centos7部署DNS-1
文章索引：
一、服务相关介绍
二、实验：搭建正向主DNS服务器
三、实验：搭建反向解析服务器
四、实验：泛域名解析，如wwww.baidu.com也可以正常访问
环境
服务器 节点名称 IP地址
dns node5 192.168.216.198
web1 web1 192.168.216.199
web2 web2 192.168.216.202
一、服务相关介绍
DNS服务，程序包名bind，程序名named
1、程序包：
bind：提供dns server程序，以及几个常用的测试程序；
bind-libs：被bind和bind-utils包中的程序共同用到的库文件；
bind-utils：bind程序端程序集，提供了，dig，host，nslookup等相关工具；
bind-chroot:选装，提供了一种安全机制；通常公司内部使用不需要安装；
2、bind
服务脚本：/etc/rc.d/init.d/named
主配置文件：/etc/named.conf,/etc/named.rfc1912.zones,/etc/rndc.key(远程管理，其实只在本地)
解析库文件：/var/named/ZONE_NAME.ZONE
注意：
1)一台物理服务器可同时为多个区域提供解析；
2)必须有根区域文件；named.ca
3)应该有两个（不包括ipv6）实现localhost和本地回环地址的解析库；
正向：named.localhost
反向：named.loopback
rndc命令：remote name domain controller,默认与bind安装在同一个主机，且只能通过127.0.0.1来俩姐named进程；提供辅助性的管理功能；端口953/tcp
二、开始搭建正向主DNS服务器
1、安装yum install bind -y
node5
yum install bind -y
Installed:
bind.x86_64 :9.9.-.el7_5. Dependency Updated:
bind-libs.x86_64 :9.9.-.el7_5. bind-libs-lite.x86_64 :9.9.-.el7_5.
bind-license.noarch :9.9.-.el7_5. bind-utils.x86_64 :9.9.-.el7_5.
cat /var/named/named.ca 看一下全球的13各根节点
[root@node5 ~]# cat /var/named/named.ca
; <<>> DiG 9.9.-RedHat-9.9.-.el7_3. <<>> +bufsize= +norec @a.root-servers.net
; ( servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
;; flags: qr aa; QUERY: , ANSWER: , AUTHORITY: , ADDITIONAL: ;; OPT PSEUDOSECTION:
; EDNS: version: , flags:; udp:
;; QUESTION SECTION:
;. IN NS ;; ANSWER SECTION:
. IN NS a.root-servers.net.
. IN NS b.root-servers.net.
. IN NS c.root-servers.net.
. IN NS d.root-servers.net.
. IN NS e.root-servers.net.
. IN NS f.root-servers.net.
. IN NS g.root-servers.net.
. IN NS h.root-servers.net.
. IN NS i.root-servers.net.
. IN NS j.root-servers.net.
. IN NS k.root-servers.net.
. IN NS l.root-servers.net.
. IN NS m.root-servers.net. ;; ADDITIONAL SECTION:
a.root-servers.net. IN A 198.41.0.4
a.root-servers.net. IN AAAA ::ba3e:::
b.root-servers.net. IN A 192.228.79.201
b.root-servers.net. IN AAAA ::::b
c.root-servers.net. IN A 192.33.4.12
c.root-servers.net. IN AAAA ::::c
d.root-servers.net. IN A 199.7.91.13
d.root-servers.net. IN AAAA ::2d::d
e.root-servers.net. IN A 192.203.230.10
e.root-servers.net. IN AAAA ::a8::e
f.root-servers.net. IN A 192.5.5.241
f.root-servers.net. IN AAAA ::2f::f
g.root-servers.net. IN A 192.112.36.4
g.root-servers.net. IN AAAA ::::d0d
h.root-servers.net. IN A 198.97.190.53
h.root-servers.net. IN AAAA ::::
i.root-servers.net. IN A 192.36.148.17
i.root-servers.net. IN AAAA :7fe::
j.root-servers.net. IN A 192.58.128.30
j.root-servers.net. IN AAAA ::c27:::
k.root-servers.net. IN A 193.0.14.129
k.root-servers.net. IN AAAA :7fd::
l.root-servers.net. IN A 199.7.83.42
l.root-servers.net. IN AAAA ::9f::
m.root-servers.net. IN A 202.12.27.33
m.root-servers.net. IN AAAA :dc3:: ;; Query time: msec
;; SERVER: 198.41.0.4#(198.41.0.4)
;; WHEN: Po kv臎 :: CEST
;; MSG SIZE rcvd: [root@node5 ~]#
查看一下监听端口是否监听
[root@node5 ~]# ss -tunlop |grep
udp UNCONN *: *:* users:(("avahi-daemon",pid=,fd=))
udp UNCONN 192.168.122.1: *:* users:(("dnsmasq",pid=,fd=))
tcp LISTEN 192.168.122.1: *:* users:(("dnsmasq",pid=,fd=))
2、修改主配置文件：
全局配置：options{}
日志子系统配置：logging{}
区域定义：本机能够为哪些zone进行解析，就要定义哪些zone；
zone "ZONE_NAME" IN {}
注意：任何服务程序如果期望其能够通过网络被其他主机访问，至少应该监听在一个能与外部主机通信的IP地址上；
备份配置文件
cp -v /etc/named.conf {,.bak}
编辑vim /etc/named.conf
[root@node5 ~]# vim /etc/named.conf //
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html options {
15 listen-on port 53 {192.168.216.198; 127.0.0.1; }; #添加本机地址，这里也可以any；
16 //listen-on-v6 port 53 { ::1; }; #注释v6；
directory "/var/named"; #定义区域配置文件路径；
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; }; #允许所有人；
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes; dnssec-enable yes; #学习过程可以关掉改成no
dnssec-validation yes; #可以先关掉，也是改成no
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic"; pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
}; logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
}; zone "." IN {
type hint;
file "named.ca";
}; include "/etc/named.rfc1912.zones"; #这个文件定义区域配置文件
include "/etc/named.root.key"; ~
~
~
~
"/etc/named.conf" 59L, 1723C written
重启服务查看监听端口的变化
[root@node5 ~]# systemctl restart named
[root@node5 ~]# ss -tunlp |grep
udp UNCONN *: *:* users:(("avahi-daemon",pid=,fd=))
udp UNCONN 192.168.216.198: *:* users:(("named",pid=,fd=),("named",pid=,fd=),("named",pid=,fd=),("named",pid=,fd=))
udp UNCONN 127.0.0.1: *:* users:(("named",pid=,fd=),("named",pid=,fd=),("named",pid=,fd=),("named",pid=,fd=))
udp UNCONN 192.168.122.1: *:* users:(("dnsmasq",pid=,fd=))
tcp LISTEN 192.168.216.198: *:* users:(("named",pid=,fd=))
tcp LISTEN 127.0.0.1: *:* users:(("named",pid=,fd=))
tcp LISTEN 192.168.122.1: *:* users:(("dnsmasq",pid=,fd=))
tcp LISTEN 127.0.0.1: *:* users:(("named",pid=,fd=))
tcp LISTEN ::: :::* users:(("named",pid=,fd=))
[root@node5 ~]#
3、修改区域解析文件
[root@node5 ~]# vim /etc/named.rfc1912.zones zone "www.web1.com"
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
// zone "localhost.localdomain" IN {
type master;
file "named.localhost";
allow-update { none; };
}; zone "localhost" IN {
type master;
file "named.localhost";
allow-update { none; };
}; zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
}; zone "1.0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
}; zone "0.in-addr.arpa" IN {
type master;
file "named.empty";
allow-update { none; };
};
45 zone "zhangxingeng.com" IN {
46 type master;
47 file "zhangxingeng.com.zone"；
48 };
4、创建区域解析数据库文件（也就是正向解析）
vim /var/named/zhangxingeng.com.zone
[root@node5 named]# cat /var/named/zhangxingeng.com.zone
$TTL
$ORIGIN zhangxingeng.com.
@ IN SOA dns1.zhangxingeng.com. admin.zhangxingeng.com. (
; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
zhangxingeng.com. IN NS dns1
IN MX mail
web1 IN A 192.168.216.199.
dns1 IN A 192.168.216.198.
mail IN A 192.168.216.199.
www IN CNAME web1
5、web1当作客户端ip-199
安装nginx
yum install nginx -y
echo welcome to web1 >/usr/share/nginx/html/index.html
systemctl start nginx
systemctl enable nginx
ss -tunlp |grep 80
web1的web服务器已经搭建好
更改dns
1 [root@web1 ~]# cat /etc/sysconfig/network-scripts/ifcfg-ens33
2 TYPE="Ethernet"
3 BOOTPROTO="dhcp"
4 DEFROUTE="yes"
5 PEERDNS="yes"
6 PEERROUTES="yes"
7 IPV4_FAILURE_FATAL="no"
8 IPV6INIT="yes"
9 IPV6_AUTOCONF="yes"
10 IPV6_DEFROUTE="yes"
11 IPV6_PEERDNS="yes"
12 IPV6_PEERROUTES="yes"
13 IPV6_FAILURE_FATAL="no"
14 IPV6_ADDR_GEN_MODE="stable-privacy"
15 NAME="ens33"
16 UUID="4f788080-131a-4f10-85a8-179b4f14ab48"
17 DEVICE="ens33"
18 ONBOOT="yes"
19 DNS1=192.168.216.198
20 [root@web1 ~]#
6、语法检查
named-checkconf 主配置文件语法
named-checkzone "zhangxingeng.com" /var/named/zhangxingeng.com.zone 解析库文件语法检查
7、重启服务
sytemctl reload named或rndc reload
8、node5（dns服务器）安装nginx，http服务器
yum -y install nginx
echo welcome to web1 >/usr/share/nginx/html/index.html
systemctl start nginx
systemctl enable nginx
9、web1测试
用dig命令测试
格式
dig [-t RR_TYPE] name [@server] [query options]
查询
+[no]trace:跟踪解析过程；
+[no]recurse:进行递归解析；
反向解析
dig -x IPADDR
默认完全区域传输
dig -t axfr DOMAIN [@server]
比如：
查询baidu.com的NS记录
dig -t NS baidu.com
跟踪解析www.baidu.com的过程
dig +trace www.baidu.com
解析www.baidu.com的A记录
dig -t A www.baidu.com
1 root@web1 ~]# dig -t A dns1.zhangxingeng.com @192.168.216.198 ; <<>> DiG 9.9.-RedHat-9.9.-.el7 <<>> -t A dns1.zhangxingeng.com @192.168.216.198
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
;; flags: qr aa rd ra; QUERY: , ANSWER: , AUTHORITY: , ADDITIONAL: ;; OPT PSEUDOSECTION:
; EDNS: version: , flags:; udp:
;; QUESTION SECTION:
;dns1.zhangxingeng.com. IN A ;; ANSWER SECTION:
dns1.zhangxingeng.com. IN A 192.168.216.198 ;; AUTHORITY SECTION:
zhangxingeng.com. IN NS dns1.zhangxingeng.com. ;; Query time: msec
;; SERVER: 192.168.216.198#(192.168.216.198)
;; WHEN: Thu Nov :: CST
;; MSG SIZE rcvd:
1 [root@web1 ~]# dig -t CNAME dns1.zhangxingeng.com @192.168.216.198 ; <<>> DiG 9.9.-RedHat-9.9.-.el7 <<>> -t CNAME dns1.zhangxingeng.com @192.168.216.198
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
;; flags: qr aa rd ra; QUERY: , ANSWER: , AUTHORITY: , ADDITIONAL: ;; OPT PSEUDOSECTION:
; EDNS: version: , flags:; udp:
;; QUESTION SECTION:
;dns1.zhangxingeng.com. IN CNAME ;; AUTHORITY SECTION:
zhangxingeng.com. IN SOA dns1.zhangxingeng.com. admin.zhangxingeng.com. ;; Query time: msec
;; SERVER: 192.168.216.198#(192.168.216.198)
;; WHEN: Thu Nov :: CST
;; MSG SIZE rcvd: [root@web1 ~]# curl www.zhangxingeng.com
welcome to web1
[root@web1 ~]#
1 [root@web1 ~]# dig -t NS dns1.zhangxingeng.com @192.168.216.198 ; <<>> DiG 9.9.-RedHat-9.9.-.el7 <<>> -t NS dns1.zhangxingeng.com @192.168.216.198
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
;; flags: qr aa rd ra; QUERY: , ANSWER: , AUTHORITY: , ADDITIONAL: ;; OPT PSEUDOSECTION:
; EDNS: version: , flags:; udp:
;; QUESTION SECTION:
;dns1.zhangxingeng.com. IN NS ;; AUTHORITY SECTION:
zhangxingeng.com. IN SOA dns1.zhangxingeng.com. admin.zhangxingeng.com. ;; Query time: msec
;; SERVER: 192.168.216.198#(192.168.216.198)
;; WHEN: Thu Nov :: CST
;; MSG SIZE rcvd:
访问一下dns服务器部署的http服务
[root@web1 ~]# curl dns1.zhangxingeng.com
welcome to dns1
[root@web1 ~]#
三、开始搭建反向解析
1、定义区域文件
~
[root@node5 named]# vim /etc/named.rfc1912.zones // named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
// zone "localhost.localdomain" IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "localhost" IN {
type master;
file "named.localhost";
allow-update { none; };
}; zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
}; zone "1.0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
}; zone "0.in-addr.arpa" IN {
type master;
file "named.empty";
allow-update { none; };
};
zone "zhangxingeng.com" IN {
type master;
file "zhangxingeng.com.zone";
};
zone "216.168.192.in-addr.arpa" IN {
49 type master;
50 file "192.168.216.zone";
51 };
2、定义区域解析库
cd /var/named/
[root@node5 named]# cat 192.168..zone
$TTL
$ORIGIN 216.168..in-addr.arpa.
@ IN SOA zhangxingeng.com. admin.zhangxingeng.com. (
; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
IN NS web1.zhangxingeng.com.
IN NS dns1.zhangxingeng.com.
IN PTR web1.zhangxingeng.com.
IN PTR dns1.zhangxingeng.com.
IN PTR mail.zhangxingeng.com.
IN PTR www.zhangxingeng.com.
3、语法测试
[root@node5 named]# named-checkconf
[root@node5 named]# named-checkzone zhangxingeng.com. zhangxingeng.com.zone
zone zhangxingeng.com/IN: zhangxingeng.com/MX 'mail.zhangxigneng.com' (out of zone) has no addresses records (A or AAAA)
zone zhangxingeng.com/IN: loaded serial
OK
[root@node5 named]# named-checkzone 216.168..in-addr.arpa. 192.168..zone
zone 216.168..in-addr.arpa/IN: loaded serial
OK
[root@node5 named]#
4、重启主服务器配置
rndc reload
systemctl status named.service
5、测试
命令dig -x ipaddr
web1上测试
1 [root@web1 ~]# dig -x 192.168.216.198 ; <<>> DiG 9.9.-RedHat-9.9.-.el7 <<>> -x 192.168.216.198
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
;; flags: qr aa rd ra; QUERY: , ANSWER: , AUTHORITY: , ADDITIONAL: ;; OPT PSEUDOSECTION:
; EDNS: version: , flags:; udp:
;; QUESTION SECTION:
;198.216.168.192.in-addr.arpa. IN PTR ;; ANSWER SECTION:
198.216.168.192.in-addr.arpa. IN PTR dns1.zhangxingeng.com. ;; AUTHORITY SECTION:
18 216.168.192.in-addr.arpa. 3600 IN NS dns1.zhangxingeng.com.
19 216.168.192.in-addr.arpa. 3600 IN NS web1.zhangxingeng.com. ;; ADDITIONAL SECTION:
22 web1.zhangxingeng.com. 86400 IN A 192.168.216.199
23 dns1.zhangxingeng.com. 86400 IN A 192.168.216.198 ;; Query time: msec
;; SERVER: 192.168.216.198#(192.168.216.198)
;; WHEN: Wed Nov :: CST
;; MSG SIZE rcvd: [root@web1 ~]#
能够解析出web1和dns1
四、泛域名解析，提高访问的感受
即使将主机名写错，也能正常访问
1、修改区域解析库，添加一条A记录即可
[root@node5 named]# vim /var/named/zhangxingeng.com.zone $TTL
$ORIGIN zhangxingeng.com.
@ IN SOA dns1.zhangxingeng.com. admin.zhangxingeng.com. (
; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
zhangxingeng.com. IN NS dns1
IN MX mail
web1 IN A 192.168.216.199.
dns1 IN A 192.168.216.198.
mail IN A 192.168.216.199.
www IN CNAME web1
17 * IN A 192.168.216.199.
2、简单测试一下
1 [root@node5 named]# curl web11.zhangxingeng.com
welcome to web1
[root@node5 named]#
待续。。。
转载请注明出处：https://www.cnblogs.com/zhangxingeng/p/9983944.html
centos7部署DNS-1的更多相关文章
- centos7 部署dns服务器
=============================================== 2017/12/6_第2次修改 ccb_warlock 20 ...
- CentOS7系统DNS主从配置
CentOS7系统DNS主从配置:一.DNS服务器正向解析:1.1 基础环境:主机IP 主机名 操作系统 用途192.168.0.110 master ...
- [原]CentOS7部署osm2pgsql
转载请注明原作者(think8848)和出处(http://think8848.cnblogs.com) 部署Postgresql和部署PostGis请参考前两篇文章 本文主要参考GitHub上osm ...
- centos7 部署ssserver
centos7 部署shadowsocks服务端 为什么要选centos7? 以后centos7 肯定是主流,在不重要的环境还是尽量使用新系统吧 centos7 的坑 默认可能会有firewall 或 ...
- CentOS7系统安装DNS服务
CentOS7系统安装DNS服务 30.1.DNS是什么? DNS ( Domain Name System )是"域名系统"的英文缩写,简单来说就是一个数据库,用于存储网络中IP ...
- Linux 自动化部署DNS服务器
Linux 自动化部署DNS服务器 1.首先配置主DNS服务器的IP地址,DNS地址一个写主dns的IP地址,一个写从dns的地址,这里也可以不写,在测试的时候在/etc/resolv.conf中添加 ...
- linux系统下部署DNS正向解析
DNS服务概述: DNS(Domain Name System)域名系统,能够提供域名与IP地址的解析服务. 正向解析 正向解析是指域名到IP 地址的解析过程. 部署DNS正向解析 DNS服务的三个配 ...
- centos7 部署 docker compose
=============================================== 2019/4/10_第1次修改 ccb_warlock == ...
- centos7 部署 docker ce
=============================================== 2019/4/9_第1次修改 ccb_warlock === ...
- centos7 部署 open-falcon 0.2.0
=============================================== 2019/4/29_第3次修改 ccb_warlock 更新 ...
随机推荐
- 计算机网络四：网卡与MAC地址
网卡与MAC地址 ㈠网卡 1.网卡定义 网卡是工作在OSI的数据链路层的网络组件,是局域网中连接计算机和传输介质(网线或WIFI信号)的接口,不仅能实现与局域网传输介质之间的物理连接和电信号匹配,还涉 ...
- <笔记>字体文件的路径问题
如果做过虚拟域名,不可以通过127.0.0.1来访问字体文件 改成通过虚拟域名访问,就没问题: 不过更建议使用相对路径
- day_12函数默认值，数据类型的补充，函数对象名称空间与作用域，函数的嵌套定义
复习, 昨天讲了字符串的比较,按照从左往右比较每一个字符,通过字符对应的ASCII码进行比较 函数的参数,‘ 实参与形参 形参:在函数定义时()中出现的参数 实参,在函数调用时()中出现的参数 实参的 ...
- 读书笔记二 How Does the Internet work？
原文链接: https://web.stanford.edu/class/msande91si/www-spr04/readings/week1/InternetWhitepaper.htm 先写写 ...
- PMP学习总结(1) -- 引论
3月18日考试,1个月后出的成绩,当我拿到Pass的结果的时候还是蛮开心的,因为在备考期间,公司项目十分紧急,经常加班到晚上9,10点,而且宝贝女儿也在这个期间出生,所以备考是十分辛苦的,经常晚上11 ...
- Chrome部分站点无法启用Flash问题
## 69.0之前 ## 1. 打开 chrome://settings/content/flash 2. 禁止网站运行Flash -> 改为“先询问(推荐)” 3. 允许->添加 4. ...
- Java语言中的面向对象特性
面向对象的基本特征 1．封装性 封装性就是把对象的属性和服务结合成一个独立的相同单位,并尽可能隐蔽对象的内部细节,包含两个含义: ◇ 把对象的全部属性和全部服务结合在一起,形成一个不可分割的独立单位( ...
- Webview 浏览器开源项目总结
在Android开发中,我们不免会遇到使用WebView实现网页展示的需求,以下是本人之前star的开源项目,供大家参考: 一.CrosswalkWebview 项目地址:https://github ...
- 移动端调试神器-vConsole
什么是vConsole? 官方说明是一个web前端开发者面板,可用于展示console日志,方便日常开发,调试. 简单来说相当于移动版的Chrome调试控制台,就是我们在PC端常用的F12 vCo ...
- gcc编译参数详解一（-ffunction-sections -fdata-sections）
背景 有时我们的程序会定义一些暂时使用不上的功能和函数,虽然我们不使用这些功能和函数,但它们往往会浪费我们的ROM和RAM的空间.这在使用静态库时,体现的更为严重.有时,我们只使用了静态库仅有的几个功 ...