基于BIND实现主从DNS服务器、手动区域传送、子域授权及ACL配置（案例详解）

最新推荐文章于 2023-08-18 14:40:26 发布

Lee木木

最新推荐文章于 2023-08-18 14:40:26 发布

阅读量799

点赞数 1

分类专栏： Linux学习笔记文章标签： Linux BIND

本文链接：https://blog.csdn.net/weixin_44983653/article/details/100628403

版权

基于BIND实现主从DNS服务器、手动区域传送和子域授权（案例详解）

1、主从服务器配置（正向）
2、主从服务器配置（反向）
3、新增地址解析（正向）
4、新增地址解析（正向）
5、手动进行区域传送
6、子域授权
6、BIND的ACL配置

1、主从服务器配置（正向）

1.1 配置主服务器（192.168.1.9）

主服务器的配置可以参考以下博客：

https://blog.csdn.net/weixin_44983653/article/details/100625533

1.1.1 编辑正向解析文件

主服务器上必须要有一个关于从服务器上的NS记录，主机名随意定义，但是一定要有一个 A 记录指向从服务器。

[root@Tang-Neo named]# vim /var/named/magedu.com.zone 
[root@Tang-Neo named]# cat /var/named/magedu.com.zone
$TTL 3600
$ORIGIN magedu.com.
@	IN	SOA	ns1.magedu.com.	dnsadmin.magedu.com. (
		20190908     # 主要是主从服务器的话，每次修改此配置文件，这个序列号都要 +1，不然从服务器无法更新
		1H
		10M
		3D
		1D 		
)
	IN	NS		ns1
	IN	NS		ns2
	IN	MX  10  mx1
	IN	MX  20  mx2
ns1	IN	A		192.168.1.9
ns2	IN	A		192.168.1.10    # 必须有此条A记录
mx1	IN	A		192.168.1.91
mx2	IN	A		192.168.1.92
www	IN	A		192.168.1.9
web	IN	CNAME	www
bbs	IN	A		192.168.1.93
bbs	IN	A		192.168.1.94

1.1.2 进行语法检查和服务重载

[root@Tang-Neo named]# named-checkzone magedu.com /var/named/magedu.com.zone 
zone magedu.com/IN: loaded serial 20190908
OK
[root@Tang-Neo named]# rndc reload
server reload successful
[root@Tang-Neo named]# rndc status
version: 9.9.4-RedHat-9.9.4-74.el7_6.2 <id:8f9657aa>
CPUs found: 4
worker threads: 4
UDP listeners per interface: 4
number of zones: 8
debug level: 0
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is OFF
recursive clients: 0/0/1000
tcp clients: 3/100
server is up and running

此时可以去从服务器上，进行查看。

1.2 配置从服务器（192.168.1.10）

1.2.1 编辑 /etc/named.conf，并重启服务

[root@neo ~]# vim /etc/named.conf
		listen-on port 53 {
    127.0.0.1; 192.168.1.10; };
//      allow-query     { localhost; };
        recursion yes;

        dnssec-lookaside no;
        dnssec-enable no;
        dnssec-validation no;

[root@neo slaves]# systemctl restart named.service

注意：配置完以上信息后，该服务器就可以作为一个DNS的缓存服务器了。

1.2.2 编辑 /etc/named.rfc1912.conf

定义一个正向的从区域：

[root@neo ~]# vim /etc/named.rfc1912.zones
zone "magedu.com" IN {
   
        type slave;
        file "slaves/magedu.com.zone";
        masters {
    192.168.1.9; };
};

1.2.3 进行语法检查和重载

[root@neo ~]# named-checkconf 
/etc/named.rfc1912.zones:46: unknown option 'master'
[root@neo ~]# vim /etc/named.rfc1912.zones 
[root@neo ~]# named-checkconf 
[root@neo ~]# systemctl start named.service
[root@neo ~]# rndc reload
server reload successful

1.2.4 查看named的状态，并查看配置文件是否传输成功

[root@neo ~]# systemctl status named.service
● named.service - Berkeley Internet Name Domain (DNS)
   Loaded: loaded (/usr/lib/systemd/system/named.service; disabled; vendor preset: disabled)
   Active: active (running) since Sun 2019-09-08 04:43:03 EDT; 2min 0s ago
  Process: 11866 ExecStart=/usr/sbin/named -u named -c ${
   NAMEDCONF} $OPTIONS (code=exited, status=0/SUCCESS)
  Process: 11862 ExecStartPre=/bin/bash -c if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi (code=exited, status=0/SUCCESS)
 Main PID: 11867 (named)
   CGroup: /system.slice/named.service
           └─11867 /usr/sbin/named -u named -c /etc/named.conf

Sep 08 04:45:02 neo named[11867]: GeoIP AS (type 9) DB not available
Sep 08 04:45:02 neo named[11867]: GeoIP Domain (type 11) DB not available
Sep 08 04:45:02 neo named[11867]: GeoIP NetSpeed (type 10) DB not available
Sep 08 04:45:02 neo named[11867]: using default UDP/IPv4 port range: [1024, 65535]
Sep 08 04:45:02 neo named[11867]: using default UDP/IPv6 port range: [1024, 65535]
Sep 08 04:45:02 neo named[11867]: sizing zone task pool based on 7 zones
Sep 08 04:45:02 neo named[11867]: reloading configuration succeeded
Sep 08 04:45:02 neo named[11867]: reloading zones succeeded
Sep 08 04:45:02 neo named[11867]: all zones loaded
Sep 08 04:45:02 neo named[11867]: running
[root@neo ~]# 
[root@neo ~]# 
[root@neo ~]# cd /var/named/slaves/
[root@neo slaves]# ll
total 4
-rw-r--r--. 1 named named 567 Sep  8 04:43 magedu.com.zone
[root@neo slaves]# cat magedu.com.zone    # 二进制格式的正向区域配置文件
]t¿[ 
    mageducom9ns1mageducodnsadminmageducom4¼X?H 
                                               mageducom 
mx1mageducommx2mageducomD 
                         mageducomns1mageducomns2mageducom0bbsmageducom(](^*mx1mageducom([*mx2mageducom(\*ns1mageducom(	*ns2mageducom( 
6webmageducomwwwmageducom*wwwmageducom(	[root@neo slaves]# Xshell

1.2.5 进行测试（使用从服务器地址进行域名解析）

可成功解析，说明配置文件传输成功。

[root@neo slaves]# dig -t A www.magedu.com @192.168.1.10

; <<>> DiG 9.9.4-RedHat-9.9.4-74.el7_6.2 <<>> -t A www.magedu.com @192.168.1.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32909
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.magedu.com.			IN	A

;; ANSWER SECTION:
www.magedu.com.		3600	IN	A	192.168.1.9

;; AUTHORITY SECTION:
magedu.com.		3600	IN	NS	ns1.magedu.com.
magedu.com.		3600	IN	NS	ns2.magedu.com.

;; ADDITIONAL SECTION:
ns1.magedu.com.		3600	IN	A	192.168.1.9
ns2.magedu.com.		3600	IN	A	192.168.1.10

;; Query time: 0 msec
;; SERVER: 192.168.1.10#53(192.168.1.10)
;; WHEN: Sun Sep 08 04:47:20 EDT 2019
;; MSG SIZE  rcvd: 127

2、主从服务器配置（反向）

2.1 配置主服务器（192.168.1.9）

2.1.1 编辑反向解析库文件，添加NS记录和反向PTR记录

[root@Tang-Neo named]# vim 192.168.1.zone 
[root@Tang-Neo named]# cat 192.168.1.zone 
$TTL 3600
$ORIGIN 1.168.192.in-addr.arpa.   # 全局继承
@	IN	SOA	ns1.magedu.com. nsadmin.magedu.com. (
		20190909             # 序列号一定要 +1
		1H
		10M
		3D
		12H
)
	IN	NS	ns1.magedu.com.
	IN	NS	ns2.magedu.com.   # 新增NS记录
9	IN	PTR	ns1.magedu.com.
10	IN	PTR	ns2.magedu.com.   # 新增NS的PTR记录
91	IN	PTR	mx1.magedu.com.
92	IN	PTR	mx2.magedu.com.
9	IN	PTR	www.magedu.com.
93	IN	PTR	bbs.magedu.com.
94	IN	PTR	bbs.magedu.com.

2.1.2 检查语法并进行服务重载

[root@Tang-Neo named]# named-checkzone 1.168.192.in-addr.arpa /var/named/192.168.1.zone 
zone 1.168.192.in-addr.arpa/IN: loaded serial 20190909
OK
[root@Tang-Neo named]# rndc reload
server reload successful

2.2 配置主服务器（192.168.1.10）

2.2.1 编辑 /etc/named.rfc1912.conf

zone "1.168.192.in-addr.arpa" IN {
   
        type slave;
        file "slaves/192.168.1.zone";
        masters {
    192.168.1.9; };
};

2.2.2 进行语法检查，并进行重载（主服务器要先进行重载）

[root@neo slaves]# named-checkconf 
[root@neo slaves]# rndc reload
server reload successful

2.2.3 named 服务状态

[root@neo slaves]# systemctl status named.service
● named.service - Berkeley Internet Name Domain (DNS)
   Loaded: loaded (/usr/lib/systemd/system/named.service; disabled; vendor preset: disabled)
   Active: active (running) since Sun 2019-09-08 04:43:03 EDT; 47min ago
  Process: 11866 ExecStart=/usr/sbin/named -u named -c ${
   NAMEDCONF} $OPTIONS (code=exited, status=0/SUCCESS)
  Process: 11862 ExecStartPre=/bin/bash -c if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi (code=exited, status=0/SUCCESS)
 Main PID: 11867 (named)
   CGroup: /system.slice/named.service
           └─11867 /usr/sbin/named -u named -c /etc/named.conf

Sep 08 05:30:04 neo named[11867]: sizing zone task pool based on 8 zones
Sep 08 05:30:04 neo named[11867]: reloading configuration succeeded
Sep 08 05:30:04 neo named[11867]: reloading zones succeeded
Sep 08 05:30:04 neo named[11867]: all zones loaded
Sep 08 05:30:04 neo named[11867]: running
Sep 08 05:30:04 neo named[11867]: zone 1.168.192.in-addr.arpa/IN: Transfer started.
Sep 08 05:30:04 neo named[11867]: transfer of '1.168.192.in-addr.arpa/IN' from 192.168.1.9#53: connected using 192.16...0#51413
Sep 08 05:30:04 neo named[11867]: zone 1.168.192.in-addr.arpa/IN: transferred serial 20190909
Sep 08 05:30:04 neo named[11867]: transfer of '1.168.192.in-addr.arpa/IN' from 192.168.1.9#53: Transfer completed: 1 ...es/sec)
Sep 08 05:30:04 neo named[11867]: zone 1.168.192.in-addr.arpa/IN: sending notifies (serial 20190909)
Hint: Some lines were ellipsized, use -l to show in full.

2.2.4 查看反向解析库文件，已传输成功

[root@neo slaves]# ll /var/named/slaves/
total 8
-rw-r--r--. 1 named named 613 Sep  8 05:30 192.168.1.zone
-rw-r--r--. 1 named named 610 Sep  8 04:54 magedu.com.zone

2.2.5 进行反向解析验证

[root@neo slaves]# dig -x 192.168.1.9 @192.168.1.10

; <<>> DiG 9.9.4-RedHat-9.9.4-74.el7_6.2 <<>> -x 192.168.1.9 @192.168.1.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11382
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 3
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;9.1.168.192.in-addr.arpa.	IN	PTR

;; ANSWER SECTION:
9.1.168.192.in-addr.arpa. 3600	IN	PTR	www.magedu.com.
9.1.168.192.in-addr.arpa. 3600	IN	PTR	ns1.magedu.com.

;; AUTHORITY SECTION:
1.168.192.in-addr.arpa.	3600	IN	NS	ns2.magedu.com.
1.168.192.in-addr.arpa.	3600	IN	NS	ns1.magedu.com.

;; ADDITIONAL SECTION:
ns1.magedu.com.		3600	IN	A	192.168.1.9
ns2.magedu.com.		3600	IN	A	192.168.1.10

;; Query time: 0 msec
;; SERVER: 192.168.1.10#53(192.168.1.10)
;; WHEN: Sun Sep 08 05:33:01 EDT 2019
;; MSG SIZE  rcvd: 163

3、新增地址解析（正向）

3.1主服务器配置

3.1.1 看是否有 pop3 的域名解析

[root@Tang-Neo named]# dig -t A pop3.magedu.com

; <<>> DiG 9.9.4-RedHat-9.9.4-74.el7_6.2 <<>> -t A pop3.magedu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 22173
;; flags: qr aa rd; QUERY: 1

最低0.47元/天解锁文章

Lee木木

关注

1
点赞
踩
4

收藏

觉得还不错? 一键收藏
1
评论
基于BIND实现主从DNS服务器、手动区域传送、子域授权及ACL配置（案例详解）

基于BIND实现主从DNS服务器、手动区域传送和子域授权（案例详解）1、主从服务器配置（正向）1.1 配置主服务器（192.168.1.9）1.1.1 编辑正向解析文件1.1.2 进行语法检查和服务重载1.2 配置从服务器（192.168.1.10）1.2.1 编辑 /etc/named.conf，并重启服务1.2.2 编辑 /etc/named.rfc1912.conf1.2.3 进行语法检查和...
复制链接

扫一扫