RHEL5.2 安装bind-9.5.1-P2

转自：blog.chinaunix.net/uid-7541208-id-2612869.html

1、安装openssl
tar -zxvf openssl-0.9.8d.tar.gz
cd openssl-0.9.8d
./config --prefix=/usr/local/openssl
make;make install

2、安装bind
groupadd -g 25 named
useradd -u 25 -g 25 -d /usr/local/named -s /sbin/nologin named
tar -zxvf bind-9.5.1-P2.tar.gz
cd bind-9.5.1-P2
./configure --prefix=/usr/local/named/ --mandir=/usr/local/share/man/ --enable-threads --with-openssl=/usr/local/openssl/
make;make install
mkdir /usr/local/named/namedb
mkdir /usr/local/named/var
touch /usr/local/named/var/dns_log
touch /usr/local/named/var/dns_warning
chown -R named:named /usr/local/named
chown -R named:named /usr/local/named/.
开始配置bind
创建 rndc.conf文件，用bind自带程序生成
cd /usr/local/named/
sbin/rndc-confgen > etc/rndc.conf
把rndc.conf 中的key信息输出到 named.conf 中
cd /etc/
tail -n 10 rndc.conf | head -n9 | sed -e s/#\ //g > ../named.conf
编辑named.conf
cat named.conf
写入以下内容：
key "rndc-key" {
       algorithm hmac-md5;
       secret "20GNHJDG8IpyiBpG+qUwqg==";
 };
 
 controls {
       inet 127.0.0.1 port 953
       allow { 127.0.0.1; } keys { "rndc-key"; };
 };
#允许dns forward的网段用户
acl "trusted-lan" {
   127.0.0.1/8;
   10.31.255.0/24;
   172.17.167.0/24;
   10.10.1.0/24;
};
options {
   directory "/usr/local/named";
   dump-file "/usr/local/named/data/cache_dump.db";
   statistics-file "/usr/local/named/data/named_stats.txt";
   version "";
   datasize 40M;
   allow-transfer {
    "trusted-lan";
   };
   recursion yes;
   allow-notify {
       "trusted-lan";
   };
   allow-recursion {
       "trusted-lan";
   };
   auth-nxdomain no;
   forwarders {
       202.96.199.133;
       202.96.209.133;
   };
};
logging {
   channel warning {
    file "/usr/local/named/var/dns_warning" versions 3 size 1240k;
    severity warning;
    print-category yes;
    print-severity yes;
    print-time yes;
   };
   channel general_dns {
       file "/usr/local/named/var/dns_log" versions 3 size 1240k;
       severity info;
       print-category yes;
       print-severity yes;
       print-time yes;
   };
   category default {
       warning;
   };
   category queries {
       general_dns;
   };
};
include "cnc_acl.conf";
include "telecom_acl.conf";
view "view_cnc" {
   match-clients {
         CNC;
   };
   zone "." {
         type hint;
         file "named.ca";
   };
   include "master/cnc.def";
};
view "view_telecom" {
   match-clients {
         TELECOM;
   };
   zone "." {
         type hint;
         file "named.ca";
   };
   include "master/telecom.def";
};
view "view_any" {
   match-clients {
         any;
   };
   zone "." {
         type hint;
         file "named.ca";
   };
   include "master/any.def";
};

保存,退出。
3、安装IP地址段查询工具Ripe-dbase-client-v3：
下载软件包：
wget http://ftp.apnic.net/apnic/dbase/tools/ripe-dbase-client-v3.tar.gz
tar zxvf ripe-dbase-client-v3.tar.gz
cd whois-3.1
./configure --prefix=/usr
make;make install

4、设置配置文件
mkdir /usr/local/named/data
mkdir /usr/local/named/master
wget ftp://ftp.internic.org/domain/named.root -O /usr/local/named/named.ca
配置ACL文件
/usr/bin/whois3 -h whois.apnic.net -l -i mb MAINT-CNCGROUP | grep "descr" | grep "Reverse" | awk -F "for" '{if ($2!="") print $2}'| sort -n | awk 'BEGIN{print "acl \"CNC\" '{'"}{print $1";"}END{print "'}';"}' > /usr/local/named/cnc_acl.conf

/usr/bin/whois3 -h whois.apnic.net -l -i mb MAINT-CHINANET | grep "descr" | grep "Reverse" | awk -F "for" '{if ($2!="") print $2}'| sort -n | awk 'BEGIN{print "acl \"TELECOM\" '{'"}{print $1";"}END{print "'}';"}' > /usr/local/named/telecom_acl.conf

增加域名解析配置文件
设置网通解析配置文件：
vi /usr/local/named/master/cnc.def
==========cnc.def begin==========
zone "cnzqf.com"{
    type master;
    file "master/cnc/cnzqf.com";
#一下几句可不写
#    allow-transfer { 192.168.1.100 ; };
#    notify yes;
#    also-notify { 192.168.1.100 ; };
};
==========cnc.def end===========   

设置电信解析配置文件：
vi /usr/local/named/master/telecom.def

==========telecom.def begin==========
zone "king.com"{
zone "cnzqf.com"{
    type master;
    file "master/telecom/cnzqf.com";
#   allow-transfer { 192.168.1.100 ; };
#   notify yes;
#   also-notify { 192.168.1.100 ; };
};
==========telecom.def end===========
设置网通电信以外解析配置文件：
vi /usr/local/named/master/any.def
==========any.def begin==========
zone "cnzqf.com"{
    type master;
    file "master/any/cnzqf.com";
#   allow-transfer { 192.168.1.100 ; };
#   notify yes;
#   also-notify { 192.168.1.100 ; };
};
==========any.def end===========

增加域名定义文件

设置网通域名定义文件：
vi /usr/local/named/master/cnc/cnzqf.com

==========cnc/cnzqf.com begin==========
$TTL 3600
$ORIGIN cnzqf.com.
@ IN SOA ns.cnzqf.com. root.cnzqf.com. (
                      2007011701  ;Serial
                      3600    ;Refresh ( seconds )
                      1800    ;Retry ( seconds )
                      604800       ;Expire ( seconds )
                      3600          ;Minimum TTL for Zone ( seconds )
                      )
@       IN      NS     ns.cnzqf.com.
@       IN      A      61.172.197.A
ns      IN      A      61.172.197.A
ns1     IN      A       61.172.197.A
www     IN      A      202.108.13.B
mial    IN      A      61.135.173.C
ldap    IN      A       61.135.173.C
;
;end
==========cnc/cnzqf.com end===========

设置电信域名定义文件：
vi /usr/local/named/master/telecom/cnzqf.com

==========telecom/cnzqf.com begin==========
$TTL 3600
$ORIGIN cnzqf.com.
@ IN SOA ns.cnzqf.com. root.cnzqf.com. (
                       2007011701  ;Serial
                       3600   ;Refresh ( seconds )
                       1800   ;Retry ( seconds )
                       604800   ;Expire ( seconds )
                       3600   ;Minimum TTL for Zone ( seconds )
                       )
@      IN       NS      ns.cnzqf.com.
@      IN       A       61.172.197.A
ns     IN       A       61.172.197.A
ns1     IN      A       61.172.197.A
www    IN       A       124.74.202.Q
mail   IN       A       61.172.197.A
ldap    IN      A       124.74.202.P
sh      IN      A       61.172.197.A
*       IN      A       124.74.202.Q
;
;end
==========telecom/cnzqf.com end===========
设置其它区域域名定义文件：
vi /usr/local/named/master/any/cnzqf.com
==========any/cnzqf.com begin==========
$TTL 3600
$ORIGIN cnzqf.com.
@ IN SOA ns.cnzqf.com. root.cnzqf.com. (
                       2007011701  ;Serial
                       3600   ;Refresh ( seconds )
                       1800   ;Retry ( seconds )
                       60480   ;Expire ( seconds )
                       3600   ;Minimum TTL for Zone ( seconds )
                       )
@      IN       NS      ns.cnzqf.com.
@      IN       A       61.172.197.A
ns     IN       A        61.172.197.A
ns1     IN      A       61.172.197.A
www    IN       A       124.74.202.Q
mail    IN      A       124.74.202.Q
ldap    IN      A       124.74.202.Q
;
;end
==========any/cnzqf.com end===========

启动bind
/usr/local/named/sbin/named –gc /usr/local/named/named.conf &
设为开机启动：
echo "/usr/local/named/sbin/named –gc /usr/local/named/named.conf &" >> /etc/rc.local
全部安装结束，就可以开展应用的配置和测试了。

可以使用脚本启动：
[root@localhost var]# cat /etc/init.d/named
#!/bin/bash
#
# named           This shell scrīpt takes care of starting and stopping
#                 named (BIND DNS server).
# add for chkcofnig
# chkconfig: 2345 14 87
# descrīption: named (BIND) is a Domain Name Server (DNS) \
# that is used to resolve host names to IP addresses.
# probe: true
# processname:named
#
if [ `id -u` -ne 0 ]
  then
  echo "ERROR:For bind to port 53,must run as root."
  exit 1
fi
case "$1" in
  start)
        if [ -x /usr/sbin/named ]
     then
           /usr/sbin/named -u named -c /etc/named.conf && echo . && echo 'BIND9 server started.'
        fi
        ;;
  stop)
#        kill `cat /var/run/named/pid` && echo . && echo 'BIND9 server stopped.'
        kill `ps -eo cmd,pid| grep /usr/sbin/named | awk '{print $5}'` && echo . && echo 'BIND9 server stopped.'
        ;;
  restart)
        echo .
        echo "Restart BIND9 server"
        $0 stop
        sleep 10
        $0 start
        ;;
  *)
        echo "$0 start | stop | restart"
        ;;
esac
exit 0
================================================
OVER