目录
DNS是互联网基石之一,是信息互联网不可或缺的,DNS的稳定性和可靠性决定了业务系统的可用性,很多企业会自建一台DNS系统来满足自身业务需要。
bind9是常见的开源DNS软件,功能强大。是目前使用最广泛的DNS软件之一。
本文讲述bind9源码方式安装。
准备工作
以各大云主机厂商常用的镜像centos-8.5为例.
# cat /etc/redhat-release
CentOS Linux release 8.5.2111
# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens32: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:6a:c8:d2 brd ff:ff:ff:ff:ff:ff
inet 192.168.3.7/24 brd 192.168.3.255 scope global dynamic noprefixroute ens32
valid_lft 603011sec preferred_lft 603011sec
测试期间,建议先关闭SELINUX和firewall
setenforce 0
sed -i 's/^SELINUX=enforcing$/SELINUX=disabled/' /etc/selinux/config
systemctl disable firewalld
systemctl stop firewalld
基础依赖包安装
基本依赖包
yum -y install pkg-config pkgconfig pkgconf
yum -y install perl
yum -y install gcc make gcc-c++ cmake
yum -y install autoconf automake libtool
yum -y install protobuf-c-compiler
yum -y install libcap libcap-devel
yum -y install protobuf-c protobuf-c-devel
yum -y install fstrm fstrm-devel
yum -y install libxml2 libxml2-devel
yum -y install zlib zlib-devel
yum -y install json-c json-c-devel
yum -y install systemd-devel
yum -y install mysql-devel
liburcu包
wget https://lttng.org/files/urcu/userspace-rcu-0.14.0.tar.bz2
tar xvfj userspace-rcu-0.14.0.tar.bz2
cd userspace-rcu-0.14.0
./configure --prefix=/usr/local/rcu
make
make install
cp -fr /usr/local/rcu/lib/pkgconfig/* /usr/lib64/pkgconfig/
libuv包
yum -y remove libuv
wget https://dist.libuv.org/dist/v1.47.0/libuv-v1.47.0.tar.gz
tar zxvf libuv-v1.47.0.tar.gz
cd libuv-v1.47.0
sh autogen.sh
./configure --prefix=/usr/local/libuv
make
make install
cp /usr/local/libuv/lib/pkgconfig/libuv.pc /usr/lib64/pkgconfig/
libnghttp2包
wget https://github.com/nghttp2/nghttp2/releases/download/v1.58.0/nghttp2-1.58.0.tar.bz2
tar jxvf nghttp2-1.58.0.tar.bz2
cd nghttp2-1.58.0
./configure --prefix=/usr/local/libnghttp2
make
make install
cp /usr/local/libnghttp2/lib/pkgconfig/libnghttp2.pc /usr/lib64/pkgconfig/
bind9源码安装
安装
# wget https://ftp.isc.org/isc/bind9/9.19.23/bind-9.19.23.tar.xz
# tar xfv bind-9.19.23.tar.xz
# cd bind-9.19.23
# more README.md # 查看安装说明
# ./configure --help
# ./configure \
--prefix=/usr/local/bind \
--enable-fixed-rrset \
--enable-dnstap \
--enable-leak-detection \
--enable-singletrace \
--enable-querytrace \
--enable-auto-validation \
--enable-dnsrps-dl \
--enable-dnsrps \
--enable-tracing \
--with-libxml2 \
--with-zlib \
--with-dnsrps-libname \
--with-dnsrps-dir \
--with-libsystemd
# make
# make install
创建软链接
ln -s /usr/local/bind/sbin/rndc /usr/sbin/rndc
ln -s /usr/local/bind/sbin/named /usr/bin/named
ln -s /usr/local/bind/sbin/named-checkconf /usr/bin/named-checkconf
ln -s /usr/local/bind/bin/dig /usr/bin/dig
ln -s /usr/local/bind/bin/nslookup /usr/bin/nslookup
ln -s /usr/local/bind/bin/host /usr/bin/host
配置
创建配置目录及bind9启动用户bind
mkdir -p /usr/local/bind/{etc,var}
useradd -s /sbin/nologin -d /usr/local/bind/var/named bind
mkdir -p /usr/local/bind/var/named/{logs,dynamic,slaves,run}
chown bind:bind -R /usr/local/bind/var/named
rndc配置
/usr/local/bind/sbin/rndc-confgen > /usr/local/bind/etc/rndc.conf
tail -10 /usr/local/bind/etc/rndc.conf | head -9 | sed s/#\ //g > /usr/local/bind/etc/rndc.key
named.ca文件
named.ca是根域的ns记录。
/usr/local/bind/bin/dig @a.root-servers.net . -t ns > /usr/local/bind/etc/named.ca
本地localhost解析
wget https://data.mm-dns.com/dw/named.empty -O /usr/local/bind/etc/named.empty
wget https://data.mm-dns.com/dw/named.localhost -O /usr/local/bind/etc/named.localhost
wget https://data.mm-dns.com/dw/named.loopback -O /usr/local/bind/etc/named.loopback
wget https://data.mm-dns.com/dw/named.rfc1912.zones -O /usr/local/bind/etc/named.rfc1912.zones
named.conf配置
/usr/local/bind/etc/named.conf
acl LAN-user {
10.0.0.0/8;
172.16.0.0/12;
192.168.0.0/16;
any;
};
options {
listen-on port 53 { any; }; // listen any interface
//listen-on-v6 port 53 { ::1; };
//该directory参数定的路径是下面dump-file、statistics-file、memstatistics-file、managed-keys-directory、file等参数的绝对路径。
directory "/usr/local/bind/var/named";
dump-file "/usr/local/bind/var/named/data/cache_dump.db";
statistics-file "/usr/local/bind/var/named/data/named_stats.txt";
memstatistics-file "/usr/local/bind/var/named/data/named_mem_stats.txt";
secroots-file "/usr/local/bind/var/named/data/named.secroots";
recursing-file "/usr/local/bind/var/named/data/named.recursing";
//转发
allow-query { localhost; LAN-user; };
//递归查找
recursion yes;
//在bind9-v9.19.18中,dnssec-validation必须配置为auto
dnssec-validation auto;
managed-keys-directory "/usr/local/bind/var/named/dynamic";
//本地找不到时,转发到外部DNS
forwarders {
8.8.8.8;
223.6.6.6;
};
//named进程,文件会自动产生
pid-file "/usr/local/bind/var/named/run/named.pid";
session-keyfile "/usr/local/bind/var/named/run/session.key";
/* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
// 如下文件来自于crypto-policies包(yum -y install crypto-policies)
include "/etc/crypto-policies/back-ends/bind.config";
};
logging {
channel default_debug {
file "logs/named.run";
severity dynamic;
};
};
include "/usr/local/bind/etc/rndc.key";
// DNS Root
zone "." IN {
type hint;
file "/usr/local/bind/etc/named.ca";
};
include "/usr/local/bind/etc/named.rfc1912.zones";
自启配置
# cat > /usr/lib/systemd/system/named.service << 'EOF'
[Unit]
Description=Berkeley Internet Name Domain (DNS)
Wants=nss-lookup.target
Before=nss-lookup.target
After=network.target network-online.target
After=syslog.target
After=mysqld.service
[Service]
Type=forking
PIDFile=/usr/local/bind/var/named/run/named.pid
ExecStart=/bin/sh -c '/usr/local/bind/sbin/named -c /usr/local/bind/etc/named.conf -u bind 2>/dev/null'
ExecReload=/bin/sh -c '/usr/local/bind/sbin/rndc -c /usr/local/bind/etc/rndc.conf -u bind reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'
ExecStop=/bin/sh -c '/usr/local/bind/sbin/rndc -c /usr/local/bind/etc/rndc.conf -u bind stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
PrivateTmp=true
[Install]
WantedBy=multi-user.target
EOF
# systemctl enable named.service
# systemctl start named.service
测试
# rndc status
WARNING: key file (/usr/local/bind/etc/rndc.key) exists, but using default configuration file (/usr/local/bind/etc/rndc.conf)
version: BIND 9.19.23 (Development Release) <id:3c0eaff>
running on localhost: Linux x86_64 4.18.0-348.el8.x86_64 #1 SMP Tue Oct 19 15:14:17 UTC 2021
boot time: Sun, 28 Jul 2024 05:35:11 GMT
last configured: Sun, 28 Jul 2024 05:35:12 GMT
configuration file: /usr/local/bind/etc/named.conf
CPUs found: 2
worker threads: 2
number of zones: 107 (98 automatic)
debug level: 0
xfers running: 0
xfers deferred: 0
xfers first refresh: 0
soa queries in progress: 0
query logging is OFF
recursive clients: 0/900/1000
tcp clients: 0/150
TCP high-water: 0
server is up and running
# nslookup -type=soa baidu.com 192.168.3.7
Server: 192.168.3.7
Address: 192.168.3.7#53
Non-authoritative answer:
baidu.com
origin = dns.baidu.com
mail addr = sa.baidu.com
serial = 2012148480
refresh = 300
retry = 300
expire = 2592000
minimum = 7200
Authoritative answers can be found from:
# nslookup -type=a www.baidu.com 192.168.3.7
Server: 192.168.3.7
Address: 192.168.3.7#53
Non-authoritative answer:
www.baidu.com canonical name = www.a.shifen.com.
Name: www.a.shifen.com
Address: 183.2.172.42
Name: www.a.shifen.com
Address: 183.2.172.185
添加zone及测试
# cat > /usr/local/bind/etc/test.com.zone << 'EOF'
$TTL 86400
$ORIGIN test.com.
@ IN SOA ns.test.com. root.mail.test.com. (
2004010101 ; Serial
28800 ; Refresh
14400 ; Retry
3600000 ; Expire
86400 ) ; Minimum
@ IN NS ns.test.com.
ns IN A 192.168.3.52
www IN A 192.168.3.110
EOF
# cat >> /usr/local/bind/etc/named.conf << 'EOF'
zone "test.com." IN {
type master;
file "/usr/local/bind/etc/data/test.com.zone";
allow-update { none;};
};
EOF
# nslookup -type=ns test.com 192.168.3.7
Server: 192.168.3.7
Address: 192.168.3.7#53
test.com nameserver = ns.test.com.
# nslookup -type=soa test.com 192.168.3.7
Server: 192.168.3.7
Address: 192.168.3.7#53
test.com
origin = ns.test.com
mail addr = root.mail.test.com
serial = 2004010101
refresh = 28800
retry = 14400
expire = 3600000
minimum = 86400
# nslookup -type=a www.test.com 192.168.3.7
Server: 192.168.3.7
Address: 192.168.3.7#53
Name: www.test.com
Address: 192.168.3.110
从上面测试来看,bind9源码安装是正常的。
bind webadmin
在配置bind的zone时,bind9支持从文本文件中直接读取,也支持从数据库(如常见的mysql)中读取。不管是哪一种方式,配置bind9的zone都一样麻烦一点点,最近推出一款bind webadmin免费软件,可以很好的解决这一问题,感兴的同学可以体现一下。
github: https://github.com/guofusheng007/bindwebadmin.git
website: https://bind-webadmin.com
demo: https://mm-dns.com