玩转DNS服务器——Bind服务

合理的配置DNS的查询方式

实验环境:

虚拟机：VMware® Workstation 15 Pro

均使用NAT连接   网段为192.168.1.0/24

DNS 服务器 ---- Centos 7.4

内核版本  Kernel: Linux 3.10.0-693.el7.x86_64

IP地址：192.168.1.1/24

网关： 192.168.1.254

DNS： 192.168.1.1

客户端 ---- Centos 7.4

内核版本  Kernel: Linux 3.10.0-693.el7.x86_64

IP地址：192.168.1.2/24

网关： 192.168.1.254

DNS： 192.168.1.1

安装DNS服务

[root@localhost ~]#yum install bind -y                //安装

Loaded plugins: fastestmirror, langpacks

repo                                                            | 3.6 kB  ::    

Determining fastest mirrors

Resolving Dependencies

--> Running transaction check

---> Package bind.x86_64 :9.9.-.el7 will be installed

--> Finished Dependency Resolution

Dependencies Resolved

=======================================================================================

 Package         Arch              Version                       Repository       Size

=======================================================================================

Installing:

 bind            x86_64            :9.9.-.el7               repo            1.8 M

Transaction Summary

=======================================================================================

Install   Package

Total download size: 1.8 M

Installed size: 4.3 M

Downloading packages:

Running transaction check

Running transaction test

Transaction test succeeded

Running transaction

  Installing : :bind-9.9.-.el7.x86_64                                         /

  Verifying  : :bind-9.9.-.el7.x86_64                                         /

Installed:

  bind.x86_64 :9.9.-.el7                                                         

Complete!

[root@localhost ~]#

编辑dns服务器配置文件

[root@localhost ~]# vim /etc/named.conf

//

// named.conf

//

// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS // server as a caching only nameserver (as a localhost DNS resolver only).

//

// See /usr/share/doc/bind*/sample/ for example named configuration files.

//

// See the BIND Administrator's Reference Manual (ARM) for details about the

// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {

listen-on port { 127.0.0.1; }; //修改为listen-on port 53 { any; };

listen-on-v6 port { ::; }; //修改为linsten-on-v6 port 53 { any; };

directory "/var/named";

dump-file "/var/named/data/cache_dump.db";

statistics-file "/var/named/data/named_stats.txt";

memstatistics-file "/var/named/data/named_mem_stats.txt";

allow-query { localhost; }; //修改为allow-query { any; };

/*

- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.

- If you are building a RECURSIVE (caching) DNS server, you need to enable

recursion.

- If your recursive DNS server has a public IP address, you MUST enable access

control to limit queries to your legitimate users. Failing to do so will

cause your server to become part of large scale DNS amplification

attacks. Implementing BCP38 within your network would greatly

reduce such attack surface

*/

recursion yes;

dnssec-enable yes;

dnssec-validation yes;

/* Path to ISC DLV key */

bindkeys-file "/etc/named.iscdlv.key";

managed-keys-directory "/var/named/dynamic";

pid-file "/run/named/named.pid"; session-keyfile "/run/named/session.key";

};

logging {

channel default_debug {

file "data/named.run";

severity dynamic;

};

};

zone "." IN {

type hint;

file "named.ca";

};

include "/etc/named.rfc1912.zones";

include "/etc/named.root.key";

编辑DNS正反向区域

 [root@localhost named]# vim /etc/named.rfc1912.zones
 // named.rfc1912.zones:
 //
 // Provided by Red Hat caching-nameserver package
 //
 // ISC BIND named zone configuration for zones recommended by
 // RFC 1912 section 4.1 : localhost TLDs and address zones
 // and http://www.ietf.org/internet-drafts/draft-ietf-dnsopdefault-local-zones-02.txt
 // (c)2007 R W Franks
 //
 // See /usr/share/doc/bind*/sample/ for example named configuration files.
 //
 zone "localhost.localdomain" IN {
         type master;
         file "named.localhost";
         allow-update { none; };
 };

 zone "localhost" IN {
         type master;
         file "named.localhost";
         allow-update { none; };
 };

 zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
         type master;
         file "named.loopback";
         allow-update { none; };
 };

 zone "1.0.0.127.in-addr.arpa" IN {
         type master;
         file "named.loopback";
         allow-update { none; };
 };

 zone "0.in-addr.arpa" IN {
         type master;
         file "named.empty";
         allow-update { none; };
 };

 //-------------------------------------------//在最底下添加下面两段
 //第一段为正向解析
 zone "netdj.net" IN {
         type master;
         file "netdj.net.zone";
         allow-update { none; };
 };

 //第二段为反向解析
 zone "1.168.192.in-addr.arpa" IN {
         type master;
         file "1.168.192.zone";
         allow-update { none; };
 };

创建DNS正反向区域解析文件

[root@localhost ~]# cd /var/named/
[root@localhost named]# ls
data dynamic named.ca named.empty named.localhost named.loopback slaves
//复制模板创建正反向解析文件
[root@localhost named]# cp -p named.empty netdj.net.zone
[root@localhost named]# cp -p named.empty 1.168..zone

编辑正向解析文件

 [root@localhost named]# vim netdj.net.zone
 $TTL 3H
 @       IN SOA  @ rname.invalid. (
                                                ; serial
                                         1D      ; refresh
                                         1H      ; retry
                                         1W      ; expire
                                         3H )    ; minimum
         NS      @
         A       127.0.0.1
 dns     A       192.168.1.1         //使用A记录将dns.netdj.net指向192.168.1.1
 client  A       192.168.1.2         //使用A记录将client.netdj.net指向192.168.1.2

编辑反向解析文件

 [root@localhost named]# vim 1.168..zone
 $TTL 3H
 @       IN SOA  @ rname.invalid. (
                                                ; serial
                                         1D      ; refresh
                                         1H      ; retry
                                         1W      ; expire
                                         3H )    ; minimum
         NS      @
         A       127.0.0.1
        PTR     dns.netdj.net.         //使用PTR记录将192.168.1.1指向dns.netdj.net
        PTR     client.netdj.net.      //使用PTR记录将192.168.1.2指向client.netdj.net

重启服务

[root@localhost named]# systemctl restart named //重启服务
[root@localhost named]# systemctl enable named //开机自启动
Created symlink from /etc/systemd/system/multi-user.target.wants/named.service to /usr/lib/systemd/system/named.service.

关闭防火墙、selinux

[root@localhost named]# systemctl stop firewalld.service
[root@localhost named]# setenforce  //临时生效，重启后失效

服务端测试

[root@localhost named]# nslookup
> dns.netdj.net
Server: 192.168.1.1
Address: 192.168.1.1#

Name: dns.netdj.net
Address: 192.168.1.1
> client.netdj.net
Server: 192.168.1.1
Address: 192.168.1.1#

Name: client.netdj.net
Address: 192.168.1.2
> exit

[root@localhost named]# 

客户端测试

[root@localhost ~]# nslookup
> dns.netdj.net
Server: 192.168.1.1
Address: 192.168.1.1#

Name: dns.netdj.net
Address: 192.168.1.1
> client.netdj.net
Server: 192.168.1.1
Address: 192.168.1.1#

Name: client.netdj.net
Address: 192.168.1.2
> exit

[root@localhost ~]#

DNS服务搭建完成！！

限制区域传送，可实现两个IP之间的区域传送。避免黑客的缓存投毒进而利用虚假IP地址替换域名系统表中的地址造成破坏。此外还可以防止注册劫持，DNS欺骗等攻击

 [root@localhost named]# vim /etc/named.rfc1912.zones
 // named.rfc1912.zones:
 //
 // Provided by Red Hat caching-nameserver package
 //
 // ISC BIND named zone configuration for zones recommended by
 // RFC 1912 section 4.1 : localhost TLDs and address zones
 // and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
 // (c)2007 R W Franks
 //
 // See /usr/share/doc/bind*/sample/ for example named configuration files.
 //

 zone "localhost.localdomain" IN {
 　　　　type master;
 　　　　file "named.localhost";
 　　　　allow-update { none; };
 };

 zone "localhost" IN {
 　　　　type master;
 　　　　file "named.localhost";
 　　　　allow-update { none; };
 };

 zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
 　　　　type master;
 　　　　file "named.loopback";
 　　　　allow-update { none; };
 };

 zone "1.0.0.127.in-addr.arpa" IN {
 　　　　type master;
 　　　　file "named.loopback";
 　　　　allow-update { none; };
 };

 zone "0.in-addr.arpa" IN {
 　　　　type master;
 　　　　file "named.empty";
 　　　　allow-update { none; };
 };

 zone "netdj.net" IN {
 　　　　type master;
 　　　　file "netdj.net.zone";
 　　　　allow-update { none; };     //修改为allow-transfer { 192.168.1.1;192.168.1.2; };
 };

 zone "1.168.192.in-addr.arpa" IN {
 　　　　type master;
 　　　　file "1.168.192.zone";
 　　　　allow-update { none; };     //修改为allow-transfer { 192.168.1.1;192.168.1.2; };
 };

修改DNS配置查询，可实现仅指定网段主机查询DNS信息。以保障DNS服务器不易被黑客发现并攻击。

 [root@localhost named]# vim /etc/named.conf
 //
 // named.conf
 //
 // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
 // server as a caching only nameserver (as a localhost DNS resolver only).
 //
 // See /usr/share/doc/bind*/sample/ for example named configuration files.
 //
 // See the BIND Administrator's Reference Manual (ARM) for details about the
 // configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

 options {
         listen-on port  { any; };
         listen-on-v6 port  { any; };
         directory       "/var/named";
         dump-file       "/var/named/data/cache_dump.db";
         statistics-file "/var/named/data/named_stats.txt";
         memstatistics-file "/var/named/data/named_mem_stats.txt";
         allow-query     { any; };      //修改为allow-query     { 192.168.1.0/24; };

         /*
          - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
          - If you are building a RECURSIVE (caching) DNS server, you need to enable
            recursion.
          - If your recursive DNS server has a public IP address, you MUST enable access

            control to limit queries to your legitimate users. Failing to do so will
            cause your server to become part of large scale DNS amplification
            attacks. Implementing BCP38 within your network would greatly
            reduce such attack surface
         */
         recursion yes;

         dnssec-enable yes;
         dnssec-validation yes;

         /* Path to ISC DLV key */
         bindkeys-file "/etc/named.iscdlv.key";

         managed-keys-directory "/var/named/dynamic";

         pid-file "/run/named/named.pid";
         session-keyfile "/run/named/session.key";
 };

 logging {
         channel default_debug {
                 file "data/named.run";
                 severity dynamic;
         };
 };

 zone "." IN {
         type hint;
         file "named.ca";
 };

 include "/etc/named.rfc1912.zones";
 include "/etc/named.root.key";
                                 

本文由博主亲测有效，若有错误请评论指出谢谢

----------持续更新中