centos7部署DNS-1
文章索引：
一、服务相关介绍
二、实验：搭建正向主DNS服务器
三、实验：搭建反向解析服务器
四、实验：泛域名解析，如wwww.baidu.com也可以正常访问
环境
服务器 节点名称 IP地址
dns node5 192.168.216.198
web1 web1 192.168.216.199
web2 web2 192.168.216.202
一、服务相关介绍
DNS服务，程序包名bind，程序名named
1、程序包：
bind：提供dns server程序，以及几个常用的测试程序；
bind-libs：被bind和bind-utils包中的程序共同用到的库文件；
bind-utils：bind程序端程序集，提供了，dig，host，nslookup等相关工具；
bind-chroot:选装，提供了一种安全机制；通常公司内部使用不需要安装；
2、bind
服务脚本：/etc/rc.d/init.d/named
主配置文件：/etc/named.conf,/etc/named.rfc1912.zones,/etc/rndc.key(远程管理，其实只在本地)
解析库文件：/var/named/ZONE_NAME.ZONE
注意：
1)一台物理服务器可同时为多个区域提供解析；
2)必须有根区域文件；named.ca
3)应该有两个（不包括ipv6）实现localhost和本地回环地址的解析库；
正向：named.localhost
反向：named.loopback
rndc命令：remote name domain controller,默认与bind安装在同一个主机，且只能通过127.0.0.1来俩姐named进程；提供辅助性的管理功能；端口953/tcp
二、开始搭建正向主DNS服务器
1、安装yum install bind -y
node5
yum install bind -y
Installed:
bind.x86_64 :9.9.-.el7_5. Dependency Updated:
bind-libs.x86_64 :9.9.-.el7_5. bind-libs-lite.x86_64 :9.9.-.el7_5.
bind-license.noarch :9.9.-.el7_5. bind-utils.x86_64 :9.9.-.el7_5.
cat /var/named/named.ca 看一下全球的13各根节点
[root@node5 ~]# cat /var/named/named.ca
; <<>> DiG 9.9.-RedHat-9.9.-.el7_3. <<>> +bufsize= +norec @a.root-servers.net
; ( servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
;; flags: qr aa; QUERY: , ANSWER: , AUTHORITY: , ADDITIONAL: ;; OPT PSEUDOSECTION:
; EDNS: version: , flags:; udp:
;; QUESTION SECTION:
;. IN NS ;; ANSWER SECTION:
. IN NS a.root-servers.net.
. IN NS b.root-servers.net.
. IN NS c.root-servers.net.
. IN NS d.root-servers.net.
. IN NS e.root-servers.net.
. IN NS f.root-servers.net.
. IN NS g.root-servers.net.
. IN NS h.root-servers.net.
. IN NS i.root-servers.net.
. IN NS j.root-servers.net.
. IN NS k.root-servers.net.
. IN NS l.root-servers.net.
. IN NS m.root-servers.net. ;; ADDITIONAL SECTION:
a.root-servers.net. IN A 198.41.0.4
a.root-servers.net. IN AAAA ::ba3e:::
b.root-servers.net. IN A 192.228.79.201
b.root-servers.net. IN AAAA ::::b
c.root-servers.net. IN A 192.33.4.12
c.root-servers.net. IN AAAA ::::c
d.root-servers.net. IN A 199.7.91.13
d.root-servers.net. IN AAAA ::2d::d
e.root-servers.net. IN A 192.203.230.10
e.root-servers.net. IN AAAA ::a8::e
f.root-servers.net. IN A 192.5.5.241
f.root-servers.net. IN AAAA ::2f::f
g.root-servers.net. IN A 192.112.36.4
g.root-servers.net. IN AAAA ::::d0d
h.root-servers.net. IN A 198.97.190.53
h.root-servers.net. IN AAAA ::::
i.root-servers.net. IN A 192.36.148.17
i.root-servers.net. IN AAAA :7fe::
j.root-servers.net. IN A 192.58.128.30
j.root-servers.net. IN AAAA ::c27:::
k.root-servers.net. IN A 193.0.14.129
k.root-servers.net. IN AAAA :7fd::
l.root-servers.net. IN A 199.7.83.42
l.root-servers.net. IN AAAA ::9f::
m.root-servers.net. IN A 202.12.27.33
m.root-servers.net. IN AAAA :dc3:: ;; Query time: msec
;; SERVER: 198.41.0.4#(198.41.0.4)
;; WHEN: Po kv臎 :: CEST
;; MSG SIZE rcvd: [root@node5 ~]#
查看一下监听端口是否监听
[root@node5 ~]# ss -tunlop |grep
udp UNCONN *: *:* users:(("avahi-daemon",pid=,fd=))
udp UNCONN 192.168.122.1: *:* users:(("dnsmasq",pid=,fd=))
tcp LISTEN 192.168.122.1: *:* users:(("dnsmasq",pid=,fd=))
2、修改主配置文件：
全局配置：options{}
日志子系统配置：logging{}
区域定义：本机能够为哪些zone进行解析，就要定义哪些zone；
zone "ZONE_NAME" IN {}
注意：任何服务程序如果期望其能够通过网络被其他主机访问，至少应该监听在一个能与外部主机通信的IP地址上；
备份配置文件
cp -v /etc/named.conf {,.bak}
编辑vim /etc/named.conf
[root@node5 ~]# vim /etc/named.conf //
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html options {
15 listen-on port 53 {192.168.216.198; 127.0.0.1; }; #添加本机地址，这里也可以any；
16 //listen-on-v6 port 53 { ::1; }; #注释v6；
directory "/var/named"; #定义区域配置文件路径；
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; }; #允许所有人；
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes; dnssec-enable yes; #学习过程可以关掉改成no
dnssec-validation yes; #可以先关掉，也是改成no
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic"; pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
}; logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
}; zone "." IN {
type hint;
file "named.ca";
}; include "/etc/named.rfc1912.zones"; #这个文件定义区域配置文件
include "/etc/named.root.key"; ~
~
~
~
"/etc/named.conf" 59L, 1723C written
重启服务查看监听端口的变化
[root@node5 ~]# systemctl restart named
[root@node5 ~]# ss -tunlp |grep
udp UNCONN *: *:* users:(("avahi-daemon",pid=,fd=))
udp UNCONN 192.168.216.198: *:* users:(("named",pid=,fd=),("named",pid=,fd=),("named",pid=,fd=),("named",pid=,fd=))
udp UNCONN 127.0.0.1: *:* users:(("named",pid=,fd=),("named",pid=,fd=),("named",pid=,fd=),("named",pid=,fd=))
udp UNCONN 192.168.122.1: *:* users:(("dnsmasq",pid=,fd=))
tcp LISTEN 192.168.216.198: *:* users:(("named",pid=,fd=))
tcp LISTEN 127.0.0.1: *:* users:(("named",pid=,fd=))
tcp LISTEN 192.168.122.1: *:* users:(("dnsmasq",pid=,fd=))
tcp LISTEN 127.0.0.1: *:* users:(("named",pid=,fd=))
tcp LISTEN ::: :::* users:(("named",pid=,fd=))
[root@node5 ~]#
3、修改区域解析文件
[root@node5 ~]# vim /etc/named.rfc1912.zones zone "www.web1.com"
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
// zone "localhost.localdomain" IN {
type master;
file "named.localhost";
allow-update { none; };
}; zone "localhost" IN {
type master;
file "named.localhost";
allow-update { none; };
}; zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
}; zone "1.0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
}; zone "0.in-addr.arpa" IN {
type master;
file "named.empty";
allow-update { none; };
};
45 zone "zhangxingeng.com" IN {
46 type master;
47 file "zhangxingeng.com.zone"；
48 };
4、创建区域解析数据库文件（也就是正向解析）
vim /var/named/zhangxingeng.com.zone
[root@node5 named]# cat /var/named/zhangxingeng.com.zone
$TTL
$ORIGIN zhangxingeng.com.
@ IN SOA dns1.zhangxingeng.com. admin.zhangxingeng.com. (
; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
zhangxingeng.com. IN NS dns1
IN MX mail
web1 IN A 192.168.216.199.
dns1 IN A 192.168.216.198.
mail IN A 192.168.216.199.
www IN CNAME web1
5、web1当作客户端ip-199
安装nginx
yum install nginx -y
echo welcome to web1 >/usr/share/nginx/html/index.html
systemctl start nginx
systemctl enable nginx
ss -tunlp |grep 80
web1的web服务器已经搭建好
更改dns
1 [root@web1 ~]# cat /etc/sysconfig/network-scripts/ifcfg-ens33
2 TYPE="Ethernet"
3 BOOTPROTO="dhcp"
4 DEFROUTE="yes"
5 PEERDNS="yes"
6 PEERROUTES="yes"
7 IPV4_FAILURE_FATAL="no"
8 IPV6INIT="yes"
9 IPV6_AUTOCONF="yes"
10 IPV6_DEFROUTE="yes"
11 IPV6_PEERDNS="yes"
12 IPV6_PEERROUTES="yes"
13 IPV6_FAILURE_FATAL="no"
14 IPV6_ADDR_GEN_MODE="stable-privacy"
15 NAME="ens33"
16 UUID="4f788080-131a-4f10-85a8-179b4f14ab48"
17 DEVICE="ens33"
18 ONBOOT="yes"
19 DNS1=192.168.216.198
20 [root@web1 ~]#
6、语法检查
named-checkconf 主配置文件语法
named-checkzone "zhangxingeng.com" /var/named/zhangxingeng.com.zone 解析库文件语法检查
7、重启服务
sytemctl reload named或rndc reload
8、node5（dns服务器）安装nginx，http服务器
yum -y install nginx
echo welcome to web1 >/usr/share/nginx/html/index.html
systemctl start nginx
systemctl enable nginx
9、web1测试
用dig命令测试
格式
dig [-t RR_TYPE] name [@server] [query options]
查询
+[no]trace:跟踪解析过程；
+[no]recurse:进行递归解析；
反向解析
dig -x IPADDR
默认完全区域传输
dig -t axfr DOMAIN [@server]
比如：
查询baidu.com的NS记录
dig -t NS baidu.com
跟踪解析www.baidu.com的过程
dig +trace www.baidu.com
解析www.baidu.com的A记录
dig -t A www.baidu.com
1 root@web1 ~]# dig -t A dns1.zhangxingeng.com @192.168.216.198 ; <<>> DiG 9.9.-RedHat-9.9.-.el7 <<>> -t A dns1.zhangxingeng.com @192.168.216.198
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
;; flags: qr aa rd ra; QUERY: , ANSWER: , AUTHORITY: , ADDITIONAL: ;; OPT PSEUDOSECTION:
; EDNS: version: , flags:; udp:
;; QUESTION SECTION:
;dns1.zhangxingeng.com. IN A ;; ANSWER SECTION:
dns1.zhangxingeng.com. IN A 192.168.216.198 ;; AUTHORITY SECTION:
zhangxingeng.com. IN NS dns1.zhangxingeng.com. ;; Query time: msec
;; SERVER: 192.168.216.198#(192.168.216.198)
;; WHEN: Thu Nov :: CST
;; MSG SIZE rcvd:
1 [root@web1 ~]# dig -t CNAME dns1.zhangxingeng.com @192.168.216.198 ; <<>> DiG 9.9.-RedHat-9.9.-.el7 <<>> -t CNAME dns1.zhangxingeng.com @192.168.216.198
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
;; flags: qr aa rd ra; QUERY: , ANSWER: , AUTHORITY: , ADDITIONAL: ;; OPT PSEUDOSECTION:
; EDNS: version: , flags:; udp:
;; QUESTION SECTION:
;dns1.zhangxingeng.com. IN CNAME ;; AUTHORITY SECTION:
zhangxingeng.com. IN SOA dns1.zhangxingeng.com. admin.zhangxingeng.com. ;; Query time: msec
;; SERVER: 192.168.216.198#(192.168.216.198)
;; WHEN: Thu Nov :: CST
;; MSG SIZE rcvd: [root@web1 ~]# curl www.zhangxingeng.com
welcome to web1
[root@web1 ~]#
1 [root@web1 ~]# dig -t NS dns1.zhangxingeng.com @192.168.216.198 ; <<>> DiG 9.9.-RedHat-9.9.-.el7 <<>> -t NS dns1.zhangxingeng.com @192.168.216.198
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
;; flags: qr aa rd ra; QUERY: , ANSWER: , AUTHORITY: , ADDITIONAL: ;; OPT PSEUDOSECTION:
; EDNS: version: , flags:; udp:
;; QUESTION SECTION:
;dns1.zhangxingeng.com. IN NS ;; AUTHORITY SECTION:
zhangxingeng.com. IN SOA dns1.zhangxingeng.com. admin.zhangxingeng.com. ;; Query time: msec
;; SERVER: 192.168.216.198#(192.168.216.198)
;; WHEN: Thu Nov :: CST
;; MSG SIZE rcvd:
访问一下dns服务器部署的http服务
[root@web1 ~]# curl dns1.zhangxingeng.com
welcome to dns1
[root@web1 ~]#
三、开始搭建反向解析
1、定义区域文件
~
[root@node5 named]# vim /etc/named.rfc1912.zones // named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
// zone "localhost.localdomain" IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "localhost" IN {
type master;
file "named.localhost";
allow-update { none; };
}; zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
}; zone "1.0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
}; zone "0.in-addr.arpa" IN {
type master;
file "named.empty";
allow-update { none; };
};
zone "zhangxingeng.com" IN {
type master;
file "zhangxingeng.com.zone";
};
zone "216.168.192.in-addr.arpa" IN {
49 type master;
50 file "192.168.216.zone";
51 };
2、定义区域解析库
cd /var/named/
[root@node5 named]# cat 192.168..zone
$TTL
$ORIGIN 216.168..in-addr.arpa.
@ IN SOA zhangxingeng.com. admin.zhangxingeng.com. (
; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
IN NS web1.zhangxingeng.com.
IN NS dns1.zhangxingeng.com.
IN PTR web1.zhangxingeng.com.
IN PTR dns1.zhangxingeng.com.
IN PTR mail.zhangxingeng.com.
IN PTR www.zhangxingeng.com.
3、语法测试
[root@node5 named]# named-checkconf
[root@node5 named]# named-checkzone zhangxingeng.com. zhangxingeng.com.zone
zone zhangxingeng.com/IN: zhangxingeng.com/MX 'mail.zhangxigneng.com' (out of zone) has no addresses records (A or AAAA)
zone zhangxingeng.com/IN: loaded serial
OK
[root@node5 named]# named-checkzone 216.168..in-addr.arpa. 192.168..zone
zone 216.168..in-addr.arpa/IN: loaded serial
OK
[root@node5 named]#
4、重启主服务器配置
rndc reload
systemctl status named.service
5、测试
命令dig -x ipaddr
web1上测试
1 [root@web1 ~]# dig -x 192.168.216.198 ; <<>> DiG 9.9.-RedHat-9.9.-.el7 <<>> -x 192.168.216.198
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
;; flags: qr aa rd ra; QUERY: , ANSWER: , AUTHORITY: , ADDITIONAL: ;; OPT PSEUDOSECTION:
; EDNS: version: , flags:; udp:
;; QUESTION SECTION:
;198.216.168.192.in-addr.arpa. IN PTR ;; ANSWER SECTION:
198.216.168.192.in-addr.arpa. IN PTR dns1.zhangxingeng.com. ;; AUTHORITY SECTION:
18 216.168.192.in-addr.arpa. 3600 IN NS dns1.zhangxingeng.com.
19 216.168.192.in-addr.arpa. 3600 IN NS web1.zhangxingeng.com. ;; ADDITIONAL SECTION:
22 web1.zhangxingeng.com. 86400 IN A 192.168.216.199
23 dns1.zhangxingeng.com. 86400 IN A 192.168.216.198 ;; Query time: msec
;; SERVER: 192.168.216.198#(192.168.216.198)
;; WHEN: Wed Nov :: CST
;; MSG SIZE rcvd: [root@web1 ~]#
能够解析出web1和dns1
四、泛域名解析，提高访问的感受
即使将主机名写错，也能正常访问
1、修改区域解析库，添加一条A记录即可
[root@node5 named]# vim /var/named/zhangxingeng.com.zone $TTL
$ORIGIN zhangxingeng.com.
@ IN SOA dns1.zhangxingeng.com. admin.zhangxingeng.com. (
; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
zhangxingeng.com. IN NS dns1
IN MX mail
web1 IN A 192.168.216.199.
dns1 IN A 192.168.216.198.
mail IN A 192.168.216.199.
www IN CNAME web1
17 * IN A 192.168.216.199.
2、简单测试一下
1 [root@node5 named]# curl web11.zhangxingeng.com
welcome to web1
[root@node5 named]#
待续。。。
转载请注明出处：https://www.cnblogs.com/zhangxingeng/p/9983944.html
centos7部署DNS-1的更多相关文章
- centos7 部署dns服务器
=============================================== 2017/12/6_第2次修改 ccb_warlock 20 ...
- CentOS7系统DNS主从配置
CentOS7系统DNS主从配置:一.DNS服务器正向解析:1.1 基础环境:主机IP 主机名 操作系统 用途192.168.0.110 master ...
- [原]CentOS7部署osm2pgsql
转载请注明原作者(think8848)和出处(http://think8848.cnblogs.com) 部署Postgresql和部署PostGis请参考前两篇文章 本文主要参考GitHub上osm ...
- centos7 部署ssserver
centos7 部署shadowsocks服务端 为什么要选centos7? 以后centos7 肯定是主流,在不重要的环境还是尽量使用新系统吧 centos7 的坑 默认可能会有firewall 或 ...
- CentOS7系统安装DNS服务
CentOS7系统安装DNS服务 30.1.DNS是什么? DNS ( Domain Name System )是"域名系统"的英文缩写,简单来说就是一个数据库,用于存储网络中IP ...
- Linux 自动化部署DNS服务器
Linux 自动化部署DNS服务器 1.首先配置主DNS服务器的IP地址,DNS地址一个写主dns的IP地址,一个写从dns的地址,这里也可以不写,在测试的时候在/etc/resolv.conf中添加 ...
- linux系统下部署DNS正向解析
DNS服务概述: DNS(Domain Name System)域名系统,能够提供域名与IP地址的解析服务. 正向解析 正向解析是指域名到IP 地址的解析过程. 部署DNS正向解析 DNS服务的三个配 ...
- centos7 部署 docker compose
=============================================== 2019/4/10_第1次修改 ccb_warlock == ...
- centos7 部署 docker ce
=============================================== 2019/4/9_第1次修改 ccb_warlock === ...
- centos7 部署 open-falcon 0.2.0
=============================================== 2019/4/29_第3次修改 ccb_warlock 更新 ...
随机推荐
- entity framework 上下文对象跟踪相关
entity framework 上下文对于对象的跟踪有2中方式进行控制,第一种从数据库查询但不加载到上下文. 这里可以用到.AsNoTracing()方法. 这里用到的是实体(entity)在上下文 ...
- gitlab 之 cicd
1.使用 docker 安装 gitlab docker run -d --hostname gitlab \ --env GITLAB_OMNIBUS_CONFIG="ex ...
- Linux命令中：rsync和scp之间的区别
scp是把文件全部复制过去,当文件修改后还是把所有文件复制过去, rsync 第一次是把所有文件同步过去,当文件修改后,只把修改的文件同步过去 rsync -av 10.251.205.8:/usr1 ...
- Android基础知识学习
IPC (Inter-Process Communication) 意思是: 进程间的通信,是指两个进程之间进行数据交换的过程. Android中如何开启多进程呢? 只需要给四大组件(Activit ...
- 段的性能统计信息v$segment_statistics
v$segment_statistics视图记录了段的统计信息 简单的几个字段就不说了,就说最后三个吧 STATISTIC_NAME,STATISTIC#,VALUE记录了发生在表上的操作 SYS @ ...
- c++ 实现hashmap
由于hashmap不是c++ stl中标准实现,这样在跨平台使用时就可能会出现问题,于是想到自己实现一个hashmap hash算法使用开链法解决hash冲突,主要实现了添加,删除,查找几个方法 头文 ...
- 背水一战 Windows 10 (113) - 锁屏: 将 Application 的 Badge 通知和 Tile 通知发送到锁屏, 将 secondary tile 的 Badge 通知和 Tile 通知发送到锁屏
[源码下载] 背水一战 Windows 10 (113) - 锁屏: 将 Application 的 Badge 通知和 Tile 通知发送到锁屏, 将 secondary tile 的 Badge ...
- 【高速接口-RapidIO】4、Xilinx RapidIO核详解
一.RapidIO核概述 RapidIO核的设计标准来源于RapidIO Interconnect Specification rev2.2,它支持1x,2x和4x三种模式,每通道的速度支持1.25G ...
- 知乎十万级容器规模的Java分布式镜像仓库实践
作者:知乎令孤无忌 前言 知乎在 2016 年已经完成了全量业务的容器化,并在自研容器平台上以原生镜像的方式部署和运行,并在后续陆续实施了 CI.Cron.Kafka.HAProxy.HBase.Tw ...
- TextView文字描边实现
TextView文字描边实现 需求描述 文字显示在图片的上面,图片的内容是不确定了,为了防止文字与图片的颜色相近导致用户看不到或者看不清文字的问题,所以显示文字描边,避免问题. 实现 实现思想 使用T ...