DNS TSIG实现CDN+GSLB
Note
1、 本文只涉及User-Server-User过程[Request及Response请参考上图]
2、 有关站点加速及Cache请参考:http://longrujun.com/tags/SQUID/default.aspx
3、 有关大规模站点体系规划及性能优化请参考下图,不深入探讨
Server 1:Master
IPADDR=192.168.5.96
NETMASK=255.255.255.0
GATEWAY=192.168.5.1
Server 2: Slave
IPADDR=192.168.5.29
NETMASK=255.255.255.0
GATEWAY=192.168.5.1
Master Server
Part I Config Master Dns Server
Step 1、下载并安装
Cd /software
wget http://ftp.isc.org/isc/bind9/9.3.2-P1/bind-9.3.2-P1.tar.gz
tar zxvf bind-9.3.2-P1.tar.gz
cd bind-9.3.2-P1
./configure --prefix=/Data/apps/named \
--enable-threads
Make
Make install
Step 2、配置
1、 基本配置
Cd /Data/apps/named
[root@linux named]# mkdir etc
生成rndc控制命令的key文件
[root@linux named]# sbin/rndc-confgen > etc/rndc.conf
从rndc.conf文件中提取named.conf用的key
[root@linux named]# cd etc
自动在/Data/apps/named/etc生成named.conf文件
[root@linux etc]# tail -10 rndc.conf | head -9 | sed s/#\ //g > named.conf
2、 建立Zone文件目录
[root@linux etc]# mkdir /Data/named
进入/Data/named目录
[root@linux etc]# cd /Data/named
A、 建立localhost.zone
[root@linux named]#vi localhost.zone
$TTL 86400
$ORIGIN localhost.
@ 1D IN SOA @ root (
42 ; serial (d. adams)
3H ; refresh
15M ; retry
1W ; expiry
1D ) ; minimum
1D IN NS @
1D IN A 127.0.0.1
B、 建立named.local
[root@linux named]#vi named.local
$TTL 86400
@ IN SOA localhost. root.localhost. (
1997022700 ; Serial
28800 ; Refresh
14400 ; Retry
3600000 ; Expire
86400 ) ; Minimum
IN NS localhost.
1 IN PTR localhost.
C、 生成named.root
[root@linux named]#dig > named.root
D、 修改named.conf
Cd /Data/apps/named/etc
配置named.conf文件,在后面加入以下代码
[root@linux etc]# vi named.conf
options {
directory "/Data/named";
pid-file "named.pid";
};
controls {
inet 127.0.0.1 allow { localhost; } keys { rndckey; };
};
zone "." IN {
type hint;
file "named.root";
};
zone "localhost" IN {
type master;
file "localhost.zone";
allow-update { none; };
};
zone "0.0.127.in-addr.arpa" IN {
type master;
file "named.local";
allow-update { none; };
};
E、 测试启动bind
/Data/apps/named/sbin/named -c /Data/apps/named/etc/named.conf &
Step 3、使用TSIG技术加固DNS服务器
3、 下面longrujun.com/test.com为例进行配置
使用TSIG技术,执行 dnssec-keygen function 产生加密金钥,一个为 public key 文件,另一个
为 private key 文件,产生加密金钥。
首先在master上生成两对key,用于教育网和其他部分的IP段,
进入named安装的sbin目录
cd /usr/local/named/sbin/
#用于教育网的view,我们用certnet作为参数
./dnssec-keygen -a hmac-md5 -b 128 -n HOST certnet
#用于其他部分IP的view,我们用othernet作为参数
./dnssec-keygen -a hmac-md5 -b 128 -n HOST othernet
加入private key[Key: 1ks7MJQvWmisPMWbRnYYjg==]至named.conf文件中
在Master建立config及zone文件
1>、修改named.conf文件
加入private key至named.conf文件中,同时删除zone "." IN、zone "localhost" IN及zone "0.0.127.in-addr.arpa" IN配置文件
完整的named.conf如下
debian:/Data/apps/named/etc# cat named.conf
key "rndc-key" {
algorithm hmac-md5;
secret "Ngvc7XGzxmBizws8minZmg==";
};
controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { "rndc-key"; };
};
options {
directory "/Data/named";
pid-file "named.pid";
};
key "certnet" {
algorithm hmac-md5;
secret "1ks7MJQvWmisPMWbRnYYjg==";
};
key "othernet" {
algorithm hmac-md5;
secret "CC3eLL3okKM5pBHM1HSMNA==";
};
include "acl.conf";
2>、建立acl.conf
[root@redhatas4 etc]# cd /Data/named/
[root@redhatas4 named]# vi acl.conf
acl "dns-ip-list" {
192.168.5.96; #主dns服务器IP
192.168.5.29; #辅dns服务器IP
};
acl CNC {
58.16.0.0/16;
58.17.0.0/17;
58.17.128.0/17;
58.18.0.0/16;
58.19.0.0/16;
58.20.0.0/16;
58.21.0.0/16;
58.22.0.0/15;
58.240.0.0/15;
58.242.0.0/15;
58.244.0.0/15;
58.246.0.0/15;
58.248.0.0/13;
60.0.0.0/13;
60.8.0.0/15;
60.10.0.0/16;
60.11.0.0/16;
60.12.0.0/16;
60.13.0.0/18;
60.13.128.0/17;
60.14.0.0/15;
60.16.0.0/13;
60.24.0.0/14;
60.30.0.0/16;
60.31.0.0/16;
60.208.0.0/13;
60.216.0.0/15;
60.218.0.0/15;
60.220.0.0/14;
61.48.0.0/13;
61.133.0.0/17;
61.134.96.0/19;
61.134.128.0/17;
61.135.0.0/16;
61.137.128.0/17;
61.138.0.0/17;
61.138.128.0/18;
61.139.128.0/18;
61.148.0.0/15;
61.156.0.0/16;
61.159.0.0/18;
61.161.0.0/18;
61.161.128.0/17;
61.162.0.0/16;
61.163.0.0/16;
61.167.0.0/16;
61.168.0.0/16;
61.176.0.0/16;
61.179.0.0/16;
61.181.0.0/16;
61.182.0.0/16;
61.189.0.0/17;
125.32.0.0/16;
125.40.0.0/13;
202.96.0.0/18;
202.96.64.0/21;
202.96.72.0/21;
202.97.128.0/18;
202.97.224.0/21;
202.97.240.0/20;
202.98.0.0/21;
202.98.8.0/21;
202.99.64.0/19;
202.99.96.0/21;
202.99.128.0/19;
202.99.160.0/21;
202.99.168.0/21;
202.99.176.0/20;
202.99.208.0/20;
202.99.224.0/21;
202.99.232.0/21;
202.99.240.0/20;
202.102.128.0/21;
202.102.224.0/21;
202.102.232.0/21;
202.106.0.0/16;
202.107.0.0/17;
202.108.0.0/16;
202.110.0.0/17;
202.111.128.0/18;
203.93.8.0/24;
203.93.192.0/18;
210.13.128.0/17;
210.14.160.0/19;
210.14.192.0/19;
210.15.32.0/19;
210.15.96.0/19;
210.15.128.0/18;
210.21.0.0/16;
210.52.128.0/17;
210.53.0.0/17;
210.53.128.0/17;
210.74.96.0/19;
210.74.128.0/19;
210.82.0.0/15;
218.8.0.0/14;
218.12.0.0/16;
218.21.128.0/17;
218.24.0.0/14;
218.56.0.0/14;
218.60.0.0/15;
218.67.128.0/17;
218.68.0.0/15;
218.104.0.0/14;
219.154.0.0/15;
219.156.0.0/15;
219.158.0.0/17;
219.158.128.0/17;
219.159.0.0/18;
220.252.0.0/16;
221.0.0.0/15;
221.2.0.0/16;
221.3.0.0/17;
221.3.128.0/17;
221.4.0.0/16;
221.5.0.0/17;
221.5.128.0/17;
221.6.0.0/16;
221.7.0.0/19;
221.7.32.0/19;
221.7.64.0/19;
221.7.96.0/19;
221.8.0.0/15;
221.10.0.0/16;
221.11.0.0/17;
221.11.128.0/18;
221.11.192.0/19;
221.12.0.0/17;
221.12.128.0/18;
221.13.0.0/18;
221.13.64.0/19;
221.13.96.0/19;
221.13.128.0/17;
221.14.0.0/15;
221.192.0.0/15;
221.194.0.0/16;
221.195.0.0/16;
221.196.0.0/15;
221.198.0.0/16;
221.199.0.0/19;
221.199.32.0/20;
221.199.128.0/18;
221.199.192.0/20;
221.200.0.0/14;
221.204.0.0/15;
221.206.0.0/16;
221.207.0.0/18;
221.207.64.0/18;
221.207.128.0/17;
221.208.0.0/14;
221.212.0.0/16;
221.213.0.0/16;
221.216.0.0/13;
222.128.0.0/14;
222.132.0.0/14;
222.136.0.0/13;
222.160.0.0/15;
222.162.0.0/16;
222.163.0.0/19;
222.163.32.0/19;
222.163.64.0/18;
222.163.128.0/17;
};
//教育网IP
acl CERT {
58.17.0.0/16;
58.19.0.0/16;
58.20.0.0/16;
58.24.0.0/15;
58.59.128.0/17;
58.60.8.0/21;
58.61.32.0/25;
58.61.32.128/32;
58.100.0.0/15;
58.116.0.0/14;
58.128.0.0/13;
58.154.0.0/15;
58.192.0.0/12;
58.240.0.0/15;
58.248.0.0/13;
59.32.0.0/12;
59.49.128.0/17;
59.50.0.0/16;
59.61.128.0/19;
59.64.0.0/12;
59.151.0.0/17;
60.0.0.0/11;
60.63.0.0/16;
60.190.28.0/28;
60.190.28.96/27;
60.190.28.128/28;
60.190.28.144/30;
60.191.2.0/24;
60.208.0.0/16;
61.28.0.0/20;
61.48.0.0/13;
61.128.0.0/10;
61.200.81.134/31;
61.200.81.136/31;
61.200.81.142/31;
61.200.81.144/31;
61.200.81.150/31;
61.213.179.87/32;
61.232.0.0/14;
61.236.0.0/15;
61.240.0.0/14;
62.4.69.0/24;
62.159.60.207/32;
62.159.60.208/31;
62.159.60.213/32;
62.159.60.214/32;
62.173.115.116/32;
63.73.227.0/24;
63.84.162.0/24;
63.86.118.0/23;
63.89.64.0/24;
63.123.46.86/32;
63.125.146.0/24;
63.164.11.0/24;
63.208.195.68/32;
63.209.48.0/24;
63.210.142.0/24;
63.211.40.87/32;
63.211.66.0/24;
63.215.124.0/24;
64.4.0.0/18;
64.4.240.0/20;
64.68.78.0/23;
64.124.183.0/24;
64.215.165.86/32;
64.215.167.87/32;
64.215.172.0/24;
64.233.160.0/19;
65.54.0.0/15;
65.171.126.87/32;
65.215.128.0/24;
65.245.226.86/32;
65.246.184.0/23;
66.37.210.86/32;
66.45.81.158/32;
66.45.81.190/32;
66.98.205.0/24;
66.102.0.0/20;
66.117.176.136/31;
66.117.176.210/31;
66.117.176.212/30;
66.117.176.216/30;
66.117.176.220/32;
66.117.177.21/32;
66.135.192.0/19;
66.160.145.87/32;
66.179.148.0/24;
66.179.235.32/27;
66.211.160.0/19;
66.249.64.0/19;
67.72.126.87/32;
67.106.214.87/32;
67.133.36.87/32;
67.133.38.87/32;
67.133.200.87/32;
69.32.132.0/24;
69.45.80.87/32;
69.45.82.87/32;
69.45.84.87/32;
72.14.192.0/19;
72.14.224.0/20;
72.164.152.0/24;
80.67.78.87/32;
81.52.203.87/32;
81.52.251.87/32;
82.150.20.0/22;
82.165.43.115/32;
83.70.140.0/22;
84.18.160.0/19;
84.53.128.87/32;
121.30.0.0/15;
121.48.0.0/15;
121.192.0.0/14;
121.248.0.0/14;
123.49.160.0/24;
124.64.0.0/15;
124.88.0.0/14;
124.128.0.0/13;
124.161.0.0/16;
124.162.0.0/15;
124.164.0.0/14;
125.32.0.0/12;
125.73.0.0/16;
125.96.0.0/15;
125.98.0.0/16;
125.171.0.0/17;
125.208.0.0/20;
125.216.0.0/13;
128.84.158.0/24;
128.107.229.0/24;
129.35.76.0/24;
129.35.77.193/32;
129.41.4.137/32;
129.41.4.138/32;
129.41.4.140/32;
129.41.4.143/32;
129.41.4.144/30;
129.41.4.148/32;
129.41.4.154/32;
129.41.4.158/32;
129.42.24.230/32;
129.42.25.230/32;
129.42.32.230/32;
129.42.33.230/32;
129.42.40.230/32;
129.42.41.230/32;
130.88.203.58/32;
132.174.1.0/24;
132.174.11.0/24;
134.243.5.21/32;
134.243.5.70/32;
134.243.5.160/32;
134.243.85.3/32;
137.189.0.0/16;
138.12.4.0/24;
140.98.193.0/24;
140.98.194.0/24;
140.113.0.0/16;
140.234.29.0/24;
141.66.18.186/32;
143.89.0.0/16;
144.81.82.0/24;
144.81.87.0/24;
144.81.88.0/23;
144.214.0.0/16;
147.8.0.0/16;
149.28.1.0/24;
152.101.0.0/16;
152.104.0.0/16;
158.132.0.0/16;
158.182.0.0/16;
159.226.0.0/16;
161.207.0.0/16;
162.97.112.87/32;
162.97.114.87/32;
162.105.0.0/16;
165.193.106.0/23;
165.193.159.0/24;
165.215.136.0/24;
166.90.150.87/32;
166.111.0.0/16;
167.68.6.0/23;
167.139.0.0/16;
167.216.166.0/24;
168.160.0.0/16;
170.107.185.0/24;
170.107.188.0/22;
171.66.120.0/21;
192.58.150.0/24;
192.80.71.0/24;
192.84.75.0/24;
192.86.104.0/24;
192.195.245.0/24;
192.207.91.0/24;
192.245.208.0/24;
193.128.223.0/24;
193.131.119.0/24;
193.174.24.39/32;
193.174.240.6/32;
193.174.240.8/32;
193.194.158.0/24;
194.119.138.1/32;
194.128.228.153/32;
194.130.252.0/24;
195.22.150.0/23;
195.27.60.0/24;
195.27.123.0/24;
195.27.130.0/24;
195.90.89.87/32;
195.144.69.0/24;
198.81.200.2/32;
198.185.19.0/24;
199.4.154.0/23;
199.98.88.0/24;
199.164.217.0/24;
202.4.128.0/19;
202.14.80.0/24;
202.38.0.0/16;
202.40.138.0/23;
202.40.157.0/24;
202.40.192.0/19;
202.43.216.0/23;
202.45.32.0/19;
202.45.176.0/20;
202.75.64.0/19;
202.84.16.0/23;
202.91.176.0/20;
202.93.252.0/22;
202.95.0.0/19;
202.96.0.0/12;
202.112.0.0/13;
202.120.0.0/15;
202.122.32.0/20;
202.123.110.0/24;
202.125.192.0/18;
202.127.0.0/18;
202.127.128.0/17;
202.130.0.0/19;
202.130.224.0/19;
202.131.208.0/20;
202.134.86.130/32;
202.147.5.152/31;
202.147.5.158/31;
202.147.5.160/31;
202.147.5.166/31;
202.152.176.0/20;
202.160.176.0/20;
202.165.96.0/21;
202.165.104.0/22;
202.177.217.87/32;
202.179.240.0/20;
202.189.96.0/19;
202.192.0.0/12;
203.81.16.0/20;
203.87.224.0/19;
203.88.32.0/19;
203.91.120.0/21;
203.93.0.0/16;
203.95.0.0/21;
203.112.23.19/32;
203.119.28.0/23;
203.126.70.87/32;
203.128.128.0/19;
203.166.101.87/32;
203.175.128.0/19;
203.188.64.0/18;
203.192.0.0/19;
203.207.64.0/18;
203.207.128.0/17;
203.208.0.0/19;
203.209.224.0/19;
203.212.0.0/20;
204.94.134.87/32;
204.95.14.87/32;
204.153.51.29/32;
204.153.51.60/32;
204.153.51.65/32;
204.153.51.113/32;