dns服务及缓存

1、高速缓存dns
服务端：172.25.254.235
安装blind.x86_64 yum搜索dns
开启服务named 若出现卡顿输入字符便可
设置网关，dns解析114.114.114.114
named配置文件:/etc/named.conf
listen-on port 53{any;};
allow-query {any;};
forwarders{114.114.114.114;};
dnssec-validation no 安全检查
配置防火墙添加dns

本地端：172.25.254.135
配置dns172.25.254.235
使用dig命令查看解析
dig www.baidu.com

dns资源记录
A ipv4地址
AAAA ipv6地址
CNAME 规范名称，将外部名称转换成内部名称
PTR 根据ip获取域名
MX 用与解释邮件名
NS 域名解释
SOA 授权起始，DNS 管理信息

设置dns服务器为服务端
2、dns正向解析
服务端
named的配置文件：/etc/named.conf
去除forwarders{114.114.114.114;};

/etc/named.rfc1912.zone
24 zone “admin.com” IN {
25 type master;
26 file “admin.com.zone”;
27 allow-update { none; };
28 };

cd /var/named

cp -p named.localhost admin.com.zone

vim admin.com.zone
1 $TTL 1D
2 @ IN SOA dns.admin.com. root.admin.com. (
3 0 ; serial
4 1D ; refresh
5 1H ; retry
6 1W ; expire
7 3H ) ; minimum
8 NS dns.admin.com.
9 dns A 172.25.254.100
10 www A 172.25.254.111

systemctl restart named

本地端：
dig dns.admin.com
dig www.admin.com

3、dns域名轮寻
vim admin.com.zone

1 $TTL 1D
2 @ IN SOA dns.admin.com. root.admin.com. (
3 0 ; serial
4 1D ; refresh
5 1H ; retry
6 1W ; expire
7 3H ) ; minimum
8 NS dns.admin.com.
9 dns A 172.25.254.100
10 kkk CNAME www.admin.com.
11 www CNAME 172.25.254.110
12 www CNAME 172.25.254.111

规范域名转换成内部域名进行解析
4、反向解析

服务端：
/etc/named.rfc1912.zones

49 zone “254.25.172.in-addr.arpa” IN {
50 type master;
51 file “admin.com.ptr”;
52 allow-update { none; };
53 };

cp named.loopback admin.com.ptr -p

admin.com.ptr
1 $TTL 1D
2 @ IN SOA dns.westos.com. root.westos.com. (
3 0 ; serial
4 1D ; refresh
5 1H ; retry
6 1W ; expire
7 3H ) ; minimum
8 NS dns.westos.com.
9 dns A 172.25.254.100
10 100 PTR www.admin.com.

服务端
dig -x 172.25.254.100

正相反向解析的ip和域名可不同，两者读取文件不同

5、dns双向解析

vim /etc/named.conf
将之前的注释
50 view localnet {
51 match-clients { localhost; };
52 zone “.” IN {
53 type hint;
54 file “named.ca”;
55 };
56 include “/etc/named.rfc1912.zones”;
58 };
59 view any {
60 match-clients { any; };
61 zone “.” IN {
62 type hint;
63 file “named.ca”;
64 };
65 include “/etc/named.rfc1912.zones.inter”;
67 };

cp /etc/named.rfc1912.zones /etc/named.rfc1912.zones.inter -p
vim /etc/named.rfc1912.zones.inter
24 zone “westos.com” IN {
25 type master;
26 file “westos.com.inter”;
27 allow-update { none; };
28 };

cp -p westos.com.zone westos.com.inter
vim westos.com.inter
1 $TTL 1D
2 @ IN SOA dns.westos.com. root.westos.com. (
3 0 ; serial
4 1D ; refresh
5 1H ; retry
6 1W ; expire
7 3H ) ; minimum
8 NS dns.westos.com.
9 dns A 1.1.1.100
10 www A 1.1.1.111
6、辅助dns

主dns的设定219
还原初始设定

vim /etc/named.rfc1912.zones
24 zone “westos.com” IN {
25 type master;
26 file “admin.com.zone”;
27 allow-update { none; };
28 also-notify { 172.25.254.200; };
29 };

systemctl restart named
注意：每次跟改A记录文件后必须更改serial的数值，这个数值最大10位

辅助dns上119
yum install bind -y
systemctl restart named
systemctl stop firewalld
vim /etc/named.conf
vim /etc/named.rfc1912.zones
zone “westos.com” IN {
type slave;
masters { 172.25.254.100; };
file “slaves/admin.com.zone”;
allow-update { none; };
};

systemctl restart named

测试
vim /etc/resolv.conf
nameserver 172.25.254.119

dig www.westos.com

vim /etc/resolv.conf
nameserver 172.25.254.219
修改admin.com.zone中serial中的值，比原本的值大，每次文件同步比较该值，该值不同为立刻同步

dig www.westos.com

7.dns的远程更新
selinux为disable或setsebool -P named_write_master_zones

基于ip的
/etc/named.rfc1912.zones
24 zone “westos.com” IN {
25 type master;
26 file “westos.com.inter”;
27 allow-update { 172.25.254.219; };
28 also-notify { 172.25.254.119; };
29 };

chmod 770 /var/name
systemctl restart named

测试
在219这台主机上
[root@dns-slave ~]# nsupdate

server 172.25.254.100 #添加
update add bbs.westos.com 86400 A 1.1.1.3
send
server 172.25.254.100 #删除
update delete bbs.westos.com
send

##基于key
dnssec-keygen -a HMAC-MD5 -b 128 -n HOST westos
cp /etc/rndc.key /etc/westos.key -p
key “westos” {
algorithm hmac-md5;
secret “nc9URbaN8qau5tOjSch8Dg==”;
};
vim /etc/named.conf
42 include “/etc/westos.key”;
vim /etc/named.rfc1912.zones
25 zone “westos.com” IN {
26 type master;
27 file “westos.com.zone”;
28 allow-update { key westos; };
29 also-notify { 172.25.254.200; };
30 };
systemctl restart named

#测试
scp Kwestos.+157+59719.* root@172.25.254.200:/mnt/
[root@dns-slave mnt]# nsupdate -k Kwestos.+157+59719.key

server 172.25.254.100
update add hello.westos.com 86400 A 172.25.254.222
send
quit

dns key 更新########

服务端：
#1
dnssec-keygen -a HMAC-MD5 -b 128 -n HOST westos ##生成密匙

cat Kwestos.+157+18569.key
westos. IN KEY 512 3 157 4SJx4m33BpJnNpl8slHIWA==

#2
cp /etc/rndc.key /etc/westos.key -p ##生成dns的加密文件
vim /etc/westos.key
key “westos” { ##key名称
algorithm hmac-md5;
secret “4SJx4m33BpJnNpl8slHIWA==”; ##key的加密字符
};

#3
vim /etc/named.conf
43 include “/etc/westos.key”; ##指定dns服务读取的key文件

vim /etc/named.rfc1913.zones
zone “westos.com” IN {
type master;
file “westos.com.inter”;
allow-update { key westos; }; ##指定westos域可以被westoskey 更新
};

##dhcpd 配置 ########

vim /etc/dhcp/dhcpd.conf
14 ddns-update-style interim; ##开启dhcp更新dns功能

37 key admin { ##dhcp更新dns时用到的key
38 algorithm hmac-md5;
39 secret 4SJx4m33BpJnNpl8slHIWA==;
40 };
41
42 zone westos.com. { ##指定dhcp更新的域名
43 primary 127.0.0.1; ##指定dns所在的主机ip
44 key admin; ##指定更新这个域时用到的key名称
45 }

###测试##
设定一台主机网络的工作方式为dhcp
设定这台主机的主机名music.westos.com，这个名称在原有的dns服务中是没有解析的
重启网络看ip 和主机名称的解析

本地端：
IP获取方式：dhcp