ubuntu20.04.6系统部署DNS解析服务
提示:文章写完后,目录可以自动生成,如何生成可参考右边的帮助文档
文章目录
前言
之前都是centos系统搭建DNS服务器,最近业务需要在ubuntu系统搭建DNS服务器。搭建过程中发现与centos系统差别还是挺大,就把过程记录下,供大家参考。提示:这里可以添加本文要记录的大概内容:
提示:以下是本篇文章正文内容,下面案例可供参考
一、现状条件
OS:ubunutu 20.04
DNS 服务: bind9
dns 主
VMhostanme: dns0001
IP: 172.16.5.218
dns从 VM hostname: dns0002
IP:172.16.5.219
域:zuiwangzai.com.
解析目标:
A记录: apaas-node000X.zuiwangzai.com ----> IP
PTR记录 :IP ----> apaas-node.zuiwangzai.com
二、服务部署路径:
/etc/bind/
name.conf //主配置文件
name.conf.options //配置文件
rndc-key //认证密钥自己生成
/var/lib/bind/zuiwangzai.com/
zuiwangzai.conf //包含正向zuiwangzai.com.域解析配置,
var/lib/bind/db.16.172/
包含反向解析配置。
1.主DNS部署安装:
1、安装bind9服务
apt-get install bind9
2、编辑主配置文件
cd /etc/bind/
cp named.conf named.conf.bak
cat /etc/bind/named.conf
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
include "/var/lib/bind/zuiwangzai.com/zuiwangzai.conf";
include "/var/lib/bind/db.16.172/db.16.172.conf";
3、编辑配置文件
cp named.conf.options named.conf.options.bak
cat named.conf.options
options {
directory "/var/cache/bind";
//forwarders {
// 转发IP地址;
//};
listen-on port 53 {
172.16.5.218;//本机IP
};
allow-query {
any;
};
allow-transfer { key rndc-key; };
allow-update { key rndc-key;};
// 启用dnssec认证
//dnssec-enable yes;
//dnssec-validation no;
// listen-on-v6 { any; };
//};
key "rndc-key" {
algorithm hmac-sha256;
secret "你实际key";
};
4、创建域配置文件并编辑
mkdir -pv /var/lib/bind/eniot.io/
cd /var/lib/bind/eniot.io/
创建eniot.io.conf文件
cat eniot.io.conf
zone "zuiwangzai.com" IN {
type master;
file "/var/lib/bind/zuiwangzai.com/zuiwangzai.zone";
};
创建eniot.io.zone文件
cat eniot.io.zone
$ORIGIN .
$TTL 86400 ; 1 day
zuiwangzai.com IN SOA zuiwangzai.com. zuiwangzai.com. (
20230833 ; serial
604800 ; refresh (1 week)
86400 ; retry (1 day)
2419200 ; expire (4 weeks)
86400 ; minimum (1 day)
)
NS dns0001.zuiwangzai.com.
NS dns0002.zuiwangzai.com.
$ORIGIN zuiwangzai.com
dns0001 A 172.16.5.218
dns0002 A 172.16.5.219
test A 172.16.5.212
mkdir -pv /var/lib/bind/db.16.172
cd /var/lib/bind/db.16.172
创建db.16.172.conf 文件 //根据实际IP创建
cat db.16.172.conf
zone "16.172.in-addr.arpa" IN {
type master;
file "/var/lib/bind/db.16.172/db.16.172.zone";
};
创建db.16.172.zone文件
cat db.16.172.zone
$ORIGIN .
$TTL 86400 ; 1day
16.172.in-addr.arpa IN SOA zuiwangzai.com. zuiwangzai.com. (
3 ;Serial
604800 ;Refresh
86400 ;Retry
2419200 ;Expire
86400 ) ;Negative Cache TTL
;nameserver
IN NS dns0001.eniot.io.
IN NS dns0002.eniot.io.
;PTR Records
$ORIGIN 16.172.in-addr.arpa.
218.5 IN PTR dns0001.eniot.io.
219.5 IN PTR dns0002.eniot.io.
修改文件owner
chown -R bind:bind /var/lib/bind/
启动服务
systemctl start bind9
systemctl enable bind9
检服务状态
systemctl status bind9
解析验证
nslookup XXXX.zuiwangzai.com 正确解析既是服务正常。
2、从DNS部署安装
1、安装bind9服务
apt-get install bind9
2、编辑主配置文件
cd /etc/bind/
cp named.conf named.conf.bak
cat /etc/bind/named.conf
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
include "/var/lib/bind/zuiwangzai.com/zuiwangzai.conf";
include "/var/lib/bind/db.16.172/db.16.172.conf";
3、编辑配置文件
cp named.conf.options named.conf.options.bak
cat named.conf.options
options {
directory "/var/cache/bind";
//forwarders {
// 转发IP;
//};
listen-on port 53 {
172.16.5.219;//本机IP
};
allow-query {
any;
};
allow-transfer { key rndc-key; };
allow-update { key rndc-key;};
// 启用dnssec认证
//dnssec-enable yes;
//dnssec-validation no;
// listen-on-v6 { any; };
};
key "rndc-key" {
algorithm hmac-sha256;
secret "DNS主的key";
};
4、创建域配置文件并编辑
mkdir -pv /var/lib/bind/eniot.io/
cd /var/lib/bind/eniot.io/
创建eniot.io.conf文件
cat eniot.io.conf
zone "eniot.io" IN {
type slave;
file "/var/lib/bind/zuiwangzai.com/zuiwangzai.com.zone";
masters { 172.16.5.218; }; //主DNS_IP 注意分号
};
mkdir -pv /var/lib/bind/db.16.172
cd /var/lib/bind/db.16.172
创建db.16.172.conf 文件 。 //根据实际IP创建
cat db.16.172.conf
zone "16.172.in-addr.arpa" IN {
type slave;
file "/var/lib/bind/db.16.172/db.16.172.zone";
masters { 172.16.5.218 ; }; //主DNS_IP 注意分号
};
5、修改文件owner
chown -R bind:bind /var/lib/bind/
启动服务
systemctl start bind9
systemctl enable bind9
检服务状态
systemctl status bind9
解析验证
nslookup XXXX.zuiwangzai.com 正确解析既是服务正常。
nslookup IP 正确解析既是服务正常。
总结
注意⚠️:
1、ubuntu系统 /etc/resolv.conf 配置文件被 systemd-reslov.server 服务管理 ,文件定期会被还原为默认配置。需要保证关闭此服务
//关闭服务
systemctl stop systemd-resolv.service
//开启服务
systemctl start systemd-resolv.service
以上操作机器重启后依然会失效
2、清除systemd-resolve --flush-caches
systemd-resolve --flush-caches
参考文章:
ubuntu20.04 主从dns和自动更新配置 主要参考
Ubuntu使用bind9配置DNS服务器。 细节主要参考
Linux服务篇之DNS服务器搭建
运维之DNS服务器Bind9配置解析和基础示例及附带命令