管理DNS

孙晓神

已于 2023-04-03 16:18:23 修改

阅读量401

点赞数

分类专栏： Ansible linux 文章标签：自动化

于 2022-05-23 16:20:53 首次发布

本文链接：https://blog.csdn.net/YSEasi/article/details/124929457

版权

linux 同时被 2 个专栏收录

16 篇文章 0 订阅

订阅专栏

Ansible

5 篇文章 0 订阅

订阅专栏

1.使 serverb 成为 backend.lab.example.com 的主名称服务器，以及 192.168.0/24 和 fde2:6494:1e09:2::/64 的反向区域。
在 serverb 上安装BIND9。根据以下规范配置BIND：

在任何接口上侦听 IPv4 和 IPv6 查询。
允许 localhost、172.25.250.254 和 192.168.0.0/24 请求资源数据。
禁用递归。
删除 root(.) 提示节。
为 /etc/named.backend.conf 添加一个包含语句。
在 /etc/named.backend.conf 中配置区域指令以引用您的区域文件。您可以从workstation上的 ~/dns-review/files/primary-named.backend.conf 复制此文件。
将现有区域文件从workstation上的 ~/dns-review/files/zones 复制到 serverb 上的 /var/named 并确保 named 可以读取它们。

1.8.1 查看playbook配置

[student@workstation ~]$ cat ~/dns-review/configure_primary.yml
---
- name: Configure primary nameserver
  hosts: primary_dns
  remote_user: devops
  become: yes

  tasks:
    - name: Install BIND9
      yum:
        name: bind
        state: present

    - name: Copy primary config file
      copy:
        src: files/primary-named.conf
        dest: /etc/named.conf
        owner: root
        group: named
        mode: 0640
      notify:
        - reload_named

    - name: Copy zone files to primary
      copy:
        src: files/zones/
        dest: /var/named
        owner: root
        group: named
        mode: 0640
      notify:
        - reload_named

    - name: Copy named.backend conf file
      copy:
        src: files/primary-named.backend.conf
        dest: /etc/named.backend.conf
        owner: root
        group: named
        mode: 0640
      notify:
        - reload_named

    - name: Add dns service on firewall
      firewalld:
        service: dns
        state: enabled
        immediate: yes
        permanent: yes

    - name: Make sure named is running
      service:
        name: named
        state: started
        enabled: yes

  handlers:
    - name: reload_named
      service:
        name: named
        state: reloaded

1.8.2 playbook配置中目录的文件

src: files/primary_named.conf
src: files/zones/
src: files/primary-named.backend.conf

files/primary_named.conf

[student@workstation ~]$ cat ~/dns-review/files/primary-named.conf 
# /etc/named.conf (primary/secondary)
#
# Template file for BIND labs.

options {
        listen-on port 53 { any; };
        listen-on-v6 port 53 { any; };
        directory "/var/named";
        allow-transfer { 192.168.0.12; };
        allow-query { localhost; 172.25.250.254; 192.168.0.0/24; };
        recursion no;

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";

        /* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
        include "/etc/crypto-policies/back-ends/bind.config";

};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
include "/etc/named.backend.conf";

files/zones/

[student@workstation ~]$ ls -l ~/dns-review/files/zones/
total 12
-rw-rw-r--. 1 student student 801 Jul 30  2020 192.168.0.zone
-rw-rw-r--. 1 student student 984 Jul 30  2020 backend.lab.example.com.zone
-rw-rw-r--. 1 student student 813 Jul 30  2020 fde2.6494.1e09.2.zone

[student@workstation ~]$ cat ~/dns-review/files/zones/192.168.0.zone 
$TTL 300
@ IN SOA serverb.backend.lab.example.com. root.serverb.backend.lab.example.com. (
                    2020041805    ;serial number
                    1H            ;refresh secondary
                    5M            ;retry refresh
                    1W            ;expire zone
                    1M )          ;cache time-to-live for negative answers

; owner                   TTL   CL  type    RDATA
                          600   IN  NS      serverb.backend.lab.example.com.

10.0.168.192.IN-ADDR.ARPA.      IN  PTR     servera.backend.lab.example.com.
11                              IN  PTR     serverb.backend.lab.example.com.
12                              IN  PTR     serverc.backend.lab.example.com.
13                              IN  PTR     serverd.backend.lab.example.com.

[student@workstation ~]$ cat ~/dns-review/files/zones/backend.lab.example.com.zone 
$TTL 300
@ IN  SOA serverb.backend.lab.example.com. root.serverb.backend.lab.example.com. (
                        2020041806  ;serial number
                        1H          ;refresh secondary
                        5m          ;retry refresh
                        1w          ;expire zone
                        1m )        ;cache time-to-live for negative answers

; owner                   TTL     CL  type    RDATA
                          600     IN  NS      serverb

servera                           IN  A       192.168.0.10
serverb                           IN  A       192.168.0.11
serverc                           IN  A       192.168.0.12
serverd                           IN  A       192.168.0.13

servera                           IN  AAAA    fde2:6494:1e09:2::a
serverb                           IN  AAAA    fde2:6494:1e09:2::b
serverc                           IN  AAAA    fde2:6494:1e09:2::c
serverd                           IN  AAAA    fde2:6494:1e09:2::d

[student@workstation ~]$ cat ~/dns-review/files/zones/fde2.6494.1e09.2.zone 
$TTL 300
@ IN SOA serverb.backend.lab.example.com. root.serverb.backend.lab.example.com. (
                    2020041805    ;serial number
                    1H            ;refresh secondary
                    5M            ;retry refresh
                    1W            ;expire zone
                    1M )          ;cache time-to-live for negative answers

; owner                   TTL     CL  type    RDATA
                          600     IN  NS      serverb.backend.lab.example.com.

A.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0   IN  PTR     servera.backend.lab.example.com.
B.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0   IN  PTR     serverb.backend.lab.example.com.
C.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0   IN  PTR     serverc.backend.lab.example.com.
D.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0   IN  PTR     serverd.backend.lab.example.com.

files/primary-named.backend.conf

[student@workstation ~]$ cat ~/dns-review/files/primary-named.backend.conf 
zone "backend.lab.example.com" IN {
        type master;
        file "backend.lab.example.com.zone";
        forwarders {};
};

zone "0.168.192.in-addr.arpa" IN {
        type master;
        file "192.168.0.zone";
        forwarders {};
};

zone "2.0.0.0.9.0.E.1.4.9.4.6.2.E.D.F.ip6.arpa" IN {
        type master;
        file "fde2.6494.1e09.2.zone";
        forwarders {};
};

1.8.2 查看下Inventory主机清单

[student@workstation ~]$ cat /home/student/dns-review/inventory 
[control_node]
workstation.lab.example.com

[caching_dns]
servera.lab.example.com

[primary_dns]
serverb.lab.example.com

[secondary_dns]
serverc.lab.example.com

2.配置满足以下要求的servera缓存名称服务器：

在servera上安装unbound软件包。
配置 unbound 以允许来自 172. 25.250.0/24 子网的查询，免除 example.com 区域的 DNSSEC 验证，并将所有查询转发到 172.25.250.254 。
启动并启用unbound并配置防火墙以允许服务器上的 DNS 流量。

~/dns-review/templates/unbound.conf.j2模板如下内容所示：

[student@workstation ~]$ cat ~/dns-review/templates/unbound.conf.j2 
server:
        interface-automatic: {{ interface_automatic }}
        access-control: {{ access_control }}
        domain-insecure: "{{ domain_insecure }}"

forward-zone:
        name: "{{ forward_zone_name }}"
        forward-addr: {{ forward_zone_addr }}

~/dns-review/configure_caching.yml剧本如下所示：

[student@workstation ~]$ cat ~/dns-review/configure_caching.yml
---
- name: Install cache only nameserver
  hosts: caching_dns
  remote_user: devops
  become: true

  vars:
    interface_automatic: "yes"
    access_control: "172.25.250.0/24 allow"
    domain_insecure: example.com
    forward_zone_name: .
    forward_zone_addr: "172.25.250.254"

  tasks:
    - name: Install cache only nameserver
      yum:
        name: unbound
        state: present
      notify:
        - restart_unbound

    - name: Create configuration file on caching server host
      template:
        src: unbound.conf.j2
        dest: /etc/unbound/conf.d/unbound.conf
      notify:
        - restart_unbound

    - name: Add dns service to firewall
      firewalld:
        service: dns
        state: enabled
        immediate: yes
        permanent: yes

    - name: Make sure unbound is running and enabled
      service:
        name: unbound
        state: started
        enabled: yes

  handlers:
    - name: restart_unbound
      service:
        name: unbound
        state: restarted
        enabled: true

2.8.1 查看inventory配置

[student@workstation ~]$ cat ~/dns-review/inventory 
[control_node]
workstation.lab.example.com

[caching_dns]
servera.lab.example.com

[primary_dns]
serverb.lab.example.com

[secondary_dns]
serverc.lab.example.com