3.6企业dns服务器搭建-CSDN博客

本文链接：https://blog.csdn.net/wlxiaozhuzhu/article/details/119395172

dns服务器部署

1.关于dns的名词解释
dns:
domain name service(域名解析服务)

#关于客户端:#
/etc/resolv.conf ##dns指向文件
nameserver 172.25.254.132（可以是服务器的ip）

#测试：
host www.baidu.com ##地址解析命令
dig www.baidu.com ##地址详细解析信息命令

A记录 ##ip地址叫做域名的Address 记录
SOA ##授权起始主机
dns顶级
. 13
次级
.com .net .edu .org ....

baidu.com

#关于服务端#
bind       ##安装包
named       ##服务名称
/etc/named.conf   ##主配置文件
/var/named   ##数据目录
端口       ##53

在客户端检验
关于报错信息：
1.no servers could be reached   ##服务无法访问（服务开启？火墙？网络？端口？）
2.服务启动失败           ##配置文件写错 journalctl -xe查询错误
3.dig 查询状态
NOERROR               ##表示查询成功
REFUSED               ##服务拒绝访问
SERVFAIL           ##查询记录失败,（dns服务器无法到达上级，拒绝缓存）
NXDOMAIN           ##此域名A记录在dns中不存在

2.dns服务的安装与启用

#安装#
dnf install bind.x86_64 -y

#启用#
systemctl enable --now named
firewall-cmd --permanent --add-service=dns
firewall-cmd --reload

vim /etc/named.conf
listen-on port 53 { any; }; ##在本地所有网络接口上开启53端口

allow-query { any; }; ##允许查询A记录的客户端列表
dnssec-validation no; ##禁用dns检测使dns能够缓存外部信息到本纪

systemctl restart named

3.高速缓存dns
forwarders { 114.114.114.114; };

准备两台客户端

4.dns的正向解析

vim /etc/named.rfc1912.zone
zone "westos.com" IN {       ##维护的域名
type master;       ##当前服务器位主dns
file "westos.com.zone";   ##域名A记录文件
allow-update { none; };   ##允许更新主机列表
};

cd /var/named/
cp -p named.localhost westos.com.zone
vim westos.com.zone
$TTL 1D
@ IN SOA dns.westos.com. root.westos.com. (
0 ; serial #域名版本序列号
1D ; refresh #刷新时间（辅助dns)
1H ; retry #重试时间（辅助dns）
1W ; expire #过期时间（辅助dns,查询失败过期停止对辅助域名的应答）
3H ) ; minimum #A记录最短有效期
NS dns.westos.com. ##规范域名
dns A 172.25.254.132
(www CNAME lee.a) 规范域名
lee.a A 172.25.254.222(解析到222地址)
lee.a A 172.25.254.111（解析到111地址）
westos.com. MX 1 172.25.254.132.（邮件解析）
systemctl restart named

vim /etc/resolv.conf（客户端）
172.25.254.132(主机IP)
dig www.westos.com #查询正向解析
dig -t mx westos.com #邮件解析记录查询

5.dns的反向解析
vim /etc/named.rfc1912.zones
zone "254.25.172.in-addr.arpa" IN {
type master;
file "172.25.254.ptr";
allow-update { none; };
};
cd /var/named
ls
cp -p named.loopback 172.25.254.ptr
vim 172.25.254.ptr
$TTL 1D
@ IN SOA dns.westos.com. rname.invalid. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.westos.com.
dns A 127.25.254.132
222 PTR mail.westos.com.
systemctl restart named

dig -x 172.25.254.222（客户端）

6.dns的双向解析
实验环境：
客户端2台
172.25.254。网段
1.1.1.网段 ##ifconfig ens12 netmask 255.255.255.0

服务端1台2个网段的ip
cd /etc/sysconfig/network-scripts/
vim ifcfg-ens12
DEVICE=ens12
ONBOOT=yes
BOOTPROTO=none
IPADDR0=172.25.254.132
PREFIX0=24
IPADDR1=1.1.1.132
PREFIX1=24
NAME=ens12

在1.1.1.网段的客户主机中
vim /etc/resolv.conf
nameserver 1.1.1.132

在172.25.254网段的客户主机中
vim /etc/resolv.conf
nameserver 172.25.254.132

配置方式：
cd /var/named/
cp -p westos.com.zone westos.com.inter
vim westos.com.inter
$TTL 1D
@   IN SOA   dns.westos.com. root.westos.com (
                   0   ; serial
                   1D   ; refresh
                   1H   ; retry
                   1W   ; expire
                   3H )   ; minimum
  NS dns.westos.com. ##规范域名
dns A 1.1.1.132
(www CNAME lee.a) 规范域名
lee.a A 1.1.1.222(解析到222地址)
lee.a A 1.1.1.111（解析到111地址）
westos.com. MX 1 172.25.254.132.（邮件解析

cp -p /etc/named.rfc1912.zones /etc/named.rfc1912.inters
vim /etc/named.rfc1912.inters
zone "westos.com" IN {
   type master;
   file "westos.com.inter";
   allow-update { none; };
};

vim /etc/named.conf
/*
zone "." IN {
type hint;
file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
*/

view localnet {
match-clients { 172.25.254.0/24; };
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
};

view anyone {
match-clients { any; };
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.inters";
include "/etc/named.root.key";
};

systemctl restart named

测试：
分别在2个网段的主机中作同样域名的地址解析
得到的A记录不同

7.dns集群

主dns：
zone "westos.com" IN {
type master;
file "westos.com.zone";
allow-update { none; };
also-notify { 172.25.254.232; }; ##主动通知的辅助dns主机
};

vim /var/named/westos.com.zone
$TTL 1D
@ IN SOA dns.westos.com. root.westos.com (
2020031402 ; serial ##每次修改A记录文件需要
1D ; refresh ##变更此参数的值
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.westos.com.
dns A 172.25.254.132
www CNAME lee.a
lee.a A 172.25.254.111
lee.a A 172.25.254.222
westos.com. MX 1 172.25.254.232

slave dns：
dnf install bind -y
firewall-cmd --add-service=dns

vim /etc/named.conf
listen-on port 53 { any; };
allow-query { any; };
dnssec-validation no;

vim /etc/named.rfc1912.zone
zone "westos.com" IN {
type slave;           ##dns状态位辅助dns
masters { 172.25.254.132 };   ##主dns
file "slaves/westos.com.zone";   ##同步数据文件
};

systemctl restart named

8.dns的更新
dns基于ip地址的更新：
在dns中设定：
vim /etc/named.rfc1912.zones

zone "westos.com" IN {
type master;
file "westos.com.zone";
allow-update { 172.25.254.80(随机获取) }; ##允许指定客户端更新westos域
also-notify { 172.25.254.232; };
};

dns基于key更新的方式:
dnssec-keygen -a HMAC-SHA256 -b 128 -n HOST westos
cp -p /etc/rndc.key /etc/westos.key
vim /etc/westos.key
key "westos" {
algorithm hmac-sha256;
secret "SB1tQcLaWeroU9lGW21zeA==";
};we

vim /etc/named.conf
include "/etc/wesots.key";

vim /etc/named.rfc1912.zones
zone "westos.com" IN {
type master;
file "westos.com.zone";
allow-update { key westos; };
also-notify { 172.25.254.232; };
};

systemctl restart named

9.ddns（dhcp+dns）

dnf instsall dhcp-server -y
cp /usr/share/doc/dhcp-server/dhcp.conf.example /etc/dhcp/dhcpd.conf
vim /etc/dhcp/dhcpd.conf
# dhcpd.conf
#
# Sample configuration file for ISC dhcpd
#

# option definitions common to all supported networks...
option domain-name "westos.com";
option domain-name-servers 192.168.0.20;

default-lease-time 600;
max-lease-time 7200;

# Use this to enble / disable dynamic dns updates globally.
ddns-update-style interim;

# If this DHCP server is the official DHCP server for the local
# network, the authoritative directive should be uncommented.
#authoritative;

# Use this to send dhcp log messages to a different log file (you also
# have to hack syslog.conf to complete the redirection).
log-facility local7;

# No service will be given on this subnet, but declaring it helps the
# DHCP server to understand the network topology.

# This is a very basic subnet declaration.

subnet 172.25.254.0 netmask 255.255.255.0 {
range 172.25.254.60 172.25.254.90;
option routers 172.25.254.132

}

key westos {
algorithm hmac-sha256;
secret SB1tQcLaWeroU9lGW21zeA==;
};

zone westos.com. {
primary 127.0.0.1;
key westos;
}

systemctl restart dhcpd
dns的key更新