linux——部署DNS

DNS

  1. 什么是DNS——DNS 是域名系统 (Domain Name System) 的缩写,它是由解析器和域名服务器组成的,又名“域名解析服务器”。
  2. DNS的作用——DNS把要访问的网址找到然后把信息送到电脑上。
  3. 什么是DNS服务器——DNS服务器是(Domain Name System或者Domain Name Service)域名系统或者域名服务,域名系统为Internet上的主机分配域名地址和IP地址。用户使用域名地址,该系统就会自动把域名地址转为IP地址。域名服务是运行域名系统的Internet工具。执行域名服务的服务器称之为DNS服务器,通过DNS服务器来应答域名服务的查询。
  4. DNS的解析方式——正向解析域、反向解析域

一、dns服务器设置

[root@localhost ~]# hostnamectl set-hostname dns-server.example.com
[root@localhost ~]# hostname
dns-server.example.com
[root@localhost ~]# reboot
[root@dns-server Desktop]# yum install bind -y
##安装过程略
[root@dns-server Desktop]# systemctl start named   ##需要在屏幕上敲些字符,才能启动
[root@dns-server Desktop]# netstat -antlpe | grep named
tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN      25         75394      2353/named
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      25         75389      2353/named
tcp6       0      0 ::1:953                 :::*                    LISTEN      25         75395      2353/named
tcp6       0      0 ::1:53                  :::*                    LISTEN      25         75391      2353/named
[root@dns-server Desktop]# rpm -qc bind
/etc/logrotate.d/named
/etc/named.conf
/etc/named.iscdlv.key
/etc/named.rfc1912.zones
/etc/named.root.key
/etc/rndc.conf
/etc/rndc.key
/etc/sysconfig/named
/var/named/named.ca
/var/named/named.empty
/var/named/named.localhost
/var/named/named.loopback
[root@dns-server Desktop]# vim /etc/named.conf      
##编辑配置文件,需要修改添加的内容如下:
 11         listen-on port 53 { any; };             
 17         allow-query     { any; };
 18         forwarders { 172.25.254.50; };
 33         dnssec-validation no;
[root@dns-server Desktop]# vim /etc/resolv.conf
[root@dns-server Desktop]# cat /etc/resolv.conf       
##想要自己也能解析,需要更改/etc/resolv.conf文件如下:
# Generated by NetworkManager
domain example.com
search example.com
nameserver 172.25.254.129   
[root@dns-server Desktop]# ifconfig eth0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.25.254.129  netmask 255.255.255.0  broadcast 172.25.254.255
        inet6 fe80::5054:ff:fe60:1871  prefixlen 64  scopeid 0x20<link>
        ether 52:54:00:60:18:71  txqueuelen 1000  (Ethernet)
        RX packets 4862  bytes 6057910 (5.7 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 682  bytes 51200 (50.0 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
[root@dns-server Desktop]# systemctl stop firewalld
[root@dns-server Desktop]# systemctl disable firewalld
[root@dns-server Desktop]# systemctl restart named
[root@dns-server Desktop]# dig www.baidu.com

; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> www.baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9696
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 13, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.baidu.com.                 IN      A

;; ANSWER SECTION:
www.baidu.com.          926     IN      CNAME   www.a.shifen.com.
www.a.shifen.com.       56      IN      A       220.181.111.188
www.a.shifen.com.       56      IN      A       220.181.112.244

;; AUTHORITY SECTION:
.                       164299  IN      NS      h.root-servers.net.
.                       164299  IN      NS      d.root-servers.net.
.                       164299  IN      NS      i.root-servers.net.
.                       164299  IN      NS      g.root-servers.net.
.                       164299  IN      NS      a.root-servers.net.
.                       164299  IN      NS      f.root-servers.net.
.                       164299  IN      NS      k.root-servers.net.
.                       164299  IN      NS      l.root-servers.net.
.                       164299  IN      NS      b.root-servers.net.
.                       164299  IN      NS      c.root-servers.net.
.                       164299  IN      NS      e.root-servers.net.
.                       164299  IN      NS      j.root-servers.net.
.                       164299  IN      NS      m.root-servers.net.

;; Query time: 132 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Sat May 22 03:22:26 EDT 2018
;; MSG SIZE  rcvd: 312
##dns服务配置成功 

二、正向解析域(域名—> IP )

  • 一个域名对应一个IP(一对一)
[root@dns-server Desktop]# vim /etc/named.conf
 18         forwarders { 172.25.254.50; };            ##删掉
[root@dns-server Desktop]# vim /etc/named.rfc1912.zones
 25 zone "westos.com" IN {
 26         type master;
 27         file "westos.com.zone";
 28         allow-update { none; };
 29 }; 
[root@dns-server Desktop]# cd /var/named/
[root@dns-server named]# ls
data  dynamic  named.ca  named.empty  named.localhost  named.loopback  slaves
[root@dns-server named]# cp -p named.localhost westos.com.zone
[root@dns-server named]# vim westos.com.zone 
[root@dns-server named]# cat westos.com.zone 
$TTL 1D
@	IN SOA	dns.westos.com. root.westos.com. (
					0	; serial
					1D	; refresh
					1H	; retry
					1W	; expire
					3H )	; minimum
	NS	dns.westos.com.
dns	A	172.25.254.127
tutu    A       172.25.254.229
[root@dns-server named]# systemctl restart named
[root@dns-server named]# dig dns.westos.com

; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> dns.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28385
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;dns.westos.com.			IN	A

;; ANSWER SECTION:
dns.westos.com.		86400	IN	A	172.25.254.129

;; AUTHORITY SECTION:
westos.com.		86400	IN	NS	dns.westos.com.

;; Query time: 0 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 07:26:14 EDT 2018
;; MSG SIZE  rcvd: 73

[root@dns-server named]# dig tutu.westos.com

; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> tutu.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26556
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;tutu.westos.com.		IN	A

;; ANSWER SECTION:
tutu.westos.com.	86400	IN	A	172.25.254.120

;; AUTHORITY SECTION:
westos.com.		86400	IN	NS	dns.westos.com.

;; ADDITIONAL SECTION:
dns.westos.com.		86400	IN	A	172.25.254.129

;; Query time: 0 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 07:27:26 EDT 2018
;; MSG SIZE  rcvd: 94

[root@dns-server named]#
  • 一个域名对应多个IP(一对多)
[root@dns-server named]# pwd
/var/named
[root@dns-server named]# ls
data     named.ca     named.localhost  slaves
dynamic  named.empty  named.loopback   westos.com.zone
[root@dns-server named]# vim westos.com.zone 
[root@dns-server named]# cat westos.com.zone 
$TTL 1D
@	IN SOA	dns.westos.com. root.westos.com. (
					0	; serial
					1D	; refresh
					1H	; retry
					1W	; expire
					3H )	; minimum
	NS	dns.westos.com.
dns	A	172.25.254.129
tutu	A	172.25.254.120
csdn    CNAME   node1.westos.com.
node1   A       172.25.254.66
node1   A       172.25.254.88
[root@dns-server named]# systemctl restart named
[root@dns-server named]# dig csdn.westos.com

; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> csdn.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63112
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;csdn.westos.com.		IN	A

;; ANSWER SECTION:
csdn.westos.com.	86400	IN	CNAME	node1.westos.com.
node1.westos.com.	86400	IN	A	172.25.254.66
node1.westos.com.	86400	IN	A	172.25.254.88

;; AUTHORITY SECTION:
westos.com.		86400	IN	NS	dns.westos.com.

;; ADDITIONAL SECTION:
dns.westos.com.		86400	IN	A	172.25.254.129

;; Query time: 0 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 07:45:42 EDT 2018
;; MSG SIZE  rcvd: 130

[root@dns-server named]# dig csdn.westos.com

; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> csdn.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61199
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;csdn.westos.com.		IN	A

;; ANSWER SECTION:
csdn.westos.com.	86400	IN	CNAME	node1.westos.com.
node1.westos.com.	86400	IN	A	172.25.254.88
node1.westos.com.	86400	IN	A	172.25.254.66

;; AUTHORITY SECTION:
westos.com.		86400	IN	NS	dns.westos.com.

;; ADDITIONAL SECTION:
dns.westos.com.		86400	IN	A	172.25.254.129

;; Query time: 0 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 07:47:38 EDT 2018
;; MSG SIZE  rcvd: 130

[root@dns-server named]#
##在访问网址的时候,客户访问到的IP可能是172.25.254.66或者172.25.254.88

另一台主机测试

[root@localhost ~]# vim /etc/resolv.conf 
[root@localhost ~]# cat /etc/resolv.conf
# Generated by NetworkManager
domain ilt.example.com
search ilt.example.com example.com
nameserver 172.25.254.129   ##dns服务器的ip
[root@localhost ~]# dig csdn.westos.com

; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> csdn.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2735
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;csdn.westos.com.		IN	A

;; ANSWER SECTION:
csdn.westos.com.	86400	IN	CNAME	node1.westos.com.
node1.westos.com.	86400	IN	A	172.25.254.66
node1.westos.com.	86400	IN	A	172.25.254.88

;; AUTHORITY SECTION:
westos.com.		86400	IN	NS	dns.westos.com.

;; ADDITIONAL SECTION:
dns.westos.com.		86400	IN	A	172.25.254.129

;; Query time: 1 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 07:46:35 EDT 2018
;; MSG SIZE  rcvd: 130

[root@localhost ~]# dig csdn.westos.com

; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> csdn.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61298
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;csdn.westos.com.		IN	A

;; ANSWER SECTION:
csdn.westos.com.	86400	IN	CNAME	node1.westos.com.
node1.westos.com.	86400	IN	A	172.25.254.88
node1.westos.com.	86400	IN	A	172.25.254.66

;; AUTHORITY SECTION:
westos.com.		86400	IN	NS	dns.westos.com.

;; ADDITIONAL SECTION:
dns.westos.com.		86400	IN	A	172.25.254.129

;; Query time: 1 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 07:46:42 EDT 2018
;; MSG SIZE  rcvd: 130

三、反向解析域( IP —> 域名)

  • 一个IP对应一个域名
[root@dns-server named]# vim /etc/named.rfc1912.zones
##添加文件/etc/named.rfc1912.zones的内容如下:
 31 zone "254.25.172.in-addr.arpa" IN {
 32         type master;
 33         file "westos.com.ptr";
 34         allow-update { none; };
 35 };
[root@dns-server named]# pwd
/var/named
[root@dns-server named]# ls
data     named.ca     named.localhost  slaves
dynamic  named.empty  named.loopback   westos.com.zone
[root@dns-server named]# cp -p named.loopback westos.com.ptr   ##复制模板,然后修改内容
[root@dns-server named]# vim westos.com.ptr 
[root@dns-server named]# cat westos.com.ptr 
$TTL 1D
@	IN SOA	dns.westos.com. root.westos.com. (
					0	; serial
					1D	; refresh
					1H	; retry
					1W	; expire
					3H )	; minimum
	NS	dns.westos.com.
	A	172.25.254.129
120	PTR	tutu.westos.com.
115	PTR	butterfly.westos.com.
[root@dns-server named]# systemctl restart named
[root@dns-server named]# dig -x 172.25.254.115

; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> -x 172.25.254.115
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49131
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;115.254.25.172.in-addr.arpa.	IN	PTR

;; ANSWER SECTION:
115.254.25.172.in-addr.arpa. 86400 IN	PTR	butterfly.westos.com.

;; AUTHORITY SECTION:
254.25.172.in-addr.arpa. 86400	IN	NS	dns.westos.com.

;; ADDITIONAL SECTION:
dns.westos.com.		86400	IN	A	172.25.254.129

;; Query time: 0 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 08:16:24 EDT 2018
;; MSG SIZE  rcvd: 124

[root@dns-server named]# dig -x 172.25.254.120

; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> -x 172.25.254.120
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46710
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;120.254.25.172.in-addr.arpa.	IN	PTR

;; ANSWER SECTION:
120.254.25.172.in-addr.arpa. 86400 IN	PTR	tutu.westos.com.

;; AUTHORITY SECTION:
254.25.172.in-addr.arpa. 86400	IN	NS	dns.westos.com.

;; ADDITIONAL SECTION:
dns.westos.com.		86400	IN	A	172.25.254.129

;; Query time: 0 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 08:16:29 EDT 2018
;; MSG SIZE  rcvd: 119

[root@dns-server named]#

四、正向解析域之指定主机的解析

本次实验说明

设置dns服务器自身可以解析到的IP和其他的主机不一样

  • DNS服务器设置
[root@dns-server named]# pwd
/var/named
[root@dns-server named]# ls
data     named.ca     named.localhost  slaves          westos.com.zone
dynamic  named.empty  named.loopback   westos.com.ptr
[root@dns-server named]# cp -p westos.com.zone westos.com.inter
[root@dns-server named]# vim westos.com.inter 
[root@dns-server named]# cat westos.com.inter 
$TTL 1D
@	IN SOA	dns.westos.com. root.westos.com. (
					0	; serial
					1D	; refresh
					1H	; retry
					1W	; expire
					3H )	; minimum
	NS	dns.westos.com.
dns	A	192.168.0.129
tutu	A	192.168.0.120
csdn    CNAME   node1.westos.com.
node1   A       192.168.0.66
node1   A       192.168.0.88
[root@dns-server named]# cp -p /etc/named.rfc1912.zones /etc/named.rfc1912.inter
[root@dns-server named]# vim /etc/named.rfc1912.inter
##在前面的实验基础上,修改第25-29行内容如下:
 25 zone "westos.com" IN {
 26         type master;
 27         file "westos.com.inter";
 28         allow-update { none; };
 29 };
[root@dns-server named]# vim /etc/named.conf 
[root@dns-server named]# cat /etc/named.conf | tail -n 25
##需要注释的内容为蓝色,用符号/*内容*/;需要添加的内容为红色;其余不需要修改的此处就不显示了
/*
zone "." IN {
	type hint;
	file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
*/
view localnet {
	match-clients { 172.25.254.129; };
	zone "." IN{
	         type hint;
		 file "named.ca";
	};
include "/etc/named.rfc1912.zones";
};
view inter {
	match-clients { any; };
	zone "." IN{
	         type hint;
		 file "named.ca";
	};
include "/etc/named.rfc1912.inter";
};
[root@dns-server named]# systemctl restart named
[root@dns-server named]# dig csdn.westos.com

; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> csdn.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5741
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;csdn.westos.com.		IN	A

;; ANSWER SECTION:
csdn.westos.com.	86400	IN	CNAME	node1.westos.com.
node1.westos.com.	86400	IN	A	172.25.254.66
node1.westos.com.	86400	IN	A	172.25.254.88

;; AUTHORITY SECTION:
westos.com.		86400	IN	NS	dns.westos.com.

;; ADDITIONAL SECTION:
dns.westos.com.		86400	IN	A	172.25.254.129

;; Query time: 0 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 08:49:48 EDT 2018
;; MSG SIZE  rcvd: 130

[root@dns-server named]#
  • 另一台主机一测试
[root@localhost ~]# cat /etc/resolv.conf 
# Generated by NetworkManager
domain ilt.example.com
search ilt.example.com example.com
nameserver 172.25.254.129
[root@localhost ~]# dig csdn.westos.com

; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> csdn.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17264
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;csdn.westos.com.		IN	A

;; ANSWER SECTION:
csdn.westos.com.	86400	IN	CNAME	node1.westos.com.
node1.westos.com.	86400	IN	A	192.168.0.66
node1.westos.com.	86400	IN	A	192.168.0.88

;; AUTHORITY SECTION:
westos.com.		86400	IN	NS	dns.westos.com.

;; ADDITIONAL SECTION:
dns.westos.com.		86400	IN	A	192.168.0.129

;; Query time: 1 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 08:50:35 EDT 2018
;; MSG SIZE  rcvd: 130

[root@localhost ~]#
  • 另一台主机二测试
[root@foundation50 Desktop]# cat /etc/resolv.conf 
# Generated by NetworkManager
search lan ilt.example.com example.com lan.
nameserver 172.25.254.129
[root@foundation50 Desktop]# dig tutu.westos.com

; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7 <<>> tutu.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62593
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;tutu.westos.com.		IN	A

;; ANSWER SECTION:
tutu.westos.com.	86400	IN	A	192.168.0.120

;; AUTHORITY SECTION:
westos.com.		86400	IN	NS	dns.westos.com.

;; ADDITIONAL SECTION:
dns.westos.com.		86400	IN	A	192.168.0.129

;; Query time: 1 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 20:55:52 CST 2018
;; MSG SIZE  rcvd: 94

[root@foundation50 Desktop]#

五、辅助DNS——Slave DNS

  • 主DNS服务器
[root@dns-server named]# vim /etc/named.rfc1912.zones 
 25 zone "westos.com" IN {
 26         type master;
 27         file "westos.com.zone";
 28         allow-update { none; };
 29         also-notify { 172.25.254.229; };
 30 };
[root@dns-server named]# vim /etc/named.conf 
 50 
 51 zone "." IN {
 52         type hint;
 53         file "named.ca";
 54 };
 55 
 56 include "/etc/named.rfc1912.zones";
 57 include "/etc/named.root.key";
 58 /*
 59 view localnet {
 60         match-clients { 172.25.254.129; };
 61         zone "." IN{
 62                  type hint;
 63                  file "named.ca";
 64         };
 65 include "/etc/named.rfc1912.zones";
 66 };
 67 view inter {
 68         match-clients { any; };
 69         zone "." IN{
 70                  type hint;
 71                  file "named.ca";
 72         };
 73 include "/etc/named.rfc1912.inter";
 74 };
 75 */
[root@dns-server named]# cat westos.com.zone 
$TTL 1D
@    IN SOA    dns.westos.com. root.westos.com. (
                    0    ; serial
                    1D    ; refresh
                    1H    ; retry
                    1W    ; expire
                    3H )    ; minimum
         NS      dns.westos.com.
dns      A       172.25.254.129
tutu     A       172.25.254.120
csdn     CNAME   node1.westos.com.
node1    A       172.25.254.77
node1    A       172.25.254.99
[root@dns-server named]# systemctl restart named

  • Slave DNS
[root@localhost ~]# hostnamectl set-hostname dns-slave.example.com
[root@localhost ~]# hostname
dns-slave.example.com
[root@localhost ~]#reboot
[root@dns-slave ~]# vim /etc/yum.repos.d/rhel_dvd.repo 
[root@dns-slave ~]# cat /etc/yum.repos.d/rhel_dvd.repo
# Created by cloud-init on Thu, 10 Jul 2014 22:19:11 +0000
[rhel_dvd]
gpgcheck = 0
enabled = 1
baseurl = http://172.25.254.50/rhel7.0
name = Remote classroom copy of dvd
[root@dns-slave ~]# yum clean all 
Loaded plugins: langpacks
Cleaning repos: rhel_dvd
Cleaning up everything
[root@dns-slave named]# cat /etc/resolv.conf
# Generated by NetworkManager
search example.com
nameserver 172.25.254.229
[root@dns-slave ~]# yum install bind -y
##安装过程略
[root@dns-slave ~]# vim /etc/named.conf
 11         listen-on port 53 { any; };
 17         allow-query     { any; };
 32         dnssec-validation no;
[root@dns-slave named]# vim /etc/named.rfc1912.zones
 25 zone "westos.com" IN {
 26         type slave;
 27         masters { 172.25.254.129; };
 28         file "slaves/westos.com.zone";
 29         allow-update { none; };
 30 };
[root@dns-slave named]# systemctl restart named
[root@dns-slave named]# dig csdn.westos.com

; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> csdn.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3164
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;csdn.westos.com.		IN	A

;; ANSWER SECTION:
csdn.westos.com.	86400	IN	CNAME	node1.westos.com.
node1.westos.com.	86400	IN	A	192.168.0.88
node1.westos.com.	86400	IN	A	192.168.0.66

;; AUTHORITY SECTION:
westos.com.		86400	IN	NS	dns.westos.com.

;; ADDITIONAL SECTION:
dns.westos.com.		86400	IN	A	192.168.0.129

;; Query time: 1 msec
;; SERVER: 172.25.254.229#53(172.25.254.229)
;; WHEN: Wed May 23 10:07:12 EDT 2018
;; MSG SIZE  rcvd: 130

[root@dns-slave named]# systemctl stop firewalld
[root@dns-slave named]# systemctl disable firewalld
rm '/etc/systemd/system/basic.target.wants/firewalld.service'
rm '/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service'
[root@dns-slave named]# systemctl restart named
[root@dns-slave named]# dig csdn.westos.com

; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> csdn.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44326
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;csdn.westos.com.		IN	A

;; ANSWER SECTION:
csdn.westos.com.	86400	IN	CNAME	node1.westos.com.
node1.westos.com.	86400	IN	A	172.25.254.77
node1.westos.com.	86400	IN	A	172.25.254.99

;; AUTHORITY SECTION:
westos.com.		86400	IN	NS	dns.westos.com.

;; ADDITIONAL SECTION:
dns.westos.com.		86400	IN	A	192.168.0.129

;; Query time: 1 msec
;; SERVER: 172.25.254.229#53(172.25.254.229)
;; WHEN: Wed May 23 10:16:53 EDT 2018
;; MSG SIZE  rcvd: 130

六、nsupdate(动态DNS更新工具)

  • DNS服务器端
[root@dns-server named]# ls
data     named.ca     named.localhost  slaves            westos.com.ptr
dynamic  named.empty  named.loopback   westos.com.inter  westos.com.zone
[root@dns-server named]# cp -p westos.com.zone /mnt/    ##做备份
[root@dns-server named]# vim /etc/named.rfc1912.zones
 25 zone "westos.com" IN {
 26         type master;
 27         file "westos.com.zone";
 28         allow-update { 172.25.254.50; };
 29         also-notify { 172.25.254.229; };
 30 };
[root@dns-server named]# systemctl restart named
此时用ip为172.25.254.50的主机实验:(实验结果失败)
[root@foundation50 Desktop]# nsupdate 
> server 172.25.254.129
> update add test.westos.com 86400 A 172.25.254.133
> send
update failed: SERVFAIL
> quit
[root@dns-server named]# ll -d /var/named/
drwxr-x--- 5 root named 4096 May 23 10:36 /var/named/
[root@dns-server named]# chmod 770 /var/named/    ##添加权限
[root@dns-server named]# ll -d /var/named/
drwxrwx--- 5 root named 4096 May 23 10:36 /var/named/
此时再用ip为172.25.254.50的主机实验:(实验结果成功)
[root@foundation50 Desktop]# nsupdate 
> server 172.25.254.129
> update add test.westos.com 86400 A 172.25.254.133
> send
> quit
[root@dns-server named]# ls
data      named.empty      slaves            westos.com.zone
dynamic   named.localhost  westos.com.inter  westos.com.zone.jnl
named.ca  named.loopback   westos.com.ptr
[root@dns-server named]# ll
total 36
drwxrwx--- 2 named named   22 May 22 10:39 data
drwxrwx--- 2 named named 4096 May 23 10:36 dynamic
-rw-r----- 1 root  named 2076 Jan 28  2013 named.ca
-rw-r----- 1 root  named  152 Dec 15  2009 named.empty
-rw-r----- 1 root  named  152 Jun 21  2007 named.localhost
-rw-r----- 1 root  named  168 Dec 15  2009 named.loopback
drwxrwx--- 2 named named    6 Jan 29  2014 slaves
-rw-r----- 1 root  named  292 May 23 08:40 westos.com.inter
-rw-r----- 1 root  named  232 May 23 08:15 westos.com.ptr
-rw-r----- 1 root  named  296 May 23 10:36 westos.com.zone
-rw-r--r-- 1 named named  717 May 23 11:21 westos.com.zone.jnl
[root@dns-server named]# cat westos.com.zone
$TTL 1D
@	IN SOA	dns.westos.com. root.westos.com. (
					0	; serial
					1D	; refresh
					1H	; retry
					1W	; expire
					3H )	; minimum
	NS	dns.westos.com.
dns	A	172.25.254.129
tutu	A	172.25.254.120
csdn    CNAME   node1.westos.com.
node1   A       172.25.254.77
node1   A       172.25.254.99
[root@dns-server named]# systemctl restart named
[root@dns-server named]# cat westos.com.zone
$ORIGIN .
$TTL 86400	; 1 day
westos.com		IN SOA	dns.westos.com. root.westos.com. (
				1          ; serial
				86400      ; refresh (1 day)
				3600       ; retry (1 hour)
				604800     ; expire (1 week)
				10800      ; minimum (3 hours)
				)
			NS	dns.westos.com.
$ORIGIN westos.com.
csdn			CNAME	node1
dns			A	172.25.254.129
node1			A	172.25.254.77
			A	172.25.254.99
test			A	172.25.254.133
tutu			A	172.25.254.120
[root@dns-server named]#
  • 加密的方式
利用ip指定DNS动态更新不安全,设定加密,有钥匙的才可以成功更新DNS
[root@dns-server named]# cd /mnt/
[root@dns-server mnt]# ls
westos.com.zone
[root@dns-server mnt]# dnssec-keygen -a HMAC-MD5 -b 128 -n HOST westos
Kwestos.+157+26053
[root@dns-server mnt]# ls
Kwestos.+157+26053.key  Kwestos.+157+26053.private  westos.com.zone
[root@dns-server mnt]# cat Kwestos.+157+26053.private 
Private-key-format: v1.3
Algorithm: 157 (HMAC_MD5)
Key: +4CdGcPfu8EGinUoYo9pqg==
Bits: AAA=
Created: 20180520063433
Publish: 20180520063433
Activate: 20180520063433
[root@dns-server mnt]# cat Kwestos.+157+26053.key 
westos. IN KEY 512 3 157 +4CdGcPfu8EGinUoYo9pqg==
[root@dns-server mnt]# cp -p /etc/rndc.key /etc/westos.key    
[root@dns-server mnt]# vim /etc/westos.key 
key "westos" {
    algorithm hmac-md5;
    secret "+4CdGcPfu8EGinUoYo9pqg==";
};
[root@dns-server mnt]# vim /etc/named.conf 
43 include "/etc/westos.key";   ##添加第43行
[root@dns-server mnt]# vim /etc/named.rfc1912.zones
 25 zone "westos.com" IN {
 26         type master;
 27         file "westos.com.zone";
 28         allow-update { key westos; };
 29         also-notify { 172.25.254.229; };
 30 };
[root@dns-server mnt]# cd /var/named/
[root@dns-server named]# ll
total 32
drwxrwx--- 2 named named   22 May 19 03:09 data
drwxrwx--- 2 named named 4096 May 20 02:05 dynamic
-rw-r----- 1 root  named 2076 Jan 28  2013 named.ca
-rw-r----- 1 root  named  152 Dec 15  2009 named.empty
-rw-r----- 1 root  named  152 Jun 21  2007 named.localhost
-rw-r----- 1 root  named  168 Dec 15  2009 named.loopback
drwxrwx--- 2 named named    6 Jan 29  2014 slaves
-rw-r----- 1 root  named  304 May 19 22:45 westos.com.inter
-rw-r----- 1 root  named  229 May 19 22:02 westos.com.ptr
-rw-r----- 1 root  named  308 May 20 00:05 westos.com.zone
[root@dns-server named]# systemctl restart named
[root@dns-server named]# cd /mnt/
[root@dns-server mnt]# ls
Kwestos.+157+26053.key  Kwestos.+157+26053.private  westos.com.zone
[root@dns-server mnt]# scp Kwestos.+157+26053.* root@172.25.254.227:/mnt/   ##传钥匙给slave
The authenticity of host '172.25.254.227 (172.25.254.227)' can't be established.
ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.25.254.227' (ECDSA) to the list of known hosts.
root@172.25.254.227's password: 
Kwestos.+157+26053.key                                                               100%   50     0.1KB/s   00:00    
Kwestos.+157+26053.private                                                           100%  165     0.2KB/s   00:00    
[root@dns-server mnt]#
没有钥匙的主机——没有钥匙,不能动态更新DNS
[root@foundation50 Desktop]$ nsupdate 
> server 172.25.254.129   
> update add test.westos.com 86400 A 172.25.254.133
> send
update failed: REFUSED
> quit	
[root@foundation50 Desktop]$ cd /mnt/
[root@foundation50 Desktop]$ ls
[kiosk@foundation27 mnt]$
有钥匙的主机——dns-server传过来钥匙,有了钥匙,才能被允许动态更新DNS
[root@dns-slave named]# cd /mnt/
[root@dns-slave mnt]# ls
boot  etc  kernel-3.10.0-123.el7.x86_64.rpm  lib
[root@dns-slave mnt]# ls
boot  etc  kernel-3.10.0-123.el7.x86_64.rpm  Kwestos.+157+26053.key  Kwestos.+157+26053.private  lib
[root@dns-slave mnt]# nsupdate -k Kwestos.+157+26053.private 
> server 172.25.254.127
> update add  butter.westos.com 86400 A 172.25.254.111
> send
> quit
[root@dns-slave mnt]#

七、DNS服务器不受动态IP的影响

  • DNS服务端
[root@dns-server mnt]# yum install dhcp -y
[root@dns-server mnt]# cp /usr/share/doc/dhcp-4.2.5/dhcpd.conf.example /etc/dhcp/dhcpd.conf 
cp: overwrite ‘/etc/dhcp/dhcpd.conf’? y
[root@dns-server mnt]# vim /etc/dhcp/dhcpd.conf  ##祥见DHCP配置
[root@dns-server mnt]# systemctl restart dhcpd
[root@dns-server mnt]# cd /var/named/
[root@dns-server named]# ls
data      named.empty      slaves            westos.com.zone
dynamic   named.localhost  westos.com.inter  westos.com.zone.jnl
named.ca  named.loopback   westos.com.ptr
[root@dns-server named]# vim westos.com.zone
[root@dns-server named]# ls /mnt/
Kwestos.+157+26053.key  Kwestos.+157+26053.private  westos.com.zone
[root@dns-server named]# rm -fr westos.com.zone*
[root@dns-server named]# cat /etc/westos.key 
key "westos" {
	algorithm hmac-md5;
	secret "+4CdGcPfu8EGinUoYo9pqg==";
};
[root@dns-server named]# vim /etc/dhcp/dhcpd.conf
14 ddns-update-style initerim;
35 key westos {
36    algorithm hmac-md5;
37    secret +4CdGcPfu8EGinUoYo9pqg==;
38  };
39 zone westos.com. {
40     primary 127.0.0.1;
41     key westos;
42  }
[root@dns-server named]# systemctl restart dhcpd
另一台主机
[root@linux Desktop]# ifconfig 
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.25.254.60  netmask 255.255.255.0  broadcast 172.25.254.255
        inet6 fe80::5054:ff:fe00:1b0b  prefixlen 64  scopeid 0x20<link>
        ether 52:54:00:00:1b:0b  txqueuelen 1000  (Ethernet)
        RX packets 87  bytes 7810 (7.6 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 111  bytes 10939 (10.6 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 0  (Local Loopback)
        RX packets 12  bytes 976 (976.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 12  bytes 976 (976.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

[root@linux Desktop]# hostname
linux.westos.com
[root@linux Desktop]# hostnamectl set-hostname hello.westos.com
[root@linux Desktop]# hostname
hello.westos.com
[root@linux Desktop]# dig hello.westos.com

; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> hello.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 4895
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;hello.westos.com.		IN	A

;; AUTHORITY SECTION:
westos.com.		10800	IN	SOA	dns.westos.com. root.westos.com. 3 86400 3600 604800 10800

;; Query time: 1 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Sun May 23 04:45:51 EDT 2018
;; MSG SIZE  rcvd: 90

[root@linux Desktop]# systemctl restart network
[root@linux Desktop]# dig hello.westos.com

; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> hello.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23853
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;hello.westos.com.		IN	A

;; ANSWER SECTION:
test.westos.com.	300	IN	A	172.25.254.60

;; AUTHORITY SECTION:
westos.com.		86400	IN	NS	dns.westos.com.

;; ADDITIONAL SECTION:
dns.westos.com.		86400	IN	A	172.25.254.127

;; Query time: 1 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Sun May 23 04:46:33 EDT 2018
;; MSG SIZE  rcvd: 95

[root@linux Desktop]#
  • 1
    点赞
  • 5
    收藏
    觉得还不错? 一键收藏
  • 0
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值