Centos7 安装内网dns

Centos7 安装内网dns 

1 安装Bind Chroot DNS 服务器

    [root@iZbp1b78w5ngl4nfvh3y3gZ 34.192 /root]#yum install bind-chroot bind bind-utils -y

2 拷贝bind相关文件,准备bind chroot 环境

    [root@iZbp1b78w5ngl4nfvh3y3gZ 34.192 /root]#cp -R /usr/share/doc/bind-*/sample/var/named/* /var/named/chroot/var/named/

3 在bind chroot 的目录中创建相关文件

    [root@iZbp1b78w5ngl4nfvh3y3gZ 34.192 /root]#touch /var/named/chroot/var/named/data/cache_dump.db
    [root@iZbp1b78w5ngl4nfvh3y3gZ 34.192 /root]#touch /var/named/chroot/var/named/data/named_stats.txt
    [root@iZbp1b78w5ngl4nfvh3y3gZ 34.192 /root]#touch /var/named/chroot/var/named/data/named_mem_stats.txt 
    [root@iZbp1b78w5ngl4nfvh3y3gZ 34.192 /root]#touch /var/named/chroot/var/named/data/named.run
    [root@iZbp1b78w5ngl4nfvh3y3gZ 34.192 /root]#mkdir /var/named/chroot/var/named/dynamic
    [root@iZbp1b78w5ngl4nfvh3y3gZ 34.192 /root]#touch /var/named/chroot/var/named/dynamic/managed-keys.bind 

4  将 Bind 锁定文件设置为可写

    [root@iZbp1b78w5ngl4nfvh3y3gZ 34.192 /root]#chmod -R 777 /var/named/chroot/var/named/data
    [root@iZbp1b78w5ngl4nfvh3y3gZ 34.192 /root]#chmod -R 777 /var/named/chroot/var/named/dynamic

5  将 /etc/named.conf 拷贝到 bind chroot目录

    [root@iZbp1b78w5ngl4nfvh3y3gZ 34.192 /root]#cp -p /etc/named.conf /var/named/chroot/etc/named.conf

6  在/etc/named.conf中对 bind 进行配置

    在 named.conf 文件尾添加 pp.local 域信息， 创建转发域(Forward Zone)与反向域(Reverse Zone)

    vi /var/named/chroot/etc/named.conf 

   ..

   .. 

   zone "pp.local" { 
        type master; 
        file "pp.local.zone"; 
    }; 

   zone "0.0.10.in-addr.arpa" IN {
        type master;
        file "10.0.0.zone";
   };

  ..

  ..

7  named.conf 完全配置如下：

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {
        listen-on port 53 { any; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { any; };

        /* 
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable 
           recursion. 
         - If your recursive DNS server has a public IP address, you MUST enable access 
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification 
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface 
        */
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};
zone "pp.local" { 
    type master; 
    file "pp.local.zone"; 
}; 

zone "0.0.10.in-addr.arpa" IN {
        type master;
        file "10.0.0.zone";
}; 
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

8  为 pp.local 域名创建转发域与反向域文件

   a)创建转发域

    vi /var/named/chroot/var/named/pp.local.zone  

   

;
;       Addresses and other host information.
;
$TTL 86400
@       IN      SOA     pp.local. master.pp.local. (
                               2014101901      ; Serial
                               43200      ; Refresh
                               3600       ; Retry
                               3600000    ; Expire
                               2592000 )  ; Minimum

;       Define the nameservers and the mail servers

               IN      NS      testfront.pp.local.
testfront        IN      A       10.0.0.116
testapp          IN      A       10.0.0.117

b)创建反向域

vi /var/named/chroot/var/named/10.0.0.zone

;
;       Addresses and other host information.
;
$TTL 86400
@       IN      SOA     pp.local master.pp.local. (
                               2014101901      ; Serial
                               43200      ; Refresh
                               3600       ; Retry
                               3600000    ; Expire
                               2592000 )  ; Minimum

0.0.10.in-addr.arpa.  NS      testfront.pp.local.

116.0.0.10.in-addr.arpa. IN PTR testfront.pp.local.
117.0.0.10.in-addr.arpa. IN PTR testapp.pp.local.

9  开机自启动 bind-chroot 服务

1. [root@centos7 ~]# /usr/libexec/setup-named-chroot.sh /var/named/chroot on 
2. [root@centos7 ~]# systemctl stop named 
3. [root@centos7 ~]# systemctl disable named 
4. [root@centos7 ~]# systemctl start named-chroot 
5. [root@centos7 ~]# systemctl enable named-chroot 

11  碰到的问题

1 systemctl start named-chroot 启动时查看日志/var/log/messages出现unresolving './DNSKEY/IN'

/etc/sysconfig/named加入红色部分，让bind仅支持ipv4

 

ROOTDIR=/var/named/chroot

OPTIONS="-4"

2 nslookup 没有answer

vi /etc/sysconfig/network-scripts/ifcfg-eth0

DNS1=10.0.0.116

systemctl restart network.service

3 检查配置文件的正确性

named-checkconf

[root@izbp10zim3tjch7uz2pqikz named]# named-checkzone pp.local.zone /var/named/chroot/var/named/pp.local.zone 
zone pp.local.zone/IN: loaded serial 2014101901
OK

[root@izbp10zim3tjch7uz2pqikz named]# named-checkzone 10.0.0.zone /var/named/chroot/var/named/10.0.0.zone 
/var/named/chroot/var/named/10.0.0.zone:13: ignoring out-of-zone data (0.0.10.in-addr.arpa)
/var/named/chroot/var/named/10.0.0.zone:15: ignoring out-of-zone data (116.0.0.10.in-addr.arpa)
/var/named/chroot/var/named/10.0.0.zone:16: ignoring out-of-zone data (117.0.0.10.in-addr.arpa)
zone 10.0.0.zone/IN: has no NS records
zone 10.0.0.zone/IN: not loaded due to errors.

4 确定域名是否生效，如果有answer，表示成功

[root@izbp10zim3tjch7uz2pqikz named]# nslookup
> testfront.pp.local
Server:         10.0.0.116
Address:        10.0.0.116#53

Name:   testfront.pp.local
Address: 10.0.0.116

> 10.0.0.117   
Server:         10.0.0.116
Address:        10.0.0.116#53

117.0.0.10.in-addr.arpa name = testapp.pp.local.

[root@izbp10zim3tjch7uz2pqikz named]# dig -t A testfront.pp.local

; <<>> DiG 9.9.4-RedHat-9.9.4-72.el7 <<>> -t A testfront.pp.local
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22233
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;testfront.pp.local.            IN      A

;; ANSWER SECTION:
testfront.pp.local.     86400   IN      A       10.0.0.116

;; AUTHORITY SECTION:
pp.local.               86400   IN      NS      testfront.pp.local.

;; Query time: 0 msec
;; SERVER: 10.0.0.116#53(10.0.0.116)
;; WHEN: Wed Dec 05 16:22:39 CST 2018
;; MSG SIZE  rcvd: 77

 

[root@izbp10zim3tjch7uz2pqikz named]# dig -x 10.0.0.116

; <<>> DiG 9.9.4-RedHat-9.9.4-72.el7 <<>> -x 10.0.0.116
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29968
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;116.0.0.10.in-addr.arpa.       IN      PTR

;; ANSWER SECTION:
116.0.0.10.in-addr.arpa. 86400  IN      PTR     testfront.pp.local.

;; AUTHORITY SECTION:
0.0.10.in-addr.arpa.    86400   IN      NS      testfront.pp.local.

;; ADDITIONAL SECTION:
testfront.pp.local.     86400   IN      A       10.0.0.116

;; Query time: 0 msec
;; SERVER: 10.0.0.116#53(10.0.0.116)
;; WHEN: Wed Dec 05 16:23:47 CST 2018
;; MSG SIZE  rcvd: 114