centos7部署DNS-1
文章索引：
一、服务相关介绍
二、实验：搭建正向主DNS服务器
三、实验：搭建反向解析服务器
四、实验：泛域名解析，如wwww.baidu.com也可以正常访问
环境
服务器 节点名称 IP地址
dns node5 192.168.216.198
web1 web1 192.168.216.199
web2 web2 192.168.216.202
一、服务相关介绍
DNS服务，程序包名bind，程序名named
1、程序包：
bind：提供dns server程序，以及几个常用的测试程序；
bind-libs：被bind和bind-utils包中的程序共同用到的库文件；
bind-utils：bind程序端程序集，提供了，dig，host，nslookup等相关工具；
bind-chroot:选装，提供了一种安全机制；通常公司内部使用不需要安装；
2、bind
服务脚本：/etc/rc.d/init.d/named
主配置文件：/etc/named.conf,/etc/named.rfc1912.zones,/etc/rndc.key(远程管理，其实只在本地)
解析库文件：/var/named/ZONE_NAME.ZONE
注意：
1)一台物理服务器可同时为多个区域提供解析；
2)必须有根区域文件；named.ca
3)应该有两个（不包括ipv6）实现localhost和本地回环地址的解析库；
正向：named.localhost
反向：named.loopback
rndc命令：remote name domain controller,默认与bind安装在同一个主机，且只能通过127.0.0.1来俩姐named进程；提供辅助性的管理功能；端口953/tcp
二、开始搭建正向主DNS服务器
1、安装yum install bind -y
node5
yum install bind -y
Installed:
bind.x86_64 :9.9.-.el7_5. Dependency Updated:
bind-libs.x86_64 :9.9.-.el7_5. bind-libs-lite.x86_64 :9.9.-.el7_5.
bind-license.noarch :9.9.-.el7_5. bind-utils.x86_64 :9.9.-.el7_5.
cat /var/named/named.ca 看一下全球的13各根节点
[root@node5 ~]# cat /var/named/named.ca
; <<>> DiG 9.9.-RedHat-9.9.-.el7_3. <<>> +bufsize= +norec @a.root-servers.net
; ( servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
;; flags: qr aa; QUERY: , ANSWER: , AUTHORITY: , ADDITIONAL: ;; OPT PSEUDOSECTION:
; EDNS: version: , flags:; udp:
;; QUESTION SECTION:
;. IN NS ;; ANSWER SECTION:
. IN NS a.root-servers.net.
. IN NS b.root-servers.net.
. IN NS c.root-servers.net.
. IN NS d.root-servers.net.
. IN NS e.root-servers.net.
. IN NS f.root-servers.net.
. IN NS g.root-servers.net.
. IN NS h.root-servers.net.
. IN NS i.root-servers.net.
. IN NS j.root-servers.net.
. IN NS k.root-servers.net.
. IN NS l.root-servers.net.
. IN NS m.root-servers.net. ;; ADDITIONAL SECTION:
a.root-servers.net. IN A 198.41.0.4
a.root-servers.net. IN AAAA ::ba3e:::
b.root-servers.net. IN A 192.228.79.201
b.root-servers.net. IN AAAA ::::b
c.root-servers.net. IN A 192.33.4.12
c.root-servers.net. IN AAAA ::::c
d.root-servers.net. IN A 199.7.91.13
d.root-servers.net. IN AAAA ::2d::d
e.root-servers.net. IN A 192.203.230.10
e.root-servers.net. IN AAAA ::a8::e
f.root-servers.net. IN A 192.5.5.241
f.root-servers.net. IN AAAA ::2f::f
g.root-servers.net. IN A 192.112.36.4
g.root-servers.net. IN AAAA ::::d0d
h.root-servers.net. IN A 198.97.190.53
h.root-servers.net. IN AAAA ::::
i.root-servers.net. IN A 192.36.148.17
i.root-servers.net. IN AAAA :7fe::
j.root-servers.net. IN A 192.58.128.30
j.root-servers.net. IN AAAA ::c27:::
k.root-servers.net. IN A 193.0.14.129
k.root-servers.net. IN AAAA :7fd::
l.root-servers.net. IN A 199.7.83.42
l.root-servers.net. IN AAAA ::9f::
m.root-servers.net. IN A 202.12.27.33
m.root-servers.net. IN AAAA :dc3:: ;; Query time: msec
;; SERVER: 198.41.0.4#(198.41.0.4)
;; WHEN: Po kv臎 :: CEST
;; MSG SIZE rcvd: [root@node5 ~]#
查看一下监听端口是否监听
[root@node5 ~]# ss -tunlop |grep
udp UNCONN *: *:* users:(("avahi-daemon",pid=,fd=))
udp UNCONN 192.168.122.1: *:* users:(("dnsmasq",pid=,fd=))
tcp LISTEN 192.168.122.1: *:* users:(("dnsmasq",pid=,fd=))
2、修改主配置文件：
全局配置：options{}
日志子系统配置：logging{}
区域定义：本机能够为哪些zone进行解析，就要定义哪些zone；
zone "ZONE_NAME" IN {}
注意：任何服务程序如果期望其能够通过网络被其他主机访问，至少应该监听在一个能与外部主机通信的IP地址上；
备份配置文件
cp -v /etc/named.conf {,.bak}
编辑vim /etc/named.conf
[root@node5 ~]# vim /etc/named.conf //
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html options {
15 listen-on port 53 {192.168.216.198; 127.0.0.1; }; #添加本机地址，这里也可以any；
16 //listen-on-v6 port 53 { ::1; }; #注释v6；
directory "/var/named"; #定义区域配置文件路径；
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; }; #允许所有人；
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes; dnssec-enable yes; #学习过程可以关掉改成no
dnssec-validation yes; #可以先关掉，也是改成no
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic"; pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
}; logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
}; zone "." IN {
type hint;
file "named.ca";
}; include "/etc/named.rfc1912.zones"; #这个文件定义区域配置文件
include "/etc/named.root.key"; ~
~
~
~
"/etc/named.conf" 59L, 1723C written
重启服务查看监听端口的变化
[root@node5 ~]# systemctl restart named
[root@node5 ~]# ss -tunlp |grep
udp UNCONN *: *:* users:(("avahi-daemon",pid=,fd=))
udp UNCONN 192.168.216.198: *:* users:(("named",pid=,fd=),("named",pid=,fd=),("named",pid=,fd=),("named",pid=,fd=))
udp UNCONN 127.0.0.1: *:* users:(("named",pid=,fd=),("named",pid=,fd=),("named",pid=,fd=),("named",pid=,fd=))
udp UNCONN 192.168.122.1: *:* users:(("dnsmasq",pid=,fd=))
tcp LISTEN 192.168.216.198: *:* users:(("named",pid=,fd=))
tcp LISTEN 127.0.0.1: *:* users:(("named",pid=,fd=))
tcp LISTEN 192.168.122.1: *:* users:(("dnsmasq",pid=,fd=))
tcp LISTEN 127.0.0.1: *:* users:(("named",pid=,fd=))
tcp LISTEN ::: :::* users:(("named",pid=,fd=))
[root@node5 ~]#
3、修改区域解析文件
[root@node5 ~]# vim /etc/named.rfc1912.zones zone "www.web1.com"
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
// zone "localhost.localdomain" IN {
type master;
file "named.localhost";
allow-update { none; };
}; zone "localhost" IN {
type master;
file "named.localhost";
allow-update { none; };
}; zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
}; zone "1.0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
}; zone "0.in-addr.arpa" IN {
type master;
file "named.empty";
allow-update { none; };
};
45 zone "zhangxingeng.com" IN {
46 type master;
47 file "zhangxingeng.com.zone"；
48 };
4、创建区域解析数据库文件（也就是正向解析）
vim /var/named/zhangxingeng.com.zone
[root@node5 named]# cat /var/named/zhangxingeng.com.zone
$TTL
$ORIGIN zhangxingeng.com.
@ IN SOA dns1.zhangxingeng.com. admin.zhangxingeng.com. (
; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
zhangxingeng.com. IN NS dns1
IN MX mail
web1 IN A 192.168.216.199.
dns1 IN A 192.168.216.198.
mail IN A 192.168.216.199.
www IN CNAME web1
5、web1当作客户端ip-199
安装nginx
yum install nginx -y
echo welcome to web1 >/usr/share/nginx/html/index.html
systemctl start nginx
systemctl enable nginx
ss -tunlp |grep 80
web1的web服务器已经搭建好
更改dns
1 [root@web1 ~]# cat /etc/sysconfig/network-scripts/ifcfg-ens33
2 TYPE="Ethernet"
3 BOOTPROTO="dhcp"
4 DEFROUTE="yes"
5 PEERDNS="yes"
6 PEERROUTES="yes"
7 IPV4_FAILURE_FATAL="no"
8 IPV6INIT="yes"
9 IPV6_AUTOCONF="yes"
10 IPV6_DEFROUTE="yes"
11 IPV6_PEERDNS="yes"
12 IPV6_PEERROUTES="yes"
13 IPV6_FAILURE_FATAL="no"
14 IPV6_ADDR_GEN_MODE="stable-privacy"
15 NAME="ens33"
16 UUID="4f788080-131a-4f10-85a8-179b4f14ab48"
17 DEVICE="ens33"
18 ONBOOT="yes"
19 DNS1=192.168.216.198
20 [root@web1 ~]#
6、语法检查
named-checkconf 主配置文件语法
named-checkzone "zhangxingeng.com" /var/named/zhangxingeng.com.zone 解析库文件语法检查
7、重启服务
sytemctl reload named或rndc reload
8、node5（dns服务器）安装nginx，http服务器
yum -y install nginx
echo welcome to web1 >/usr/share/nginx/html/index.html
systemctl start nginx
systemctl enable nginx
9、web1测试
用dig命令测试
格式
dig [-t RR_TYPE] name [@server] [query options]
查询
+[no]trace:跟踪解析过程；
+[no]recurse:进行递归解析；
反向解析
dig -x IPADDR
默认完全区域传输
dig -t axfr DOMAIN [@server]
比如：
查询baidu.com的NS记录
dig -t NS baidu.com
跟踪解析www.baidu.com的过程
dig +trace www.baidu.com
解析www.baidu.com的A记录
dig -t A www.baidu.com
1 root@web1 ~]# dig -t A dns1.zhangxingeng.com @192.168.216.198 ; <<>> DiG 9.9.-RedHat-9.9.-.el7 <<>> -t A dns1.zhangxingeng.com @192.168.216.198
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
;; flags: qr aa rd ra; QUERY: , ANSWER: , AUTHORITY: , ADDITIONAL: ;; OPT PSEUDOSECTION:
; EDNS: version: , flags:; udp:
;; QUESTION SECTION:
;dns1.zhangxingeng.com. IN A ;; ANSWER SECTION:
dns1.zhangxingeng.com. IN A 192.168.216.198 ;; AUTHORITY SECTION:
zhangxingeng.com. IN NS dns1.zhangxingeng.com. ;; Query time: msec
;; SERVER: 192.168.216.198#(192.168.216.198)
;; WHEN: Thu Nov :: CST
;; MSG SIZE rcvd:
1 [root@web1 ~]# dig -t CNAME dns1.zhangxingeng.com @192.168.216.198 ; <<>> DiG 9.9.-RedHat-9.9.-.el7 <<>> -t CNAME dns1.zhangxingeng.com @192.168.216.198
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
;; flags: qr aa rd ra; QUERY: , ANSWER: , AUTHORITY: , ADDITIONAL: ;; OPT PSEUDOSECTION:
; EDNS: version: , flags:; udp:
;; QUESTION SECTION:
;dns1.zhangxingeng.com. IN CNAME ;; AUTHORITY SECTION:
zhangxingeng.com. IN SOA dns1.zhangxingeng.com. admin.zhangxingeng.com. ;; Query time: msec
;; SERVER: 192.168.216.198#(192.168.216.198)
;; WHEN: Thu Nov :: CST
;; MSG SIZE rcvd: [root@web1 ~]# curl www.zhangxingeng.com
welcome to web1
[root@web1 ~]#
1 [root@web1 ~]# dig -t NS dns1.zhangxingeng.com @192.168.216.198 ; <<>> DiG 9.9.-RedHat-9.9.-.el7 <<>> -t NS dns1.zhangxingeng.com @192.168.216.198
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
;; flags: qr aa rd ra; QUERY: , ANSWER: , AUTHORITY: , ADDITIONAL: ;; OPT PSEUDOSECTION:
; EDNS: version: , flags:; udp:
;; QUESTION SECTION:
;dns1.zhangxingeng.com. IN NS ;; AUTHORITY SECTION:
zhangxingeng.com. IN SOA dns1.zhangxingeng.com. admin.zhangxingeng.com. ;; Query time: msec
;; SERVER: 192.168.216.198#(192.168.216.198)
;; WHEN: Thu Nov :: CST
;; MSG SIZE rcvd:
访问一下dns服务器部署的http服务
[root@web1 ~]# curl dns1.zhangxingeng.com
welcome to dns1
[root@web1 ~]#
三、开始搭建反向解析
1、定义区域文件
~
[root@node5 named]# vim /etc/named.rfc1912.zones // named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
// zone "localhost.localdomain" IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "localhost" IN {
type master;
file "named.localhost";
allow-update { none; };
}; zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
}; zone "1.0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
}; zone "0.in-addr.arpa" IN {
type master;
file "named.empty";
allow-update { none; };
};
zone "zhangxingeng.com" IN {
type master;
file "zhangxingeng.com.zone";
};
zone "216.168.192.in-addr.arpa" IN {
49 type master;
50 file "192.168.216.zone";
51 };
2、定义区域解析库
cd /var/named/
[root@node5 named]# cat 192.168..zone
$TTL
$ORIGIN 216.168..in-addr.arpa.
@ IN SOA zhangxingeng.com. admin.zhangxingeng.com. (
; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
IN NS web1.zhangxingeng.com.
IN NS dns1.zhangxingeng.com.
IN PTR web1.zhangxingeng.com.
IN PTR dns1.zhangxingeng.com.
IN PTR mail.zhangxingeng.com.
IN PTR www.zhangxingeng.com.
3、语法测试
[root@node5 named]# named-checkconf
[root@node5 named]# named-checkzone zhangxingeng.com. zhangxingeng.com.zone
zone zhangxingeng.com/IN: zhangxingeng.com/MX 'mail.zhangxigneng.com' (out of zone) has no addresses records (A or AAAA)
zone zhangxingeng.com/IN: loaded serial
OK
[root@node5 named]# named-checkzone 216.168..in-addr.arpa. 192.168..zone
zone 216.168..in-addr.arpa/IN: loaded serial
OK
[root@node5 named]#
4、重启主服务器配置
rndc reload
systemctl status named.service
5、测试
命令dig -x ipaddr
web1上测试
1 [root@web1 ~]# dig -x 192.168.216.198 ; <<>> DiG 9.9.-RedHat-9.9.-.el7 <<>> -x 192.168.216.198
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
;; flags: qr aa rd ra; QUERY: , ANSWER: , AUTHORITY: , ADDITIONAL: ;; OPT PSEUDOSECTION:
; EDNS: version: , flags:; udp:
;; QUESTION SECTION:
;198.216.168.192.in-addr.arpa. IN PTR ;; ANSWER SECTION:
198.216.168.192.in-addr.arpa. IN PTR dns1.zhangxingeng.com. ;; AUTHORITY SECTION:
18 216.168.192.in-addr.arpa. 3600 IN NS dns1.zhangxingeng.com.
19 216.168.192.in-addr.arpa. 3600 IN NS web1.zhangxingeng.com. ;; ADDITIONAL SECTION:
22 web1.zhangxingeng.com. 86400 IN A 192.168.216.199
23 dns1.zhangxingeng.com. 86400 IN A 192.168.216.198 ;; Query time: msec
;; SERVER: 192.168.216.198#(192.168.216.198)
;; WHEN: Wed Nov :: CST
;; MSG SIZE rcvd: [root@web1 ~]#
能够解析出web1和dns1
四、泛域名解析，提高访问的感受
即使将主机名写错，也能正常访问
1、修改区域解析库，添加一条A记录即可
[root@node5 named]# vim /var/named/zhangxingeng.com.zone $TTL
$ORIGIN zhangxingeng.com.
@ IN SOA dns1.zhangxingeng.com. admin.zhangxingeng.com. (
; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
zhangxingeng.com. IN NS dns1
IN MX mail
web1 IN A 192.168.216.199.
dns1 IN A 192.168.216.198.
mail IN A 192.168.216.199.
www IN CNAME web1
17 * IN A 192.168.216.199.
2、简单测试一下
1 [root@node5 named]# curl web11.zhangxingeng.com
welcome to web1
[root@node5 named]#
待续。。。
转载请注明出处：https://www.cnblogs.com/zhangxingeng/p/9983944.html
centos7部署DNS-1的更多相关文章
- centos7 部署dns服务器
=============================================== 2017/12/6_第2次修改 ccb_warlock 20 ...
- CentOS7系统DNS主从配置
CentOS7系统DNS主从配置:一.DNS服务器正向解析:1.1 基础环境:主机IP 主机名 操作系统 用途192.168.0.110 master ...
- [原]CentOS7部署osm2pgsql
转载请注明原作者(think8848)和出处(http://think8848.cnblogs.com) 部署Postgresql和部署PostGis请参考前两篇文章 本文主要参考GitHub上osm ...
- centos7 部署ssserver
centos7 部署shadowsocks服务端 为什么要选centos7? 以后centos7 肯定是主流,在不重要的环境还是尽量使用新系统吧 centos7 的坑 默认可能会有firewall 或 ...
- CentOS7系统安装DNS服务
CentOS7系统安装DNS服务 30.1.DNS是什么? DNS ( Domain Name System )是"域名系统"的英文缩写,简单来说就是一个数据库,用于存储网络中IP ...
- Linux 自动化部署DNS服务器
Linux 自动化部署DNS服务器 1.首先配置主DNS服务器的IP地址,DNS地址一个写主dns的IP地址,一个写从dns的地址,这里也可以不写,在测试的时候在/etc/resolv.conf中添加 ...
- linux系统下部署DNS正向解析
DNS服务概述: DNS(Domain Name System)域名系统,能够提供域名与IP地址的解析服务. 正向解析 正向解析是指域名到IP 地址的解析过程. 部署DNS正向解析 DNS服务的三个配 ...
- centos7 部署 docker compose
=============================================== 2019/4/10_第1次修改 ccb_warlock == ...
- centos7 部署 docker ce
=============================================== 2019/4/9_第1次修改 ccb_warlock === ...
- centos7 部署 open-falcon 0.2.0
=============================================== 2019/4/29_第3次修改 ccb_warlock 更新 ...
随机推荐
- 网页偶现性崩溃-chrome
简介: 项目前台框架:Angular2 + Bootstrap(日期等组件) + Echarts + 响应式(包括页面.字体缩放:rem) chrome版本:多个版本测试均有此问题. 表现: 订单详情 ...
- expdp错误案例
转自:https://www.cnblogs.com/kerrycode/p/3960328.html Oracle数据泵(Data Dump)使用过程当中经常会遇到一些奇奇怪怪的错误案例,下面总结一 ...
- ps修改图片文字
原图(机密内容以打马赛克): 需要修改的地方: 1.去除蓝色的线条, 2.改表格的字体 操作: 1.去线条 放大图片,使用魔棒工具选中蓝色点,调节容差,取消连续,然后填充白色,ctrl+delete ...
- python学习第四天笔记整理
一.迭代器及生成器 #迭代器:迭代的工具 #1 什么是迭代:指的是一个重复的过程,每一次重复称为一次迭代,并且每一次重复的结果是下一次重复的初始值# while True:# print('===== ...
- linux 硬盘
df -hT 查看格式 各种文件 mount命令 可以挂载那些块设备:光盘.磁盘分区.U盘 光盘:文件系统:iso9660 iso文件文件系统:iso9660 iso文件可以进行挂载的 mount c ...
- shell实例利用crontab自动清除日志
shell实例利用crontab自动清除日志 程序运行会产生很多的日志,对于无用的日志手动删除比价麻烦,写一个自动执行的命令是很有必要的. 删除文件shell命令 find 对应目录 -mtime + ...
- Fiddler的配置
增加监控请求的详情时间 //添加请求的响应时间 public static BindUIColumn("Time Taken") function CalcT ...
- Asp.net Security框架（1）
Security框架主要用于身份认证的,基本上所有Asp.net项目有意或者无意的都在使用的,框架的源码包含在Katana项目下. 最常见的使用方式或许就是SignIn来给客户端浏览器生成包含身份信息 ...
- weblogic.xml 精妙设置
1.一:weblogic 页面访问速度比tomcat慢的原因和解决办法 一:weblogic 页面访问速度比tomcat慢的原因和解决办法 公司有个项目,部署在weblogic8.1上之后,发现比在t ...
- 移动APP外挂攻防实战
前言 近日,某某龙在2018年的一次会议上发表了一个演讲,4000多人聚集在现场玩“跳一跳”游戏.随着他们指尖的翻飞跳跃,大屏幕上的现场排名也在不断刷新……而在全场的惊叹声中,最高分出现了,967分! ...