DNS

理解DNS

DNS分为正向解析和反向解析；正向解析是通过域名来解析IP，就像我们平时使用的www.baidu.com 就是通过域名来解析IP的；反向解析是通过IP来解析域名的；

此次要求

1.主配置文件设置为/etc/named.zones
2.为域名siso.edu.cn创建正向解析区域文件/var/named/zone.siso.edu.cn
3.为网段192.168.20.0.24创建反向解析区域文件/var/named/zone.192.168.20
4. 5条A资源记录，主机名分别为ns1、ns2、mymail、www、ftp，IP地址分别为192.168.20.21、 192.168.20.22、192.168.20.23、192.168.20.24、192.168.20.25；以此来配置正反解析文件
5.使用nslookup、dig和host工具分别验证DNS服务器

前提

//前提要配置好yum源，还有要确定好自己的IP，本机IP为192.168.20.20
[root@localhost ~]# cat /etc/yum.repos.d/local.repo 
[centos]
name=centos
baseurl=file:///opt/cdrom
gpgcheck=0
enbaled=1

安装

[root@localhost ~]# yum install -y bind

安装成功的样子

配置全局配置文件

[root@localhost ~]# cat  /etc/named.conf 
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

options {
	listen-on port 53 { any; };			//这里改为any为所有
	listen-on-v6 port 53 { ::1; };
	directory 	"/var/named";
	dump-file 	"/var/named/data/cache_dump.db";
	statistics-file "/var/named/data/named_stats.txt";
	memstatistics-file "/var/named/data/named_mem_stats.txt";
	allow-query     { any; };			//这里改为any为所有

	/* 
	 - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
	 - If you are building a RECURSIVE (caching) DNS server, you need to enable 
	   recursion. 
	 - If your recursive DNS server has a public IP address, you MUST enable access 
	   control to limit queries to your legitimate users. Failing to do so will
	   cause your server to become part of large scale DNS amplification 
	   attacks. Implementing BCP38 within your network would greatly
	   reduce such attack surface 
	*/
	recursion yes;

	dnssec-enable yes;
	dnssec-validation yes;

	/* Path to ISC DLV key */
	bindkeys-file "/etc/named.iscdlv.key";

	managed-keys-directory "/var/named/dynamic";

	pid-file "/run/named/named.pid";
	session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
	type hint;
	file "named.ca";
};

include "/etc/named.zones";				//这里是修改读取主配置文件的地方
include "/etc/named.root.key";

[root@localhost ~]# 
[root@localhost ~]# cd /etc/
[root@localhost etc]# cp -a named.rfc1912.zones named.zone		//拷贝一个主配置文件

配置主配置文件

[root@localhost etc]# cat named.zone 
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package 
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
// 
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

zone "localhost.localdomain" IN {
	type master;
	file "named.localhost";
	allow-update { none; };
};

zone "localhost" IN {
	type master;
	file "named.localhost";
	allow-update { none; };
};

zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
	type master;
	file "named.loopback";
	allow-update { none; };
};

zone "1.0.0.127.in-addr.arpa" IN {
	type master;
	file "named.loopback";
	allow-update { none; };
};

zone "0.in-addr.arpa" IN {
	type master;
	file "named.empty";
	allow-update { none; };
};
//正向解析文件配置
zone "siso.edu.cn" IN {					//正向解析的域名
        type master;					//增加的DNS的主要区域
        file "zone.siso.edu.cn";		//正向域名解析的区域配置文件名
        allow-update { none; };			//DNS不允许动态更新
};
//反向解析文件配置
zone "20.168.192.in-addr.arpa" IN {		//ip地址要反写，指明该区域为反向查找区域
        type master;	//指明反向查找区域为主要区域
        file "zone.192.168.20"; //设置反向查找区域的区域配置文件名
        allow-update { none; };
};
[root@localhost etc]# cd /var/named/
[root@localhost named]# ll
total 16
drwxrwx--- 2 named named    6 Nov 20  2015 data
drwxrwx--- 2 named named    6 Nov 20  2015 dynamic
-rw-r----- 1 root  named 2076 Jan 28  2013 named.ca
-rw-r----- 1 root  named  152 Dec 15  2009 named.empty
-rw-r----- 1 root  named  152 Jun 21  2007 named.localhost	//正向解析模板
-rw-r----- 1 root  named  168 Dec 15  2009 named.loopback	//反向解析模板
drwxrwx--- 2 named named    6 Nov 20  2015 slaves
[root@localhost named]# cp -a named.localhost zone.siso.edu.cn 		//拷贝是要加上-a，保留原文件的属性
[root@localhost named]# cp -a named.loopback zone.192.168.20

配置区域配置文件

[root@localhost named]# cat zone.siso.edu.cn 
$TTL 1D
@	IN SOA	@ rname.invalid. (
					0	; serial
					1D	; refresh
					1H	; retry
					1W	; expire
					3H )	; minimum
	    NS	ns1.siso.edu.cn.
ns1	    A	192.168.20.21
na2	    A	192.168.20.22
mymail	A	192.168.20.23
wwww	A	192.168.20.24
ftp	    A	192.168.20.25
[root@localhost named]# cat zone.192.168.20 
$TTL 1D
@	IN SOA	@ rname.invalid. (
					0	; serial
					1D	; refresh
					1H	; retry
					1W	; expire
					3H )	; minimum
		NS	ns1.siso.edu.cn.
21		PTR	ns1.siso.edu.cn.
22      PTR     ns2.siso.edu.cn.
23      PTR     mymail.siso.edu.cn.
24      PTR     www.siso.edu.cn.
25      PTR     ftp.siso.edu.cn.
[root@localhost named]# host ns.siso.edu.cn
ns.siso.edu.cn has address 192.168.20.21
[root@localhost named]# host 192.168.20.22
22.20.168.192.in-addr.arpa domain name pointer ns2.siso.edu.cn.

检查配置文件

[root@localhost etc]# systemctl restart named
[root@localhost etc]# named-checkconf
[root@localhost etc]# named-checkzone /etc/named.zones /var/named/zone.siso.edu.cn 
/var/named/zone.siso.edu.cn:2: warning: /etc/named.zones: bad name (check-names)
/var/named/zone.siso.edu.cn:9: ns1./etc/named.zones: bad owner name (check-names)
/var/named/zone.siso.edu.cn:10: na2./etc/named.zones: bad owner name (check-names)
/var/named/zone.siso.edu.cn:11: mymail./etc/named.zones: bad owner name (check-names)
/var/named/zone.siso.edu.cn:12: wwww./etc/named.zones: bad owner name (check-names)
/var/named/zone.siso.edu.cn:13: ftp./etc/named.zones: bad owner name (check-names)
zone /etc/named.zones/IN: loaded serial 0
OK
[root@localhost etc]# named-checkzone /etc/named.zones /var/named/zone.192.168.20 
/var/named/zone.192.168.20:2: warning: /etc/named.zones: bad name (check-names)
zone /etc/named.zones/IN: loaded serial 0
OK

验证

[root@localhost ~]# yum install -y bind-utils
//nslookup验证
[root@localhost etc]# nslookup 192.168.20.21
Server:		127.0.0.1
Address:	127.0.0.1#53

21.20.168.192.in-addr.arpa	name = ns1.siso.edu.cn.
[root@localhost named]# nslookup ns.siso.edu.cn
Server:		127.0.0.1
Address:	127.0.0.1#53

Name:	ns.siso.edu.cn
Address: 192.168.20.21
//dig验证
[root@localhost ~]# dig 192.168.20.21

; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7 <<>> 192.168.20.21
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 36692
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;192.168.20.21.			IN	A

;; Query time: 19 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Apr 08 19:52:15 EDT 2021
;; MSG SIZE  rcvd: 42

[root@localhost ~]# dig www.siso.edu.cn

; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7 <<>> www.siso.edu.cn
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 707
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.siso.edu.cn.		IN	A

;; ANSWER SECTION:
www.siso.edu.cn.	86400	IN	A	192.168.20.24

;; AUTHORITY SECTION:
siso.edu.cn.		86400	IN	NS	ns.siso.edu.cn.

;; ADDITIONAL SECTION:
ns.siso.edu.cn.		86400	IN	A	192.168.20.20

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Apr 08 19:53:14 EDT 2021
;; MSG SIZE  rcvd: 93
//host验证
[root@localhost ~]# host 192.168.20.22
22.20.168.192.in-addr.arpa domain name pointer ns2.siso.edu.cn.
[root@localhost ~]# host www.siso.edu.cn
www.siso.edu.cn has address 192.168.20.24