linux中bind9源码包安装使用,linux下bind9安装配置一例

一,安装BIND

1.下载BIND http://www.isc.org 也可以去本站下载 bind9 dns软件。

2.编译安装

. 代码如下:

# tar zxvf bind-9.4.0.tar.gz

# cd bind-9.4.0

# ./configure sysconfdir=/etc //更多安装选项 ./configure --help

# make

# make install

二,配置BIND

A.创建需要文件

1)./etc/named.conf

# vi /etc/named.conf 推出保存即可 或 touch /etc/named.conf

2)./etc/rndc.conf

# rndc-confgen > /etc/rndc.conf

B.创建目录 /var/named

# mkdir /var/named

B.编辑/etc/named.conf 内容如下

. 代码如下:

options {

directory "/var/named"; //表示默认的数据库文件在/var/named中 若没有需手动创建

// pid-file "/var/run/named/named.pid"; //运行的PID文件路径,用于使用其他用户启动named

};

zone "." { //创建root域

type hint;

file "named.ca";

};

zone "localhost" { //创建 localhost域

type master;

file "named.local";

};

zone "example.com" { //创建 example.com域

type master;

file "example.com.zone";

};

zone "0.0.127.in-addr.arpa"{ //localhost的反解析

type master;

file "127.0.0.zone";

};

zone "100.168.192.in-addr.arpa" { //example.com的反向解析

type master;

file "192.168.100.zone";

};

//这段文件在/etc/rndc.conf 的尾部需拷贝才能使用 # tail +13 /etc/rndc.conf >>/etc/named.conf

# Use with the following in named.conf, adjusting the allow list as needed:

key "rndc-key" {

algorithm hmac-md5;

secret "HWM3L+e7LWDZJJ/dJEzQEw==";

};

controls {

inet 127.0.0.1 port 953

allow { 127.0.0.1; } keys { "rndc-key"; };

};

# End of named.conf

D.在/var/named 中创建相应的数据文件 文件名由named.conf 中的file 参数制定

由named.conf可知有 named.ca, named.local, example.com.zone, 127.0.0.zone , 192.168.100.zone

1. named.ca

# dig -t NS . >/var/named/named.ca

2. named.local #vi /var/named/named.local 加入以下内容

. 代码如下:

$TTL 1D

@ IN SOA localhost. root (

2007042801

1H

15M

1W

1D )

IN NS @

IN A 127.0.0.1

3. example.com.zone

. 代码如下:

$TTL 1D

@ IN SOA example.com. root (

2007042801

1H

15M

1W

1D )

IN NS ns.example.com.

IN MX 10 mail.example.com.

IN A 192.168.100.125

www IN A 192.168.100.125

db IN A 192.168.100.124

ns IN A 192.168.100.126

mail IN A 192.168.100.251

shop IN A 192.168.100.125

*.shop IN A 192.168.100.124

news IN CNAME www

3. 127.0.0.zone

$TTl 1D

@ IN SOA @ root.localhost. (

2007042801

1H

15M

1W

1D

)

IN NS localhost.

1 IN PTR localhost.

4. 192.168.100.zone

$TTL 1D

@ IN SOA @ root.example.com. (

2007042801

1H

15M

1W

1D )

IN NS example.com.

125 IN PTR example.com.

125 IN PTR www.example.com.

124 IN PTR db.example.com.

126 IN PTR ns.example.com.

251 IN PTR mail.example.com.

补充说明

a. named服务器的启动问题

1. 启动 #named //以root用户启动

#named -u named //以named用户启动,必须有这个用户而且,named.pid的属主是 named

2. 更改配置后如何重启

# rndc reload

3.测试配置是否成功,可用 host, dig ,nslookup 判断

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
DNS解析BIND 9(适用于WINDOWS桌面系统) 完全改进: Security Fixes Treat an all zero netmask as invalid when generating the localnets acl to workaround bug on Windows platform. [CVE-2013-6230] [RT #34687] Fix crashes when serving some NSEC3 signed zones. memcpy was incorrectly called with overlapping ranges, resulting in malformed names being generated on some platforms. This could cause INSIST failures. (CVE 2014-0591) [RT #35120] Features Changes Add the ability to specify ndots to "nslookup". [RT #34711] Introduce a new tool "dnssec-importkey" to allow externally-generated DNSKEY to be imported into the DNSKEY management framework. [RT #34698] Check that EDNS subnet client options are well formed. [RT #34718] "named" now preserves the capitalization of names when responding to queries. [RT #34737] Include a comment in .nzf files (used for adding new zones via "rndc"), giving the name of the associated view. [RT #34765] Use separate rate limiting queues for refresh and notify requests. [RT #30589] Adjust when a master server is deemed unreachable to be less aggressive. [RT #27075] Create delegations for all "children" of empty zones except "forward first". [RT #34826] Changed the name of "isc-config.sh" developers script (for outputting compiler and linker flags) to "bind9-config". [RT #23825] Add "dig" option to keep the TCP socket open between successive queries (+[no]keepopen). [RT #34918] Add dns_client_createx2() function to DNS Client API to provide a way to specify the local address for use when sending update packets. [RT #34811] "named-checkconf -z" now checks zones of type hint as well as master. [RT #35046] Update config.guess and config.sub to add support for ppc64le (powerpc 64-bit Little Endian). [RT #35060] Update the Windows build system to support feature selection and WIN64 builds. This is a work in progress. [RT #34160] Add "dnssec-signzone -Q" switch to drop signatures from keys that are still published but no longer active. [RT #34990] Add a more detailed "not found" message to "rndc" commands which specify a zone name. [RT #35059] named will now warn when a zone's configured "key-directory" does not exist or is not a directory. [RT #35108] Added improvements to statistics channel XSL stylesheet: the stylesheet can now be cached by the browser; section headers are omitted from the stats display when there is no data in those sections to be displayed; counters are now right-justified for easier readability. (Only available with ./configure --enable-newstats.) [RT #35117] "named-checkconf" can now obscure shared secrets when printing by specifying '-x'. [RT #34465] "named" can now accept integer timestamps in RRSIG records. [RT #35185] The export-library API call for loading "resolv.conf", irs_resconf_load(), has been modified to return ISC_R_FILENOTFOUND when the file does not exist and initializes the resconf structure as if the file had existed and configured with nameservers at the localhost addresses (127.0.0.1 and ::1). [RT #35194] Bug Fixes Treat type 65533 (KEYDATA) as opaque except when used in a key zone. [RT #34238] Fix "host" and "nslookup" so don't need dot after the domain by checking ndots when searching. Only continue searching on NXDOMAIN responses. [RT #34711] Handle changes to sig-validity-interval settings better. [RT #34625] Fix bug where journal filename string could be set incorrectly, causing garbage in log messages. [RT #34738] Address a race condition when shutting down a zone. [RT #34750] Address race condition with manual notify requests. [RT #34806] Fix nslookup crash where some readline clones don't accept NULL pointers when calling add_history. [RT #34842] Fix Linux compilation issue when libcap-devel is installed. [RT #34838] Fix installation on Solaris -- don't add explicit make dependencies/rules for python programs as make won't use the implicit rules. [RT #34835] Fix hanging server with inline-signed zones by addressing lock order reversal deadlock with inline zones. [RT #34856] Fix "host" failure if a UDP query timed out. [RT #34870] Address bugs in dns_rdata_fromstruct and dns_rdata_tostruct for WKS and ISDN types. [RT #34910] Updated OpenSSL PKCS#11 patches to fix active list locking and other bugs. [RT #34855] Fix a potential hang with failure to release lock on error in receive_secure_db. #34944] Fix cast in lex.c which could see 0xff treated as EOF. This fixes issue with potential bad data in a database used by DLZ or SDB. [RT #34993] Fix build issue on newer FreeBSD needing -lhx509 for GSSAPI build. [RT #35001] Address read after free in server side of lwres_getrrsetbyname. [RT #29075] Fix "nsupdate" memory leak if "realm" was used multiple times. [RT #35073] Fix "dig" for cleaning up TCP sockets still waiting on connect(). [RT #35074] Fix "dnssec-importkey" so imported key won't overwrite an existing non-imported private key. Fix issue where queries covered by a disabled Response Policy Zone (query type was '*') are answered with TTL of 0. [RT #35026] Fix "nsupdate" memory leak if "realm" was used multiple times. [RT #35073] Fix "dig" for cleaning up TCP sockets still waiting on connect(). [RT #35074] Fix issue with "rndc retransfer" with inline-signing replacing NSEC3 with NSEC records. [RT #34745] Fix issue with "rndc refresh" failing to sign slave zones using inline-signing. [RT #35105] Fix potential hang (detected by our inline-signing system test) with null pointer dereference in libdns zone_xfrdone. [RT #35042] Address bug in libdns loadnode function that could return a freed node on out of memory. [RT #35106] Fixed a bug causing an insecure delegation from one "static-stub" zone to another to fail with a broken trust chain. [RT #35081] Fixed problem where iterative responses could be discarded when the "query-source" port for an upstream query was the same as the listener port (53). [RT #34925] Fix crashes in RBTDB implementation. Two calls to dns_db_getoriginnode were fatal if there was no data at the node. [RT #35080] Fix a possible race and crash in the socket_search() function in dispatch.c. [RT #35107] Fix "dig" so it can handle AXFR style IXFR responses which span multiple messages. [RT #35137] Fix a "host" tool problem with converting UTF-8 textname to IDN encoding by handling "." as a search list element when IDN support is enabled. [RT #35133] Fix "queryperf" to prevent a possible integer overflow when printing results. [RT #35182] Prevent a theoretically possible race and crash when obtaining a socket in dispatch.c [RT #35128] Use built-in versions of strptime() and timegm() on all platforms to avoid portability issues. [RT #35183] Fix a bug which could cause a crash when running "rndc reconfig" or "rndc reload" after configuration is changed from regular zones to automatic empty zones. [RT #35177]
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值