DNS服务
任务描述：创建 DNS 服务器，实现企业域名访问。 （1）所有 linux 主机启用防火墙，防火墙区域为 public，在防火 墙中放行对应服务端口。
# 需要用到的工具
yum install -y bash* vim* expect
systemctl start firewalld
systemctl enable firewalld
firewall-cmd --permanent --zone=public --add-port=123/udp --add-port=53/tcp --add-port=53/udp --add-port=80/tcp --add-port=443/tcp --add-port=21/tcp --add-port=8080/tcp --add-port=8443/tcp --add-port=137/udp --add-port=138/udp --add-port=445/tcp --add-port=139/tcp --add-port=2049/tcp --add-port=2049/udp --add-port=111/tcp --add-port=111/udp --add-port=32767/tcp --add-port=32767/udp --add-port=860/tcp --add-port=3260/tcp --add-port=3306/tcp --add-port=2375/tcp --add-port=2375/udp --add-port=88/tcp --add-port=464/tcp --add-port=749/tcp
systemctl restart firewalld
firewall-cmd --list-all
（2）利用 chrony，配置 linux1 为其他 linux 主机提供 NTP 服务。
[root@localhost ~]# vi /etc/chrony.conf
#pool 2.rocky.pool.ntp.org iburst
server 10.13.220.101 iburst
allow 10.13.220.0/24
local stratum 10
#其他机子
[root@linux2 ~]# vi /etc/chrony.conf
#pool 2.rocky.pool.ntp.org iburst
server 10.13.220.101 iburst
[root@linux2 ~]# systemctl restart chronyd
[root@linux2 ~]# systemctl enable chronyd
[root@linux2 ~]# timedatectl
Local time: Thu 2023-07-06 04:03:11 EDT
Universal time: Thu 2023-07-06 08:03:11 UTC
RTC time: Thu 2023-07-06 08:03:11
Time zone: America/New_York (EDT, -0400)
System clock synchronized: yes
NTP service: active
RTC in local TZ: no
（3）所有 linux 主机之间（包含本主机）root 用户实现密钥 ssh认证
[root@linux1 ~]# ssh-keygen
[root@linux1 ~]# vi ssh.sh
[root@linux1 ~]# cat ssh.sh
留一行空行
#!/usr/bin/expect
for ip in linux{1..9}.skills.lan
do expect -c "
set timeout 2
spawn ssh-copy-id "${ip}"
expect {
"yes/no" {send yes\r;exp_continue}
"password" {send Key-1122\r}
};expect eof"
done
[root@linux1 ~]# scp ssh.sh 10.10.220.109:/root
The authenticity of host '10.10.220.109 (10.10.220.109)' can't be established.
ED25519 key fingerprint is SHA256:i+CShBZe1qfinoq2urgeEWrWyZfuy6UFl5zEeSoyKew.
This host key is known by the following other names/addresses:
~/.ssh/known_hosts:1: 10.10.220.102
~/.ssh/known_hosts:4: linux1.skills.lan
~/.ssh/known_hosts:5: linux2.skills.lan
~/.ssh/known_hosts:6: linux3.skills.lan
~/.ssh/known_hosts:7: linux4.skills.lan
~/.ssh/known_hosts:8: linux5.skills.lan
~/.ssh/known_hosts:9: linux6.skills.lan
~/.ssh/known_hosts:10: linux7.skills.lan
(8 additional names omitted)
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.220.109' (ED25519) to the list of known hosts.
ssh.sh （4）利用 bind，配置 linux1 为主 DNS 服务器，linux2 为备用 DNS服务器。为所有 linux 主机提供冗余 DNS 正反向解析服务。
yum install bind bind-utils-y
vi /etc/named.conf
options {
listen-on port 53 { any; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
allow-query { any; };
allow-transfer { 10.10.220.102; } ;
vi /etc/named.rfc1912.zones
# 在末尾添加
zone "skills.lan" IN {
type master;
file "zxqy";
};
zone "100.168.192.in-addr.arpa" IN {
type master;
file "fxqy";
};
cd /var/named/
cp -p named.localhost zxqy
cp -p named.loopback fxqy
for i in {1..9};do echo "linux$i A 10.10.220.10$i" >> zxqy;done
for i in {1..9};do echo "10$i PTR linux$i.skills.lan." >> fxqy;done
[root@linux1 named]# cat zxqy
$TTL 1D
@ IN SOA @ linux1.skills.lan. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS @
A 127.0.0.1
AAAA ::1
@ MX 10 linux5.skills.lan.
tomcat A 10.10.220.103
linux1 A 10.10.220.101
linux2 A 10.10.220.102
linux3 A 10.10.220.103
linux4 A 10.10.220.104
linux5 A 10.10.220.105
linux6 A 10.10.220.106
linux7 A 10.10.220.107
linux8 A 10.10.220.108
linux9 A 10.10.220.109
* A 10.10.220.101
[root@Linux1 named]# cat fxqy
$TTL 1D
@ IN SOA @ linux1.skills.lan. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS @
101 PTR linux1.skills.lan.
102 PTR linux2.skills.lan
103 PTR linux3.skills.lan.
104 PTR linux4.skills.lan
105 PTR linux5.skills.lan.
106 PTR linux6.skills.lan
107 PTR linux7.skills.lan.
108 PTR linux8.skills.lan
109 PTR linux9.skills.lan.
systemctl restart named
reboot
# 验证
[root@linux1 named]# nslookup
> 192.168.100.101
101.100.168.192.in-addr.arpa name = linux1.skills.lan.
> linux1.skills.lan
Server: 192.168.100.101
Address: 192.168.100.101#53
Name: linux1.skills.lan
Address: 192.168.100.101
> 192.168.100.102
102.100.168.192.in-addr.arpa name = linux2.skills.lan.
> linux2.skills.lan
Server: 192.168.100.101
Address: 192.168.100.101#53
Name: linux2.skills.lan
Address: 192.168.100.102
# linux2部分
yum install bind bind-utils-y
# 网卡配置的DNS要为本地ip地址
[ipv4]
method=manual
address1=192.168.100.102/24,192.168.100.2
dns=192.168.100.101；192.168.100.102
vi /etc/named.conf
options {
listen-on port 53 { any; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
allow-query { any; };
vi /etc/named.rfc1912.zones
# 在末尾添加
zone "skills.lan" IN {
type slave;
file "slaves/bzxqy";
masterfile-format text;
masters { 10.10.220.101; };
};
zone "220.10.10.in-addr.arpa" IN {
type slave;
file "slaves/bfxqy";
masterfile-format text;
masters { 10.10.220.101; };
};
systemctl restart named
扫一扫
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
