Linux基础服务——Bind DNS服务 Part2

DNS反向解析与区域传送

实验环境延续Part1的实验环境。

反向区域配置

正向解析是域名到IP地址的映射，反向解析则是IP地址到域名的解析，在区域名称方面有较大的的不同。

（下图为定义区域的基本样例）

且反向解析使用PTR记录表明反向解析记录，且所指向的域名必须是FQDN（SOA记录不需要改变，$ORIGIN变量的默认值也与正向解析相同）

定义完毕区域并编写完成区域文件后重新启动named服务即可生效

[root@localhost named]# systemctl restart named

反向解析测试

区域传送（zone transfer）

添加一台相同配置的虚拟机进入环境中，IP地址为192.168.100.60。（软件安装略）

如果我们想让第二台虚拟机提供备份的DNS服务，那么需要将第一台服务器的区域记录传送至第二台服务器，从服务器不能对记录进行修改，接下来进行区域传送的配置。

首先修改区域文件的记录，对第二台虚拟机进行解析，并指定第二台服务器的NS记录使其能够为区域进行解析。

然后在主服务器上进行传送权限的配置。我们需对区域定义的部分进行修改。

添加的allow-transfer指定了该区域可以被传送到那些主机。接下来配置第二台虚拟机。同样的，只需要在区域定义的部分修改部分即可。

type指定了区域类型为辅助区域，masters参数指定了它将向那台服务器进行区域传送，file指定文件保存位置（相对于/var/named/）

配置完毕后，确认防火墙配置是否正确（TCP与UDP53端口放行），重启服务即可。

[root@localhost named]# systemctl restart named

查看日志

Jun 07 07:25:10 localhost.localdomain named[1342]: zone test.com/IN: Transfer started.

Jun 07 07:25:10 localhost.localdomain named[1342]: transfer of 'test.com/IN' from 192.168.100.50#53: connected using 192.168.100.60#50187

Jun 07 07:25:10 localhost.localdomain named[1342]: zone test.com/IN: transferred serial 0

Jun 07 07:25:10 localhost.localdomain named[1342]: transfer of 'test.com/IN' from 192.168.100.50#53: Transfer status: success

Jun 07 07:25:10 localhost.localdomain named[1342]: transfer of 'test.com/IN' from 192.168.100.50#53: Transfer completed: 1 messages, 6 records, 178 bytes, 0.001 secs (178000 bytes/sec)

Jun 07 07:25:10 localhost.localdomain named[1342]: zone 100.168.192.in-addr.arpa/IN: Transfer started.

Jun 07 07:25:10 localhost.localdomain named[1342]: transfer of '100.168.192.in-addr.arpa/IN' from 192.168.100.50#53: connected using 192.168.100.60#40069

Jun 07 07:25:10 localhost.localdomain named[1342]: zone 100.168.192.in-addr.arpa/IN: transferred serial 0

Jun 07 07:25:10 localhost.localdomain named[1342]: transfer of '100.168.192.in-addr.arpa/IN' from 192.168.100.50#53: Transfer status: success

Jun 07 07:25:10 localhost.localdomain named[1342]: transfer of '100.168.192.in-addr.arpa/IN' from 192.168.100.50#53: Transfer completed: 1 messages, 6 records, 205 bytes, 0.001 secs (205000 bytes/sec)

可以看到区域传送已经传送完毕，到文件系统中查看。

[root@localhost slaves]# pwd

/var/named/slaves

[root@localhost slaves]# ls

test.com.ptr.zone  test.com.zone

区域文件被传送到了服务器中。接下来测试主辅的DNS。

主从DNS测试

使用Linux客户机的dig命令进行测试（客户机的DNS服务器需配置为192.168.100.50和192.168.100.60）

[root@localhost ~]# dig www.test.com

; <<>> DiG 9.11.20-RedHat-9.11.20-5.el8 <<>> www.test.com

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 171

;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:

; EDNS: version: 0, flags:; udp: 4096

; COOKIE: 7682c1196c8fb2fe8ac2854b60be0629b89d5d1616f419f5 (good)

;; QUESTION SECTION:

;www.test.com.                  IN      A

;; ANSWER SECTION:

www.test.com.           86400   IN      A       192.168.100.20

;; AUTHORITY SECTION:

test.com.               86400   IN      NS      dns2.test.com.

test.com.               86400   IN      NS      dns.test.com.

;; ADDITIONAL SECTION:

dns.test.com.           86400   IN      A       192.168.100.50

dns2.test.com.          86400   IN      A       192.168.100.60

;; Query time: 0 msec

;; SERVER: 192.168.100.50#53(192.168.100.50)

;; WHEN: Mon Jun 07 15:42:34 EDT 2021

;; MSG SIZE  rcvd: 154

以上可见相应的Server为192.168.100.50服务器，将主DNS关闭后再次进行测试。

[root@localhost ~]# dig www.test.com

; <<>> DiG 9.11.20-RedHat-9.11.20-5.el8 <<>> www.test.com

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44650

;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:

; EDNS: version: 0, flags:; udp: 4096

; COOKIE: 527a8826a09007e405815b9560be06449ec3acd3b38c6dee (good)

;; QUESTION SECTION:

;www.test.com.                  IN      A

;; ANSWER SECTION:

www.test.com.           86400   IN      A       192.168.100.20

;; AUTHORITY SECTION:

test.com.               86400   IN      NS      dns.test.com.

test.com.               86400   IN      NS      dns2.test.com.

;; ADDITIONAL SECTION:

dns.test.com.           86400   IN      A       192.168.100.50

dns2.test.com.          86400   IN      A       192.168.100.60

;; Query time: 0 msec

;; SERVER: 192.168.100.60#53(192.168.100.60)

;; WHEN: Mon Jun 07 15:43:00 EDT 2021

;; MSG SIZE  rcvd: 154

可见Server转变成为了192.168.100.60，它们同时提供了服务。

区域文件的更新

当在区域文件内添加内容时，需要更新SOA记录中的Serial（序列号），对于区域传送来说，它通过Serial的大小来区分区域文件的新旧，Serial值越大则区域文件越新。例如我需要在100.168.192.in-addr.arpa区域文件中添加一条A记录，那么我就需要将Serial加一，如下。

Serial由0变为1，然后查看系统日志观察区域传送的更新（从服务器端日志）

Jun 07 08:02:00 localhost.localdomain named[1570]: client @0x7f12e80bf9f0 192.168.100.50#37234: received notify for zone '100.168.192.in-addr.arpa'

Jun 07 08:02:00 localhost.localdomain named[1570]: zone 100.168.192.in-addr.arpa/IN: notify from 192.168.100.50#37234: zone is up to date

Jun 07 08:03:21 localhost.localdomain named[1570]: client @0x7f12e80bf9f0 192.168.100.50#35630: received notify for zone 'test.com'

Jun 07 08:03:21 localhost.localdomain named[1570]: zone test.com/IN: notify from 192.168.100.50#35630: zone is up to date

Jun 07 08:03:21 localhost.localdomain named[1570]: client @0x7f12e80bf9f0 192.168.100.50#58424: received notify for zone '100.168.192.in-addr.arpa'

Jun 07 08:03:21 localhost.localdomain named[1570]: zone 100.168.192.in-addr.arpa/IN: notify from 192.168.100.50#58424: serial 1

Jun 07 08:03:21 localhost.localdomain named[1570]: zone 100.168.192.in-addr.arpa/IN: Transfer started.

Jun 07 08:03:21 localhost.localdomain named[1570]: transfer of '100.168.192.in-addr.arpa/IN' from 192.168.100.50#53: connected using 192.168.100.60#49353

Jun 07 08:03:21 localhost.localdomain named[1570]: zone 100.168.192.in-addr.arpa/IN: transferred serial 1

Jun 07 08:03:21 localhost.localdomain named[1570]: transfer of '100.168.192.in-addr.arpa/IN' from 192.168.100.50#53: Transfer status: success

Jun 07 08:03:21 localhost.localdomain named[1570]: transfer of '100.168.192.in-addr.arpa/IN' from 192.168.100.50#53: Transfer completed: 1 messages, 9 records, 262 bytes, >

Jun 07 08:03:21 localhost.localdomain named[1570]: zone 100.168.192.in-addr.arpa/IN: sending notifies (serial 1)

可以看到，主服务器发出了通知告诉从服务器，区域文件需要被升级，那么从服务器将会开启区域传送传送新的区域文件到本机，在日志中Serial将会被记录。