Linux 第三本书 第六单元--------企业dns服务器搭建

高速缓存dns

服务端ndoea；172.25.254.104
客户端ndoeb；172.25.254.204

ndoea：
 dnf install bind -y
systemctl start named

firewall-cmd --permanent --add-service=dns      -----添加服务dns
 firewall-cmd --reload

 ip route add default via 172.25.254.250    ----配置网络

 

 vim /etc/named.conf
{
 11  listen-on port 53 { any; };
 
 19    allow-query     { any; };
       forwarders { 114.114.114.114; };

 34     dnssec-validation no;

}
systemctl restart named

nodeb:

vim /etc/resolv.conf
{
nameserver 172.25.254.104
}

dig  网址

此时再用一台重复nodeb的操作， 此时dig网址，速度就会大大提升。

==================================================
正向解析

nodea:

cd /var/named

 

cp -p named.localhost  westos.org.zone

vim westos.org.zone

 

{
$TTL 1D
@       IN SOA  dns.westos.org. dns.westos.org.  (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      dns.westos.org.
dns     A       172.25.254.104
www     A       172.25.254.103
~                                                                         
~                                                                         
~                                  

}

vim /etc/named.rfc1912.zones

{

zone "westos.org" IN {
        type master;
        file "westos.org.zone";
        allow-update { none; };
};

}

systemctl  restart named

nodeb:

 

dig  www.westos.org

=================================================
逆向解析

nodea:

 cp -p named.loopback 172.25.254.ptr

 

vim /etc/named.rfc1912.zones     ---编辑named.rfc1912.zones
{

zone "254.25.172.in-addr.arpa" IN {
        type master;
        file "172.25.254.ptr";
        allow-update { none; };
};

}

vim westos.org.zone                    ----编辑westos.org.zone
{
$TTL 1D
@       IN SOA  dns.westos.org. dns.westos.org.  (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      dns.westos.org.
dns     A       172.25.254.104
www     CNAME   nodea.westos.org.
nodea   A       172.25.254.111
ndoea   A       172.25.254.222
westos.org. MX 1 172.25.254.204.

}

 
vim 172.25.254.ptr                   编辑named下的 172.25.254.ptr
{
$TTL 1D
@       IN SOA  dns.westos.org. dns.westos.org. (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      dns.westos.org.
dns     A       172.25.254.104
204     PTR     mail.westos.org.
                                        
}

systemctl  restart named                ----重启服务

在nodeb测试:

dig -x 172.25.254.204

dig -t mx westos.org          邮件解析记录

==============================================================

dns集群

nodea：
 vim /etc/named.rfc1912.zones
{
zone "westos.org" IN {
        type master;
        file "westos.org.zone";
        allow-update { none; };
        also-notify { 172.25.254.204; };
};

}

 

vim westos.org.zone
{
$TTL 1D
@       IN SOA  dns.westos.org. root.westos.org.  (
                                        2021111201      ; serial         -------域名版本序列号
                                        1D      ; refresh                    ---------刷新时间
                                        1H      ; retry                         -------重试时间
                                        1W      ; expire                     --------过期时间
                                        3H )    ; minimum                 ------记录最短有效期
        NS      dns.westos.org.
dns     A       172.25.254.104
www     CNAME   nodea.westos.org.          ----域名
nodea   A       172.25.254.112                      ------正向解析
nodea   A       172.25.254.223
westos.org. MX 1 172.25.254.204.              
~                                      
}

 systemctl restart named

nodeb:

dnf install bind -y

firewall-cmd --permanent --add-service=dns

firewall-cmd --reload

 vim /etc/named.conf

vim /etc/named.rfc1912.zones

{
zone "westos.org" IN {
        type slave;
        masters { 172.25.254.104; };
        file "slaves/westos.org.zone";
};

}
systemctl restart named

dig

=======================================
双向解析
ndoea：
ip addr add 192.168.0.104/24 dev ens3

vim /etc/resolv.conf
{nameserver 172.25.254.104
}

vim /etc/named.conf

{
view localnet{
      match-clients { 172.25.254.0/24; };
       zone "." IN {
        type hint;
        file "named.ca";
       };
include "/etc/named.rfc1912.zones";
};

view internet{
      match-clients { any; };
       zone "." IN {
        type hint;
        file "named.ca";
       };
include "/etc/named.rfc1912.inter";
};

}

cp /etc/named.rfc1912.zones /etc/named.rfc1912.inter -p

 vim  /etc/named.rfc1912.inter
{
zone "westos.org" IN {
        type master;
        file "westos.org.inter";
        allow-update { none; };

};

}

systemctl restart named

dig  www.xxx

nodeb:
vim /etc/sysconfig/network-scripts/ifcfg-ens3
{IPADDR1=192.168.0.204
PREFIX1=24
}

nmcli connection reload
nmcli connection  up ens3

===========================================

dns 更新

dnf install dhcp-server  -y
cp /usr/share/doc/dhcp-server/dhcpd.conf.example   /etc/dhcp/dhcpd.conf

cd /mnt

 dnssec-keygen -a HMAC-SHA256 -b 128 -n HOST westos

cp  /etc/rndc.key    /etc/westos.key  -p       
cat /etc/westos.key
 cat Kwestos.+163+25068.private       -----从cat/etc/westos.key看到

vim /etc/westos.key

{
key "westos" {
        algorithm hmac-sha256;
        secret "DuC+QtJZX/n3P9W+ZrLvyQ==";   -----从cat Kwestos.+显示出来的
};
~       
}

vim /etc/named.rfc1912.zones
{
zone "westos.org" IN {
        type master;                 
        file "westos.org.zone";
        allow-update { key westos; };                 允许指定客户端更新westos域
        also-notify { 172.25.254.204; };
};
}

vim /etc/named.conf
{
include "/etc/westos.key";
}

systemctl restart named

nsupdate -k Kwestos.+163+25068.private
> server 172.25.254.104
> update add haha.westos.org 86400 A 172.25.254.110   新增A记录
> send

dig haha.westos.org