3_6.企业dns服务器搭建

 ###1.关于dns的名词解释 ###

dns:
domain name service(域名解析服务)

#关于客户端:

/etc/resolv.conf ##dns指向文件
nameserver 172.25.254.20

#测试:
host www.baidu.com ##地址解析命令
dig www.baidu.com ##地址详细解析信息命令

A记录 ##ip地址叫做域名的Address 记录
SOA ##授权起始主机

dns顶级
. 13
次级
.com .net .edu .org ....
baidu.com

#关于服务端#
bind ##安装包
named ##服务名称
/etc/named.conf ##主配置文件
/var/named ##数据目录
端口 ##53

#关于报错信息:
1.no servers could be reached ##服务无法访问(服务开启?火墙?网络?端口?)
2.服务启动失败 ##配置文件写错 journalctl -xe查询错误
3.dig 查询状态
NOERROR ##表示查询成功
REFUSED ##服务拒绝访问
SERVFAIL ##查询记录失败,(dns服务器无法到达上级,拒绝缓存)
NXDOMAIN ##此域名A记录在dns中不存在

###2.dns服务的安装与启用 ### 

#安装#
dnf install bind.x86_64 -y #启用#
systemctl enable --now named
firewall-cmd --permanent --add-service=dns 
firewall-cmd --reload
vim /etc/named.conf
11 listen-on port 53 { any; }; ##在本地所有网络接口上开启53端口
19 allow-query { any; }; ##允许查询A记录的客户端列表
34 dnssec-validation no; ##禁用dns检测使dns能够缓存外部信息到本机
systemctl restart named

 ​​​​​​

 

 ​​​​​​

 ​​​​​

 

### 3.高速缓存dns ### 

20 forwarders { 114.114.114.114; };

 ​​​​​​

###4.dns的正向解析 ### 

vim /etc/named.rfc1912.zone
zone "westos.com" IN { ##维护的域名
 type master; ##当前服务器位主dns
 file "westos.com.zone"; ##域名A记录文件
 allow-update { none; }; ##允许更新主机列表
};
cd /var/named/
cp -p named.localhost westos.com.zone
$TTL 1D #TIME-TO-LIVE(dns地址保存时间长度) @ IN SOA dns.westos.com. root.westos.com ( #SOA授权起始(Start of Authority)
          0 ; serial #域名版本序列号
          1D ; refresh #刷新时间(辅助dns)
          1H ; retry #重试时间(辅助dns)
          1W ; expire #过期时间(辅助dns,查询失败过期停止对辅助域名的应答)
          3H ) ; minimum #A记录最短有效期
 NS dns.westos.com.
dns A 192.168.0.20
www CNAME westos.a.westos.com. ##规范域名
westos.a A 192.168.0.111 ##正向解析记录
westos.a A 192.168.0.112
westos.com. MX 1 192.168.0.20. ##邮件解析记录
systemctl restart named 

dig www.westos.com #查询正向解析
dig -t mx westos.com #邮件解析记录查询

 ​​​​​​

 ​​​​​​

 ​​​​​​

 

 

 

 ​​​​​​​

 ​​​​​​​

 ​​​​​​​

### 5.dns的反向解析 ### 

vim /etc/named.rfc1912.zones
zone "0.168.192.in-addr.arpa" IN {
type master;
file "192.168.0.ptr";
allow-update { none; };
};

cd /var/named/
cp -p named.loopback 192.168.0.ptr

vim 192.168.0.ptr
$TTL 1D
@ IN SOA dns.westos.com. root.westos.com. (
                              0 ; serial
                              1D ; refresh
                              1H ; retry
                              1W ; expire
                              3H ) ; minimum
NS dns.westos.com.
dns A 192.168.0.20
11 PTR www.westos.com.
12 PTR bbs.westos.com.
13 PTR news.westos.com.
systemctl restart named 

测试:
dig -x 192.168.0.11

 ​​​​​​​

 ​​​​​​​

 ​​​​​​

 ​​​​​​​

 ​​​​​​

###6.dns的双向解析 ###

实验环境:
客户端2台
1.1.1.网段
172.25.254网段 
服务端1台2个网段的ip
172.25.254.50
1.1.1.50 
在1.1.1.200网段的客户主机中
vim /etc/resolv.conf
nameserver 1.1.1.50
在172.25.254.100网段的客户主机中
vim /etc/resolv.conf
nameserver 172.25.254.50

 ​​​​​​

 ​​​​​​​

 ​​​​​​

配置方式:
cd /var/named/
cp -p westos.com.zone westos.com.inter

vim westos.com.inter
$TTL 1D
@ IN SOA dns.westos.com. root.westos.com (
                            0 ; serial
                            1D ; refresh
                            1H ; retry
                            1W ; expire
                            3H ) ; minimum
NS dns.westos.com.
dns A 172.25.254.20
www CNAME westos.a.westos.com.
westos.a A 172.25.254.111
westos.a A 172.25.254.112
westos.com. MX 1 172.25.254.20. #mail exchanger 

 ​​​​​​​

 ​​​​​​​​​​​​​​

cp -p /etc/named.rfc1912.zones /etc/named.rfc1912.inters

vim /etc/named.rfc1912.inters
zone "westos.com" IN {
type master;
file "westos.com.inter";
allow-update { none; };
};

vim /etc/named.conf
#zone "." IN {
## type hint;
## file "named.ca";
##};
#
##include "/etc/named.rfc1912.zones";
##include "/etc/named.root.key";
view localnet {
 match-clients { 192.168.0.0/24; };
 zone "." IN {
 type hint;
 file "named.ca";
 };
 include "/etc/named.rfc1912.zones";
 include "/etc/named.root.key";
};
view internet {
 match-clients { any; };
 zone "." IN {
 type hint;
 file "named.ca";
 };
 include "/etc/named.rfc1912.inters";
 include "/etc/named.root.key";
};
 
systemctl restart named 

 

​​​​​​​ 

 

测试:
分别在2个网段的主机中作同样域名的地址解析
得到的A记录不同 

 ​​​​​​​

###7.dns集群 ### 

slave dns:
dnf install bind -y
firewall-cmd --add-service=dns

vim /etc/named.conf
listen-on port 53 { any; };
allow-query { any; };
dnssec-validation no;

vim /etc/named.rfc1912.zone
zone "westos.com" IN {
 type slave; ##dns状态位辅助dns
 masters { 192.168.0.20; }; ##主dns
 file "slaves/westos.com.zone"; ##同步数据文件
};

 ​​​​​

 

 ​​​​​​​

主dns:
zone "westos.com" IN {
 type master;
 file "westos.com.zone";
 allow-update { none; };
 also-notify { 192.168.0.30; }; ##主动通知的辅助dns主机
};
vim /var/named/westos.com.zone
$TTL 1D
@ IN SOA dns.westos.com. root.westos.com (
 2020031402 ; serial ##每次修改A记录文件需要
 1D ; refresh ##变更此参数的值
 1H ; retry
 1W ; expire
 3H ) ; minimum
 NS dns.westos.com.
dns A 192.168.0.20
www CNAME westos.a.westos.com.
westos.a A 192.168.0.210
westos.a A 192.168.0.211
westos.com. MX 1 192.168.0.20.
systemctl restart named

 ​​​​​​​

 ​​​​​​​

 ​​​​​​​

 ​​​​​

###8.dns的更新 ### 

(1)dns基于ip地址的更新 

dns基于ip地址的更新: 
在dns中设定:
vim /etc/named.rfc1912.zones
zone "westos.com" IN {
 type master;
 file "westos.com.zone";
 allow-update { 192.168.0.10; }; ##允许指定客户端更新westos域
 also-notify { 192.168.0.30; };
};
测试: 在192.168.0.10
[root@rhel7_node1 ~]# nsupdate 
> server 192.168.0.20
> update add hello.westos.com 86400 A 192.168.0.111 ##新曾A记录
> send 
> update delete hello.westos.com ##删除A记录
> send 

(2)dns基于key更新的方式 

dns基于key更新的方式:
dnssec-keygen -a HMAC-SHA256 -b 128 -n HOST westos
cp -p /etc/rndc.key /etc/westos.key

vim /etc/westos.key
key "westos" {
algorithm hmac-sha256;
secret "SB1tQcLaWeroU9lGW21zeA==";
};

vim /etc/named.conf
43 include "/etc/wesots.key";

vim /etc/named.rfc1912.zones
zone "westos.com" IN {
 type master;
 file "westos.com.zone";
 allow-update { key westos; };
 also-notify { 192.168.0.30; };
};

systemctl restart named 

[root@rhel7_node1 ~]# nsupdate -k /mnt/Kwestos.+163+26695.private 
> server 192.168.0.20
> update add hello.westos.com 86400 A 192.168.0.111
> send 
> quit

 

 

 

 ### 9.ddns(dhcp+dns) ###

dnf instsall dhcp-server -y
vim /etc/dhcpd/dhcpd.conf
# dhcpd.conf
#
# Sample configuration file for ISC dhcpd
#
# option definitions common to all supported networks...
option domain-name "westos.com";
option domain-name-servers 192.168.0.20;
default-lease-time 600;
max-lease-time 7200;
# Use this to enble / disable dynamic dns updates globally.
ddns-update-style interim;
# If this DHCP server is the official DHCP server for the local
# network, the authoritative directive should be uncommented.
#authoritative;
# Use this to send dhcp log messages to a different log file (you also
# have to hack syslog.conf to complete the redirection).
log-facility local7;
# No service will be given on this subnet, but declaring it helps the 
# DHCP server to understand the network topology.
# This is a very basic subnet declaration.
subnet 192.168.0.0 netmask 255.255.255.0 {
 range 192.168.0.51 192.168.0.80;
 option routers 192.168.0.1; }
key westos {
 algorithm hmac-sha256;
 secret SB1tQcLaWeroU9lGW21zeA==;
 };
zone westos.com. {
primary 127.0.0.1;
key westos;
}
dns的key更新
测试:
设定测试主机网络工作方式为dhcp
设定主机名称test.westos.com
重启网络
dig test.westos.com
可以得到正确解析

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

  • 12
    点赞
  • 16
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值