玩转DNS服务器——Bind服务
合理的配置DNS的查询方式
实验环境:
虚拟机:VMware® Workstation 15 Pro
均使用NAT连接 网段为192.168.1.0/24
DNS 服务器 ---- Centos 7.4
内核版本 Kernel: Linux 3.10.0-693.el7.x86_64
IP地址:192.168.1.1/24
网关: 192.168.1.254
DNS: 192.168.1.1
客户端 ---- Centos 7.4
内核版本 Kernel: Linux 3.10.0-693.el7.x86_64
IP地址:192.168.1.2/24
网关: 192.168.1.254
DNS: 192.168.1.1
安装DNS服务
[root@localhost ~]#yum install bind -y //安装 Loaded plugins: fastestmirror, langpacks repo | 3.6 kB :: Determining fastest mirrors Resolving Dependencies --> Running transaction check ---> Package bind.x86_64 :9.9.-.el7 will be installed --> Finished Dependency Resolution Dependencies Resolved ======================================================================================= Package Arch Version Repository Size ======================================================================================= Installing: bind x86_64 :9.9.-.el7 repo 1.8 M Transaction Summary ======================================================================================= Install Package Total download size: 1.8 M Installed size: 4.3 M Downloading packages: Running transaction check Running transaction test Transaction test succeeded Running transaction Installing : :bind-9.9.-.el7.x86_64 / Verifying : :bind-9.9.-.el7.x86_64 / Installed: bind.x86_64 :9.9.-.el7 Complete! [root@localhost ~]#
编辑dns服务器配置文件
[root@localhost ~]# vim /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS // server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html
options {
listen-on port { 127.0.0.1; }; //修改为listen-on port 53 { any; };
listen-on-v6 port { ::; }; //修改为linsten-on-v6 port 53 { any; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; }; //修改为allow-query { any; };
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid"; session-keyfile "/run/named/session.key";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
编辑DNS正反向区域
[root@localhost named]# vim /etc/named.rfc1912.zones
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsopdefault-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
zone "localhost.localdomain" IN {
type master;
file "named.localhost";
allow-update { none; };
}; zone "localhost" IN {
type master;
file "named.localhost";
allow-update { none; };
}; zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
}; zone "1.0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
}; zone "0.in-addr.arpa" IN {
type master;
file "named.empty";
allow-update { none; };
}; //-------------------------------------------//在最底下添加下面两段
//第一段为正向解析
zone "netdj.net" IN {
type master;
file "netdj.net.zone";
allow-update { none; };
}; //第二段为反向解析
zone "1.168.192.in-addr.arpa" IN {
type master;
file "1.168.192.zone";
allow-update { none; };
};
创建DNS正反向区域解析文件
[root@localhost ~]# cd /var/named/
[root@localhost named]# ls
data dynamic named.ca named.empty named.localhost named.loopback slaves
//复制模板创建正反向解析文件
[root@localhost named]# cp -p named.empty netdj.net.zone
[root@localhost named]# cp -p named.empty 1.168..zone
编辑正向解析文件
[root@localhost named]# vim netdj.net.zone
$TTL 3H
@ IN SOA @ rname.invalid. (
; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS @
A 127.0.0.1
dns A 192.168.1.1 //使用A记录将dns.netdj.net指向192.168.1.1
client A 192.168.1.2 //使用A记录将client.netdj.net指向192.168.1.2
编辑反向解析文件
[root@localhost named]# vim 1.168..zone
$TTL 3H
@ IN SOA @ rname.invalid. (
; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS @
A 127.0.0.1
PTR dns.netdj.net. //使用PTR记录将192.168.1.1指向dns.netdj.net
PTR client.netdj.net. //使用PTR记录将192.168.1.2指向client.netdj.net
重启服务
[root@localhost named]# systemctl restart named //重启服务
[root@localhost named]# systemctl enable named //开机自启动
Created symlink from /etc/systemd/system/multi-user.target.wants/named.service to /usr/lib/systemd/system/named.service.
关闭防火墙、selinux
[root@localhost named]# systemctl stop firewalld.service
[root@localhost named]# setenforce //临时生效,重启后失效
服务端测试
[root@localhost named]# nslookup
> dns.netdj.net
Server: 192.168.1.1
Address: 192.168.1.1# Name: dns.netdj.net
Address: 192.168.1.1
> client.netdj.net
Server: 192.168.1.1
Address: 192.168.1.1# Name: client.netdj.net
Address: 192.168.1.2
> exit [root@localhost named]#
客户端测试
[root@localhost ~]# nslookup
> dns.netdj.net
Server: 192.168.1.1
Address: 192.168.1.1# Name: dns.netdj.net
Address: 192.168.1.1
> client.netdj.net
Server: 192.168.1.1
Address: 192.168.1.1# Name: client.netdj.net
Address: 192.168.1.2
> exit [root@localhost ~]#
DNS服务搭建完成!!
限制区域传送,可实现两个IP之间的区域传送。避免黑客的缓存投毒进而利用虚假IP地址替换域名系统表中的地址造成破坏。此外还可以防止注册劫持,DNS欺骗等攻击
[root@localhost named]# vim /etc/named.rfc1912.zones
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
// zone "localhost.localdomain" IN {
type master;
file "named.localhost";
allow-update { none; };
}; zone "localhost" IN {
type master;
file "named.localhost";
allow-update { none; };
}; zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
}; zone "1.0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
}; zone "0.in-addr.arpa" IN {
type master;
file "named.empty";
allow-update { none; };
}; zone "netdj.net" IN {
type master;
file "netdj.net.zone";
allow-update { none; }; //修改为allow-transfer { 192.168.1.1;192.168.1.2; };
}; zone "1.168.192.in-addr.arpa" IN {
type master;
file "1.168.192.zone";
allow-update { none; }; //修改为allow-transfer { 192.168.1.1;192.168.1.2; };
};
修改DNS配置查询,可实现仅指定网段主机查询DNS信息。以保障DNS服务器不易被黑客发现并攻击。
[root@localhost named]# vim /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html options {
listen-on port { any; };
listen-on-v6 port { any; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; }; //修改为allow-query { 192.168.1.0/24; }; /*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes; dnssec-enable yes;
dnssec-validation yes; /* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic"; pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
}; logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
}; zone "." IN {
type hint;
file "named.ca";
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
本文由博主亲测有效,若有错误请评论指出谢谢
----------持续更新中
玩转DNS服务器——Bind服务的更多相关文章
- centos6.5环境DNS-本地DNS服务器bind的搭建
centos6.5环境DNS-本地DNS服务器bind的搭建 域名系统(英文:Domain Name System,缩写:DNS)是因特网的一项服务.它作为将域名和IP地址相互映射的一个分布式数据库, ...
- 内建DNS服务器--BIND
参考 BIND 官网:http://www.isc.org/downloads/bind/ 1.系统环境说明 [root@clsn6 ~]# cat /etc/redhat-release CentO ...
- Debian9.5系统DNS服务器BIND软件配置说明
DNS的出现的历史 网络出现的早期是使用IP地址通讯的,那时就几台主机通讯.但是随着接入网络主机的增多,这种数字标识的地址非常不便于记忆,UNIX上就出现了建立一个叫做hosts的文件(Linux和W ...
- CentOS7-1810 系统DNS服务器BIND软件配置说明
DNS的出现的历史 网络出现的早期是使用IP地址通讯的,那时就几台主机通讯.但是随着接入网络主机的增多,这种数字标识的地址非常不便于记忆,UNIX上就出现了建立一个叫做hosts的文件(Linux和W ...
- Centos7.3搭建DNS服务器--BIND
1.系统环境说明 [root@dns-server etc]# cat /etc/redhat-release CentOS Linux release (Core) 防火墙和Selinux关闭 [r ...
- centos7 主从dns配置 bind服务
一,配置前请先关闭防火墙selinux 防火墙关闭方法,参见上一篇文章. setenforce 0 #临时关闭 修改/etc/selinux/config 文件 将SELINUX=enforc ...
- redhat配置dns服务器bind
配置Oracle11g的RAC需要使用DNS服务器来解析SCAN IP,本文就是以此为例介绍bind服务器的使用.首先科普一下bind服务器,属于企业级产品了,还是开源的: Bind是Berkeley ...
- 搭建DNS服务器-bind
1. 安装 yum install -y bind-chroot yum install -y bind-utils service named-chroot start 2. 修改配置 增加一 ...
- 简单搭建DNS服务器——bind
1安装bind yum install -y bind bind-utils bind-chroot 2 修改配置文件 # grep '^[^#]' /etc/named.conf options { ...
随机推荐
- WeQuant教程—1.4 实践教学:比特币量化定投
在wequant.io,为了让读者能直接体验量化系统的魅力,我们用前面的思路,实现了一套完整的量化系统和回测工具,这个系统非常简单,用户只需要把交易意志用策略表达出来,系统就可以自己完成交易效果的回 ...
- zabbix自动停用与开启agent
我们在升级环境时遇到了一个问题,那就是zabbix会自动发送邮件给领导,此时领导心里会嘎嘣一下,为了给领导营造一个良好的环境,减少不必要的告警邮件,减少嘎嘣次数,于是在升级之前,取消zabbix监控的 ...
- matlab柱状图画法
%%各时段电量需求 clc close all clear all x = [11000 33000 25000 36000 25000 30000 18000]; tick = {'0-6' '6- ...
- Spirng学习指南-第一章(完)
Spring学习指南 内容提要 Spring框架是以简化J2EE应用程序开发为特定目标而创建的,是当前最流行的Java开发框架. 本书从介绍Spring框架入手,针对Spring4.3和Jav ...
- Java开发笔记(一百四十四)实现FXML对应的控制器
前面介绍了如何通过fxml文件编排界面布局,可是光有静态界面根本没法处理业务,必须另外书写业务逻辑的代码,方能响应各按钮的单击事件,并将业务结果即使呈现到界面上.显然,fxml内部写不了Java代码, ...
- Redis缓存雪崩、击穿、穿透
参考大佬 前言 Redis在互联网技术存储方面使用如此广泛,几乎所有的后端技术面试官都要在Redis的使用和原理方面对小伙伴们进行360°的刁难.作为一个在互联网公司面一次拿一次offer的面霸(请允 ...
- 生意bisynes商业
1.Of, to, pertaining to or utilized for purposes of conducting trade, commerce, governance, advocacy ...
- 全栈项目|小书架|服务器端-NodeJS+Koa2实现首页图书列表接口
通过上篇文章 全栈项目|小书架|微信小程序-首页水平轮播实现 我们实现了前端(小程序)效果图的展示,这篇文章来介绍服务器端的实现. 首页书籍信息 先来回顾一下首页书籍都有哪些信息: 从下面的图片可以看 ...
- flask 与 SQLAlchemy的使用
flask 与 SQLAlchemy的使用 安装模块 pip install flask-sqlalchemy 在单个python中与flask使用 # 文件名:manage.py from flas ...
- Java自学-数组 二维数组
Java 如何使用二维数组 这是一个一维数组, 里面的每一个元素,都是一个基本类型int int a[] =new int[]{1,2,3,4,5}; 这是一个二维数组,里面的每一个元素,都是一个一维 ...