## 一、项目需求
1.1 公司域名是aishop.com
1.2 公司需要一个对外宣传的网站,域名是:www.aishop.com
1.3 为了对应黑客攻击,因此www.aishop.com需要使用CNAME进行解析
1.4 为了避免单点故障,因此要求DNS服务器至少有一个从服务器,并且不允许其他主机通过主DNS能进行解析
1.5 公司预计在武汉成立一个分公司,因此需要在武汉分公司注册一个本地的子域名系统:wuhan.aishop.com进行开展业务
## 二、前期准备
准备五台机器
|客户端client|10.0.0.20|
|-------|-------|-------|
|主DNS master|10.0.0.60|
|从DNS slave|10.0.0.70|
|服务端 web|10.0.0.102|
|子域 wuhan|10.0.0.101|
### 2.1主DNS配置步骤
```
1) 安装bind软件
[root@master ~ ]# yum install bind bind-utils -y
2)编辑 /etc/name.conf文件
[root@master ~]#vim /etc/named.conf
options {
listen-on port 53 { any; };
listen-on-v6 port 53 { any; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
allow-query { any; };
allow-transfer { 10.0.0.70;10.0.0.101; }; #子域DNS服务器地址
关闭
dnssec-enable no;
dnssec-validation no;
3)配置区域
[root@master ~ ]# vim /etc/named.rfc1912.zones
zone "aishop.com" IN {
type master; #指定角色是master
file "aishop.com.zone";#指定区域文件
};
4)创建区域数据库文件
[root@master ~]#vim /var/named/aishop.com.zone
$TTL 1D
@ IN SOA ns1 smtp.aishop.com. (
1001 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
@ NS ns1
@ NS ns2
ns1 A 10.0.0.60
ns2 A 10.0.0.70
www CNAME web
web A 10.0.0.102
wuhan A 10.0.0.101
5)检查配置启动服务
[root@master ~ ]#chmod 640 /var/named/aishop.com.zone
[root@master ~ ]#chown root.named /var/named/aishop.com.zone
[root@master ~ ]#named-checkzone aishop.com /var/named/aishop.com.zone
[root@master ~ ]#systemctl enable --now named
```
### 2.2从DNS配置
```
[root@slave ~ ]# yum install bind bind-utils -y
[root@slave ~ ]# vim /etc/named.conf
// listen-on port 53 { 127.0.0.1; };
// allow-query { localhost; };
#注释这两行
#从DNS配置区域
[root@slave ~ ]# vim /etc/named.rfc1912.zones
zone "aishop.com" IN {
type slave;
masters { 10.0.0.60; };#主服务器IP
file "slaves/aishop.com.zone.slave";
};
#第一次启动服务
[root@slave ~ ]#systemctl enable --now named
#不是第一次启动服务
[root@slave ~ ]#rndc reload
#查看区域数据库文件是否生成
[root@slave ~ ]#ls /var/named/slaves/
```
### 2.3客户端测试主从DNS
```
#客户端和从dns都配置
vim /etc/sysconfig/network-scripts/ifcfg-eth0
DNS1=主服务器
DNS2=从服务器
#验证从DNS服务器是否可以查询
[root@slave slaves]# dig www.aishop.com
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.13 <<>> www.ops.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6764
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.ops.com. IN A
;; ANSWER SECTION:
www.ops.com. 86400 IN A 192.168.1.102
;; AUTHORITY SECTION:
ops.com. 86400 IN NS master.ops.com.
ops.com. 86400 IN NS slave.ops.com.
;; ADDITIONAL SECTION:
master.ops.com. 86400 IN A 192.168.1.100 ##可以查询
slave.ops.com. 86400 IN A 192.168.1.101
;; Query time: 0 msec
;; SERVER: 192.168.1.100#53(192.168.1.100)
;; WHEN: Fri Apr 28 15:15:57 CST 2023
;; MSG SIZE rcvd: 129
#从服务上测试curl正常
[root@slave slaves]# curl www.aishop.com
www.ops.com ON 192.168.1.102
#在主服务器上停止DNS服务
[root@master ~]# systemctl stop named
#客户端访问测试
[root@client1 ~]# curl www.aishop.com
www.ops.com ON 192.168.1.102
```
### 2.4子域服务器配置
```
[root@wuhan ~ ]# yum install bind bind-utils -y
[root@wuhan~ ]# vim /etc/named.conf
options {
listen-on port 53 { any; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
allow-query { any; };
[root@wuhan ~]#vim /etc/named.rfc1912.zones
zone "wuhan.aishop.com" IN {
type master;
file "wuhan.aishop.com.zone";
};
[root@wuhan ~]#vim /var/named/wuhan.aishop.com.zone
$TTL 1D
@ IN SOA master smtp.ops.com. (
1027 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
@ NS master
master A 10.0.0.70
www A 10.0.0.101
[root@wuhan ~ ]# chmod 640 /var/named/wuhan.aishop.com.zone
[root@wuhan ~ ]# chmod 640 /var/named/wuhan.aishop.com.zone
[root@wuhan ~ ]# named-checkzone wuhan .aishop.com /var/named/wuhan .aishop.com.zone
[root@wuhan ~ ]# systemctl enable --now named
### 2.5 客户端子域测试
```
#权威服务器测试
[root@client1 ~]# nslookup www.wuhan.aishop.com 192.168.1.101
Server: 192.168.1.101
Address: 192.168.1.101#53
Name: www.wuhan.aishop.com
Address: 192.168.1.105
#父域服务器测试
[root@client1 ~]# nslookup www.aishop.com 192.168.1.100
Server: 192.168.1.100
Address: 192.168.1.100#53
Name: www.aishop.com
Address: 192.168.1.101
```
### 2.6 web服务器
```
[root@web ~]#yum install bind bind-utils -y
[root@web ~]#yum install httpd -y
```