04DNS主辅同步

1. DNS主辅同步架构

IP	主机名	功能
10.100.214.208	dns-208.host.com	DNS 主
10.100.214.209	dns-209.host.com	DNS 辅
注意：所有资源记录的增、删、改的操作，均在主DNS上进行，辅助DNS仅提供查询功能

2. 辅助DNS主机上安装部署BIND9

2.1. 安装BIND9软件

root@dns-209 ~ yum install bind bind-utils net-tools -y

2.2. 修改辅助DNS主配置文

修改主配置文件，并加入masterfile-format text;

1 2 3 4 5 6 7 8 9 10 11 12

options { listen-on port 53 { 10.100.214.209; }; listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; recursing-file "/var/named/data/named.recursing"; secroots-file "/var/named/data/named.secroots"; allow-query { any; }; masterfile-format text;

2.3. 对照named.conf 配置查看修改哪些地方

1 2 3 4 5 6 7 8 9 10 11

root@dns-209 ~]# diff /etc/named.conf /etc/named.conf.bk 13c13 < listen-on port 53 { 10.100.214.209; }; --- > listen-on port 53 { 127.0.0.1; }; 21,22c21,22 < allow-query { any; }; < masterfile-format text; --- > allow-query { localhost; }; >

3. 修改主DNS主配置文件

3.1 加入一下配置

1 2 3 4 5 6

vim /etc/named.conf 文件options 主配置文件中添加 allow-transfer { 10.100.214.209; }; allow-notify { 10.100.214.209; };

3.2 检查配置并重启bind服务

root@dns-208 ~]# named-checkconf
root@dns-208 ~]# systemctl restart named

3.3 检查完全区域数据传送

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

[root@dns-209 ~]# dig -t axfr host.com @10.100.214.208 ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.5 <<>> -t axfr host.com @10.100.214.208 ;; global options: +cmd host.com. 600 IN SOA dns.host.com. shixingwen\@huayun.com. 2021080803 10800 900 604800 86400 host.com. 600 IN NS dns.host.com. dns.host.com. 60 IN A 10.100.214.208 dns-208.host.com. 60 IN A 10.100.214.208 dns-209.host.com. 60 IN A 10.100.214.209 host.com. 600 IN SOA dns.host.com. shixingwen\@huayun.com. 2021080803 10800 900 604800 86400 ;; Query time: 1 msec ;; SERVER: 10.100.214.208#53(10.100.214.208) ;; WHEN: Mon Aug 09 14:14:57 CST 2021 ;; XFR size: 6 records (messages 1, bytes 209)

4. 辅助DNS上创建自定义正解区域配置

root@dns-209 ~]# vim /etc/named.rfc1912.zones

1 2 3 4 5

zone "host.com" IN { type slave; masters { 10.100.214.208; }; file "slaves/host.com.zone"; };

4.1 检查配置并启动辅助DNS

root@dns-209 ~]# named-checkconf
root@dns-209 ~]# systemctl restart named

4.2 检查同步过来的区域数据库文件

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

[root@dns-209 slaves]# cat /var/named/slaves/host.com.zone $ORIGIN . $TTL 600 ; 10 minutes host.com IN SOA dns.host.com. shixingwen\@huayun.com. ( 2021080803 ; serial 10800 ; refresh (3 hours) 900 ; retry (15 minutes) 604800 ; expire (1 week) 86400 ; minimum (1 day) ) NS dns.host.com. $ORIGIN host.com. $TTL 60 ; 1 minute dns A 10.100.214.208 dns-208 A 10.100.214.208 dns-209 A 10.100.214.209 [root@dns-209 slaves]#

4.3 检查解析是否正确

[root@dns-208 ~]# dig dns-208.host.com @10.100.214.208 +short
10.100.214.208
[root@dns-208 ~]# dig dns-208.host.com @10.100.214.209 +short
10.100.214.208
[root@dns-208 ~]# dig dns-209.host.com @10.100.214.208 +short
10.100.214.209
[root@dns-208 ~]# dig dns-209.host.com @10.100.214.209 +short
10.100.214.209
[root@dns-208 ~]#

再增加一个hy.com的业务域，并验证主辅同步（复习）

主DNS上增加自定义区域

root@dns-208 ~]# vim /etc/named.rfc1912.zones

1 2 3 4 5

zone "hy.com" IN { type master; file "hy.com.zone"; allow-update { 10.100.214.208;10.100.214.209; }; };

主DNS上增加自定义区域数据库文件

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

[root@dns-208 named]# cat /var/named/hy.com.zone $ORIGIN . $TTL 600 ; 10 minutes hy.com IN SOA dns.hy.com. shixingwen@huayun.com. ( 2021080801 ; serial 10800 ; refresh (3 hours) 900 ; retry (15 minutes) 604800 ; expire (1 week) 86400 ; minimum (1 day) ) NS dns.hy.com. $ORIGIN hy.com. $TTL 60 ; 1 minute dns A 10.100.214.208 dns-208 A 10.100.214.208 dns-209 A 10.100.214.209

主DNS上增加自定义区域资源记录

检查配置并重启主DNS服务

1 2 3 4 5 6

[root@dns-208 named]# named-checkzone hy.com. /var/named/hy.com.zone zone hy.com/IN: loaded serial 2021080801 OK [root@dns-208 named]# systemctl restart named [root@dns-208 named]# systemctl status named

辅助DNS上增加自定义区域

root@dns-209 slaves]# vim /etc/named.rfc1912.zones

1 2 3 4 5

zone "hy.com" IN { type slave; masters { 10.100.214.208; }; file "slaves/hy.com.zone"; };

检查完全区域数据传送

检查配置并重启辅助DNS服务

root@dns-209 slaves]# named-checkconf

root@dns-209 slaves]# systemctl restart named

验证主辅同步

root@dns-209 slaves]# dig -t axfr hy.com @10.100.214.208

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.5 <<>> -t axfr hy.com @10.100.214.208 ;; global options: +cmd hy.com. 600 IN SOA dns.hy.com. shixingwen\@huayun.com. 2021080801 10800 900 604800 86400 hy.com. 600 IN NS dns.hy.com. dns.hy.com. 60 IN A 10.100.214.208 dns-208.hy.com. 60 IN A 10.100.214.208 dns-209.hy.com. 60 IN A 10.100.214.209 hy.com. 600 IN SOA dns.hy.com. shixingwen\@huayun.com. 2021080801 10800 900 604800 86400 ;; Query time: 1 msec ;; SERVER: 10.100.214.208#53(10.100.214.208) ;; WHEN: Mon Aug 09 15:29:37 CST 2021 ;; XFR size: 6 records (messages 1, bytes 207) [root@dns-209 slaves]# ls host.com.zone hy.com.zone [root@dns-209 slaves]#

分别使用主DNS和辅助DNS查询新业务域的A记录

[root@dns-209 slaves]# dig -t A dns-208.hy.com @10.100.214.208 +short
10.100.214.208
[root@dns-209 slaves]# dig -t A dns-208.hy.com @10.100.214.209 +short
10.100.214.208

在主DNS上新增一条A记录，并验证主辅同步
在主DNS上修改一条A记录，并验证主辅同步
在主DNS上删除一条A记录，并验证主辅同步