转自:

https://zh.codepre.com/centos-2700.html

前言

本指南描述了在CentOS 8 / RHEL 8 Linux上配置BIND DNS服务器所需的步骤。在CentOS8 / RHEL8上设置主/从绑定DNS。域名系统是连接到Internet或专用网络的计算机,服务或其他资源。 (维基百科)。充当Internet电话簿,为与FQDN关联的所有计算机提供地址。

作为TCP / IP参考模型应用程序层的一部分,DNS在全球计算机的日常操作中非常重要。在CentOS8上安装权威的BIND DNS主机和从机并配置PTR,添加A / AAAA记录等。

对于Windows用户:在Windows Server 2019上安装和配置DNS服务器

在CentOS 8 / RHEL 8上安装绑定DNS服务器

运行以下命令以在CentOS 8 / RHEL 8 Linux服务器上安装绑定DNS服务器软件包。

$ dnf -y install bind bind-utils vim
CentOS-8 - AppStream 1.3 kB/s | 4.3 kB 00:03
CentOS-8 - Base 1.2 kB/s | 3.9 kB 00:03
CentOS-8 - Extras 467 B/s | 1.5 kB 00:03
Dependencies resolved

此设置使SELinux处于强制模式。

$ getenforce
Enforcing
THE REASON FOR THIS IS THAT (Source: RedHat)
SELinux helps mitigate the damage made by configuration mistakes. Domain Name System (DNS) servers often replicate information between each other in what is known as a zone transfer. Attackers can use zone transfers to update DNS servers with false information. When running the Berkeley Internet Name Domain (BIND) as a DNS server in Red Hat Enterprise Linux, even if an administrator forgets to limit which servers can perform a zone transfer, the default SELinux policy prevents zone files from being updated using zone transfers, by the BIND named daemon itself, and by other processes (Source: RedHat).

在CentOS 8 / RHEL 8上配置BIND DNS授权服务器

配置BIND DNS授权服务器。打开配置文件/etc/named.conf。

DNS服务器具有以下设置:

  • computingforgeeks.com 区域(域名)
  • 192.168.154.0 –托管子网
  • 192.168.154.94 从服务器IP
  • 192.168.154.88 –主服务器IP

named.conf配置文件如下:

$ sudo vim /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
// options {
listen-on port 53 { any; }; ## Listen on any since it is an authoritative DNS Publicly available.
listen-on-v6 port 53 { any; }; ## You can also set the same for IPv6
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
## Since this will be an authoritative Nameserver, allow query from any host
allow-query { any; };
allow-transfer {192.168.154.94; }; /* - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. - If you are building a RECURSIVE (caching) DNS server, you need to enable recursion. - If your recursive DNS server has a public IP address, you MUST enable access control to limit queries to your legitimate users. Failing to do so will cause your server to become part of large scale DNS amplification attacks. Implementing BCP38 within your network would greatly reduce such attack surface.
*/
recursion no; ## Following Advice from above.
dnssec-enable yes;
dnssec-validation yes;
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key"; /* https://fedoraproject.org/wiki/Changes/CryptoPolicy */ include "/etc/crypto-policies/back-ends/bind.config";
}; logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
}; zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key"; ## Set your ZONE details as shown below for different domains. Set the forward and reverse details. You can set the names of files as you like zone "computingforgeeks.com" IN {
type master;
file "computingforgeeks.forward";
allow-update { none; };
}; ## Make sure you follow the rule for reverse zone (154.168.192.in-addr.arpa). [If your IP is 192.168.10.10, It will be 10.168.192.in-addr.arpa] zone "154.168.192.in-addr.arpa" IN {
type master;
file "computingforgeeks.reverse";
allow-update { none; };
};

主服务器192.168.154.88。请注意,这是一台权威的DNS服务器,因此IP必须是公用IP。

创建区域文件

在named.conf中设置文件后,您需要创建一个区域文件并将所有其他记录(如A / AAAA,MX,PTR等)放置。在/ var / named /目录中创建文件

$ sudo vim /var/named/computingforgeeks.forward

$TTL 86400
@ IN SOA dns1.computingforgeeks.com. root.computingforgeeks.com. (
# You can use any numerical values for serial number but it is recommended to use [YYYYMMDDnn]
2019112201 ;Serial
3600 ;Refresh
1800 ;Retry
604800 ;Expire
86400 ;Minimum TTL
)
# Set your Name Servers here
IN NS dns1.computingforgeeks.com.
IN NS dns2.computingforgeeks.com.
# define Name Server's IP address
IN A 192.168.154.88
# Set your Mail Exchanger (MX) Server here
IN MX 10 dns1.computingforgeeks.com. # Set each IP address of a hostname. Sample A records.
dns1 IN A 192.168.154.88
dns2 IN A 192.168.154.94
mail1 IN A 192.168.154.97

创建与named.conf配置文件中定义的相同域对应的反向记录。

$ sudo vim /var/named/computingforgeeks.reverse

$TTL 86400
@ IN SOA dns1.computingforgeeks.com. root.computingforgeeks.com. (
2019112201 ;Serial
3600 ;Refresh
1800 ;Retry
604800 ;Expire
86400 ;Minimum TTL
)
# Set Name Server
IN NS dns1.computingforgeeks.com.
## Set each IP address of a hostname. Sample PTR records.
88 IN PTR dns1.computingforgeeks.com.
94 IN PTR dns2.computingforgeeks.com.
97 IN PTR mail1.computingforgeeks.com.

更改主服务器的DNS设置

创建一个新的DNS服务器作为默认名称服务器。打开文件/etc/resolv.conf并添加以下行:根据环境更换IP。

$ sudo vim /etc/resolv.conf
nameserver 192.168.154.88

允许防火墙上的DNS服务

配置防火墙以允许DNS服务。

sudo firewall-cmd --add-service=dns --permanent
sudo firewall-cmd --reload

检查设置是否正确,然后启动并激活绑定。

sudo named-checkconf
sudo systemctl start named
sudo systemctl enable named

BIND主DNS服务器上的工作已完成。让我们继续配置从属服务器。

从DNS服务器配置-192.168.154.94

在从属服务器上,安装bind和bind-utils。

sudo dnf -y install bind bind-utils vim

配置从服务器。打开/etc/named.conf并进行相应的编辑

$ sudo vim /etc/named.conf
//
// named.conf
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
// See /usr/share/doc/bind*/sample/ for example named configuration files.
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html options {
listen-on port 53 { any; };
listen-on-v6 port 53 { any; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
allow-query { any; }; ## Allows hosts to query Slave DNS
allow-transfer { none; }; ## Disable zone transfer /*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
## Since this is a slave, lets allow recursion.
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.root.key";
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
}; logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
}; zone "." IN {
type hint;
file "named.ca";
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key"; ## Let us create zone definitions for both forward and reverse dns lookups.
# The files will be created automatically on the slave. zone "computingforgeeks.com" IN {
type slave;
file "slaves/computingforgeeks.forward";
masters { 192.168.154.88; }; ## Master server it is receiving DNS Records from
}; zone "154.168.192.in-addr.arpa" IN {
type slave;
file "slaves/computingforgeeks.reverse";
masters { 192.168.154.88; }; ## Master server it is receiving DNS Records from
};

更改从属服务器的DNS设置

创建一个新的DNS服务器(主服务器和从服务器)作为默认名称服务器。打开文件/etc/resolv.conf并添加以下行:根据您的环境替换IP

$ sudo vim /etc/resolv.conf
nameserver 192.168.154.88
nameserver 192.168.154.94

检查设置是否正确,然后启动并激活绑定。

sudo named-checkconf
sudo systemctl start named
sudo systemctl enable named

确保/ var / named / slaves目录正在从主目录传输区域文件

$ ll /var/named/slaves/
total 12
-rw-r--r-- 1 named named 480 Nov 23 14:16 computingforgeeks.forward
-rw-r--r-- 1 named named 492 Nov 23 14:45 computingforgeeks.reverse

DNS有效的证明

测试DNS服务器是否解析。使用Windows计算机测试BIND DNS服务器。

如下所示,在窗口中更改网络详细信息。在DNS中反映新的DNS服务器。

打开PowerShell或命令提示符,然后键入nslookup以测试DNS服务。

和绑定DNS的作品!如果您在Linux客户端计算机上运行,​​请编辑/ etc / hosts文件以更改DNS配置设置。

结论

您的BIND DNS主服务器和从服务器现在正在工作。我希望本指南对您来说是全面而有用的。感谢您阅读这份引人入胜的指南。

【转】在CentOS 8 / RHEL 8上配置主/从BIND DNS服务器的更多相关文章

  1. 在 CentOS7.0 上搭建 Chroot 的 Bind DNS 服务器

    BIND(Berkeley internet Name Daemon)也叫做NAMED,是现今互联网上使用最为广泛的DNS 服务器程序.这篇文章将要讲述如何在 chroot 监牢中运行 BIND,这样 ...

  2. CentOS 7 / RHEL 7 上安装 LAMP + phpMyAdmin

    原文 CentOS 7 / RHEL 7 上安装 LAMP + phpMyAdmin 发表于 2014-11-02 作者 Haoxian Zeng 更新于 2014-12-12   之前根据在 Lin ...

  3. 在 CentOS 8/RHEL 8 上安装和使用 Cockpit

    Cockpit 是一个基于 Web 的服务器管理工具,可用于 CentOS 和 RHEL 系统.最近发布的 CentOS 8 和 RHEL 8,其中 cockpit 是默认的服务器管理工具.它的软件包 ...

  4. Ubuntu14.04安装配置web/ftp/tftp/dns服务器

    目录: 1.安装ftp服务器vsftpd --基于tcp,需要帐号密码 2.安装tftp服务器tftpd-hpa,tftp-hpa --udp 3.web服务器--使用Apache2+Mysql+PH ...

  5. 在 CentOS 或 RHEL 系统上检查可用的安全更新的方法

    当你更新系统时,根据你所在公司的安全策略,有时候可能只需要打上与安全相关的补丁.大多数情况下,这应该是出于程序兼容性方面的考量.那该怎样实践呢?有没有办法让 yum 只安装安全补丁呢? 答案是肯定的, ...

  6. nginx的centos和rhel的yum配置安装

    Official Red Hat/CentOS packages To add NGINX yum repository, create a file named /etc/yum.repos.d/n ...

  7. win10笔记本连接wifi出现:您的计算机配置似乎是正确的,但该配置或资源(DNS服务器)检测到有响应

    问题上图: 一直以来连接网线使用,很少使用WiFi了,在网线不好使的时候使用wifi发现并不怎么好用,甚至上不了网页,但是那时候也不怎么在意,不过一会网线就好使了所以也没处理,直到今天,因为接下来好多 ...

  8. 配置域从DNS服务器以及缓存DNS服务器

    一.域从DNS服务器的作用 我们在之前上一篇随笔里有提到,DNS服务器一般有三种类型,一个是Primary DNS Server(主DNS服务器),一个是Secondary DNS Server(从D ...

  9. How to install redis server on CentOS 7 / RHEL 7

    在本教程中,我们将学习如何在CentOS 7 / RHEL 7上安装Redis服务器. redis的缩写是REmote DIctionary Server. 它是最流行的开源,高级键值缓存和存储之一. ...

随机推荐

  1. SpringCloud组件

    1.Hystrix 1.1.简介 Hystrix,英文意思是豪猪,全身是刺,看起来就不好惹,是一种保护机制. Hystrix也是Netflix公司的一款组件. 主页:https://github.co ...

  2. [UNP] TCP 多进程服务器

    UNP Part-2: Chapter 5. TCP Client/Server Example 的读书笔记. 阅读本文前,建议先阅读多线程服务器的实现,熟悉常见的 TCP 网络通信 API 的基本使 ...

  3. 剑指 Offer 51. 数组中的逆序对 + 归并排序 + 树状数组

    剑指 Offer 51. 数组中的逆序对 Offer_51 题目描述 方法一:暴力法(双层循环,超时) package com.walegarrett.offer; /** * @Author Wal ...

  4. HDOJ-4027(线段树+区间更新(每个节点更新的值不同))

    Can You answer these queries? HDOJ-4027 这道题目和前面做的题目略有不同.以前的题目区间更新的时候都是统一更新的,也就是更新相同的值.但是这里不一样,这里更新的每 ...

  5. 解决新版谷歌浏览器在http请求下无法开启麦克风问题

    1.在浏览器地址栏中输入"chrome://flags/#unsafely-treat-insecure-origin-as-secure", 2.将该选项置为Enabled, 3 ...

  6. 解决VM 与 Device/Credential Guard 不兼容(全网有效解决思路)

    为什么要写这篇文章先说背景:前段时间因为学习Linux系统需要,自己本机用的是Windows系统,那这里就需要用到虚拟机来创建虚拟环境用来支持Linux系统 1: 于是乎,自己很激动的下载了vm虚拟机 ...

  7. kmp&字典树 模板

    kmp: const int maxn=1e5+5; char s[maxn],p[maxn]; int nex[maxn]; int KmpSearch(char* s, char* p) { in ...

  8. HOOK实现游戏无敌-直接修改客户端-2-使用VS来处理

    HOOK实现游戏无敌-直接修改客户端-2-使用VS来处理 大概流程 1 首先找到游戏进程,打开进程 2 申请一段内存空间来保存我们的硬编码(virtualAllocEx) 3 找到攻击函数,修改函数的 ...

  9. Echarts4.x雷达图如何展示一维数据?

    最近做的项目其中一个功能是画雷达图,鼠标滑过雷达图的拐点,展示该维相关数据,并且需要显示雷达图的刻度. 但是我发现单纯的雷达图似乎没办法展示一维数据. 我总结了一下,关于画雷达图,我遇到的难点有三个: ...

  10. .Net Core 路由处理

    用户请求接口路由,应用返回处理结果.应用中如何匹配请求的数据呢?为何能如此精确的找到对应的处理方法?今天就谈谈这个路由.路由负责匹配传入的HTTP请求,将这些请求发送到可以执行的终结点.终结点在应用中 ...