怎么修改GRS的服务器地址,DNS安装与设置（3）

主要实现DNS从服务器及配置转发服务器配置与实现

测试环境还是参照1，2来实现从服务器配置

1:测试环境

DNS版本：version: 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6

主服务器：10.1.77.85

从服务器：192.168.7.74

2:安装从服务器和转发服务器之前需要知道的

1－1.如何创建从服务器？

如果有多台DNS从服务器，必须为每个DNS服务器建立NS记录，否则主DNS不能向从服务器发送通知。

区域定义：

zone "区域名称" IN {

type slave;

file "slaves/ZONE_NAME.zone";

master {

master_dns_ip;

master_dns2_ip;};

};

在主服务器/etc/named.rfc1912.zones设置从服务器可以请求数据allow-transfer { IP; };

1－2.bind访问控制列表

acl string { address_match_clement;....  };

ang, none,local,localnet  这几个参数都可以选择

2-2.如何将请求转发出去解析：

转发类型：

转发所有针对非本机负责解析的区域的请求；

options {

forwarders { 192.168.211.116; };

forward only;

};

仅针对特定区域进行转发：

zone {

type forward;

};

PS：转发的前提，接受请求的服务器必须能够为请求者做递归查询；

forwarders { IP; };

forward only | first;

3:现在根据前面的提示开始设置

1-1:在主服务器设置 allow-transfer

[root@erickpuppet77_85 ~]# less /etc/named.rfc1912.zones

zone "luhaigang.com" IN {

type master;

file "luhaigang.com.zone";

allow-transfer { 192.168.7.74; };

};

zone "luhaigang.cn" IN {

type master;

file "luhaigang.cn.zone";

allow-transfer { 192.168.7.74; };

};

zone "77.1.10.in-addr.arpa" IN {

type master;

file "77.1.10.zone";

allow-transfer { 192.168.7.74; };

};

1-2:在192.168.7.74安装 DNS从服务器

[root@erickagent ~]#yum -y install bind*

修改配置文件之前不要启动named

修改从服务器192.168.7.74的DNS配置文件/etc/named.rfc1912.zones

[root@erickagent ~]# less /etc/named.rfc1912.zones

allow-update { none; };

};

zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {

type master;

file "named.loopback";

allow-update { none; };

};

zone "1.0.0.127.in-addr.arpa" IN {

type master;

file "named.loopback";

allow-update { none; };

};

zone "0.in-addr.arpa" IN {

type master;

file "named.empty";

allow-update { none; };

};

zone "luhaigang.com" IN {

type slave;//类型为从服务器

file "slaves/luhaigang.com.zone";//从服务器的区域文件

allow-transfer { none; };//从服务器不允许其它DNS请求

masters { 10.1.77.85; };//指明主服务器的IP地址

};

zone "luhaigang.cn" IN {

type slave;

file "slaves/luhaigang.cn.zone";

allow-transfer { none; };

masters { 10.1.77.85; };

};

zone "77.1.10.in-addr.arpa" {

type slave;

file "slaves/77.1.10.zone";

allow-transfer { none; };

masters { 10.1.77.85; };

};

在从服务器192.168.7.74创建slaves这个目录即可

#makdir /var/named/slaves

#chown named:named /var/named/slaves

#chmod 640 /var/named/slaves

以上步骤做完之后即可在从服务器192.168.7.74启动named程序：

#service named start

启动之后，去从服务器192.168.7.74下的/var/named/slaves会看到两个正向解析文件和一个反向解析文件都会同步到从服务器

[root@erickagent ~]# ll /var/named/slaves/

总用量 12

-rw-r--r-- 1 named named 491 3月  25 13:45 77.1.10.zone

-rw-r--r-- 1 named named 437 3月  25 13:48 luhaigang.cn.zone

-rw-r--r-- 1 named named 443 3月  25 14:19 luhaigang.com.zone

[root@erickagent ~]# less /var/named/slaves/luhaigang.cn.zone

$ORIGIN .

$TTL 3600       ; 1 hour

luhaigang.cn            IN SOA  dns.luhaigang.cn. admin.luhaigang.cn. (

2015032315 ; serial

3600       ; refresh (1 hour)

300        ; retry (5 minutes)

259200     ; expire (3 days)

10800      ; minimum (3 hours)

)

NS      dns.luhaigang.cn.

MX      10 mail.luhaigang.cn.

$ORIGIN luhaigang.cn.

dns                     A       10.1.77.85

mail                    A       10.1.77.89

web                     CNAME   www

www                     A       10.1.77.86

A       10.1.77.87

A       10.1.77.88

把从服务器192.168.7.74的本地dns配置文件修改成自己的地址

[root@erickagent ~]# less /etc/resolv.conf

nameserver 192.168.7.74

如果一切顺利，现在测试是否可以解析到luhaigang.com(正向)，luhaigang.cn(正向)，192.168.7.74(反向)，10.1.77.85(反向)

[root@erickagent ~]# dig -t A luhaigang.com

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6 <<>> -t A luhaigang.com

;; global options: +cmd

;; Got answer:

;; ->>HEADER<

;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:

;luhaigang.com.INA

;; AUTHORITY SECTION:

luhaigang.com.3600INSOAdns.luhaigang.com. admin.luhaigang.com. 2015032315 3600 300 259200 10800

;; Query time: 0 msec

;; SERVER: 192.168.7.74#53(192.168.7.74)

;; WHEN: Wed Mar 25 14:45:20 2015

;; MSG SIZE  rcvd: 77

[root@erickagent ~]# dig -t A luhaigang.con

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6 <<>> -t A luhaigang.con

;; global options: +cmd

;; Got answer:

;; ->>HEADER<

;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:

;luhaigang.con.INA

;; AUTHORITY SECTION:

.10800INSOAa.root-servers.net. nstld.verisign-grs.com. 2015032401 1800 900 604800 86400

;; Query time: 230 msec

;; SERVER: 192.168.7.74#53(192.168.7.74)

;; WHEN: Wed Mar 25 14:45:27 2015

;; MSG SIZE  rcvd: 106

[root@erickagent ~]# dig -x 192.168.7.74

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6 <<>> -x 192.168.7.74

;; global options: +cmd

;; Got answer:

;; ->>HEADER<

;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:

;74.7.168.192.in-addr.arpa.INPTR

;; Query time: 415 msec

;; SERVER: 192.168.7.74#53(192.168.7.74)

;; WHEN: Wed Mar 25 14:45:47 2015

;; MSG SIZE  rcvd: 43

[root@erickagent ~]# dig -x 10.1.77.85

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6 <<>> -x 10.1.77.85

;; global options: +cmd

;; Got answer:

;; ->>HEADER<

;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:

;85.77.1.10.in-addr.arpa.INPTR

;; ANSWER SECTION:

85.77.1.10.in-addr.arpa. 3600INPTRdns.luhaigang.com.

;; AUTHORITY SECTION:

77.1.10.in-addr.arpa.3600INNSdns.luhaigang.com.

;; ADDITIONAL SECTION:

dns.luhaigang.com.3600INA10.1.77.85

;; Query time: 0 msec

;; SERVER: 192.168.7.74#53(192.168.7.74)

;; WHEN: Wed Mar 25 14:45:56 2015

;; MSG SIZE  rcvd: 102

[root@erickagent ~]#

4:以上实现了从服务器的配置与实现，以下开始实现转发功能

1:在主DNS服务器10.1.77.85编辑named.conf配置文件

[root@erickpuppet77_85 ~]# less /etc/named.conf

//

// named.conf

//

// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS

// server as a caching only nameserver (as a localhost DNS resolver only).

//

// See /usr/share/doc/bind*/sample/ for example named configuration files.

//

options {

//      listen-on port 53 { 127.0.0.1; };

//      listen-on-v6 port 53 { ::1; };

directory       "/var/named";

dump-file       "/var/named/data/cache_dump.db";

statistics-file "/var/named/data/named_stats.txt";

memstatistics-file "/var/named/data/named_mem_stats.txt";

//      allow-query     { localhost; };

recursion yes;

forwarders { 192.168.211.116; };

forward only;

dnssec-enable yes;

dnssec-validation yes;

dnssec-lookaside auto;

/* Path to ISC DLV key */

bindkeys-file "/etc/named.iscdlv.key";

managed-keys-directory "/var/named/dynamic";

};

logging {

channel default_debug {

file "data/named.run";

severity dynamic;

};

};

配置文件修改完成之后重启下named   #service named restart

这个Ip地址是我们内网的一个DNS服务器

现在测试一下是否可以解析211.116这个dns服务器负责的域名解析

1:主DNS服务器测试是否可以转发

[root@erickpuppet77_85 ~]# dig -t A www.baidu.com

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6_6.2 <<>> -t A www.baidu.com

;; global options: +cmd

;; Got answer:

;; ->>HEADER<

;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:

;www.baidu.com.INA

;; ANSWER SECTION:

www.baidu.com.1200INCNAMEwww.a.shifen.com.

www.a.shifen.com.299INA115.239.210.27

www.a.shifen.com.299INA115.239.211.112

;; Query time: 1145 msec

;; SERVER: 10.1.77.85#53(10.1.77.85)

;; WHEN: Wed Mar 25 15:11:39 2015

;; MSG SIZE  rcvd: 90

You have new mail in /var/spool/mail/root

[root@erickpuppet77_85 ~]#

2:从服务器测试是否可以转发

[root@erickagent ~]#  dig -t A www.baidu.com

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6 <<>> -t A www.baidu.com

;; global options: +cmd

;; connection timed out; no servers could be reached

[root@erickagent ~]# service named start

Starting named:                                            [OK]

[root@erickagent ~]#  dig -t A www.baidu.com

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6 <<>> -t A www.baidu.com

;; global options: +cmd

;; Got answer:

;; ->>HEADER<

;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 5, ADDITIONAL: 5

;; QUESTION SECTION:

;www.baidu.com.INA

;; ANSWER SECTION:

www.baidu.com.1200INCNAMEwww.a.shifen.com.

www.a.shifen.com.300INA115.239.210.27

www.a.shifen.com.300INA115.239.211.112

;; AUTHORITY SECTION:

a.shifen.com.1200INNSns1.a.shifen.com.

a.shifen.com.1200INNSns2.a.shifen.com.

a.shifen.com.1200INNSns3.a.shifen.com.

a.shifen.com.1200INNSns4.a.shifen.com.

a.shifen.com.1200INNSns5.a.shifen.com.

;; ADDITIONAL SECTION:

ns4.a.shifen.com.1200INA115.239.210.176

ns1.a.shifen.com.1200INA61.135.165.224

ns3.a.shifen.com.1200INA61.135.162.215

ns2.a.shifen.com.1200INA180.149.133.241

ns5.a.shifen.com.1200INA119.75.222.17

;; Query time: 1694 msec

;; SERVER: 192.168.7.74#53(192.168.7.74)

;; WHEN: Wed Mar 25 15:12:34 2015

;; MSG SIZE  rcvd: 260

现在主从都可以通过211.116转发请求到www.baidu.com的A记录

下一章节就开始实现DNS的日志系统的实现