linux服务之—DNS域名解析

1 DNS简介

       

举例:

       

域名的分级:

      

2 DNS解析过程

(1)客户端访问域名

(2)查本机hosts文件

(3)查看本机dns缓存

(4)查看网卡上配置的DNS服务器地址,访问DNS服务器进行域名解析

(5)若本地DNS服务器上没有该域名,则本地DNS服务器向根域服务器、顶级域服务器、二级域服务器进行迭代查询;

(6)最终DNS查到该域名的解析记录,返回给客户端,同时自身保存该解析记录以备后续其他客户端请求查询;

注意:(1)(2)(3)(4)可以视为递归查询,客户端与服务器之间的过程。

如下图所示:

 

3 分布式DNS服务器

同一个任务,由不同步骤共同完成的过程就叫分布式。(生产车间中的某一条流水线,流水线上很多步骤,不同步骤之间就叫分布式)

  • 根域中保存所有顶级域ip地址
  • 顶级域保存所有二级域的ip地址
  • 二级域知道所有三级域名的ip地址,没有三级域名服务器,后续都统称为DNS服务器

4 DNS软件

4.1 DNS软件信息

       

(1)主配置文件(/etc/named.conf配置文件)

[root@]# cat /etc/named.conf 
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {
        listen-on port 53 { 127.0.0.1; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { localhost; };

        /* 
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable 
           recursion. 
         - If your recursive DNS server has a public IP address, you MUST enable access 
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification 
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface 
        */
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

主要修改的信息如下:

        

(2)区域配置文件(/etc/named.rfc1912.zones)

[root@]# cat /etc/named.rfc1912.zones 
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package 
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
// 
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

zone "localhost.localdomain" IN {
        type master;
        file "named.localhost";
        allow-update { none; };
};

zone "localhost" IN {
        type master;
        file "named.localhost";
        allow-update { none; };
};

zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
        type master;
        file "named.loopback";
        allow-update { none; };
};

zone "1.0.0.127.in-addr.arpa" IN {
        type master;
        file "named.loopback";
        allow-update { none; };
};

zone "0.in-addr.arpa" IN {
        type master;
        file "named.empty";
        allow-update { none; };
};

主要修改的地方如下:

上面修改的地方,针对file处根据自己的需求进行修改(比如修改成xiaomi.localhost或者xiaomi.loopback),其他多余的可以去掉。

(3)数据配置文件

[root@]# ls
data  dynamic  named.ca  named.empty  named.localhost  named.loopback  slaves
[root@]# pwd
/var/named
  • 正向解析配置文件:**.localhost
  • 反向解析配置文件:**.loopback
[root@]# cat named.localhost 
$TTL 1D
@       IN SOA  @ rname.invalid. (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      @
        A       127.0.0.1
        AAAA    ::1
[root@]# cat named.loopback 
$TTL 1D
@       IN SOA  @ rname.invalid. (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      @
        A       127.0.0.1
        AAAA    ::1
        PTR     localhost.

上面字段解释如下:

记录类型

4.2 DNS基础实验

       实验模型:

      

实验流程如下:

     

/etc/named.conf配置文件:

[root@vm3 ~]# cat /etc/named.conf 
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {
        listen-on port 53 { any; };
        listen-on-v6 port 53 { any; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
        allow-query     { any; };

        /* 
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable 
           recursion. 
         - If your recursive DNS server has a public IP address, you MUST enable access 
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification 
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface 
        */
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

/etc/named.rfc1912.zones配置文件:

[root@vm3 ~]# cat /etc/named.rfc1912.zones 
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package 
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
// 
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
#正向解析
zone "atguigu.com" IN {
        type master;
        file "atguigu.localhost";
        allow-update { 192.168.0.154; };(此处需要填写从DNS Server的IP,没从服务器则不写)
};

#反向解析
zone "0.168.192.in-addr.arpa" IN {
        type master;
        file "atguigu.loopback";
        allow-update { 192.168.0.154; };(此处需要填写从DNS Server的IP,没从服务器则不写)
};

/var/named/atguigu.localhost 正向解析文件:

[root@vm3 named]# cat atguigu.localhost
$TTL 1D
@       IN SOA  atguigu.com. rname.invalid. (
                                        20210325        ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      dns.atguigu.com.
dns     A       192.168.0.152
www     A       192.168.0.154

/var/named/atguigu.loopback 反向解析文件:

[root@vm3 named]# cat atguigu.loopback
$TTL 1D
@       IN SOA  atguigu.com. rname.invalid. (
                                        20210325        ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      dns.atguigu.com.
152     PTR     dns.atguigu.com.
154     PTR     www.atguigu.com.

 

4.3 DNS主从服务器实验

    从服务器会主动从主服务器上按一定时间周期间隔进行数据同步。

    实验模型:

     

    实验步骤如下:

    

   

主服务器的DNS配置如4.2所示,从服务器DNS配置如下:

/etc/named.conf配置文件:

[root@xuexi ~]# cat /etc/named.conf 
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {
        listen-on port 53 { any; };
        listen-on-v6 port 53 { any; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
        allow-query     { any; };

        /* 
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable 
           recursion. 
         - If your recursive DNS server has a public IP address, you MUST enable access 
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification 
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface 
        */
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

/etc/named.rfc1912.zones:

[root@xuexi ~]# cat /etc/named.rfc1912.zones 
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package 
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
// 
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

zone "atguigu.com" IN {
        type slave;
        masters { 192.168.0.152; };
        file "slaves/atguigu.localhost";
        allow-update { none; };
};


zone "0.168.192.in-addr.arpa" IN {
        type slave;
        masters { 192.168.0.152; };
        file "slaves/atguigu.loopback";
        allow-update { none; };
};

重启完named服务后,/var/named/slaves/目录下会自动同步这两个文件atguigu.localhost、atguigu.loopback。

[root@xuexi slaves]# ls
atguigu.localhost  atguigu.loopback
[root@xuexi slaves]# 

4.4 DNS缓存服务器实验(dnsmasq)

       实现DNS快速的解析,节省主服务器快速查询过程。主DNS服务器按正常进行配置,缓存DNS服务器需要安装dnsmasq。(实验中有个问题,主DNS服务器挂了,客户端解析失败,可能与主服务器上配置有关系)

       缓存服务器上的配置文件/etc/dnsmasq.conf进行如下修改,并重启dnsmasq服务。

       

4.5 智能DNS(分离解析)

       一个域名解析成不同的ip地址,例如私网内的DNS请求解析成内网的ip,外网的DNS请求解析成外网的ip。实际上这种使用方式很少,因为大部分公司公网域名解析都用的DNS-POD等第三方的域名机构。该分离解析模型如下:

        

       主要的操作内容:视图、区域配置文件、数据配置文件

       

      

vim /etc/named.conf修改,增加两个view,原来的include注释掉:

      

生成自己的区域配置文件/etc/lan.zones、/etc/wan.zones:

[root@vm3 etc]# cat lan.zones 
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package 
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
// 
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

zone "atguigu.com" IN {
        type master;
        file "lan.localhost";
        allow-update { none; };
};


[root@vm3 etc]# cat wan.zones 
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package 
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
// 
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

zone "atguigu.com" IN {
        type master;
        file "wan.localhost";
        allow-update { none; };
};

数据文件配置:

同理,对于wan.localhost配置文件类似配置。最后重启服务就可以进行客户端测试了。

linuxftp文件传输服务是一种基于Linux系统的文件传输协议服务,它允许用户通过网络将文件从一台主机传输到另一台主机。Linux系统中常用的ftp服务器软件有vsftpd、proftpd等。用户可以使用ftp客户端软件(如FileZilla、WinSCP等)通过用户名和密码连接到ftp服务器,并通过它来上传、下载、删除、重命名等操作文件。 Linux系统通过FTP协议实现文件传输具有以下优点: 1. 简单易用:通过命令行或图形界面都可以使用ftp服务,非常方便。 2. 跨平台:FTP是一种跨平台的协议,可以在不同操作系统之间传输文件。 3. 安全性:可以通过ftp服务的配置选项来限制访问权限,保障文件传输的安全性。 4. 多用户同时访问:ftp服务器可以同时接受多个用户的访问,提高了文件传输效率。 DNS(Domain Name System)域名解析服务是一种将域名(例如www.example.com)解析为IP地址的服务。在互联网上,每个设备都有一个唯一的IP地址用于定位和通讯,然而人们更倾向使用易记的域名来访问网站。DNS服务器就是用于将域名解析为IP地址,并将用户请求转发给相应的服务器。 DNS域名解析服务的作用如下: 1. 简化访问:用户通过输入易于记忆的域名来访问网站,而不需要输入复杂的IP地址。 2. 负载均衡:DNS服务器可以将用户请求分发到应用服务器的不同IP地址上,实现负载均衡,提高网站的性能和可靠性。 3. 防止攻击:DNS服务器可以通过屏蔽来自一些恶意网址的访问,提高网络的安全性。 4. 域名管理:DNS服务器还提供域名注册、管理和转移等功能,使域名的管理更加方便。 总之,Linux系统提供了ftp文件传输服务DNS域名解析服务,它们在互联网应用中扮演着重要的角色。
评论 1
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值