企业级域名解析服务

DNS：

权威名称服务器：

存储并提供某区域（整个DNS域或DNS域的一部分）的实际数据。

权威名称服务器类型包括：

    Master：包括原始区域数据。有时称作"主要"名称服务器。
    Slave：备份服务器，通过区域传送从Master服务器获得的区域数据的副本。有时称作"次要"名称服务器
    非权威/递归名称服务器的类型包括仅缓存名称服务器：仅用于查找，对于非重要>数据之外的任何内容都不具有权威性
DNS查找：
客户端上的Stub解析器将查询发送至/etc/reslove.conf的名称服务器nameserver
如果名称服务器对于请求的信息具有权威性，会将权威答案发送至客户端，否则如果名称服务器在其缓存中有请求的信息，则会将非权威答案发送至客户端；
如果缓存区没有该信息，名称服务器将搜索权威名称服务器以查找信息，从根区域开始，按照DNS层次结构向下搜索，直至对于信息

具有权威性的名称服务器，以此为客户端获得答案。

1.高速缓存DNS

1.yum install bind.x86_64
2.vim /etc/named.conf    #编辑dns服务配置文件
 11         listen-on port 53 { any; };
 12         listen-on-v6 port 53 { ::1; };
 13         directory       "/var/named";
 14         dump-file       "/var/named/data/cache_dump.db";
 15         statistics-file "/var/named/data/named_stats.txt";
 16         memstatistics-file "/var/named/data/named_mem_stats.txt";
 17         allow-query     { any; };
 18          forwarders     {114.114.114.114;};

 29         recursion yes;
 30
 31         dnssec-enable yes;
 32         dnssec-validation no;
 33         dnssec-lookaside auto;
3.systemctl restart named    #重启服务
4.vim /etc/sysconfig/network-scripts/ifcfg-eth0
GATEWAY=172.25.254.65
NETMASK=255.255.255.0
5.vim /etc/resolv.conf
nameserver=114.114.114.114
dig www.baidu.com

在172.25.254.65中
vim /etc/resolv.conf
nameserver=172.25.254.133
dig www.baidu.com

2.正向解析

vim /etc/named.rfc1912.zones
 25 zone "westos.com" IN {
 26         type master;
 27         file "westos.com.zone";
 28         allow-update { none; };
 29 };

cd /var/named/
cp  -p  named.localhost westos.com.zone
vim westos.com.zone
$TTL 1D
@       IN SOA dns.westos.com.  lala.westos.com. (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      dns.westos.com.
dns     A       172.25.254.133
hello   A       172.25.254.101
systemctl restart named
dig hello.westos.com

3.轮询式域名解析

vim westos.com.zone
www   CNAME    node1.westos.com.
node1   A       172.25.254.222
node1   A       172.25.254.111
systemctl restart named
dig www.westos.com

4.反向解析

vim /etc/named.rfc1912.zones
  37 zone "1.0.0.127.in-addr.arpa" IN {
  38         type master;
  39         file "named.loopback";
  40         allow-update { none; };
  41 };
  42
  43 zone "0.in-addr.arpa" IN {
  44         type master;
  45         file "named.empty";
  46         allow-update { none; };
  47 };
  48
  49 zone "254.25.172.in-addr.arpa" IN {  #复制37-42行到49行，并修改为如下内容
  50         type master;
  51         file "westos.com.ptr";
  52         allow-update { none; };
  53 };
  54                     

cp -p /var/named/named.loopback /var/named/westos.com.ptr
vim /var/named/westos.com.ptr
  $TTL 1D
  @       IN SOA  dns.westos.com. xixi.westos.com. (
                                          0       ; serial
                                          1D      ; refresh
                                          1H      ; retry
                                          1W      ; expire
                                          3H )    ; minimum
          NS      dns.westos.com.
  dns     A       172.25.254.133
  133     PTR     wei.westos.com.
  111     PTR     hello.westos.com.

systemctl restart named
dig -x 172.25.254.111

5.双向域名解析

cp -p /var/named/westos.com.zone /var/named/westos.com.inter
vim /var/named/westos.com.inter
      $TTL 1D
      @       IN SOA dns.westos.com.  lala.westos.com. (
                                              0       ; serial
                                              1D      ; refresh
                                              1H      ; retry
                                              1W      ; expire
                                              3H )    ; minimum
              NS      dns.westos.com.
      dns     A       192.168.0.132
      hello   A       192.168.0.101
      www     CNAME   node1.westos.com.
      node1   A       192.168.0.111
      node1   A       192.168.0.222

cp -p /etc/named.rfc1912.zones /etc/named.rfc1912.inter
vim /etc/named.rfc1912.inter
      19 zone "westos.com" IN {
      20         type master;
      21         file "westos.com.inter";
      22         allow-update { none; };
      23 };
      24 

vim /etc/named.conf
      50 /*
      51 zone "." IN {
      52         type hint;
      53         file "named.ca";
      54 };
      55 
      56 include "/etc/named.rfc1912.zones";
      57 include "/etc/named.root.key";
      58 */
      59 
      60 view localnet {
      61         match-clients { 172.25.254.133; };
      62         zone "." IN {
      63                 type hint;
      64                 file "named.ca";
      65         };
      66 include "/etc/named.rfc1912.zones";
      67 };
      68 
      69 view innet {
      70         match-clients { any; };
      71         zone "." IN {
      72                 type hint;
      73                 file "named.ca";
      74         };
      75 include "/etc/named.rfc1912.inter";
      76 };

systemctl restart named

编辑 /var/named/westos.com.inter 文件

编辑 /etc/named.rfc1912.inter 文件

编辑 /etc/named.conf 文件

检测双向解析是否配置成功

在172.25.254.133中dig www.westos.com

在172.254.25.65中dig www.westos.com

6.dns集群

133为dns 233为辅助dns
133：
vim /etc/named.rfc1912.zones
zone "westos.com" IN {
        type master;
        file "westos.com.zone";
        allow-update { none; };
        also-notify { 172.25.254.233; };
};
systemctl restart named
233:
vim /etc/resolv.conf
nameserver 172.25.254.233
vim /etc/named.rfc1912.zones
zone "westos.com" IN {
        type slave;
        masters { 172.25.254.133; };
        file "slaves/westos.com.zone";
        allow-update { none; };
};
systemctl restart named
133：
vim /var/named/westos.com.zone
@       IN SOA dns.westos.com.  lala.westos.com. (
                                        0       ; serial
注：在主服务端更改一次，serial 上的数值要进行修改，这样更改过的数据才能更新到233上面更新DNS

在133中编辑/var/named/westos.com.zone文件 添加jiqun.westos.com

在233中dig jiqun.westos.com 测试配置是否成功

7.DNS更新

133:
vim /etc/named.rfc1912.zones
zone "westos.com" IN {
        type master;
        file "westos.com.zone";
        allow-update { 172.25.254.33; };  #允许33更新DNS
        also-notify { 172.25.254.233; };
};
chmod 770 /var/named/
systemctl restart named

33：
nsupdate 
> server 172.25.254.133
> update add test.westos.com 86400 A 172.25.254.120
> send

编辑 /etc/named.rfc1912.zones 文件 允许ip为172.25.254.33的主机更新DNS

测试是否能成功更新

8.加密DNS更新

133：
dnssec-keygen -a HMAC-MD5 -b 128 -n HOST westos
cp /etc/rndc.key /etc/westos.key -p
vim /etc/named.conf
 43 include "/etc/westos.key";
[root@localhost ~]# cat /mnt/Kwestos.+157+63867.key 
westos. IN KEY 512 3 157 3cEu+wFZYPUR0OhltLrV4g==
vim /etc/westos.key
key "westos" {
        algorithm hmac-md5;
        secret "3cEu+wFZYPUR0OhltLrV4g==";
};

vim /etc/named.rfc1912.zones
zone "westos.com" IN {
         type master;
         file "westos.com.zone";
         allow-update { key westos; };
	 also-notify { 172.25.254.233; };
};
systemctl restart named
scp /mnt/Kwestos.+157+63867.* root@172.25.254.233:/mnt
233：
nsupdate -k Kwestos.+157+63867.private 
> server 172.25.254.133
> update add test.westos.com 86400 A 172.25.254.110
> send

修改钥匙及配置文件

测试加密是否成功

9.DDNS域名动态解析

133：
yum install dhcp -y
cp /usr/share/doc/dhcp-4.2.5/dhcpd.conf.example /etc/dhcp/dhcpd.conf
vim /etc/dhcp/dhcpd.conf
  7 option domain-name "westos.com";
  8 option domain-name-servers 172.25.254.133;

 14 ddns-update-style interim;
 删除26 17 及34行以后
 30 subnet 172.25.254.0 netmask 255.255.255.0 {
 31   range 172.25.254.90 172.25.254.100;
 32   option routers 172.25.254.133;
 33 }
 34 key westos {
 35          algorithm hmac-md5;
 36          secret 3cEu+wFZYPUR0OhltLrV4g==;
 37        };
 38 
 39 zone westos.com. {
 40          primary 127.0.0.1;

systemctl restart dhcpd

233：
将主机名改为域名为westos.com的名称，ip获取方式为动态获取
dig 主机名
查看解析出的ip是否随主机动态获取的ip变化而变化