一.准备工作
真机firewall-cmd --list-all
查看防火墙开启的服务
让masquerade开启
如果没开启
[root@foundation15 ~]# firewall-cmd --add-masquerade
success
再次查看就会出来
虚拟机vim ifcfg-eth0
配置好网络以及网关
用route -n 查看
在虚拟机中配置好yum源
yum clean all
1.在虚拟机中yum search dns
yum install bind -y
rpm -qc bind 查看配置文件
netstat -antlupe | grep named 查看可以共享dns的客户端
vim /etc/named.conf
10 options {
11 listen-on port 53 { any; };
12 listen-on-v6 port 53 { ::1; };
13 directory “/var/named”;
14 dump-file “/var/named/data/cache_dump.db”;
15 statistics-file “/var/named/data/named_stats.txt”;
16 memstatistics-file “/var/named/data/named_mem_stats.txt”;
17 allow-query { any; };
18 forwarders { 114.114.114.114; };
dnssec-validation 网络检查服务,把信息发送给网警机构
将其设置为 no
dig www.4399.com
2.在另一台机子上vim /etc/resolv.conf
nameserver 172.25.254.115
dig www.4399.com
二.正向解析dns
@可以让字符串后自动加上westos.com
不以’.'结尾的字符串会自动补齐
expire | 客户可以查询这个文件的期限(到期日) |
---|---|
refresh | 刷新客户缓存时间 |
minimum | 最小缓存时间 |
retry | 查询不到的话一个小时之后可以重新查询 |
[root@dns-server ~]# vim /etc/named.rfc1912.zones
19 zone “westos.com” IN {
20 type master;
21 file “kk.com.zone”;
22 allow-update { key westos; };
23 };
cd /var/named
cp -p named.localhost kk.com.zone
vim kk.com.zone
1 $TTL 1D
2 @ IN SOA dns.westos.com. rname.invalid. (
3 0 ; serial
4 1D ; refresh
5 1H ; retry
6 1W ; expire
7 3H ) ; minimum
8 NS dns.westos.com
9 A 127.0.0.1
10 AAAA ::1
11 dns A 172.25.254.215
12 www A 172.25.254.15
三.设置轮循
vim kk.com.zone
1 $TTL 1D
2 @ IN SOA dns.westos.com. rname.invalid. (
3 0 ; serial
4 1D ; refresh
5 1H ; retry
6 1W ; expire
7 3H ) ; minimum
8 NS dns.westos.com.
9 dns A 172.25.254.215
10 www CNAME bbs.b.westos.com.
11 bbs.b A 172.25.254.111
12 bbs.b A 172.25.254.123 ##设置轮循
分别dig bbs.b.westos.com
能够看到轮循的两个结果
四.测试邮件交换器
vim kk.com.zone
1 $TTL 1D
2 @ IN SOA dns.westos.com. rname.invalid. (
3 0 ; serial
4 1D ; refresh
5 1H ; retry
6 1W ; expire
7 3H ) ; minimum
8 NS dns.westos.com.
9 dns A 172.25.254.215
10 www CNAME bbs.b.westos.com.
11 bbs.b A 172.25.254.111
12 bbs.b A 172.25.254.123
13 westos.com. MX 1 mail.westos.com.
14 mail A 172.25.254.133
重启服务
发送邮件
[root@dns-server named]# mail root@westos.com
Subject: dsa
safds
fsa
EOT
[root@dns-server named]# mailq
-Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient-------
534AD245C8A 425 Fri Feb 15 21:42:39 root@dns-server.com
(connect to mail.westos.com[172.25.254.133]:25: Connection refused)
root@westos.com
– 0 Kbytes in 1 Request.
五.反向解析dns
vim /etc/named.rfs1912.zone
[root@dns-server named]# tail -n 7 /etc/named.rfc1912.zones
zone “254.25.172.in-addr.arpa” IN {
type master;
file “172.25.254.ptr”;
allow-update { none; };
};
vim 172.25.254.ptr
1 $TTL 1D
2 @ IN SOA dns.westos.com. root.westos.com. (
3 0 ; serial
4 1D ; refresh
5 1H ; retry
6 1W ; expire
7 3H ) ; minimum
8 NS dns.westos.com.
9 dns A 172.25.254.115
10 115 PTR dns.kk.com.
11 215 PTR www.kk.com.
12 177 PTR bbb.kk.com.
重启服务
测试:dig -x 172.25.254.177
六.双向解析
vim /etc/named.conf
50 /*
51 zone “.” IN {
52 type hint;
53 file “named.ca”;
54 };
55 */
56 view localnet {
57 match-clients { localhost;};
58 zone “.” IN {
59 type hint;
60 file “named.ca”;};
61 include “/etc/named.rfc1912.zones”;
62 };
63 view internet {
64 match-clients { any;};
65
66 zone “.” IN {
67 type hint;
68 file “named.ca”;};
69 include “/etc/named.rfc1912.inter”;
70 };
71 include “/etc/named.root.key”;
cp -p /etc/named.rfc1912.zones /etc/named.rfc1912.inter
vim /etc/named.rfc1912.inter
20 zone “westos.com” IN {
21 type master;
22 file “kk.com.inter”;
23 allow-update { none; };
24 };
cp -p /var/named/kk.com.zone /var/named/kk.com.inter
vim /var/named/kk.com.inter
1 $TTL 1D
2 @ IN SOA dns.westos.com. kk.westos.com. (
3 0 ; serial
4 1D ; refresh
5 1H ; retry
6 1W ; expire
7 3H ) ; minimum
8 NS dns.westos.com.
9 dns A 192.25.0.215
10 www CNAME bbs.b.westos.com.
11 bbs.b A 192.25.0.111
12 bbs.b A 192.25.0.123
13 westos.com. MX 1 mail.westos.com.
14 mail A 192.25.0.133
在真机中dig www.westos.com
六.辅助dns
集群
配置第二台主机的yum源
yum clean all
yum install bind -y
配置主配置文件
[root@server named]# vim /etc/named.rfc1912.zones
25 zone “westos.com” IN {
26 type slave;
27 masters { 172.25.254.115; };
28 file “slaves/westos.com.zone”;
29 allow-update { none; };
30 };
重启服务
在第一台已经配置好的dns服务器上
vim /etc/name.conf
74 include “/etc/named.rfc1912.zones”;
(清除上次实验的数据)
[root@dns-server named]# vim /etc/named.rfc1912.zones
19 zone “westos.com” IN {
20 type master;
21 file “kk.com.zone”;
22 also-notify { 172.25.254.215;}; ##第二台主机的ip
23 allow-update { none; };
24 };
[root@dns-server named]# vim kk.com.zone
1 $TTL 1D
2 @ IN SOA dns.westos.com. kk.westos.com. (
3 20190216 ; serial
4 1D ; refresh
5 1H ; retry
6 1W ; expire
7 3H ) ; minimum
8 NS dns.westos.com.
9 dns A 172.25.254.215
10 www CNAME bbs.b.westos.com.
11 bbs.b A 172.25.254.1
12 bbs.b A 172.25.254.2
13 westos.com. MX 1 mail.westos.com.
14 mail A 172.25.254.133
测试:
在第二台主机上dig www.westos.com
[root@server named]# dig www.westos.com
七.远程改变dns
远程添加
在第一台主机上
[root@dns-server named]# cp -p kk.com.zone /mnt ##备份数据
[root@dns-server named]# vim /etc/named.rfc1912.zones
19 zone “westos.com” IN {
20 type master;
21 file “kk.com.zone”;
22 also-notify { 172.25.254.215;};
23 allow-update { 172.25.254.215; };
24 };
[root@dns-server named]# chmod 770 /var/named
在第二台主机上
[root@server named]# nsupdate
server 172.25.254.115
update add kk.westos.com 86400 A 172.25.254.111
send
quit
远程删除
[root@server named]# nsupdate
server 172.25.254.115
update delete kk.westos.com
send
quit
设置虚拟机2的nameserver
vim /etc/resolv.conf
在虚拟机2中dig kk.westos.com
八.用key认证做远程dns
准备工作:
在dns服务器上:
将原来做好的dns还原
[root@dns-server named]# rm -fr kk.com.zone
[root@dns-server named]# rm -fr kk.com.zone.jnl
[root@dns-server named]# ll /mnt
total 4
-rw-r----- 1 root named 337 Feb 16 01:42 kk.com.zone
[root@dns-server named]# cp -p /mnt/kk.com.zone .
[root@dns-server named]# ls
172.25.254.ptr dynamic kk.com.zone named.empty named.loopback
data kk.com.inter named.ca named.localhost slaves
[root@dns-server named]# systemctl restart named
[root@dns-server named]# cat kk.com.zone
$TTL 1D
@ IN SOA dns.westos.com. kk.westos.com. (
20190216 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.westos.com.
dns A 172.25.254.215
www CNAME bbs.b.westos.com.
bbs.b A 172.25.254.1
bbs.b A 172.25.254.2
westos.com. MX 1 mail.westos.com.
mail A 172.25.254.133
建立公钥和私钥
dnssec-keygen -a HMAC-MD5 -b 128 -n HOST westos
cp -p /etc/rndc.key /etc/westos.key
ls
cat Kwestos.+157+49506.private
cat Kwestos.+157+49506.key
[root@dns-server ~]# vim /etc/westos.key
1 key “westos” {
2 algorithm hmac-md5;
3 secret “m3rWNhm+ZiGo+eTsufOO6w==”;
4 };
vim /etc/named.conf
49 include “/etc/westos.key”;
[root@dns-server ~]# vim /etc/named.rfc1912.zones
19 zone “westos.com” IN {
20 type master;
21 file “kk.com.zone”;
22 also-notify { 172.25.254.215;};
23 allow-update { key westos; };
24 };
重启服务
scp Kwestos.+157+49506.* root@172.25.254.215:/mnt
在第二台主机上:
cd /mnt
ls
[root@dns2 mnt]# nsupdate -k Kwestos.+157+49506.private
server 172.25.254.115
update add hello.westos.com 86400 A 172.25.254.222
send
quit
[root@dns2 mnt]# dig hello.westos.com
删除
[root@dns2 mnt]# nsupdate -k Kwestos.+157+49506.private
server 172.25.254.115
update delete hello.westos.com
send
quit
九.dhcp下的dns服务
先配置好一个dhcp服务器(在dns服务器上)
配置好yum源
下载dhcp
[root@dns-server ~]# vim /etc/dhcp/dhcpd.conf
7 option domain-name “westos.com”;
8 option domain-name-servers 114.114.114.114;
30 subnet 172.25.254.0 netmask 255.255.255.0 {
31 range 172.25.254.60 172.25.254.99;
32 option routers 172.25.254.115;
33 }
测试:
(拔网线)
在另一台主机上改变ip为动态ip
重启网络服务,查看ip改变即为成功
配置dhcp服务
[root@dns-server named]# vim /etc/dhcp/dhcpd.conf
14 ddns-update-style interim; ##开启dhcp更新的域名
35 key westos { ##dhcp更新dns时用到的key
36 algorithm hmac-md5;
37 secret 2D/Gty5G89pEfvGa4K/j4w==;
38 }
39
40 zone westos.com. { ##指定dhcp更新的域名
41 primary 172.25.254.115; ##指定dns所在的主机ip(可以为回环接口127.0.0.1)
42 key westos; ##指定更新这个域时用到的key名称
43 }
测试:
设定一台主机网络的工作方式为dhcp
PEERDNS=no
BOOTPROTO=dhcp
更改这台主机的主机名称为news.westos.com
更改nameserver 172.25.254.115
这个名称在原有的dns服务中是没有解析的
重启网络之后查看ip和主机名称的解析
[root@news ~]# dig news.westos.com
能够看到ip即为成功。