CentOS 8 安装DNS服务器

:x

1.安装DNS服务

1.1查询bind

[root@lowaniot:/root]$ yum info bind

1.2安装bind

[root@lowaniot:/root]$ yum install bind -y
[root@lowaniot:/root]$ rpm -ql bind

1.3查看13个根域服务器文件

[root@lowaniot:/root]$ cat /var/named/named.ca
; <<>> DiG 9.11.3-RedHat-9.11.3-3.fc27 <<>> +bufsize=1200 +norec @a.root-servers.net
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46900
;; flags: qr aa; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 27

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1472
;; QUESTION SECTION:
;.				IN	NS

;; ANSWER SECTION:
.			518400	IN	NS	a.root-servers.net.
.			518400	IN	NS	b.root-servers.net.
.			518400	IN	NS	c.root-servers.net.
.			518400	IN	NS	d.root-servers.net.
.			518400	IN	NS	e.root-servers.net.
.			518400	IN	NS	f.root-servers.net.
.			518400	IN	NS	g.root-servers.net.
.			518400	IN	NS	h.root-servers.net.
.			518400	IN	NS	i.root-servers.net.
.			518400	IN	NS	j.root-servers.net.
.			518400	IN	NS	k.root-servers.net.
.			518400	IN	NS	l.root-servers.net.
.			518400	IN	NS	m.root-servers.net.

;; ADDITIONAL SECTION:
a.root-servers.net.	518400	IN	A	198.41.0.4
b.root-servers.net.	518400	IN	A	199.9.14.201
c.root-servers.net.	518400	IN	A	192.33.4.12
d.root-servers.net.	518400	IN	A	199.7.91.13
e.root-servers.net.	518400	IN	A	192.203.230.10
f.root-servers.net.	518400	IN	A	192.5.5.241
g.root-servers.net.	518400	IN	A	192.112.36.4
h.root-servers.net.	518400	IN	A	198.97.190.53
i.root-servers.net.	518400	IN	A	192.36.148.17
j.root-servers.net.	518400	IN	A	192.58.128.30
k.root-servers.net.	518400	IN	A	193.0.14.129
l.root-servers.net.	518400	IN	A	199.7.83.42
m.root-servers.net.	518400	IN	A	202.12.27.33
a.root-servers.net.	518400	IN	AAAA	2001:503:ba3e::2:30
b.root-servers.net.	518400	IN	AAAA	2001:500:200::b
c.root-servers.net.	518400	IN	AAAA	2001:500:2::c
d.root-servers.net.	518400	IN	AAAA	2001:500:2d::d
e.root-servers.net.	518400	IN	AAAA	2001:500:a8::e
f.root-servers.net.	518400	IN	AAAA	2001:500:2f::f
g.root-servers.net.	518400	IN	AAAA	2001:500:12::d0d
h.root-servers.net.	518400	IN	AAAA	2001:500:1::53
i.root-servers.net.	518400	IN	AAAA	2001:7fe::53
j.root-servers.net.	518400	IN	AAAA	2001:503:c27::2:30
k.root-servers.net.	518400	IN	AAAA	2001:7fd::1
l.root-servers.net.	518400	IN	AAAA	2001:500:9f::42
m.root-servers.net.	518400	IN	AAAA	2001:dc3::35

;; Query time: 24 msec
;; SERVER: 198.41.0.4#53(198.41.0.4)
;; WHEN: Thu Apr 05 15:57:34 CEST 2018
;; MSG SIZE  rcvd: 811

1.4开启DNS服务,并添加防火墙端口

[root@lowaniot:/root]$ systemctl start named
[root@lowaniot:/root]$ systemctl enable named
[root@lowaniot :/root]$ firewall-cmd --permanent --add-service=dns
success
[root@lowaniot:/root]$ firewall-cmd --permanent --add-port=53/tcp
success
[root@lowaniot:/root]$ firewall-cmd --permanent --add-port=53/udp
success
[root@lowaniot:/root]$ firewall-cmd --reload
success
[root@lowaniot:/root]$ ss -nutl

1.5查看修改网卡信息

[root@lowaniot:/root]$ vim /etc/sysconfig/network-scripts/ifcfg-ens33
TYPE="Ethernet"
PROXY_METHOD="none"
BROWSER_ONLY="no"
BOOTPROTO="none"
DEFROUTE="yes"
IPV4_FAILURE_FATAL="no"
IPV6INIT="yes"
IPV6_AUTOCONF="yes"
IPV6_DEFROUTE="yes"
IPV6_FAILURE_FATAL="no"
IPV6_ADDR_GEN_MODE="stable-privacy"
NAME="ens33"
UUID="6422ac64-fc9a-4159-895f-6191eff1fa1d"
DEVICE="ens33"
DNS1="192.168.124.2"
IPADDR="192.168.124.2"
PREFIX="24"
GATEWAY="192.168.124.1"
ONBOOT="yes"
PEERDNS="no"
#添加 PEERDNS="no" 电脑重启后 /etc/resolv.conf 的namespace不会恢复至系统默认
[root@lowaniot ~]$ systemctl restart network-online.target 
[root@lowaniot :/root]$ dig -t NS . @192.168.124.1
2.编辑DNS配置文件/etc/named.conf文件
[root@lowaniot :/etc]$ cp -p /etc/named.conf{,.bak}
[root@lowaniot :/etc]$ vim /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// 此处的localhost代表所有机子上的IP
options {
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// 此处的localhost代表所有机子上的IP
options {
        listen-on port 53 { localhost; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        secroots-file   "/var/named/data/named.secroots";
        recursing-file  "/var/named/data/named.recursing";
        allow-query     { localhost;192.168.0.0/16; };
		  allow-transfer  { 192.168.124.3; };
		  forwarders	{202.101.172.35;
		  					223.5.5.5;};
/*allow-transfer  { 192.168.124.3; }; 表示只允许192.168.124.3的机子作为slave服务器*/

        /* 
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable 
           recursion. 
         - If your recursive DNS server has a public IP address, you MUST enable access 
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification 
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface 
        */
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";

        /* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
        include "/etc/crypto-policies/back-ends/bind.config";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
[root@lowaniot :/etc]$ systemctl reload named
[root@lowaniot :/etc]$ ss -ntul
[root@lowaniot :/etc]$ cat /etc/resolv.conf 
# Generated by NetworkManager
nameserver 192.168.124.2
[root@lowaniot :/etc]$ host www.qq.com 192.168.124.2
Using domain server:
Name: 192.168.124.2
Address: 192.168.124.2#53
Aliases: 
www.qq.com is an alias for public.sparta.mig.tencent-cloud.net.
public.sparta.mig.tencent-cloud.net has address 61.151.166.139
public.sparta.mig.tencent-cloud.net has address 61.151.166.146
public.sparta.mig.tencent-cloud.net has IPv6 address 2402:4e00:8010::155
public.sparta.mig.tencent-cloud.net has IPv6 address 2402:4e00:8010::154
[root@lowaniot :/etc]$ dig www.163.com @192.168.124.2
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-17.P2.el8_0.1 <<>> www.163.com @192.168.124.2
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2031
;; flags: qr rd ra; QUERY: 1, ANSWER: 13, AUTHORITY: 6, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 6e0ebb6f296186e92631d4215de367bdf12050ca13e6646d (good)
;; QUESTION SECTION:
;www.163.com.			IN	A

;; ANSWER SECTION:
www.163.com.		300	IN	CNAME	www.163.com.163jiasu.com.
www.163.com.163jiasu.com. 300	IN	CNAME	www.163.com.bsgslb.cn.
www.163.com.bsgslb.cn.	300	IN	CNAME	z163ipv6.v.bsgslb.cn.
z163ipv6.v.bsgslb.cn.	118	IN	A	115.231.128.134
z163ipv6.v.bsgslb.cn.	118	IN	A	115.231.128.139
z163ipv6.v.bsgslb.cn.	118	IN	A	115.231.128.145
z163ipv6.v.bsgslb.cn.	118	IN	A	115.231.128.136
z163ipv6.v.bsgslb.cn.	118	IN	A	115.231.128.144
z163ipv6.v.bsgslb.cn.	118	IN	A	115.231.128.142
z163ipv6.v.bsgslb.cn.	118	IN	A	115.231.128.137
z163ipv6.v.bsgslb.cn.	118	IN	A	115.231.128.140
z163ipv6.v.bsgslb.cn.	118	IN	A	115.231.128.143
z163ipv6.v.bsgslb.cn.	118	IN	A	115.231.128.135

;; AUTHORITY SECTION:
bsgslb.cn.		85410	IN	NS	gns204.v.dolfindns.net.
bsgslb.cn.		85410	IN	NS	ns3.bsclink.cn.
bsgslb.cn.		85410	IN	NS	gns205.v.dolfindns.net.
bsgslb.cn.		85410	IN	NS	gns206.v.dolfindns.net.
bsgslb.cn.		85410	IN	NS	gns201.v.bs-dolfin.net.
bsgslb.cn.		85410	IN	NS	gns202.v.baishancloud.org.

;; ADDITIONAL SECTION:
ns3.bsclink.cn.		85410	IN	A	121.29.42.18

;; Query time: 594 msec
;; SERVER: 192.168.124.2#53(192.168.124.2)
;; WHEN: Sun Dec 01 15:11:57 CST 2019
;; MSG SIZE  rcvd: 515
3.编辑DNS配置文件 /etc/named.rfc1912.zones
[root@lowaniot :/etc]$ vim /etc/named.rfc1912.zones 
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

zone "localhost.localdomain" IN {
        type master;
        file "named.localhost";
        allow-update { none; };
};
//添加2125行内容,如下:
zone "lowaniot.com" IN {
        type master;
        file "lowaniot.com.zone";
        allow-update { none; };
};
zone "localhost" IN {
        type master;
        file "named.localhost";
        allow-update { none; };
};

zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
        type master;
        file "named.loopback";
        allow-update { none; };
};

zone "1.0.0.127.in-addr.arpa" IN {
        type master;
        file "named.loopback";
        allow-update { none; };
};

zone "0.in-addr.arpa" IN {
        type master;
        file "named.empty";
        allow-update { none; };
};
4.创建区域数据库文件
[root@lowaniot :/etc]$ cd /var/named/
[root@lowaniot :/var/named]$ ls
data  dynamic  named.ca  named.empty  named.localhost  named.loopback  slaves
[root@lowaniot :/var/named]$ cp -p /var/named/named.localhost lowaniot.com.zone
[root@lowaniot :/var/named]$ vim lowaniot.com.zone 
$TTL 1D
@       IN SOA  dns1.lowaniot.com. zg.xu.lowa.com. (
                                        20191201        ; serial
                                        1H      ; refresh
                                        30M     ; retry
                                        1D      ; expire
                                        3D )    ; minimum
        NS      dns1
dns1    A       192.168.124.2
websrv  A       192.168.50.4
ftpsrv  A       192.168.50.42
www     CNAME   websrv
@       A       192.168.50.4
*       A       192.168.50.123

PS.资源记录

  • 区域解析库:由众多RR组成:
  • ​ 资源记录:Resource Record, RR
  • ​ 记录类型:A, AAAA, RTP, SOA, NS, CNAME, MX
  • SOA : Start Of Authority,起始授权记录;一个区域解析库有且仅能有一个SOA记录,必须位于解析库的第一条记录
  • A :Internet Address,作用,FQDN --> IP
  • AAAA : FQSN --> IPv6
  • RTP : Pointer , IP --> FQDN
  • NS : Name Server, 专用于标明当前区域的DNS服务器
  • CNAME :Canonical Name,别名记录
  • MX : Mail eXchanger, 邮件交换器
5.检查配置文件命令
[root@lowaniot :/root]$ named-checkconf /etc/named.conf
[root@lowaniot :/root]$ named-checkconf /etc/named.rfc1912.zones
6.检查数据库文件命令
[root@lowaniot :/root]$ named-checkzone lowaniot.com /var/named/lowaniot.com.zone 
zone lowaniot.com/IN: loaded serial 20191201
OK
7.重新加载并测试
[root@lowaniot :/root]$ rndc reload
server reload successful
[root@lowaniot :/root]$ rndc status
version: BIND 9.11.4-P2-RedHat-9.11.4-17.P2.el8_0.1 (Extended Support Version) <id:7107deb>
running on lowaniot: Linux x86_64 4.18.0-80.11.2.el8_0.x86_64 #1 SMP Tue Sep 24 11:32:19 UTC 2019
boot time: Sun, 01 Dec 2019 07:38:49 GMT
last configured: Sun, 01 Dec 2019 08:53:04 GMT
configuration file: /etc/named.conf
CPUs found: 2
worker threads: 2
UDP listeners per interface: 1
number of zones: 104 (97 automatic)
debug level: 0
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is OFF
recursive clients: 0/900/1000
tcp clients: 4/150
server is up and running
[root@lowaniot :/root]$ dig +trace www.sina.com.cn @192.168.124.2
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-17.P2.el8_0.1 <<>> +trace www.sina.com.cn @192.168.124.2
;; global options: +cmd
.			512733	IN	NS	i.root-servers.net.
.			512733	IN	NS	a.root-servers.net.
.			512733	IN	NS	c.root-servers.net.
.			512733	IN	NS	g.root-servers.net.
.			512733	IN	NS	b.root-servers.net.
.			512733	IN	NS	m.root-servers.net.
.			512733	IN	NS	h.root-servers.net.
.			512733	IN	NS	d.root-servers.net.
.			512733	IN	NS	f.root-servers.net.
.			512733	IN	NS	k.root-servers.net.
.			512733	IN	NS	l.root-servers.net.
.			512733	IN	NS	j.root-servers.net.
.			512733	IN	NS	e.root-servers.net.
.			512733	IN	RRSIG	NS 8 0 518400 20191214050000 20191201040000 22545 . aAKxZ4f0+EGwS18FWsx1Dq5Y9jfpG7r1fNnk9I7PSrAIvbAtrhyG2fhz 7knWWY1/nIKgPumtKrsMndDnV+pssYjjf5PoEZJQTVUQEql/p/eom+Qp z6u6UWFOmO3Wk4KEyiGtVVqIUNGqFUi92TM3KYqfTe/R8qr6rm2Psrnc cwUpw2d5ElW7h/U8rMln/AFKLm39J36gua+mDGlnCOkEFeO7SMBViS2F x4v0pEuVNBsUNTduGWN4MzqWtWhFC2NDbSkmoVPmfmaSEaCX3Bb5DdM1 /w0GrzAYnX3bofSNai3dwYgr1+TxehoHT9Cf98MyQED01SpQTZV+mex6 P5EISA==
;; Received 1125 bytes from 192.168.124.2#53(192.168.124.2) in 0 ms

cn.			172800	IN	NS	a.dns.cn.
cn.			172800	IN	NS	b.dns.cn.
cn.			172800	IN	NS	c.dns.cn.
cn.			172800	IN	NS	d.dns.cn.
cn.			172800	IN	NS	e.dns.cn.
cn.			172800	IN	NS	f.dns.cn.
cn.			172800	IN	NS	g.dns.cn.
cn.			172800	IN	NS	ns.cernet.net.
cn.			86400	IN	DS	57724 8 2 5D0423633EB24A499BE78AA22D1C0C9BA36218FF49FD95A4CDF1A4AD 97C67044
cn.			86400	IN	RRSIG	DS 8 1 86400 20191214050000 20191201040000 22545 . A8eFPanG6F8p4F7w3Y/VYXXUYB3jYUHfK6Re3Zw5VmkrCXxv2NwE5gxo skHbeXdzQd2nSr6wMqaUcyM9/UoEeVtKYU9OxJadPNNhb6QRhx76NjUG qbK/a/bVRPNn2TQUdjJ15mbfBDFajEAa9A655Ez+cJtiYK9ezyo7JCpX naaRs0VB7pnpd9TLI4smaC1IgBEMMGFxf9zCduyF+lh/hb2ucB+3jNGz nobRC8SlOpUH5RqJmPuqb9hDwCpdcWPUYEx4kkoU3vElVl2c7xLFoMQp 33AStlpeItxVNPtvcIjrBgUQ6TAciU/hrxgAR9lSTA+hkm7h20JChuJo jOwQnw==
;; Received 706 bytes from 199.7.91.13#53(d.root-servers.net) in 222 ms

sina.com.cn.		86400	IN	NS	ns2.sina.com.cn.
sina.com.cn.		86400	IN	NS	ns4.sina.com.cn.
sina.com.cn.		86400	IN	NS	ns3.sina.com.cn.
sina.com.cn.		86400	IN	NS	ns1.sina.com.cn.
GICE14DNTMDN31G43AUGVRKTKALVB8QC.com.cn. 21600 IN NSEC3	1 1 10 AEF123AB H497TUER80LUF57FB9UOJIRF5LLLCPLS NS SOA RRSIG DNSKEY NSEC3PARAM
GICE14DNTMDN31G43AUGVRKTKALVB8QC.com.cn. 21600 IN RRSIG	NSEC3 8 3 21600 20191209224911 20191109215504 43326 com.cn. rwqJixPJPbhrkrl0U3d1svn/5TIUav93EC1JeqT7KapZ0+UVApVarJ4u ZZKuQpRQJJ4n1qm2H3D2JPXqh1g2DG5M9SeA8jAreyk1g6KbFcARttmH Lrz1wjEu5Zea0q1mIPni3xt8fNJwC1Jr25tH+T6o2zilkDwTvFo1xbJx G8w=
  • 4
    点赞
  • 18
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值