Linux下DNS服务搭建——bind安装

最新推荐文章于 2024-08-18 20:04:05 发布

change-can

最新推荐文章于 2024-08-18 20:04:05 发布

阅读量1.7k

点赞数

分类专栏：服务

本文链接：https://blog.csdn.net/change_can/article/details/80927115

版权

服务专栏收录该内容

8 篇文章 0 订阅

订阅专栏

要求：给需要配置的每台服务器安装bind：
[root@localhost ~]# yum install bind -y
主服务器（父域）：192.168.190.131 change.com
从服务器：192.168.190.134 ns2.change.com
子域：192.168.190.135 cdn.change.com
一、主服务器的配置（192.168.190.131）
配置缓冲名称服务器/etc/named.conf
2、主DNS名称服务器：
（1）在主配置文件中定义区域： /etc/named.rfc1912.zones
（2）定义区域解析库文件： /var/named/change.com.zone
3、反向区域
（1）定义区域解析库文件： /etc/named.rfc1912.zones
（2）区域解析库文件： /var/named/change.com.zone
二、从服务器配置（192.168.190.134）
正解：
1、在主配置文件中定义区域/etc/named.rfc1912.zone
查看从服务器同步过来的区域配置文件/var/named/slaves/change.com.zone
反解：
3、反解从服务器的配置：/etc/named.rfc1912.zones
4、查看同步过来的反解区域配置文件：/var/named/slaves/192.168.190.zone
三、子域授权
1、在父域（192.168.190.131）：
（1）缓存名称服务器： /etc/named.conf
在区域解析库文件添加授权子域：/var/named/change.com.zone
2、在子域 192.168.190.135：
（1）缓存名称服务器：/etc/named.conf
（2）在主配置文件中定义区域：/etc/named.rfc1912.zones
（3）定义区域解析库文件：/var/named/cdn.change.com.zone
（4）更改区域文件的权限为640和属组为named
（5）重启DNS并检验结果

注意：
1、查看日志文件：
[root@localhost ~]# tail /var/log/messages
2、每次编辑修改完文件后可以检查是否有语法错误
[root@localhost ~]# named-checkconf
[root@localhost ~]# named-checkzone “change.com.zone” /var/named/change.com.zone
3、防火墙也要同时放行TCP、UDP的53端口，才能保证主DNS服务器被正确解析
[root@localhost ~]# vim /etc/sysconfig/iptables
-A INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT
[root@localhost ~]# service iptables restart # 重启防火墙
iptables: Applying firewall rules: [ OK ]

一、主服务器的配置（192.168.190.131）
配置缓冲名称服务器/etc/named.conf
[root@localhost ~]# vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; };
// listen-on-v6 port 53 { ::1; };
directory “/var/named”;
dump-file “/var/named/data/cache_dump.db”;
statistics-file “/var/named/data/named_stats.txt”;
memstatistics-file “/var/named/data/named_mem_stats.txt”;
allow-query { any; };
recursion yes;

// dnssec-enable yes;
// dnssec-validation yes;

/* Path to ISC DLV key */

// bindkeys-file “/etc/named.iscdlv.key”;

// managed-keys-directory “/var/named/dynamic”;
};

logging {
channel default_debug {
file “data/named.run”;
severity dynamic;
};
};

zone “.” IN {
type hint;
file “named.ca”;
};

include “/etc/named.rfc1912.zones”;
include “/etc/named.root.key”;
2、主DNS名称服务器
（1）在主配置文件中定义区域 /etc/named.rfc1912.zones
[root@localhost ~]# vim /etc/named.rfc1912.zones #在最后面添加
zone “change.com” IN { # 正向解析
type master; # 类型为主DNS
file “change.com.zone”; # 正向解析文件位置
};
（2）定义区域解析库文件 /var/named/change.com.zone
[root@localhost ~]# vim /var/named/change.com.zone
$TTL 86440
$ORIGIN change.com.
@ IN SOA ns1.change.com. admin.change.com. ( # SOA字段
20160843001 # 版本号，同步一次+1
1H # 更新时间1h
2M # 更新失败，重试更新时间 2min
3D # 更新失败多长时间后此DNS失效时间3day
1D # 解析不到请求不予回复的时间
)
IN NS ns1.change.com. # 域名服务器
IN NS ns2.change.com. # 从服务器
IN MX 10 mx1.change.com. # 定义邮件服务器，10指优先级
ns1 IN A 192.168.190.131 # ns1域名服务器的IP地址
ns2 IN A 192.168.190.134 # ns2从服务器的IP地址
mx1 IN A 192.168.190.130 # mx1邮件服务器的IP地址
www IN A 192.168.190.132 # www.change.com的IP地址
cname IN CNAME www # 别名
检查语法错误：
[root@localhost ~]# named-checkconf
[root@localhost ~]# named-checkzone “change.com.zone” /var/named/change.com.zone
zone change.com.zone/IN: change.com.zone/MX ‘mx1.change.com’ (out of zone) has no addresses records (A or AAAA)
zone change.com.zone/IN: loaded serial 2016083001
OK
3、反向区域
（1）定义区域 /etc/named.rfc1912.zones
[root@localhost ~]# vim /etc/named.conf #在最后面添加
zone “190.168.192.in-addr.arpa” IN { # 反向解析
type master; # 类型为主DNS
file “192.168.190.zone”; # 反向解析文件位置
};
（2）区域解析库文件 /var/named/192.168.190.zone
$TTL 86440
@ IN SOA ns1.change.com. admin.change.com. (
2016083001
1H
2M
3D
1D)
IN NS ns1.change.com.
131 IN PTR ns1.change.com.
（3）更改两个自定义区域文件的权限为640和属组为named
[root@localhost ~]# chmod 640 /var/named/change.com.zone /var/named/192.168.190.zone
[root@localhost ~]# chown :named /var/named/change.com.zone /var/named/192.168.190.zone
（4）重启DNS，然后进行正向方向解析测试
[root@localhost ~]# service named restart
Stopping named: [ OK ]
Starting named: [ OK ]
[root@localhost ~]# rndc reload
server reload successful
[root@localhost ~]# dig -t A www.change.com @192.168.190.131 # 正向解析

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.47.rc1.el6 <<>> -t A www.change.com @192.168.190.131
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16244
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;www.change.com. IN A

;; ANSWER SECTION:
www.change.com. 86440 IN A 192.168.190.132

;; AUTHORITY SECTION:
change.com. 86440 IN NS ns1.change.com.

;; ADDITIONAL SECTION:
ns1.change.com. 86440 IN A 192.168.190.131

;; Query time: 1 msec
;; SERVER: 192.168.190.131#53(192.168.190.131)
;; WHEN: Thu Sep 1 10:46:07 2016
;; MSG SIZE rcvd: 82
[root@localhost ~]# dig -x 192.168.190.131 @192.168.190.131 # 反向解析

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.47.rc1.el6 <<>> -x 192.168.190.131 @192.168.190.131
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10250
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;131.190.168.192.in-addr.arpa. IN PTR

;; ANSWER SECTION:
131.190.168.192.in-addr.arpa. 86440 IN PTR ns1.change.com.

;; AUTHORITY SECTION:
190.168.192.in-addr.arpa. 86440 IN NS ns1.change.com.

;; ADDITIONAL SECTION:
ns1.change.com. 86440 IN A 192.168.190.131

;; Query time: 0 msec
;; SERVER: 192.168.190.131#53(192.168.190.131)
;; WHEN: Thu Sep 1 10:47:23 2016
;; MSG SIZE rcvd: 104
二、从服务器配置（192.168.190.134）
在上面的配置ns2的IP地址是192.168.190.134，把此服务器配置为从服务器。注意：从服务器一定要在主服务器上通过NS体现出来，否则更新配置时，主服务无法主动通知从服务器。
从服务器不需要区域文件，只要在named.rfc1912.zone文件中配置区域，指定为slave ，并指定masters的IP地址便可。同步成功后，自动会在/var/named/slaves/目录下创建区域的文件
1、主配置文件/etc/named.rfc1912.zone
[root@localhost ~]# vim /etc/named.rfc1912.zones # 在后面直接添加
zone “change.com” IN {
type slave;
masters { 192.168.190.131; };
file “slaves/change.com.zone”;
};
[root@localhost ~]# service named restart
Stopping named: . [ OK ]
Starting named: [ OK ]
2、查看从服务器同步过来的区域配置文件/var/named/slaves/change.com.zone
[root@localhost ~]# cat /var/named/slaves/change.com.zone
$ORIGIN .
$TTL 86440 ; 1 day 40 seconds
change.com IN SOA ns1.change.com. admin.change.com. (
2016083001 ; serial
3600 ; refresh (1 hour)
120 ; retry (2 minutes)
259200 ; expire (3 days)
86400 ; minimum (1 day)
)
NS ns1.change.com.
NS ns2.change.com.
MX 10 mx1.change.com.
$ORIGIN change.com.
cname CNAME www
mx1 A 192.168.190.130
ns1 A 192.168.190.131
ns2 A 192.168.190.134
www A 192.168.190.132
3、反解从服务器的配置/etc/named.rfc1912.zones
[root@localhost ~]# vim /etc/named.rfc1912.zones # 直接在后面添加
zone “190.168.192.in-addr.arpa” IN {
type slave;
masters { 192.168.190.131; };
file “slaves/192.168.190.zone”;
};
[root@localhost ~]# service named restart
Stopping named: . [ OK ]
Starting named: [ OK ]
查看日志文件 /var/log/messages
[root@localhost ~]# tail /var/log/messages
Aug 31 12:42:22 localhost named[18884]: zone change.com/IN: loaded serial 2016083001
Aug 31 12:42:22 localhost named[18884]: zone localhost.localdomain/IN: loaded serial 0
Aug 31 12:42:22 localhost named[18884]: zone localhost/IN: loaded serial 0
Aug 31 12:42:22 localhost named[18884]: managed-keys-zone ./IN: loaded serial 2
Aug 31 12:42:22 localhost named[18884]: running
Aug 31 12:42:22 localhost named[18884]: zone change.com/IN: sending notifies (serial 2016083001)
Aug 31 12:42:22 localhost named[18884]: zone 190.168.192.in-addr.arpa/IN: Transfer started.
Aug 31 12:42:22 localhost named[18884]: transfer of ‘190.168.192.in-addr.arpa/IN’ from 192.168.190.131#53: connected using 192.168.190.134#57740
Aug 31 12:42:22 localhost named[18884]: zone 190.168.192.in-addr.arpa/IN: transferred serial 2016083001
Aug 31 12:42:22 localhost named[18884]: transfer of ‘190.168.192.in-addr.arpa/IN’ from 192.168.190.131#53: Transfer completed: 1 messages, 4 records, 166 bytes, 0.003 secs (55333 bytes/sec)
4、查看同步过来的反解区域配置文件/var/named/slaves/192.168.190.zone
[root@localhost ~]# cat /var/named/slaves/192.168.190.zone
$ORIGIN .
$TTL 86440 ; 1 day 40 seconds
190.168.192.in-addr.arpa IN SOA ns1.change.com. admin.change.com. (
2016083001 ; serial
3600 ; refresh (1 hour)
120 ; retry (2 minutes)
259200 ; expire (3 days)
86400 ; minimum (1 day)
)
NS ns1.change.com.
$ORIGIN 190.168.192.in-addr.arpa.
131 PTR ns1.change.com.

三、子域授权
1、在父域（192.168.190.131）：
（1）缓存名称服务器： /etc/named.conf
通过forward启动全局转发，转发给上层172.16.92.20。如果此父域能够访问根域服务器，此可配可不配。
[root@localhost ~]# vim /etc/named.conf # 在options里面添加
forward first;
forwarders { 172.16.92.20; };
dnssec-enable no;
dnssec-validation no;
（2）在区域解析库文件添加授权子域：/var/named/change.com.zone
[root@localhost ~]# vim /var/named/change.com.zone
IN NS centos
cdn.change.com. IN NS centos.cdn.magedu.com. # 子域名称服务器
centos.cdn.magedu.com. IN A 192.168.190.135 #子域名称服务器主机记录
[root@localhost ~]# rndc reload
server reload successful
子域 192.168.190.135：
（1）缓存名称服务器：/etc/named.conf
[root@localhost ~]# vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; };
// listen-on-v6 port 53 { ::1; };
directory “/var/named”;
dump-file “/var/named/data/cache_dump.db”;
statistics-file “/var/named/data/named_stats.txt”;
memstatistics-file “/var/named/data/named_mem_stats.txt”;
allow-query { any; };
recursion yes;

    dnssec-enable no;
    dnssec-validation no;

    /* Path to ISC DLV key */
    /* Path to ISC DLV key */

// bindkeys-file “/etc/named.iscdlv.key”;

// managed-keys-directory “/var/named/dynamic”;
};

logging {
channel default_debug {
file “data/named.run”;
severity dynamic;
};
};

zone “.” IN {
type hint;
file “named.ca”;
};

#zone “change.com” IN {

type forward;

forward only;

type forwarders { 192.168.190.131; };

#};
（2）在主配置文件中定义区域：/etc/named.rfc1912.zones
[root@localhost ~]# vim /etc/named.rfc1912.zones # 在后面直接添加
zone “cdn.change.com” IN {
type master;
file “cdn.change.com.zone”;
};
（3）定义区域解析库文件：/var/named/cdn.change.com.zone
[root@localhost ~]# vim /var/named/cdn.change.com.zone
$TTL 86440
$ORIGIN cdn.change.com.
@ IN SOA centos.cdn.change.com. admin.centos.cdn.change.com. (
2016083001
1H
2M
3D
1D)
IN NS centos.cdn.change.com.
centos IN A 192.168.190.135
www IN A 192.168.190.132

```
  IN      A       192.168.190.132
```

（4）更改区域文件的权限为640和属组为named
[root@localhost ~]# chmod 640 /var/named/cdn.change.com.zone
[root@localhost ~]# chown :named !$
chown :named /var/named/cdn.change.com.zone
[root@localhost ~]# service named restart
Stopping named: [ OK ]
Starting named: [ OK ]
（5）重启DNS并检验结果
[root@localhost ~]# rndc reload
server reload successful
[root@localhost ~]# rndc status
version: 9.8.2rc1-RedHat-9.8.2-0.47.rc1.el6
CPUs found: 1
worker threads: 1
number of zones: 20
debug level: 0
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is OFF
recursive clients: 0/0/1000
tcp clients: 0/100
server is up and running
测试：
[root@localhost ~]# dig -t NS cdn.change.com @192.168.190.135

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.47.rc1.el6 <<>> -t NS cdn.change.com @192.168.190.135
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2745
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:
;cdn.change.com. IN NS

;; ANSWER SECTION:
cdn.change.com. 86440 IN NS centos.cdn.change.com.

;; ADDITIONAL SECTION:
centos.cdn.change.com. 86440 IN A 192.168.190.135

;; Query time: 1 msec
;; SERVER: 192.168.190.135#53(192.168.190.135)
;; WHEN: Thu Sep 1 19:12:06 2016
;; MSG SIZE rcvd: 69
[root@localhost ~]# dig -t A centos.cdn.change.com @192.168.190.135

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.47.rc1.el6 <<>> -t A centos.cdn.change.com @192.168.190.135
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9330
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;centos.cdn.change.com. IN A

;; ANSWER SECTION:
centos.cdn.change.com. 86440 IN A 192.168.190.135

;; AUTHORITY SECTION:
cdn.change.com. 86440 IN NS centos.cdn.change.com.

;; Query time: 0 msec
;; SERVER: 192.168.190.135#53(192.168.190.135)
;; WHEN: Thu Sep 1 19:15:04 2016
;; MSG SIZE rcvd: 69
[root@localhost ~]# dig -t A www.cdn.change.com @192.168.190.135

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.47.rc1.el6 <<>> -t A www.cdn.change.com @192.168.190.135
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25602
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;www.cdn.change.com. IN A

;; ANSWER SECTION:
www.cdn.change.com. 86440 IN A 192.168.190.132

;; AUTHORITY SECTION:
cdn.change.com. 86440 IN NS centos.cdn.change.com.

;; ADDITIONAL SECTION:
centos.cdn.change.com. 86440 IN A 192.168.190.135

;; Query time: 0 msec
;; SERVER: 192.168.190.135#53(192.168.190.135)
;; WHEN: Thu Sep 1 19:22:47 2016
;; MSG SIZE rcvd: 89
[root@localhost ~]# dig -t A www.change.com @192.168.190.131

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.47.rc1.el6 <<>> -t A www.change.com @192.168.190.131
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20167
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;www.change.com. IN A

;; ANSWER SECTION:
www.change.com. 86440 IN A 192.168.190.132

;; AUTHORITY SECTION:
change.com. 86440 IN NS ns2.change.com.
change.com. 86440 IN NS ns1.change.com.

;; ADDITIONAL SECTION:
ns1.change.com. 86440 IN A 192.168.190.131
ns2.change.com. 86440 IN A 192.168.190.134

;; Query time: 1 msec
;; SERVER: 192.168.190.131#53(192.168.190.131)
;; WHEN: Thu Sep 1 19:23:29 2016
;; MSG SIZE rcvd: 116