令,其中include "/etc/named.rfc1912.zones"; 就是定義區域資料庫檔案的內容

[root@test ~]#cat >> /etc/named.rfc1912.zones << EOF
> zone "test.com" IN {
>         type master;
>         file "test.com.zone";                                                                                                               
>     
> };
> EOF
[root@test ~]#tail -5 /etc/named.rfc1912.zones 
zone "test.com" IN {
        type master;
        file "test.com.zone";                                                                                                               
    
};
[root@test ~]#

  說明:以上配置是定義一個test.com的區域,其型別為master(主) ,區域資料庫檔名為 “test.com.zone” ,這裡需要注意這個檔名是相對域/var/named這個目錄的,也就說區域資料庫檔案必須存放在/var/named這個目錄下。這個工作目錄的定義可從主配置檔案中的directory 這個選項來指定或更改

  5)建立區域資料庫檔案

[root@test ~]#cat /var/named/test.com.zone
$TTL 1D
@ IN SOA dns1 admin ( 0 1D 1H 1W 3H );
     NS  dns1
dns1 A   192.168.0.99
www  A   1.1.1.1
blog A   2.2.2.2
[root@test ~]#

  說明:區域資料庫檔案的格式是name [TTL] IN rr_type value其中TTL可從全域性繼承,@可用於引用當前區域的名字,同一個名字可以通過多條記錄定義多個不同的值;此時DNS伺服器會以輪詢方式響應。同一個值也可能有多個不同的定義名字;通過多個不同的名字指向同一個值進行定義;此僅表示通過多個不同的名字可以找到同一個主機;name: 當前區域的名字,例如“test.com”; value: 有多部分組成,1、 當前區域的主DNS伺服器的FQDN,也可以使用當前區域的名字;2、當前區域管理員的郵箱地址;但地址中不能使用@符號,一般用.替換,例如admin.test.com.  3、主從服務區域傳輸相關定義以及否定的答案的統一的TTL;第一個數字表示序列號,第二個表示重新整理時間,第三個表示主從伺服器同步失敗重試的時間間隔,第四個表示,從伺服器同步失敗後,多久資料檔案內容過期,第五個表示快取否定答案的TTL值。以上還需要注意的是名字沒有以.結尾,預設會補上本域的名稱

  6)檢查主配置檔案和區域資料庫檔案是否正確,然後在啟動服務

[root@test ~]#named-checkconf 
[root@test ~]#named-checkzone test.com /var/named/test.com.zone 
zone test.com/IN: loaded serial 0
OK
[root@test ~]#systemctl start named
[root@test ~]#

  7)測試

[root@test ~]#dig www.test.com @192.168.0.99

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> www.test.com @192.168.0.99
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14227
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.test.com.                  IN      A

;; ANSWER SECTION:
www.test.com.           86400   IN      A       1.1.1.1

;; AUTHORITY SECTION:
test.com.               86400   IN      NS      dns1.test.com.

;; ADDITIONAL SECTION:
dns1.test.com.          86400   IN      A       192.168.0.99

;; Query time: 0 msec
;; SERVER: 192.168.0.99#53(192.168.0.99)
;; WHEN: 日 12月 29 23:29:46 CST 2019
;; MSG SIZE  rcvd: 92

[root@test ~]#dig blog.test.com @192.168.0.99    

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> blog.test.com @192.168.0.99
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62941
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;blog.test.com.                 IN      A

;; ANSWER SECTION:
blog.test.com.          86400   IN      A       2.2.2.2

;; AUTHORITY SECTION:
test.com.               86400   IN      NS      dns1.test.com.

;; ADDITIONAL SECTION:
dns1.test.com.          86400   IN      A       192.168.0.99

;; Query time: 0 msec
;; SERVER: 192.168.0.99#53(192.168.0.99)
;; WHEN: 日 12月 29 23:29:57 CST 2019
;; MSG SIZE  rcvd: 93

[root@test ~]#

  說明:dig工具來自bind-utils這個包,這個包主要是測試工具,包括host工具,dig工具,nslookup工具等測試工具。從上面的測試資料看,正向主DNS服務是搭建成功的。

  8)在/etc/named.rfc1912.zones檔案中新增反向區域檔案的配置

[root@test ~]#tail -4 /etc/named.rfc1912.zones
zone "0.168.192.in-addr.arpa" {
        type master;
        file "192.168.0.zone";
};
[root@test ~]#

  說明:反向DNS的區域必須將IP地址倒著寫,且後面必須是.in-addr.arpa結尾  裡面的檔名稱可任意填寫,這裡的檔名稱也是必須放在/var/named這個目錄下,同正向區域資料檔案放在一個目錄

  9)建立反向區域資料檔案

[root@test ~]#cat /var/named/192.168.0.zone
$TTL 1D
@ IN SOA dns1 admin (0 3H 10M 1D 1H );
     NS  dns1
dns1 A   192.168.0.99
99   PTR dns1.test.com.
100  PTR www.test.com.
101  PTR blog.test.com.
[root@test ~]#

  說明:反向區域資料庫檔案同正向區域資料庫檔案格式相同,反向記錄必須是PTR 型別其他同正向區域資料庫檔案類似,這裡還需要注意一點的是,PTR後面的域名必須以.結尾,否則它會預設給你補本域的資訊上去。

  10)檢查區域檔案,重新讀取配置檔案,時期反向區域資料庫檔案生效

[root@test ~]#named-checkzone 192.168.0.zone /var/named/192.168.0.zone 
zone 192.168.0.zone/IN: loaded serial 0
OK
[root@test ~]#rndc reload
server reload successful
[root@test ~]#

  11)測試反向解析

[root@test ~]#dig -x 192.168.0.99 @192.168.0.99

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> -x 192.168.0.99 @192.168.0.99
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61308
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;99.0.168.192.in-addr.arpa.     IN      PTR

;; ANSWER SECTION:
99.0.168.192.in-addr.arpa. 86400 IN     PTR     dns1.test.com.

;; AUTHORITY SECTION:
0.168.192.in-addr.arpa. 86400   IN      NS      dns1.0.168.192.in-addr.arpa.

;; ADDITIONAL SECTION:
dns1.0.168.192.in-addr.arpa. 86400 IN   A       192.168.0.99

;; Query time: 0 msec
;; SERVER: 192.168.0.99#53(192.168.0.99)
;; WHEN: 日 12月 29 23:58:39 CST 2019
;; MSG SIZE  rcvd: 116

[root@test ~]#dig -x 192.168.0.100 @192.168.0.99

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> -x 192.168.0.100 @192.168.0.99
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23462
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;100.0.168.192.in-addr.arpa.    IN      PTR

;; ANSWER SECTION:
100.0.168.192.in-addr.arpa. 86400 IN    PTR     www.test.com.

;; AUTHORITY SECTION:
0.168.192.in-addr.arpa. 86400   IN      NS      dns1.0.168.192.in-addr.arpa.

;; ADDITIONAL SECTION:
dns1.0.168.192.in-addr.arpa. 86400 IN   A       192.168.0.99

;; Query time: 0 msec
;; SERVER: 192.168.0.99#53(192.168.0.99)
;; WHEN: 日 12月 29 23:58:50 CST 2019
;; MSG SIZE  rcvd: 116

[root@test ~]#dig -x 192.168.0.101 @192.168.0.99

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> -x 192.168.0.101 @192.168.0.99
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17401
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;101.0.168.192.in-addr.arpa.    IN      PTR

;; ANSWER SECTION:
101.0.168.192.in-addr.arpa. 86400 IN    PTR     blog.test.com.

;; AUTHORITY SECTION:
0.168.192.in-addr.arpa. 86400   IN      NS      dns1.0.168.192.in-addr.arpa.

;; ADDITIONAL SECTION:
dns1.0.168.192.in-addr.arpa. 86400 IN   A       192.168.0.99

;; Query time: 0 msec
;; SERVER: 192.168.0.99#53(192.168.0.99)
;; WHEN: 日 12月 29 23:58:58 CST 2019
;; MSG SIZE  rcvd: 117

[root@test ~]#

  說明:可看到我們分別把192.168.0.99、100、101這三個主機對應的主機名給解析出來了,這裡不要同前面的正向區域資料庫中的資料混淆,這個反向解析可把不同的ip解析成相同的名字,這個和正向解析本質上沒有聯絡。它相當於是兩個不同的域,互不干擾。

  到此dns主伺服器就搭建完畢,接下來實現DNS從伺服器

  1)在上面的實驗上把主伺服器上的配置檔案中新增 allow_transfer { 192.168.0.151;};,並且在其資料庫檔案中新增從伺服器的NS記錄 以及A記錄

[root@test ~]#grep "transfer" /etc/named.conf
        allow-transfer  { 192.168.0.151; };
[root@test ~]#cat /var/named/test.com.zone 
$TTL 1D
@ IN SOA dns1 admin ( 0 1D 1H 1W 3H );
     NS  dns1
     NS  dns2
dns1 A   192.168.0.99
dns2 A   192.168.0.151
www  A   1.1.1.1
blog A   2.2.2.2
[root@test ~]#cat /var/named/192.168.0.zone
$TTL 1D
@ IN SOA dns1 admin (0 3H 10M 1D 1H );
     NS  dns1
     NS  dns2
dns1 A   192.168.0.99
dns2 A   192.168.0.151
99   PTR dns1.test.com.
100  PTR www.test.com.
101  PTR blog.test.com.
[root@test ~]#

  2)在從伺服器上安裝bind包,並在其配置檔案中配置 allow-transfer {none;}; 並註釋listen-on port 53 { 127.0.0.1; };和allow-query     { localhost; };

[root@test-node1 ~]#yum install -y bind
[root@test-node1 ~]#cat /etc/named.conf
……省略部分內容
options {
//      listen-on port 53 { 127.0.0.1; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
//      allow-query     { localhost; };
        allow-transfer { none; };
        recursion yes;
……省略部分內容

  3)在/etc/named.rfc1912.zonesz中配置區域資料檔案資訊

[root@test-node1 ~]#cat >> /etc/named.rfc1912.zones << EOF
> zone "test.com" {
>     type slave;
>     masters {192.168.0.99;};
>     file "slaves/test.com.zone";
> };
> EOF
[root@test-node1 ~]#cat >> /etc/named.rfc1912.zones << EOF
> zone "0.168.192.in-addr.arpa" {
>     type slave;
>     masters { 192.168.0.99; }; 
>     file "slaves/192.168.0.zone";
> };
> EOF
[root@test-node1 ~]#
[root@test-node1 ~]#tail /etc/named.rfc1912.zones
zone "test.com" {
    type slave;
    masters {192.168.0.99;};
    file "slaves/test.com.zone";
};
zone "0.168.192.in-addr.arpa" {
    type slave;
    masters { 192.168.0.99; };
    file "slaves/192.168.0.zone";
};
[root@test-node1 ~]#

  說明:在從伺服器上需要寫明區域的名稱,型別配成slave,並指明masters ,後面的files 是同步檔案的存放地,這個存放地需要named這個賬號有寫的許可權,否則將無法完成同步

  4)在從伺服器上檢查配置檔案,並啟動服務

[root@test-node1 ~]#ll /var/named/slaves/
total 0
[root@test-node1 ~]#named-checkconf 
[root@test-node1 ~]#/etc/init.d/named start
Generating /etc/rndc.key:                                  [  OK  ]
Starting named:                                            [  OK  ]
[root@test-node1 ~]#ll /var/named/slaves/
total 8
-rw-r--r-- 1 named named 449 Dec 30 00:35 192.168.0.zone
-rw-r--r-- 1 named named 336 Dec 30 00:35 test.com.zone
[root@test-node1 ~]#

  說明:啟動服務後可看到/var/named/slaves/目錄下把我們需要的區域資料庫檔案給同步過來了,接下來測試,在另一臺主機上把DNS1設定成主DNS伺服器地址,DNS2設定成從DNS伺服器地址,然後在主掛掉的情況下,看下從DNS是否可工作

  5)測試

[root@ansible_centos6 ~]# cat /etc/resolv.conf 
# Generated by NetworkManager
nameserver 192.168.0.99
nameserver 192.168.0.151
[root@ansible_centos6 ~]# dig www.test.com

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6 <<>> www.test.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22293
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;www.test.com.                  IN      A

;; ANSWER SECTION:
www.test.com.           86400   IN      A       1.1.1.1

;; AUTHORITY SECTION:
test.com.               86400   IN      NS      dns1.test.com.

;; ADDITIONAL SECTION:
dns1.test.com.          86400   IN      A       192.168.0.99

;; Query time: 4 msec
;; SERVER: 192.168.0.99#53(192.168.0.99)
;; WHEN: Mon Dec 30 00:46:46 2019
;; MSG SIZE  rcvd: 81

[root@ansible_centos6 ~]# dig -x 192.168.0.99

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6 <<>> -x 192.168.0.99
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48024
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;99.0.168.192.in-addr.arpa.     IN      PTR

;; ANSWER SECTION:
99.0.168.192.in-addr.arpa. 86400 IN     PTR     dns1.test.com.

;; AUTHORITY SECTION:
0.168.192.in-addr.arpa. 86400   IN      NS      dns1.0.168.192.in-addr.arpa.

;; ADDITIONAL SECTION:
dns1.0.168.192.in-addr.arpa. 86400 IN   A       192.168.0.99

;; Query time: 3 msec
;; SERVER: 192.168.0.99#53(192.168.0.99)
;; WHEN: Mon Dec 30 00:47:00 2019
;; MSG SIZE  rcvd: 105

[root@ansible_centos6 ~]# 

  說明:這是主DNS存活情況下的測試是可以正常解析

  主DNS掛掉的情況

[root@ansible_centos6 ~]# dig www.test.com

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6 <<>> www.test.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21730
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;www.test.com.                  IN      A

;; ANSWER SECTION:
www.test.com.           86400   IN      A       1.1.1.1

;; AUTHORITY SECTION:
test.com.               86400   IN      NS      dns1.test.com.

;; ADDITIONAL SECTION:
dns1.test.com.          86400   IN      A       192.168.0.99

;; Query time: 1 msec
;; SERVER: 192.168.0.151#53(192.168.0.151)
;; WHEN: Mon Dec 30 00:50:43 2019
;; MSG SIZE  rcvd: 81

[root@ansible_centos6 ~]# dig -x 192.168.0.99

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6 <<>> -x 192.168.0.99
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63933
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;99.0.168.192.in-addr.arpa.     IN      PTR

;; ANSWER SECTION:
99.0.168.192.in-addr.arpa. 86400 IN     PTR     dns1.test.com.

;; AUTHORITY SECTION:
0.168.192.in-addr.arpa. 86400   IN      NS      dns1.0.168.192.in-addr.arpa.

;; ADDITIONAL SECTION:
dns1.0.168.192.in-addr.arpa. 86400 IN   A       192.168.0.99

;; Query time: 1 msec
;; SERVER: 192.168.0.151#53(192.168.0.151)
;; WHEN: Mon Dec 30 00:50:55 2019
;; MSG SIZE  rcvd: 105

[root@ansible_centos6 ~]#

  說明:可看到主DNS伺服器掛掉,從伺服器是可以提供服務的,況且查詢的內容同主的一模一樣

2、搭建並實現智慧DNS。

    1)在上面的實驗環境中,更改配置檔案

[root@test ~]#cat /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html
acl cdnet {
        192.168.0.0/24;
};
acl bjnet {
        172.16.1.0/24;
};
acl shnet {
        any;
};
options {
        listen-on port 53 { localhost; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
        allow-query     { any; };
        allow-transfer  { 192.168.0.151; };
        /* 
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable 
           recursion. 
         - If your recursive DNS server has a public IP address, you MUST enable access 
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification 
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface 
        */
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.root.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};


include "/etc/named.root.key";
view  view_cd {
        match-clients {cdnet;};
        include "/etc/named.zone.cd";
        include "/etc/named.rfc1912.zones";
};
view view_bj {
        match-clients { bjnet; };
        include "/etc/named.zone.bj";
        include "/etc/named.rfc1912.zones";
};
view view_sh {
        match-clients { shnet; };
        include "/etc/named.zone.sh";
        include "/etc/named.rfc1912.zones";
};
[root@test ~]#

  說明:這個是主配置檔案,主要添加了 3段acl和3段view 這裡需要注意一點的是,一旦配置了view,所有的區域配置必須寫在view中,所有我們還需要把根區域的配置檔案到/etc/named.rfc1912.zones裡 ,然後在view 裡用include 把區域配置檔案匯入即可,借鑑上面的思想,我們也可以把不同地區的區域配置檔案也用不同的檔案給存起來,實現方便管理,然後也用include 指定匯入到各自的view,這樣就實現了 不同的網路客戶端,訪問不同的區域檔案。最後我們還需要建立各自的區域資料庫檔案。

  2)把根區域配置檔案放入到/etc/named.rfc1912.zones

[root@test ~]#cat /etc/named.rfc1912.zones
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package 
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
// 
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
zone "." IN {
        type hint;
        file "named.ca";
};
zone "localhost.localdomain" IN {
        type master;
        file "named.localhost";
        allow-update { none; };
};

zone "localhost" IN {
        type master;
        file "named.localhost";
        allow-update { none; };
};



zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
        type master;
        file "named.loopback";
        allow-update { none; };
};

zone "1.0.0.127.in-addr.arpa" IN {
        type master;
        file "named.loopback";
        allow-update { none; };
};

zone "0.in-addr.arpa" IN {
        type master;
        file "named.empty";
        allow-update { none; };
};


zone "0.168.192.in-addr.arpa" {
        type master;
        file "192.168.0.zone";
};
[root@test ~]#

  3)建立各自的區域配置檔案

[root@test ~]#cat >> /etc/named.zone.cd << EOF
> zone "test.com" IN {
>     type master;
>     file "test.com.zone.cd";
> };
> EOF
[root@test ~]#cat >> /etc/named.zone.bj << EOF
> zone "test.com" IN {
>     type master;
>     file "test.com.zone.bj";
> };
> EOF
[root@test ~]#cat >> /etc/named.zone.sh << EOF
> zone "test.com" IN {
>     type master;
>     file "test.com.zone.sh";
> };
> EOF
[root@test ~]#cat /etc/named.zone.cd 
zone "test.com" IN {
    type master;
    file "test.com.zone.cd";
};
[root@test ~]#cat /etc/named.zone.bj
zone "test.com" IN {
    type master;
    file "test.com.zone.bj";
};
[root@test ~]#cat /etc/named.zone.sh
zone "test.com" IN {
    type master;
    file "test.com.zone.sh";
};
[root@test ~]#

  4)準備各自區域的資料庫檔案

[root@test ~]#cat /var/named/test.com.zone.cd 
$TTL 1D
@ IN SOA dns1 admin ( 0 2D 1H 3D 1D )
     NS  dns1
dns1  A  192.168.0.99
www   A  3.3.3.3
blog  A  4.4.4.4
[root@test ~]#cat /var/named/test.com.zone.bj
$TTL 1D
@ IN SOA dns1 admin ( 0 2D 1H 3D 1D )
     NS  dns1
dns1 A   192.168.0.99
www  A   5.5.5.5
blog A   6.6.6.6
[root@test ~]#cat /var/named/test.com.zone.sh
$TTL 1D
@  IN SOA dns1 admin ( 0 2D 1H 3D 1D )
      NS  dns1
dns1  A   192.168.0.99
www   A   7.7.7.7
blog  A   8.8.8.8
[root@test ~]#
[root@test ~]#ll /var/named/
總用量 36
-rw-r--r-- 1 root  root   188 12月 30 00:28 192.168.0.zone
drwxrwx--- 2 named named   23 12月 29 23:23 data
drwxrwx--- 2 named named   60 12月 30 01:01 dynamic
-rw-r----- 1 root  named 2253 4月   5 2018 named.ca
-rw-r----- 1 root  named  152 12月 15 2009 named.empty
-rw-r----- 1 root  named  152 6月  21 2007 named.localhost
-rw-r----- 1 root  named  168 12月 15 2009 named.loopback
drwxrwx--- 2 named named    6 8月   8 20:16 slaves
-rw-r--r-- 1 root  root   154 12月 30 00:10 test.com.zone
-rw-r--r-- 1 root  root   112 12月 30 21:33 test.com.zone.bj
-rw-r--r-- 1 root  root   112 12月 30 21:31 test.com.zone.cd
-rw-r--r-- 1 root  root   117 12月 30 21:35 test.com.zone.sh
[root@test ~]#find /var/named/ -name "test.com.zone*"
/var/named/test.com.zone
/var/named/test.com.zone.cd
/var/named/test.com.zone.bj
/var/named/test.com.zone.sh
[root@test ~]#find /var/named/ -name "test.com.zone*"|xargs chown root.named 
[root@test ~]#ll /var/named/
總用量 36
-rw-r--r-- 1 root  root   188 12月 30 00:28 192.168.0.zone
drwxrwx--- 2 named named   23 12月 29 23:23 data
drwxrwx--- 2 named named   60 12月 30 01:01 dynamic
-rw-r----- 1 root  named 2253 4月   5 2018 named.ca
-rw-r----- 1 root  named  152 12月 15 2009 named.empty
-rw-r----- 1 root  named  152 6月  21 2007 named.localhost
-rw-r----- 1 root  named  168 12月 15 2009 named.loopback
drwxrwx--- 2 named named    6 8月   8 20:16 slaves
-rw-r--r-- 1 root  named  154 12月 30 00:10 test.com.zone
-rw-r--r-- 1 root  named  112 12月 30 21:33 test.com.zone.bj
-rw-r--r-- 1 root  named  112 12月 30 21:31 test.com.zone.cd
-rw-r--r-- 1 root  named  117 12月 30 21:35 test.com.zone.sh
[root@test ~]#
[root@test ~]#find /var/named/ -name "test.com.zone*"|xargs chmod o-r
[root@test ~]#ll /var/named/
總用量 36
-rw-r--r-- 1 root  root   188 12月 30 00:28 192.168.0.zone
drwxrwx--- 2 named named   23 12月 29 23:23 data
drwxrwx--- 2 named named   60 12月 30 01:01 dynamic
-rw-r----- 1 root  named 2253 4月   5 2018 named.ca
-rw-r----- 1 root  named  152 12月 15 2009 named.empty
-rw-r----- 1 root  named  152 6月  21 2007 named.localhost
-rw-r----- 1 root  named  168 12月 15 2009 named.loopback
drwxrwx--- 2 named named    6 8月   8 20:16 slaves
-rw-r----- 1 root  named  154 12月 30 00:10 test.com.zone
-rw-r----- 1 root  named  112 12月 30 21:33 test.com.zone.bj
-rw-r----- 1 root  named  112 12月 30 21:31 test.com.zone.cd
-rw-r----- 1 root  named  117 12月 30 21:35 test.com.zone.sh
[root@test ~]#

  說明:通過上面的配置後,我們最終希望各自的地區的使用者訪問各自區域的資料檔案,從而實現了不同區域的使用者,獲取不同ip地址資訊。這裡還是建議把新建的許可權屬組給改成named,雖然不改是可以的,但是許可權比較大,應該只允許named有讀許可權就好了。

  5)檢查配置檔案,重啟服務

[root@test ~]#named-checkconf 
[root@test ~]#named-checkzone test.com /var/named/test.com.zone.cd
zone test.com/IN: loaded serial 0
OK
[root@test ~]#named-checkzone test.com /var/named/test.com.zone.bj
zone test.com/IN: loaded serial 0
OK
[root@test ~]#named-checkzone test.com /var/named/test.com.zone.sh
zone test.com/IN: loaded serial 0
OK
[root@test ~]#rndc reload
server reload successful
[root@test ~]#

  6)測試

模擬成都的使用者訪問DNS

[qiuhom@test-node1 ~]$ip a l
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:24:81:68:ce:45 brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.151/24 brd 192.168.0.255 scope global eth0
    inet6 fe80::224:81ff:fe68:ce45/64 scope link 
       valid_lft forever preferred_lft forever
[qiuhom@test-node1 ~]$
[qiuhom@test-node1 ~]$dig www.test.com @192.168.0.99

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6_10.3 <<>> www.test.com @192.168.0.99
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51022
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;www.test.com.                  IN      A

;; ANSWER SECTION:
www.test.com.           86400   IN      A       3.3.3.3

;; AUTHORITY SECTION:
test.com.               86400   IN      NS      dns1.test.com.

;; ADDITIONAL SECTION:
dns1.test.com.          86400   IN      A       192.168.0.99

;; Query time: 2 msec
;; SERVER: 192.168.0.99#53(192.168.0.99)
;; WHEN: Mon Dec 30 22:20:02 2019
;; MSG SIZE  rcvd: 81

[qiuhom@test-node1 ~]$dig blog.test.com @192.168.0.99   

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6_10.3 <<>> blog.test.com @192.168.0.99
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4979
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;blog.test.com.                 IN      A

;; ANSWER SECTION:
blog.test.com.          86400   IN      A       4.4.4.4

;; AUTHORITY SECTION:
test.com.               86400   IN      NS      dns1.test.com.

;; ADDITIONAL SECTION:
dns1.test.com.          86400   IN      A       192.168.0.99

;; Query time: 1 msec
;; SERVER: 192.168.0.99#53(192.168.0.99)
;; WHEN: Mon Dec 30 22:20:12 2019
;; MSG SIZE  rcvd: 82

[qiuhom@test-node1 ~]$

  說明:通過192.168.0.0/24主機訪問的結果是指定view裡指定的資料庫檔案的內容.

  模擬北京的使用者訪問DNS

[root@test ~]#ip a l
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:30:18:51:af:3c brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.99/24 brd 192.168.0.255 scope global noprefixroute enp2s0
       valid_lft forever preferred_lft forever
    inet 172.16.1.2/16 brd 172.16.255.255 scope global noprefixroute enp2s0:0
       valid_lft forever preferred_lft forever
    inet6 fe80::230:18ff:fe51:af3c/64 scope link 
       valid_lft forever preferred_lft forever
3: enp3s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000
    link/ether 00:30:18:51:af:3d brd ff:ff:ff:ff:ff:ff
4: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default 
    link/ether 02:42:d6:07:f1:b0 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 scope global docker0
       valid_lft forever preferred_lft forever
[root@test ~]#dig www.test.com @172.16.1.2

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> www.test.com @172.16.1.2
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33773
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.test.com.                  IN      A

;; ANSWER SECTION:
www.test.com.           86400   IN      A       5.5.5.5

;; AUTHORITY SECTION:
test.com.               86400   IN      NS      dns1.test.com.

;; ADDITIONAL SECTION:
dns1.test.com.          86400   IN      A       192.168.0.99

;; Query time: 0 msec
;; SERVER: 172.16.1.2#53(172.16.1.2)
;; WHEN: 一 12月 30 22:24:07 CST 2019
;; MSG SIZE  rcvd: 92

[root@test ~]#dig blog.test.com @172.16.1.2   

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> blog.test.com @172.16.1.2
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8001
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;blog.test.com.                 IN      A

;; ANSWER SECTION:
blog.test.com.          86400   IN      A       6.6.6.6

;; AUTHORITY SECTION:
test.com.               86400   IN      NS      dns1.test.com.

;; ADDITIONAL SECTION:
dns1.test.com.          86400   IN      A       192.168.0.99

;; Query time: 0 msec
;; SERVER: 172.16.1.2#53(172.16.1.2)
;; WHEN: 一 12月 30 22:24:18 CST 2019
;; MSG SIZE  rcvd: 93

[root@test ~]#

  模擬上海的使用者訪問DNS

[root@test ~]#dig www.test.com @127.0.0.1

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> www.test.com @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50994
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.test.com.                  IN      A

;; ANSWER SECTION:
www.test.com.           86400   IN      A       7.7.7.7

;; AUTHORITY SECTION:
test.com.               86400   IN      NS      dns1.test.com.

;; ADDITIONAL SECTION:
dns1.test.com.          86400   IN      A       192.168.0.99

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: 一 12月 30 22:25:52 CST 2019
;; MSG SIZE  rcvd: 92

[root@test ~]#dig blog.test.com @127.0.0.1   

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> blog.test.com @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10062
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;blog.test.com.                 IN      A

;; ANSWER SECTION:
blog.test.com.          86400   IN      A       8.8.8.8

;; AUTHORITY SECTION:
test.com.               86400   IN      NS      dns1.test.com.

;; ADDITIONAL SECTION:
dns1.test.com.          86400   IN      A       192.168.0.99

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: 一 12月 30 22:25:58 CST 2019
;; MSG SIZE  rcvd: 93

[root@test ~]#

  說明:在本機使用127.0.0.1 去查,named會走回環地址去訪問DNS,這個時候acl就會匹配到shnet ,從而訪問view_sh說指定的區域資料庫檔案內容。這裡要注意一點就是acl它預設是從上往下匹配,若匹配到就不往下匹配,所以127.0.0.1 既不屬於192.168.0.0/24 這個網路,也不屬於172.16.1.0/24這個網路,所以它會被any匹配到。

  到此智慧DNS的搭建就完成了,事實上智慧DNS的主要作用就是智慧的區分不同來源的使用者訪問不同的區域檔案,從而實現使用者訪問到的DNS是離自己最近的伺服器,在網際網路中的應用有CDN(內容分發網路),它的背後實現就是智慧DNS。把不同的區域的使用者通過智慧DNS分別分向不同地區的DNS伺服器上去,從而實現了使用者訪問網站的伺服器是離自己最近的伺服器,CDN實現了加快使用者的訪問同時還減輕了網站主伺服器的壓力和頻寬。

3、編譯安裝Mariadb,並啟動後可以正常登入

  1)準備原始碼包

[root@test ~]#rz
rz waiting to receive.
 zmodem trl+C ȡ

  100%   70172 KB 23390 KB/s 00:00:03       0 Errors..

[root@test ~]#ls mariadb-10.2.19.tar.gz 
mariadb-10.2.19.tar.gz
[root@test ~]#

  2)安裝依賴環境包

[root@test ~]# yum install bison bison-devel zlib-devel libcurl-devel libarchive-devel boost-devel gcc gcc-c++ cmake ncurses-devel gnutls-devel libxml2-devel openssl-devel libevent-devel libaio-devel -y

  3)建立系統賬號,並解壓原始碼

[root@test ~]# useradd -r -s /sbin/nologin -d /app/mysql/ mysql
[root@test ~]# getent passwd mysql
mariadb:x:989:983::/app/mysql/:/sbin/nologin
[root@test ~]# tar xf mariadb-10.2.19.tar.gz 
[root@test ~]# cd mariadb-10.2.19/
[root@test mariadb-10.2.19]# 

  4)cmake 編譯並指定編譯選項

cmake . \
-DCMAKE_INSTALL_PREFIX=/app/mysql \
-DMYSQL_DATADIR=/data/mysql/ \
-DSYSCONFDIR=/etc/mysql \
-DMYSQL_USER=mysql \
-DWITH_INNOBASE_STORAGE_ENGINE=1 \
-DWITH_ARCHIVE_STORAGE_ENGINE=1 \
-DWITH_BLACKHOLE_STORAGE_ENGINE=1 \
-DWITH_PARTITION_STORAGE_ENGINE=1 \
-DWITHOUT_MROONGA_STORAGE_ENGINE=1 \
-DWITH_DEBUG=0 \
-DWITH_READLINE=1 \
-DWITH_SSL=system \
-DWITH_ZLIB=system \
-DWITH_LIBWRAP=0 \
-DENABLED_LOCAL_INFILE=1 \
-DMYSQL_UNIX_ADDR=/data/mysql/mysql.sock \
-DDEFAULT_CHARSET=utf8 \
-DDEFAULT_COLLATION=utf8_general_ci

  說明:如果出錯需要刪除 CMakeCache.txt 然後重新在用cmake指定編譯選項生成makefile檔案,在編譯

  5)上面cmake沒有錯誤的情況下,在執行make && make install 

……省略部分內容
-- Looking for krb5_free_unparsed_name
-- Looking for krb5_free_unparsed_name - found
-- Looking for event.h
-- Looking for event.h - found
-- Configuring done
-- Generating done
-- Build files have been written to: /root/mariadb-10.2.19
[root@test mariadb-10.2.19]#  make -j 4 && make install 

  說明:make -j 表示指定多少執行緒來編譯,-j 4 表示用4個執行緒同時來編譯,這是一種多執行緒的編譯方式

  6)準備path環境

[root@test ~]# echo 'PATH=/app/mysql/bin:$PATH' > /etc/profile.d/mysql.sh
[root@test ~]# cat /etc/profile.d/mysql.sh
PATH=/app/mysql/bin:$PATH
[root@test ~]# . /etc/profile.d/mysql.sh
[root@test ~]#

  7)生成資料庫檔案

[root@test ~]# cd /app/mysql/
[root@test mysql]# scripts/mysql_install_db --datadir=/data/mysql/ --user=mysql
Installing MariaDB/MySQL system tables in '/data/mysql/' ...
OK

To start mysqld at boot time you have to copy
support-files/mysql.server to the right place for your system


PLEASE REMEMBER TO SET A PASSWORD FOR THE MariaDB root USER !
To do so, start the server, then issue the following commands:

'./bin/mysqladmin' -u root password 'new-password'
'./bin/mysqladmin' -u root -h test password 'new-password'

Alternatively you can run:
'./bin/mysql_secure_installation'

which will also give you the option of removing the test
databases and anonymous user created by default.  This is
strongly recommended for production servers.

See the MariaDB Knowledgebase at http://mariadb.com/kb or the
MySQL manual for more instructions.

You can start the MariaDB daemon with:
cd '.' ; ./bin/mysqld_safe --datadir='/data/mysql/'

You can test the MariaDB daemon with mysql-test-run.pl
cd './mysql-test' ; perl mysql-test-run.pl

Please report any problems at http://mariadb.org/jira

The latest information about MariaDB is available at http://mariadb.org/.
You can find additional information about the MySQL part at:
http://dev.mysql.com
Consider joining MariaDB's strong and vibrant community:
https://mariadb.org/get-involved/

[root@test mysql]# 

  8)準備配置檔案

[root@test mysql]# cp /app/mysql/support-files/my-huge.cnf /etc/my.cnf
[root@test mysql]# 

  9)準備啟動指令碼

[root@test mysql]# cp /app/mysql/support-files/mysql.server /etc/init.d/mysqld
[root@test mysql]# 

  10)啟動服務 ,登入資料庫

[root@test mysql]# chkconfig --list

Note: This output shows SysV services only and does not include native
      systemd services. SysV configuration data might be overridden by native
      systemd configuration.

      If you want to list systemd services use 'systemctl list-unit-files'.
      To see services enabled on particular target use
      'systemctl list-dependencies [target]'.

netconsole      0:off   1:off   2:off   3:off   4:off   5:off   6:off
network         0:off   1:off   2:on    3:on    4:on    5:on    6:off
[root@test mysql]# chkconfig --add mysqld
[root@test mysql]# chkconfig --list

Note: This output shows SysV services only and does not include native
      systemd services. SysV configuration data might be overridden by native
      systemd configuration.

      If you want to list systemd services use 'systemctl list-unit-files'.
      To see services enabled on particular target use
      'systemctl list-dependencies [target]'.

mysqld          0:off   1:off   2:on    3:on    4:on    5:on    6:off
netconsole      0:off   1:off   2:off   3:off   4:off   5:off   6:off
network         0:off   1:off   2:on    3:on    4:on    5:on    6:off
[root@test mysql]# service mysqld start
Starting mysqld (via systemctl):                           [  OK  ]
[root@test mysql]# ss -ntl
State       Recv-Q Send-Q                    Local Address:Port                                   Peer Address:Port              
LISTEN      0      128                                   *:22                                                *:*                  
LISTEN      0      100                           127.0.0.1:25                                                *:*                  
LISTEN      0      128                                  :::22                                               :::*                  
LISTEN      0      100                                 ::1:25                                               :::*                  
LISTEN      0      80                                   :::3306                                             :::*                  
[root@test mysql]# mysql
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 10
Server version: 10.2.19-MariaDB-log Source distribution

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
| test               |
+--------------------+
4 rows in set (0.00 sec)

MariaDB [(none)]> 

  到此編譯安裝mariadb資料庫就完成了。