linux中企业dns的部署及优化

一、安装，测试
服务器
dnf install bind -y
systemctl enable --now named
netstat -antlupe | grep named
firewall-cmd --permanent --add-service=dns
firewall-cmd --reload

##编辑named的配置文件

vim /etc/named.conf：

options {
      

  listen-on port 53 { any; }; ##开放端口面向所有
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        secroots-file   "/var/named/data/named.secroots";
        recursing-file  "/var/named/data/named.recursing";
        allow-query     { any; }; ##允许所有地址的请求另外一台客户端中设置dns

vim /etc/resolv.conf：
nameserver：172.25.254.137（服务器的ip）

测试： ping www.baidu.com二、dns高速缓存
服务器：
vim /etc/named.conf：

10 options {
11         listen-on port 53 { any; };
12         listen-on-v6 port 53 { ::1; };
13         directory       "/var/named";
14         dump-file       "/var/named/data/cache_dump.db";
15         statistics-file "/var/named/data/named_stats.txt";
16         memstatistics-file "/var/named/data/named_mem_stats.txt";
17         secroots-file   "/var/named/data/named.secroots";
18         recursing-file  "/var/named/data/named.recursing";
19         allow-query     { any; };
20         forwarders      {114.114.114.114;};

 34         dnssec-validation no;

！！！！！注意文件的20行是我们需要编辑的

客户端：
vim /etc/resolv.conf:
nameserver 172.25.254.137(服务器ip)

三、正向解析(把ip转换成域名)
编辑子配置文件(正向解析)：
vim /etc/named.rfc1912.zones:
zone "westos.org" IN {           ##维护的域名
         type master;            ##当前服务器主dns
         file "westos.org.zone"; ##指定域名记录文件
         allow-update { none; }; ##允许更新主机列表
};

cp -p named.localhost /var/named/westos.org.zones ##复制本地域A名记录到指定域名记录文件以及权限。

编辑域名A记录文件：
vim /var/named/westos.org.zones:

$TTL 1D
@       IN SOA  dns.westos.org. root.westos.org. (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      dns.westos.org.
dns     A       172.25.254.137 ##dns指向电脑
www     A       172.25.254.37 

systemctl restart named ##重启服务

测试：
dns指向的电脑
dig www.westos.org

四、反向解析(ip转换成域名)
编辑域名A记录文件：
vim /var/named/westos.org.zone :

$TTL 1D
@       IN SOA  dns.westos.org. root.westos.org. (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
                NS      dns.westos.org.
dns             A       172.25.254.137
www             CNAME   lee.a
lee.a           A       172.25.254.37
lee.a           A       172.25.254.137
westos.org.     MX 1    172.25.254.137.

编辑反向解析域名记录文件：
vim /var/named/172.25.254.ptr
$TTL 1D

$TTL 1D
@       IN SOA  dns.westos.org. rname.invalid. (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      dns.westos.org.
dns     A       172.25.254.137
137     PTR     mail.westos.org.

配置子配置文件（反向解析）：       
vim /etc/named.rfc1912.zones:
zone "254.25.172.in-addr.arpa" IN {
         type master;
         file "172.25.254.ptr";
         allow-update { none; };
};

systemctl restart named

测试：
(dns指向电脑)
dig -x 172.25.254.137

实验五、双向解析
nmcli connection up System\ ens3
ip addr show ens3
dns主机添加一块网卡，配置新的ip:
DEVICE=ens3
ONBOOT=yes
BOOTPROTO=none
IPADDR0=172.25.254.137
PERFIX0=24
IPADDR1=1.1.1.137
PERFIX=24

虚拟机：
DEVICE=ens3
ONBOOT=yes
BOTPROTO=none
IPADDR=1.1.1.237
PERFIX=24
DNS1=1.1.1.137

                ####dns主机编辑配置文件####
vim /etc/named.conf:

zone "." IN {
         type hint;
         file "named.ca";
 };

 include "/etc/named.rfc1912.zones"
 include "/etc/named.root.key";
 */
 view localnet {
         match-clients{ 1.1.1.0/24; };
         zone "." IN {
                 type hint;
                 file "named.ca"；
         };
         include "/etc/named.rfc1912.inter";
 };

 view anyone {
         match-clients{ any; };
         zone "." IN {
                  type hint;
                  file "named.ca";
         };
         include "/etc/named.rfc1912.zones";
 };

对内网文件：
vim /var/named/westos.zone:

$TTL 1D
@ IN SOA dns.westos.org. root.westos.org. (
                         0 ; serial
                         1D ; refresh
                         1H ; retry
                         1W ; expire
                         3H ) ; minimum
                 NS     dns.westos.org.
dns              A       1.1.1.137
www              CNAME   lee.a
lee.a            A       1.1.1.37
lee.a            A       1.1.1.137
westos.org.      MX 1    1.1.1.137.

对外网文件：
vim /var/named/westos.inter：

$TTL 1D
@       IN SOA  dns.westos.org. root.westos.org. (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
                NS      dns.westos.org.
dns             A       172.25.254.137
www             CNAME   xue.a
xue.a           A       172.25.254.37
xue.a           A       172.25.254.137
westos.org.     MX 1    172.25.254.137.

cp -p /etc/named.rfc1912.zone /etc/named.rfc1912.inter
chgrp named /etc/named.rfc1912.inter

vim /etc/named.rfc1912.inter:
 zone "westos.org" IN {
          type master;
          file "westos.org.inter";

          allow-update { none; };
 };

systemctl restart named 重启服务
测试：
dns真机：dig www.westos.org
虚拟机：dig www.westos.org

六、dns集群

客户端:vim /etc/named.conf:
两个any 一个no
vim /etc/named.rfc1912.zones:
zone "westos.org" IN {
        type slave;
        masters { 172.252.54.137;};
        file "slaves/westos.org.zone";
};

关闭防火墙。

vim /etc/named.rfc1912.westos
nameserver 172.25.254.137

dns主机：
/named.rfc1912.inter
zone "westos.org" IN {
        type master;
        file "westos.org.zone";
        allow-update { none; };
        also-notify { 172.25.254.237; };
};

vim /etc/

增量变化：
$TTL 1D
@       IN SOA  dns.westos.org. root.westos.org. (
                                        （增加）       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
                NS      dns.westos.org.
dns                    A       172.25.254.137
www                  CNAME   lee.a
lee.a                  A       172.25.254.137
lee.a                  A       172.25.254.66
westos.org.       MX 1    172.25.254.137.

实验七、dns的更新（注意：域名解析、文件编译，不要手残）

客户端下载：dnf install dhcpd -y

systemctl enable --now dhcpd

firewall-cmd --permanent --add-service=dhcp

firewall-cmd --reload

vim /etc/dhcp/dhcpd.conf:

 

 删除35行之后的所有：

制作钥匙：

cp /usr/share/doc/dhcp-server/dhcpd.conf.example  /etc/dhcp/dhcpd.conf -p

dnssec-keygen -a HMAC-SHA256 -b 128 -n HOST mykey

mv Kmykey.+163+47818.key Kmykey.+163+47818.private /mnt

cp /etc/rndc.key /etc/westos.key -p

钥匙制作结束。

vim /etc/named.conf:

 vim /etc/named.rfc1912.zones:

 firewall-cmd --permanent --add-service=dhcp

firewall-cmd --reload

systemctl status dhcpd.service

systemctl restart named

测试：dig ‘hostname’