UOS配置bind+chroot

• bind+chroot
• 配置为DNS根域服务器
• 其他未知域名解析,统一解析为该本机IP
• 创建正向区域“chinaskills.cn”
• 类型为Slave;
• 主服务器为“AppSrv”，
• 启用 chrootQ功能，限制bind9在/ar/named/chroot/隐藏bind版本号，版本是示为"unknow

---

一、安装bind

[ispsrv /]# apt -y install bind9 dnsutils

[ispsrv /]# nano /etc/resolv.conf
nameserver 127.0.0.1

 

二、配置解析域和隐藏服务版本

[ispsrv /]# nano /etc/bind/named.conf.local
#根域
zone "." {
type master;
file "/etc/bind/root.zone";
};
#解析域
zone "chinaskills.cn" {
type slave;
file "/etc/bind/chinaskills.cn.zone";
masters { 81.6.63.254;};
};

[ispsrv /etc/bind]# cp -a db.local root.zone
[ispsrv /etc/bind]# nano root.zone
$TTL    604800
@       IN      SOA     localhost. root.localhost. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      localhost.
*       IN      A       81.6.63.100

#隐藏版本号
[ispsrv /etc/bind]# nano named.conf.options 
options {
        version "[unknow]";
};

 

三、启用chroot

#修改在/var/named目录下运行
[ispsrv /]# nano /etc/default/bind9
OPTIONS="-u bind -t /var/named/chroot"
#重新加载守护进程
[ispsrv /]#  systemctl daemon-reload

#启用chroot
#//创建运行目录
[ispsrv /]# mkdir -p /var/named/chroot/{etc,dev,run/named,/var/cache/bind} 
[ispsrv /]# mknod /var/named/chroot/dev/null c 1 3 
[ispsrv /]# mknod /var/named/chroot/dev/random c 1 8
[ispsrv /]# mknod /var/named/chroot/dev/urandom c 1 9 
#//修改权限
[ispsrv /]# chmod 660 /var/named/chroot/dev/{null,random,urandom} 
#//将bind移动到chroot目录中
[ispsrv /]# cp /etc/bind /var/named/chroot/etc -r 
#//创建软连接
[ispsrv /]# ln -s /var/named/chroot/etc/bind /etc/bind	
[ispsrv /]# chown bind:bind /var/named/chroot/etc/bind/rndc.key
[ispsrv /]# chown bind:bind /var/named/chroot/run/named
[ispsrv /]# chmod 775 /var/named/chroot/{var/cache/bind,/run/named}
# //更改所有权
[ispsrv /]# chgrp bind /var/named/chroot/{var/cache/bind,/run/named}
#复制/usr/share/dns下的文件
#//创建目录
[ispsrv /]# cmkdir -p /var/named/chroot/usr/share/dns	
#//复制文件
[ispsrv /]# cp /usr/share/dns/* /var/named/chroot/usr/share/dns/ 	
#设置监听日志路径
[ispsrv /]# echo "\$AddUnixListenSocket /var/named/chroot/dev/log" > /etc/rsyslog.d/bind-chroot.conf
#重启服务
[ispsrv /]# systemctl restart rsyslog
[ispsrv /]# systemctl restart bind9
#修改配置文件需到chroot目录下修改
[ispsrv /]# rm /etc/bind -rf
[ispsrv /]# nano /var/named/chroot/etc/bind/named.conf.local
[ispsrv /]# ln -s /var/named/chroot/etc/bind /etc/bind
[ispsrv /]# systemctl restart bind9

四、测试