bind9 dlz mysql_利用BIND+DLZ+MYSQL构建企业智能DNS

目录:

一、简介

二、服务规划

三、安装BIND及基本环境

四、配置Bind-View-DLZ-MYSQL

五、添加相关记录并进行测试

六、配置从DNS

七、本文以FreeBSD 10.2 stable系统为例

一、简介:

1、智能DNS(Bind-view):

智能DNS 原理很简单:在用户解析一个域名的时候的,判断一下用户使用的IP,然后跟DNS 服务器内

部的IP 表匹配一下,看看用户是电信还是网通用户,然后给用户返回对应的IP 地址。目前的域名服

务运营商不提供智能DNS 服务,所以必须自行架设DNS 服务或者使用网上免费的智能DNS 服务,如

DNSPOD.

2.Bind-DLZ

Bind-DLZ主页:http://bind-dlz.sourceforge.net/

DLZ(Dynamically Loadable Zones)与传统的BIND9不同,BIND的不足之处:

* BIND从文本文件中获取数据,这样容易因为编辑错误出现问题。

* BIND需要将数据加载到内存中,如果域或者记录较多,会消耗大量的内存。

* BIND启动时解析Zone文件,对于一个记录较多的DNS来说,会耽误更多的时间。

* 如果近修改一条记录,那么要重新加载或者重启BIND 才能生效,那么需要时间,可能会影响客户端查询。

而Bind-dlz 即将帮你解决这些问题, 对Zone文件操作也更方便了,直接对数据库操作,可以很方便扩充及开发管理程序。

二、服务规划:

1、nameserver服务器注册(需要到域名服务商那里注册)

主从dns之间实现mysql主从数据库同步:

主DNS:       ns1.gov.com    192.168.1.60

从DNS:        ns2.gov.com    192.168.1.61

网站(联通网通 CNC):    www.gov.com   192.168.1.51

网站(电信 CT):     www.gov.com   192.168.1.52

网站(移动 CMCC):   www.gov.com   192.168.1.53

网站(教育 EDU):    www.gov.com   192.168.1.54

网站(铁通 TIETONG):    www.gov.com   192.168.1.55

网站(其他 ANY):    www.gov.com   192.168.1.56

注:

当一个网通用户向本地DNS发www.gov.com的请求时,本地DNS会递归查询,最后把请求发给ns1.gov.com这台DNS服务

器上,ns1.gov.com会根据请求的用户IP所属的范围来择优选择,将www.gov.com在网通的ip返回给本地DNS.

2、Bind-view规划:

网通CNC      cnc.txt

电信CT       ct.txt

移动CMCC     cmcc.txt

教育网EDU    edu.txt

铁通TIETONG  tietong.txt

include "/usr/local/bind/etc/view.conf";(ip库里面没有的IP,属于any区域)

IP库及ACL,如果你有比较详细的按城市或者地域的IP库,在设计BIND-VIEW这个字段的时候,VIEW就可以以城市或地区来命名和规划.

三、安装BIND及基本环境:

1、安装mysql:pkg install mysql5-server

cp /usr/local/share/mysql/my-medium.cnf /etc/my.cnf

echo 'mysql_enable="YES"' >> /etc/rc.conf

cd /usr/local/etc/rc.d

./mysql-server start //启动MYSQL

mysqladmin -u root -p password '123456' //修改MYSQL密码

编译安装bind:wget http://ftp.isc.org/isc/bind9/9.10.3-P2/bind-9.10.3-P2.tar.gz

tar zxvf bind-9.6.0-P1.tar.gz

cd bind-9.6.0-P1

./configure --with-dlz-mysql --enable-largefile --enable-threads=no --prefix=/usr/local/bind --disable-openssl-version-check

make && make install

创建相关配置文件:cd /usr/local/bind/etc/

../sbin/rndc-confgen >rndc.conf

tail -n10 rndc.conf | head -n9 | sed -e s/#\//g >named.conf

创建 localhost.zonevi localhost.zone

ttl 86400

@ IN SOA localhost. root.localhost. (

1997022700 ; Serial

28800 ; Refresh

14400 ; Retry

3600000 ; Expire

86400 ) ; Minimum

IN NS localhost.

1 IN PTR localhost.

创建named.rootcd /usr/local/bind/etc/

wget ftp://ftp.rs.internic.net/domain/named.root

cat named.rot

;       This file holds the information on root name servers needed to

;       initialize cache of Internet domain name servers

;       (e.g. reference this file in the "cache  .  "

;       configuration file of BIND domain name servers).

;

;       This file is made available by InterNIC

;       under anonymous FTP as

;           file                /domain/named.cache

;           on server           FTP.INTERNIC.NET

;       -OR-                    RS.INTERNIC.NET

;

;       last update:    December 01, 2015

;       related version of root zone:   2015120100

;

; formerly NS.INTERNIC.NET

;

.                        3600000      NS    A.ROOT-SERVERS.NET.

A.ROOT-SERVERS.NET.      3600000      A     198.41.0.4

A.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:ba3e::2:30

;

; FORMERLY NS1.ISI.EDU

;

.                        3600000      NS    B.ROOT-SERVERS.NET.

B.ROOT-SERVERS.NET.      3600000      A     192.228.79.201

B.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:84::b

;

; FORMERLY C.PSI.NET

;

.                        3600000      NS    C.ROOT-SERVERS.NET.

C.ROOT-SERVERS.NET.      3600000      A     192.33.4.12

C.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2::c

;

; FORMERLY TERP.UMD.EDU

;

.                        3600000      NS    D.ROOT-SERVERS.NET.

D.ROOT-SERVERS.NET.      3600000      A     199.7.91.13

D.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2d::d

;

; FORMERLY NS.NASA.GOV

;

.                        3600000      NS    E.ROOT-SERVERS.NET.

E.ROOT-SERVERS.NET.      3600000      A     192.203.230.10

;

; FORMERLY NS.ISC.ORG

;

.                        3600000      NS    F.ROOT-SERVERS.NET.

F.ROOT-SERVERS.NET.      3600000      A     192.5.5.241

F.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2f::f

;

; FORMERLY NS.NIC.DDN.MIL

;

.                        3600000      NS    G.ROOT-SERVERS.NET.

G.ROOT-SERVERS.NET.      3600000      A     192.112.36.4

;

; FORMERLY AOS.ARL.ARMY.MIL

;

.                        3600000      NS    H.ROOT-SERVERS.NET.

H.ROOT-SERVERS.NET.      3600000      A     198.97.190.53

H.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:1::53

;

; FORMERLY NIC.NORDU.NET

;

.                        3600000      NS    I.ROOT-SERVERS.NET.

I.ROOT-SERVERS.NET.      3600000      A     192.36.148.17

I.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fe::53

;

; OPERATED BY VERISIGN, INC.

;

.                        3600000      NS    J.ROOT-SERVERS.NET.

J.ROOT-SERVERS.NET.      3600000      A     192.58.128.30

J.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:c27::2:30

;

; OPERATED BY RIPE NCC

;

.                        3600000      NS    K.ROOT-SERVERS.NET.

K.ROOT-SERVERS.NET.      3600000      A     193.0.14.129

K.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fd::1

;

; OPERATED BY ICANN

;

.                        3600000      NS    L.ROOT-SERVERS.NET.

L.ROOT-SERVERS.NET.      3600000      A     199.7.83.42

L.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:3::42

;

; OPERATED BY WIDE

;

.                        3600000      NS    M.ROOT-SERVERS.NET.

M.ROOT-SERVERS.NET.      3600000      A     202.12.27.33

M.ROOT-SERVERS.NET.      3600000      AAAA  2001:dc3::35

; End of file

用dnssec-keygen产生加密密钥,一个为public key,另一个为private keycd /usr/local/bind/sbin

./dnssec-keygen -a hmac-md5 -b 128 -n HOST cnc

./dnssec-keygen -a hmac-md5 -b 128 -n HOST ct

./dnssec-keygen -a hmac-md5 -b 128 -n HOST edu

./dnssec-keygen -a hmac-md5 -b 128 -n HOST cmcc

./dnssec-keygen -a hmac-md5 -b 128 -n HOST tietong

./dnssec-keygen -a hmac-md5 -b 128 -n HOST any

named.conf内容如下:key "rndc-key" {

algorithm hmac-md5;

secret "D3wcCb9Dti/vZ8v4OUzXVA==";

};

controls {

inet 127.0.0.1 port 953

allow { 127.0.0.1; } keys { "rndc-key"; };

};

logging {

channel query_log {

file "/var/log/named.log" versions 3 size 20m;

severity info;

print-time yes;

print-category yes;

print-severity yes;

};

category queries {

query_log;

};

category lame-servers {

null;

};

};

options {

directory "/usr/local/bind/etc";

pid-file "named.pid";

allow-query {

any;

};

#allow-recursion { none; };

recursion no;

listen-on port 53 {

192.168.137.2;

127.0.0.1;

};

#listen-on-v6 port 53 { any;};

};

#TSIG-key

key "cnc" {

algorithm hmac-md5;

secret "zI17BnACwUMcSJCT0POefQ==";};

key "ct" {

algorithm hmac-md5;

secret "zb2zBOKBO9xqMRA6BGsUqA==";};

key "edu" {

algorithm hmac-md5;

secret "H4AzW3qXq2F5wzjWOGjnLg==";};

key "cmcc" {

algorithm hmac-md5;

secret "gzUux9/0x5v6aMu/1Ay6Kg==";};

key "tietong" {

algorithm hmac-md5;

secret "kOM29Ms1BS2qMai2pwtoAQ==";};

key "any" {

algorithm hmac-md5;

secret "lmEhKVBg6HHRSevRgi8Rcw==";};

acl "dns-ip-list"{

192.168.137.2; #master DNS IP

#192.168.137.3; #slave DNS IP

};

include "/usr/local/bind/etc/ip/cnc.txt";

include "/usr/local/bind/etc/ip/ct.txt";

include "/usr/local/bind/etc/ip/cmcc.txt";

include "/usr/local/bind/etc/ip/edu.txt";

include "/usr/local/bind/etc/ip/tietong.txt";

include "/usr/local/bind/etc/view.conf";

配置各个服务商的对应的ACL:cat ct.txt

acl ct{

1.0.1.0/24;

1.0.2.0/23;

1.0.8.0/21;

1.1.0.0/24;

1.1.2.0/23;

1.1.4.0/22;

1.1.8.0/21;

1.1.16.0/20;

1.1.32.0/19;

1.2.0.0/23;

1.2.5.0/24;

1.2.6.0/23;

1.2.9.0/24;

1.2.10.0/23;

1.2.12.0/22;

1.2.16.0/20;

1.2.32.0/19;

1.2.64.0/18;

1.3.0.0/16;

1.4.1.0/24;

1.4.2.0/23;

1.4.5.0/24;

1.4.8.0/21;

1.4.16.0/20;

1.4.32.0/19;

1.4.64.0/18;

1.10.0.0/21;

1.10.8.0/23;

1.10.11.0/24;

1.10.12.0/22;

1.10.16.0/20;

1.10.32.0/19;

1.10.64.0/18;

1.48.0.0/15;

1.50.0.0/16;

1.68.0.0/14;

1.80.0.0/13;

1.180.0.0/14;

1.192.0.0/13;

1.202.0.0/15;

1.204.0.0/14;

14.0.0.0/21;

14.0.12.0/22;

14.1.0.0/22;

14.16.0.0/12;

14.102.128.0/22;

14.104.0.0/13;

14.112.0.0/12;

14.134.0.0/15;

14.144.0.0/12;

14.156.124.0/24;

14.192.76.0/22;

14.208.0.0/12;

27.16.0.0/12;

27.34.232.0/21;

27.50.40.0/21;

27.54.72.0/21;

27.54.152.0/21;

27.121.72.0/21;

27.121.120.0/21;

27.128.0.0/15;

27.148.0.0/14;

27.152.0.0/13;

27.184.0.0/13;

27.224.0.0/14;

36.0.0.0/22;

36.0.16.0/20;

36.0.32.0/19;

36.1.0.0/16;

36.4.0.0/14;

36.16.0.0/12;

36.37.0.0/19;

36.37.36.0/23;

36.37.39.0/24;

36.37.40.0/21;

36.37.48.0/20;

36.40.0.0/13;

36.48.0.0/15;

36.56.0.0/13;

36.96.0.0/11;

39.0.0.0/24;

39.0.2.0/23;

39.0.4.0/22;

39.0.8.0/21;

39.0.16.0/20;

39.0.32.0/19;

39.0.64.0/18;

39.0.128.0/17;

42.0.0.0/22;

42.0.8.0/21;

42.0.16.0/21;

42.0.24.0/22;

42.0.32.0/19;

42.1.0.0/19;

42.1.32.0/20;

42.1.48.0/21;

42.1.56.0/22;

42.62.128.0/19;

42.62.160.0/20;

42.62.180.0/22;

42.62.184.0/21;

42.80.0.0/15;

42.83.64.0/20;

42.83.80.0/22;

42.83.88.0/21;

42.83.96.0/19;

42.88.0.0/13;

42.96.64.0/19;

42.96.96.0/21;

42.96.108.0/22;

42.96.112.0/20;

42.97.0.0/16;

42.99.0.0/18;

42.99.64.0/19;

42.99.96.0/20;

42.99.112.0/22;

42.99.120.0/21;

42.100.0.0/14;

42.122.0.0/16;

42.123.0.0/19;

42.123.36.0/22;

42.123.40.0/21;

42.123.48.0/20;

42.123.64.0/18;

42.156.0.0/19;

42.156.36.0/22;

42.156.40.0/21;

42.156.48.0/20;

42.156.64.0/18;

42.184.0.0/15;

42.187.0.0/18;

42.187.64.0/19;

42.187.96.0/20;

42.187.112.0/21;

42.187.120.0/22;

42.194.0.0/21;

42.194.8.0/22;

42.194.16.0/20;

42.194.32.0/19;

42.194.64.0/18;

42.202.0.0/15;

42.242.0.0/15;

42.248.0.0/13;

43.242.192.0/22;

43.243.232.0/22;

49.64.0.0/11;

49.112.0.0/13;

49.128.0.0/24;

49.128.2.0/23;

58.32.0.0/13;

58.40.0.0/15;

58.42.0.0/16;

58.43.0.0/16;

58.44.0.0/14;

58.48.0.0/13;

58.56.0.0/15;

58.58.0.0/16;

58.59.0.0/17;

58.59.128.0/17;

58.60.0.0/14;

58.65.232.0/21;

58.208.0.0/12;

59.32.0.0/13;

59.40.0.0/15;

59.42.0.0/16;

59.43.0.0/16;

59.44.0.0/14;

59.48.0.0/16;

59.49.0.0/17;

59.49.128.0/17;

59.50.0.0/16;

59.51.0.0/17;

59.51.128.0/17;

59.52.0.0/14;

59.56.0.0/14;

59.60.0.0/15;

59.62.0.0/15;

59.172.0.0/15;

59.174.0.0/15;

60.160.0.0/15;

60.162.0.0/15;

60.164.0.0/15;

60.166.0.0/15;

60.168.0.0/13;

60.176.0.0/12;

60.235.0.0/16;

61.4.84.0/22;

61.4.88.0/21;

61.45.224.0/20;

61.128.0.0/15;

61.130.0.0/15;

61.132.0.0/16;

61.133.128.0/17;

61.134.0.0/18;

61.134.64.0/19;

61.136.128.0/17;

61.137.0.0/17;

61.138.192.0/18;

61.139.0.0/17;

61.139.192.0/18;

61.140.0.0/14;

61.144.0.0/14;

61.150.0.0/15;

61.152.0.0/16;

61.153.0.0/16;

61.154.0.0/15;

61.157.0.0/16;

61.159.64.0/18;

61.159.128.0/17;

61.160.0.0/16;

61.161.64.0/18;

61.164.0.0/16;

61.165.0.0/16;

61.166.0.0/16;

61.169.0.0/16;

61.170.0.0/15;

61.172.0.0/14;

61.177.0.0/16;

61.178.0.0/16;

61.180.0.0/17;

61.183.0.0/16;

61.184.0.0/14;

61.188.0.0/16;

61.189.128.0/17;

61.190.0.0/15;

101.0.0.0/22;

101.1.0.0/22;

101.2.172.0/22;

101.50.56.0/22;

101.53.100.0/22;

101.55.224.0/21;

101.78.0.0/22;

101.80.0.0/12;

101.96.0.0/21;

101.96.8.0/22;

101.96.16.0/20;

101.99.96.0/19;

101.101.64.0/19;

101.101.100.0/24;

101.101.102.0/23;

101.101.104.0/21;

101.101.112.0/20;

101.102.64.0/19;

101.102.100.0/23;

101.102.102.0/24;

101.102.104.0/21;

101.102.112.0/20;

101.110.64.0/19;

101.110.96.0/20;

101.110.116.0/22;

101.110.120.0/21;

101.128.0.0/22;

101.128.8.0/21;

101.128.16.0/20;

101.128.32.0/19;

101.203.128.0/19;

101.203.160.0/21;

101.203.172.0/22;

101.203.176.0/20;

101.224.0.0/13;

101.234.64.0/21;

101.234.76.0/22;

101.234.80.0/20;

101.234.96.0/19;

101.248.0.0/15;

101.251.0.0/22;

101.251.8.0/21;

101.251.16.0/20;

101.251.32.0/19;

103.12.68.0/22;

103.22.0.0/22;

103.22.4.0/22;

103.22.8.0/22;

103.22.12.0/22;

103.22.16.0/22;

103.22.20.0/22;

103.22.24.0/22;

103.22.28.0/22;

103.22.32.0/22;

103.22.36.0/22;

103.22.40.0/22;

103.22.44.0/22;

103.22.48.0/22;

103.22.52.0/22;

103.22.56.0/22;

103.22.60.0/22;

103.22.64.0/22;

103.22.68.0/22;

103.22.72.0/22;

103.22.76.0/22;

103.22.80.0/22;

103.22.84.0/22;

103.22.88.0/22;

103.22.92.0/22;

103.22.100.0/22;

103.22.104.0/22;

103.22.108.0/22;

103.22.112.0/22;

103.22.116.0/22;

103.22.120.0/22;

103.22.124.0/22;

103.29.128.0/22;

103.38.76.0/22;

103.254.188.0/22;

106.0.0.0/24;

106.0.2.0/23;

106.0.4.0/22;

106.0.8.0/21;

106.0.16.0/20;

106.0.64.0/18;

106.4.0.0/14;

106.8.0.0/15;

106.16.0.0/12;

106.32.0.0/12;

106.56.0.0/13;

106.80.0.0/12;

106.108.0.0/14;

106.112.0.0/13;

106.120.0.0/13;

106.224.0.0/12;

110.76.156.0/22;

110.76.184.0/22;

110.80.0.0/13;

110.88.0.0/14;

110.93.32.0/19;

110.94.0.0/15;

110.152.0.0/14;

110.156.0.0/15;

110.166.0.0/15;

110.173.64.0/19;

110.176.0.0/13;

110.184.0.0/13;

111.72.0.0/13;

111.112.0.0/15;

111.120.0.0/14;

111.124.0.0/16;

111.126.0.0/15;

111.170.0.0/16;

111.172.0.0/14;

111.176.0.0/13;

111.224.0.0/14;

111.235.156.0/22;

112.66.0.0/15;

112.98.0.0/15;

112.100.0.0/14;

112.112.0.0/14;

112.116.0.0/15;

112.137.48.0/21;

113.12.0.0/14;

113.16.0.0/15;

113.24.0.0/14;

113.59.224.0/22;

113.62.0.0/15;

113.64.0.0/11;

113.96.0.0/12;

113.112.0.0/13;

113.120.0.0/13;

113.128.0.0/15;

113.132.0.0/14;

113.136.0.0/13;

113.208.128.0/17;

113.209.0.0/16;

113.212.184.0/21;

113.218.0.0/15;

113.220.0.0/14;

113.240.0.0/13;

113.248.0.0/14;

114.79.64.0/18;

114.80.0.0/12;

114.96.0.0/13;

114.104.0.0/14;

114.135.0.0/16;

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值