如何进行企业DNS服务器搭建

---

1.关于dns的基本信息解释

dns:domain name service(域名解析服务)

关于客户端:

/etc/resolv.conf	##dns指向文件
	nameserver 172.25.254.20

#测试：
host www.baidu.com ##地址解析命令
dig www.baidu.com ##地址详细解析信息命令

A记录		##ip地址叫做域名的 Address 记录
SOA			##授权起始主机
dns顶级
.  13
次级
.com .net .edu .org ....

baidu.com

关于服务端

bind	安装包
named	服务名称
/etc/named.conf	主配置文件
/var/named	数据目录
端口	53

关于报错信息：
1.no servers could be reached: “服务无法访问（服务是否开启？是否火墙问题？检查网络？检查端口？）”
2.服务启动失败 : “配置文件写错，journalctl -xe查询错误”
3.dig 查询状态:

NOERROR	表示查询成功
REFUSED	服务拒绝访问
SERVFAIL	查询记录失败,（dns服务器无法到达上级，拒绝缓存）
NXDOMAIN	此域名A记录在dns中不存在

2.dns服务的安装与启用

• 安装
  dnf install bind.x86_64 -y

• 启用
  systemctl enable --now named
  firewall-cmd --permanent --add-service=dns
  firewall-cmd --reload

vim /etc/named.conf

11   listen-on port 53 { any; };	##在本地所有网络接口上开启53端口
19   allow-query     { any; };		##允许查询A记录的客户端列表
34   dnssec-validation no;			##禁用dns检测使dns能够缓存外部信息到本机

systemctl restart named

3.高速缓存dns

vim /etc/named.conf
在第20行添加 forwarders { 114.114.114.114; };

4.dns的正向解析

vim /etc/named.rfc1912.zone
	zone "westos.com" IN {		##维护的域名
	        type master;		##当前服务器位主dns
	        file "westos.com.zone";	##域名A记录文件
	        allow-update { none; };	##允许更新主机列表
	};

cd /var/named/
cp -p named.localhost westos.com.zone
$TTL 1D		#TIME-TO-LIVE(dns地址保存时间长度)
@       IN SOA  dns.westos.com. root.westos.com (	#SOA授权起始(Start of Authority)
                                        0       ; serial	#域名版本序列号
                                        1D      ; refresh	#刷新时间（辅助dns）
                                        1H      ; retry		#重试时间（辅助dns）
                                        1W      ; expire	#过期时间（辅助dns,查询失败过期停止对辅助域名的应答）
                                        3H )    ; minimum	#A记录最短有效期
                NS      dns.westos.com.
dns             A       192.168.0.20
www             CNAME   westos.a.westos.com.		##规范域名
westos.a        A       192.168.0.111			##正向解析记录
westos.a        A       192.168.0.112			
westos.com.     MX 1    192.168.0.20.			##邮件解析记录

systemctl restart named 

dig www.westos.com #查询正向解析
dig -t mx westos.com #邮件解析记录查询

5.dns的反向解析

vim /etc/named.rfc1912.zones
zone "0.168.192.in-addr.arpa" IN {
	type master;
	file "192.168.0.ptr";
	allow-update { none; };
};

cd /var/named/
cp -p named.loopback 192.168.0.ptr

vim 192.168.0.ptr
$TTL 1D
@	IN SOA	dns.westos.com. root.westos.com. (
					0	; serial
					1D	; refresh
					1H	; retry
					1W	; expire
					3H )	; minimum
	NS	dns.westos.com.
dns	A	192.168.0.20
11	PTR	www.westos.com.
12	PTR	bbs.westos.com.
13	PTR	news.westos.com.

systemctl restart named 

测试：
dig -x 192.168.0.11

6.dns的双向解析

实验环境：

• 客户端2台
  192.168.0网段
  172.25.254网段 ## ifconfig ens160 172.25.254.30 netmask 255.255.255.0

• 服务端1台2个网段的ip
  192.168.0.20
  172.25.254.20 ## ifconfig ens160 172.25.254.20 netmask 255.255.255.0

在192.168.0网段的客户主机中

vim /etc/resolv.conf
	nameserver 192.168.0.20

在172.25.254网段的客户主机中

vim /etc/resolv.conf
	nameserver 172.25.254.20

配置方式：

$sudo cd /var/named/
$sudo cp -p westos.com.zone westos.com.inter
$sudo vim westos.com.inter
$TTL 1D
@	IN SOA	dns.westos.com. root.westos.com (
					0	; serial
					1D	; refresh
					1H	; retry
					1W	; expire
					3H )	; minimum
		NS	dns.westos.com.
dns		A	172.25.254.20
www		CNAME	westos.a.westos.com.
westos.a	A	172.25.254.111
westos.a	A	172.25.254.112
westos.com.	MX 1	172.25.254.20.	#mail exchanger 

cp -p /etc/named.rfc1912.zones  /etc/named.rfc1912.inters

$sudo vim /etc/named.rfc1912.inters
zone "westos.com" IN {
	type master;
	file "westos.com.inter";
	allow-update { none; };
};

$sudo vim /etc/named.conf
#zone "." IN {
##       type hint;
##       file "named.ca";
##};
#
##include "/etc/named.rfc1912.zones";
##include "/etc/named.root.key";


view localnet {
        match-clients { 192.168.0.0/24; };
        zone "." IN {
                type hint;
                file "named.ca";
        };
        include "/etc/named.rfc1912.zones";
        include "/etc/named.root.key";
};

view internet {
        match-clients { any; };
        zone "." IN {
                type hint;
                file "named.ca";
        };
        include "/etc/named.rfc1912.inters";
        include "/etc/named.root.key";
};
      
$sudo systemctl restart named 

测试：
分别在2个网段的主机中作同样域名的地址解析得到的A记录不同。

7.dns集群

主dns：

zone "westos.com" IN {
        type master;
        file "westos.com.zone";
        allow-update { none; };
        also-notify { 192.168.0.30; };		##主动通知的辅助dns主机
};

$sudo vim /var/named/westos.com.zone
$TTL 1D
@       IN SOA  dns.westos.com. root.westos.com (
                                        2020031402      ; serial	##每次修改A记录文件需要
                                        1D      ; refresh		##变更此参数的值
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
                NS      dns.westos.com.
dns             A       192.168.0.20
www             CNAME   westos.a.westos.com.
westos.a        A       192.168.0.210
westos.a        A       192.168.0.211
westos.com.     MX 1    192.168.0.20.



slave dns：
dnf install bind -y
firewall-cmd --add-service=dns

$sudo vim /etc/named.conf
listen-on port 53 { any; };
allow-query     { any; };
dnssec-validation no;

$sudo vim /etc/named.rfc1912.zone
zone "westos.com" IN {
        type slave;			##dns状态位辅助dns
        masters { 192.168.0.20; };	##主dns
        file "slaves/westos.com.zone";	##同步数据文件
};

$sudo systemctl restart named 

8.dns的更新

dns基于ip地址的更新：
在dns中设定：

vim /etc/named.rfc1912.zones

zone "westos.com" IN {
        type master;
        file "westos.com.zone";
        allow-update { 192.168.0.10; };		##允许指定客户端更新westos域
        also-notify { 192.168.0.30; };
};

测试：
在192.168.0.10

[root@rhel8_node1 ~]# nsupdate 
> server 192.168.0.20
> update add hello.westos.com 86400 A 192.168.0.111	##新曾A记录
> send 
> update delete hello.westos.com			##删除A记录
> send 

dns基于key更新的方式:

$sudo dnssec-keygen -a HMAC-SHA256 -b 128 -n HOST westos
$sudo cp -p /etc/rndc.key /etc/wesots.key
$sudo vim /etc/wesots.key
key "westos" {
	algorithm hmac-sha256;
	secret "SB1tQcLaWeroU9lGW21zeA==";
};

$sudo vim /etc/named.conf
43 include "/etc/wesots.key";

$sudo vim /etc/named.rfc1912.zones
zone "westos.com" IN {
        type master;
        file "westos.com.zone";
        allow-update { key westos; };
        also-notify { 192.168.0.30; };
};

$sudo systemctl restart named 

[root@rhel8_node1 ~]# nsupdate -k /mnt/Kwestos.+163+26695.private 
> server 192.168.0.20
> update add hello.westos.com 86400 A 192.168.0.111
> send 
> quit

9.ddns（dhcp+dns）

$sudo dnf instsall dhcp-server -y
$sudo vim /etc/dhcpd/dhcpd.conf
# dhcpd.conf
#
# Sample configuration file for ISC dhcpd
#

# option definitions common to all supported networks...
option domain-name "westos.com";
option domain-name-servers 192.168.0.20;

default-lease-time 600;
max-lease-time 7200;

# Use this to enble / disable dynamic dns updates globally.
ddns-update-style interim;

# If this DHCP server is the official DHCP server for the local
# network, the authoritative directive should be uncommented.
#authoritative;

# Use this to send dhcp log messages to a different log file (you also
# have to hack syslog.conf to complete the redirection).
log-facility local7;

# No service will be given on this subnet, but declaring it helps the 
# DHCP server to understand the network topology.


# This is a very basic subnet declaration.

subnet 192.168.0.0 netmask 255.255.255.0 {
  range 192.168.0.51 192.168.0.80;
  option routers 192.168.0.1;

}

key westos {
         algorithm hmac-sha256;
         secret SB1tQcLaWeroU9lGW21zeA==;
       };

zone westos.com. {
	primary 127.0.0.1;
	key westos;
}

dns的key更新

测试：

设定测试主机网络工作方式为dhcp
设定主机名称test.westos.com

重启网络

dig test.westos.com

可以得到正确解析