RHCE第4次作业

准备：

关闭防火墙及selinux：

1. [root@master ~]# systemctl stop firewalld

2. [root@master ~]# setenforce 0

 安装软件包（主从服务器都需要）：

[root@slave ~]# yum install bind -y

该软件包服务名称为named。

配置主服务器

服务文件：

1. options {

2. listen-on port 53 { 127.0.0.1; };//监听对象IPV4地址

3. listen-on-v6 port 53 { ::1; };//IPV6地址

4. directory "/var/named";//数据文件主要路径

5. dump-file "/var/named/data/cache_dump.db";//查询数据备份文件

6. statistics-file "/var/named/data/named_stats.txt";

7. memstatistics-file "/var/named/data/named_mem_stats.txt";

8. secroots-file "/var/named/data/named.secroots";

9. recursing-file "/var/named/data/named.recursing";

10. allow-query { localhost; };//允许哪些主机发起域名查询

12. /*

13. - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.

14. - If you are building a RECURSIVE (caching) DNS server, you need to enable

15. recursion.

16. - If your recursive DNS server has a public IP address, you MUST enable access

17. control to limit queries to your legitimate users. Failing to do so will

18. cause your server to become part of large scale DNS amplification

19. attacks. Implementing BCP38 within your network would greatly

20. reduce such attack surface

21. */

22. recursion yes;//是否开启递归查询

24. dnssec-validation yes;

26. managed-keys-directory "/var/named/dynamic";

28. pid-file "/run/named/named.pid";

29. session-keyfile "/run/named/session.key";

31. include "/etc/crypto-policies/back-ends/bind.config";

32. };

34. logging {

35. channel default_debug {

36. file "data/named.run";

37. severity dynamic;

38. };

39. };

41. zone "." IN {

42. type hint;

43. file "named.ca";

44. };//域

46. include "/etc/named.rfc1912.zones";

47. include "/etc/named.root.key";

配置服务文件并添加域（openlab.com）：

1. options {

2. listen-on port 53 { 192.168.91.129; };//监听对象IPV4地址

3. listen-on-v6 port 53 { ::1; };//IPV6地址

4. directory "/var/named";//数据文件主要路径

5. dump-file "/var/named/data/cache_dump.db";//查询数据备份文件

6. statistics-file "/var/named/data/named_stats.txt";

7. memstatistics-file "/var/named/data/named_mem_stats.txt";

8. secroots-file "/var/named/data/named.secroots";

9. recursing-file "/var/named/data/named.recursing";

10. allow-query { any; };//允许哪些主机发起域名查询

11. allow-transfer { 192.168.91.133; };//默认不存在；允许向那个服务器同步资源信息

13. /*

14. - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.

15. - If you are building a RECURSIVE (caching) DNS server, you need to enable

16. recursion.

17. - If your recursive DNS server has a public IP address, you MUST enable access

18. control to limit queries to your legitimate users. Failing to do so will

19. cause your server to become part of large scale DNS amplification

20. attacks. Implementing BCP38 within your network would greatly

21. reduce such attack surface

22. */

24. recursion yes;//是否开启递归查询

26. dnssec-validation yes;

28. managed-keys-directory "/var/named/dynamic";

30. pid-file "/run/named/named.pid";

31. session-keyfile "/run/named/session.key";

33. include "/etc/crypto-policies/back-ends/bind.config";

34. };

36. logging {

37. channel default_debug {

38. file "data/named.run";

39. severity dynamic;

40. };

41. };

43. zone "." IN {

44. type hint;

45. file "named.ca";

46. };

48. zone "openlab.com" IN {

49. type master;

50. file "openlab";

51. };//添加正向域

53. zone "91.168.192.in-addr.arpa" IN {

54. type master;

55. file "openlab_re";

56. };//添加反向域

58. include "/etc/named.rfc1912.zones";

59. include "/etc/named.root.key";

反向域的ip是一个区段，不写主机位且反着写。

创建并添加正向资源记录文件：

[root@master ~]# vim /var/named/openlab

1. $TTL 1D ;;将TTL值统一设置为1天

2. @ IN SOA openlab.com. admin.admin.com ( 2024011600

3. 1M

4. 1M

5. 3M

6. 1D )

8. IN NS dns.openlab.com.

9. dns IN A 192.168.91.129

10. www IN A 192.168.91.111

SOA资源记录类型和NA的域名要加上根域。

每行从左到右依次是：主机名        TTL（统一后就可以省略）        INTER        资源记录类型        数据。

资源记录类型
A：通过域名能够查询到对应ipv4
AAAA：通过域名能够查询到对应ipv6
CNAME：别名资源记录
PTR：指针记录Ipv4/ipv6 查询到一个域名
NS：dns解析记录类型(标记本地dns服务器的主机名)
MX：邮件解析记录类型(标记邮件服务器的主机名）

SOA：起始授权记录(主从服同步)，特殊的是它有7个数据：
        masterdns        TTL        INTER        资源记录类型        数据        邮箱地址        (版本        检查时间        重试时间        失效时间        ttl)

创建并添加反向资源记录文件：

[root@master ~]# vim /var/named/openlab_re

1. $TTL 1D ;;将TTL值统一设置为1天

2. @ IN SOA openlab.com. admin.admin.com ( 2024011600

3. 1M

4. 1M

5. 3M

6. 1D )

8. IN NS dns.openlab.com.

9. 129 IN PTR dns.openlab.com

10. 111 IN PTR www.openlab.com

重启服务后进行测试：

1. [root@master ~]# systemctl restart named

2. [root@master ~]# nslookup

3. > server 192.168.91.129

4. Default server: 192.168.91.129

5. Address: 192.168.91.129#53

6. > dns.openlab.com

7. Server: 192.168.91.129

8. Address: 192.168.91.129#53

10. Name: dns.openlab.com

11. Address: 192.168.91.129

12. > www.openlab.com

13. Server: 192.168.91.129

14. Address: 192.168.91.129#53

16. Name: www.openlab.com

17. Address: 192.168.91.111

18. > 192.168.91.129

19. 129.91.168.192.in-addr.arpa name = dns.openlab.com.91.168.192.in-addr.arpa.

20. > 192.168.91.111

21. 111.91.168.192.in-addr.arpa name = www.openlab.com.91.168.192.in-addr.arpa.

nslookup：可以指定dns服务器进行域名解析。

配置从服务器

配置服务文件并添加域（openlab.com）：

1. options {

2. listen-on port 53 { 192.168.91.133; };

3. listen-on-v6 port 53 { ::1; };

4. directory "/var/named";

5. dump-file "/var/named/data/cache_dump.db";

6. statistics-file "/var/named/data/named_stats.txt";

7. memstatistics-file "/var/named/data/named_mem_stats.txt";

8. secroots-file "/var/named/data/named.secroots";

9. recursing-file "/var/named/data/named.recursing";

10. allow-query { any; };

12. /*

13. - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.

14. - If you are building a RECURSIVE (caching) DNS server, you need to enable

15. recursion.

16. - If your recursive DNS server has a public IP address, you MUST enable access

17. control to limit queries to your legitimate users. Failing to do so will

18. cause your server to become part of large scale DNS amplification

19. attacks. Implementing BCP38 within your network would greatly

20. reduce such attack surface

21. */

22. recursion yes;

24. dnssec-validation yes;

26. managed-keys-directory "/var/named/dynamic";

28. pid-file "/run/named/named.pid";

29. session-keyfile "/run/named/session.key";

31. include "/etc/crypto-policies/back-ends/bind.config";

32. };

34. logging {

35. channel default_debug {

36. file "data/named.run";

37. severity dynamic;

38. };

39. };

41. zone "." IN {

42. type hint;

43. file "named.ca";

44. };

46. zone "openlab.com" IN {

47. type slave;

48. file "named.openlab";

49. masters { 192.168.91.129; };

50. };

52. zone "91.168.192.in-addr.arpa" IN {

53. type slave;

54. file "named.openlab_re";

55. masters { 192.168.91.129; };

56. };

59. include "/etc/named.rfc1912.zones";

60. include "/etc/named.root.key";

不用添加资源文件，将会从主服务器同步过来：

1. [root@slave ~]# ll /var/named

2. total 36

3. drwxrwx---. 2 named named 4096 Jan 16 21:13 data

4. drwxrwx---. 2 named named 4096 Jan 16 21:14 dynamic

5. -rw-r-----. 1 root named 2253 Sep 22 02:33 named.ca

6. -rw-r-----. 1 root named 152 Sep 22 02:33 named.empty

7. -rw-r-----. 1 root named 152 Sep 22 02:33 named.localhost

8. -rw-r-----. 1 root named 168 Sep 22 02:33 named.loopback

9. -rw-r--r--. 1 named named 259 Jan 16 21:13 named.openlab //正向

10. -rw-r--r--. 1 named named 393 Jan 16 21:13 named.openlab_re //反向

11. drwxrwx---. 2 named named 4096 Sep 22 02:33 slaves

重启服务后进行测试：

1. [root@slave ~]# systemctl restart named

2. [root@slave ~]# nslookup

3. > server 192.168.91.133

4. Default server: 192.168.91.133

5. Address: 192.168.91.133#53

6. > dns.openlab.com

7. Server: 192.168.91.133

8. Address: 192.168.91.133#53

10. Name: dns.openlab.com

11. Address: 192.168.91.129

12. > www.openlab.com

13. Server: 192.168.91.133

14. Address: 192.168.91.133#53

16. Name: www.openlab.com

17. Address: 192.168.91.111

18. > 192.168.91.129

19. 129.91.168.192.in-addr.arpa name = dns.openlab.com.91.168.192.in-addr.arpa.

20. > 192.168.91.111

21. 111.91.168.192.in-addr.arpa name = www.openlab.com.91.168.192.in-addr.arpa.

修改资源文件尝试进行主从同步

在主服务器中添加正向解析并修改版本号为（2024011601）：

ftp     IN      A       192.168.91.222

在主服务器中添加反向解析并修改版本号为（2024011601）：

222     IN      PTR     ftp.openlab.com

主服务器测试：

1. [root@master ~]# systemctl restart named

2. [root@master ~]# nslookup

3. > server 192.168.91.129

4. Default server: 192.168.91.129

5. Address: 192.168.91.129#53

6. > ftp.openlab.com

7. Server: 192.168.91.129

8. Address: 192.168.91.129#53

10. Name: ftp.openlab.com

11. Address: 192.168.91.222

12. > 192.168.91.222

13. 222.91.168.192.in-addr.arpa name = ftp.openlab.com.91.168.192.in-addr.arpa.

因为检查时间设置为1分钟，所以我们等待1分钟后在从服务器中尝试：

1. [root@slave ~]# nslookup

2. > server 192.168.91.133

3. Default server: 192.168.91.133

4. Address: 192.168.91.133#53

5. > 192.168.91.222

6. 222.91.168.192.in-addr.arpa name = ftp.openlab.com.91.168.192.in-addr.arpa.

7. > ftp.openlab.com

8. Server: 192.168.91.133

9. Address: 192.168.91.133#53

11. Name: ftp.openlab.com

12. Address: 192.168.91.222

   13.同步成功！