linux——部署DNS
DNS
- 什么是DNS——DNS 是域名系统 (Domain Name System) 的缩写，它是由解析器和域名服务器组成的，又名“域名解析服务器”。
- DNS的作用——靠DNS把要访问的网址找到然后把信息送到电脑上。
- 什么是DNS服务器——DNS服务器是(Domain Name System或者Domain Name Service)域名系统或者域名服务,域名系统为Internet上的主机分配域名地址和IP地址。用户使用域名地址，该系统就会自动把域名地址转为IP地址。域名服务是运行域名系统的Internet工具。执行域名服务的服务器称之为DNS服务器，通过DNS服务器来应答域名服务的查询。
- DNS的解析方式——正向解析域、反向解析域。
一、dns服务器设置
[root@localhost ~]# hostnamectl set-hostname dns-server.example.com
[root@localhost ~]# hostname
dns-server.example.com
[root@localhost ~]# reboot
[root@dns-server Desktop]# yum install bind -y
##安装过程略
[root@dns-server Desktop]# systemctl start named ##需要在屏幕上敲些字符，才能启动
[root@dns-server Desktop]# netstat -antlpe | grep named
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 25 75394 2353/named
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 25 75389 2353/named
tcp6 0 0 ::1:953 :::* LISTEN 25 75395 2353/named
tcp6 0 0 ::1:53 :::* LISTEN 25 75391 2353/named
[root@dns-server Desktop]# rpm -qc bind
/etc/logrotate.d/named
/etc/named.conf
/etc/named.iscdlv.key
/etc/named.rfc1912.zones
/etc/named.root.key
/etc/rndc.conf
/etc/rndc.key
/etc/sysconfig/named
/var/named/named.ca
/var/named/named.empty
/var/named/named.localhost
/var/named/named.loopback
[root@dns-server Desktop]# vim /etc/named.conf
##编辑配置文件，需要修改添加的内容如下：
11 listen-on port 53 { any; };
17 allow-query { any; };
18 forwarders { 172.25.254.50; };
33 dnssec-validation no;
[root@dns-server Desktop]# vim /etc/resolv.conf
[root@dns-server Desktop]# cat /etc/resolv.conf
##想要自己也能解析，需要更改/etc/resolv.conf文件如下：
# Generated by NetworkManager
domain example.com
search example.com
nameserver 172.25.254.129
[root@dns-server Desktop]# ifconfig eth0
eth0: flags=4163 mtu 1500
inet 172.25.254.129 netmask 255.255.255.0 broadcast 172.25.254.255
inet6 fe80::5054:ff:fe60:1871 prefixlen 64 scopeid 0x20
ether 52:54:00:60:18:71 txqueuelen 1000 (Ethernet)
RX packets 4862 bytes 6057910 (5.7 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 682 bytes 51200 (50.0 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
[root@dns-server Desktop]# systemctl stop firewalld
[root@dns-server Desktop]# systemctl disable firewalld
[root@dns-server Desktop]# systemctl restart named
[root@dns-server Desktop]# dig www.baidu.com
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> www.baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9696
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 13, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.baidu.com. IN A
;; ANSWER SECTION:
www.baidu.com. 926 IN CNAME www.a.shifen.com.
www.a.shifen.com. 56 IN A 220.181.111.188
www.a.shifen.com. 56 IN A 220.181.112.244
;; AUTHORITY SECTION:
. 164299 IN NS h.root-servers.net.
. 164299 IN NS d.root-servers.net.
. 164299 IN NS i.root-servers.net.
. 164299 IN NS g.root-servers.net.
. 164299 IN NS a.root-servers.net.
. 164299 IN NS f.root-servers.net.
. 164299 IN NS k.root-servers.net.
. 164299 IN NS l.root-servers.net.
. 164299 IN NS b.root-servers.net.
. 164299 IN NS c.root-servers.net.
. 164299 IN NS e.root-servers.net.
. 164299 IN NS j.root-servers.net.
. 164299 IN NS m.root-servers.net.
;; Query time: 132 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Sat May 22 03:22:26 EDT 2018
;; MSG SIZE rcvd: 312
##dns服务配置成功
二、正向解析域（域名—> IP ）
一个域名对应一个IP（一对一）
[root@dns-server Desktop]# vim /etc/named.conf
18 forwarders { 172.25.254.50; }; ##删掉
[root@dns-server Desktop]# vim /etc/named.rfc1912.zones
25 zone "westos.com" IN {
26 type master;
27 file "westos.com.zone";
28 allow-update { none; };
29 };
[root@dns-server Desktop]# cd /var/named/
[root@dns-server named]# ls
data dynamic named.ca named.empty named.localhost named.loopback slaves
[root@dns-server named]# cp -p named.localhost westos.com.zone
[root@dns-server named]# vim westos.com.zone
[root@dns-server named]# cat westos.com.zone
$TTL 1D
@ IN SOA dns.westos.com. root.westos.com. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.westos.com.
dns A 172.25.254.127
tutu A 172.25.254.229
[root@dns-server named]# systemctl restart named
[root@dns-server named]# dig dns.westos.com
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> dns.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28385
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;dns.westos.com. IN A
;; ANSWER SECTION:
dns.westos.com. 86400 IN A 172.25.254.129
;; AUTHORITY SECTION:
westos.com. 86400 IN NS dns.westos.com.
;; Query time: 0 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 07:26:14 EDT 2018
;; MSG SIZE rcvd: 73
[root@dns-server named]# dig tutu.westos.com
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> tutu.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26556
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;tutu.westos.com. IN A
;; ANSWER SECTION:
tutu.westos.com. 86400 IN A 172.25.254.120
;; AUTHORITY SECTION:
westos.com. 86400 IN NS dns.westos.com.
;; ADDITIONAL SECTION:
dns.westos.com. 86400 IN A 172.25.254.129
;; Query time: 0 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 07:27:26 EDT 2018
;; MSG SIZE rcvd: 94
[root@dns-server named]#一个域名对应多个IP（一对多）
[root@dns-server named]# pwd
/var/named
[root@dns-server named]# ls
data named.ca named.localhost slaves
dynamic named.empty named.loopback westos.com.zone
[root@dns-server named]# vim westos.com.zone
[root@dns-server named]# cat westos.com.zone
$TTL 1D
@ IN SOA dns.westos.com. root.westos.com. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.westos.com.
dns A 172.25.254.129
tutu A 172.25.254.120
csdn CNAME node1.westos.com.
node1 A 172.25.254.66
node1 A 172.25.254.88
[root@dns-server named]# systemctl restart named
[root@dns-server named]# dig csdn.westos.com
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> csdn.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63112
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;csdn.westos.com. IN A
;; ANSWER SECTION:
csdn.westos.com. 86400 IN CNAME node1.westos.com.
node1.westos.com. 86400 IN A 172.25.254.66
node1.westos.com. 86400 IN A 172.25.254.88
;; AUTHORITY SECTION:
westos.com. 86400 IN NS dns.westos.com.
;; ADDITIONAL SECTION:
dns.westos.com. 86400 IN A 172.25.254.129
;; Query time: 0 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 07:45:42 EDT 2018
;; MSG SIZE rcvd: 130
[root@dns-server named]# dig csdn.westos.com
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> csdn.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61199
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;csdn.westos.com. IN A
;; ANSWER SECTION:
csdn.westos.com. 86400 IN CNAME node1.westos.com.
node1.westos.com. 86400 IN A 172.25.254.88
node1.westos.com. 86400 IN A 172.25.254.66
;; AUTHORITY SECTION:
westos.com. 86400 IN NS dns.westos.com.
;; ADDITIONAL SECTION:
dns.westos.com. 86400 IN A 172.25.254.129
;; Query time: 0 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 07:47:38 EDT 2018
;; MSG SIZE rcvd: 130
[root@dns-server named]#
##在访问网址的时候，客户访问到的IP可能是172.25.254.66或者172.25.254.88
另一台主机测试
[root@localhost ~]# vim /etc/resolv.conf
[root@localhost ~]# cat /etc/resolv.conf
# Generated by NetworkManager
domain ilt.example.com
search ilt.example.com example.com
nameserver 172.25.254.129 ##dns服务器的ip
[root@localhost ~]# dig csdn.westos.com
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> csdn.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2735
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;csdn.westos.com. IN A
;; ANSWER SECTION:
csdn.westos.com. 86400 IN CNAME node1.westos.com.
node1.westos.com. 86400 IN A 172.25.254.66
node1.westos.com. 86400 IN A 172.25.254.88
;; AUTHORITY SECTION:
westos.com. 86400 IN NS dns.westos.com.
;; ADDITIONAL SECTION:
dns.westos.com. 86400 IN A 172.25.254.129
;; Query time: 1 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 07:46:35 EDT 2018
;; MSG SIZE rcvd: 130
[root@localhost ~]# dig csdn.westos.com
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> csdn.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61298
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;csdn.westos.com. IN A
;; ANSWER SECTION:
csdn.westos.com. 86400 IN CNAME node1.westos.com.
node1.westos.com. 86400 IN A 172.25.254.88
node1.westos.com. 86400 IN A 172.25.254.66
;; AUTHORITY SECTION:
westos.com. 86400 IN NS dns.westos.com.
;; ADDITIONAL SECTION:
dns.westos.com. 86400 IN A 172.25.254.129
;; Query time: 1 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 07:46:42 EDT 2018
;; MSG SIZE rcvd: 130
三、反向解析域（ IP —> 域名）
一个IP对应一个域名
[root@dns-server named]# vim /etc/named.rfc1912.zones
##添加文件/etc/named.rfc1912.zones的内容如下：
31 zone "254.25.172.in-addr.arpa" IN {
32 type master;
33 file "westos.com.ptr";
34 allow-update { none; };
35 };
[root@dns-server named]# pwd
/var/named
[root@dns-server named]# ls
data named.ca named.localhost slaves
dynamic named.empty named.loopback westos.com.zone
[root@dns-server named]# cp -p named.loopback westos.com.ptr ##复制模板，然后修改内容
[root@dns-server named]# vim westos.com.ptr
[root@dns-server named]# cat westos.com.ptr
$TTL 1D
@ IN SOA dns.westos.com. root.westos.com. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.westos.com.
A 172.25.254.129
120 PTR tutu.westos.com.
115 PTR butterfly.westos.com.
[root@dns-server named]# systemctl restart named
[root@dns-server named]# dig -x 172.25.254.115
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> -x 172.25.254.115
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49131
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;115.254.25.172.in-addr.arpa. IN PTR
;; ANSWER SECTION:
115.254.25.172.in-addr.arpa. 86400 IN PTR butterfly.westos.com.
;; AUTHORITY SECTION:
254.25.172.in-addr.arpa. 86400 IN NS dns.westos.com.
;; ADDITIONAL SECTION:
dns.westos.com. 86400 IN A 172.25.254.129
;; Query time: 0 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 08:16:24 EDT 2018
;; MSG SIZE rcvd: 124
[root@dns-server named]# dig -x 172.25.254.120
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> -x 172.25.254.120
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46710
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;120.254.25.172.in-addr.arpa. IN PTR
;; ANSWER SECTION:
120.254.25.172.in-addr.arpa. 86400 IN PTR tutu.westos.com.
;; AUTHORITY SECTION:
254.25.172.in-addr.arpa. 86400 IN NS dns.westos.com.
;; ADDITIONAL SECTION:
dns.westos.com. 86400 IN A 172.25.254.129
;; Query time: 0 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 08:16:29 EDT 2018
;; MSG SIZE rcvd: 119
[root@dns-server named]#
四、正向解析域之指定主机的解析
本次实验说明
设置dns服务器自身可以解析到的IP和其他的主机不一样
- DNS服务器设置
[root@dns-server named]# pwd
/var/named
[root@dns-server named]# ls
data named.ca named.localhost slaves westos.com.zone
dynamic named.empty named.loopback westos.com.ptr
[root@dns-server named]# cp -p westos.com.zone westos.com.inter
[root@dns-server named]# vim westos.com.inter
[root@dns-server named]# cat westos.com.inter
$TTL 1D
@ IN SOA dns.westos.com. root.westos.com. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.westos.com.
dns A 192.168.0.129
tutu A 192.168.0.120
csdn CNAME node1.westos.com.
node1 A 192.168.0.66
node1 A 192.168.0.88
[root@dns-server named]# cp -p /etc/named.rfc1912.zones /etc/named.rfc1912.inter
[root@dns-server named]# vim /etc/named.rfc1912.inter
##在前面的实验基础上，修改第25-29行内容如下：
25 zone "westos.com" IN {
26 type master;
27 file "westos.com.inter";
28 allow-update { none; };
29 };
[root@dns-server named]# vim /etc/named.conf
[root@dns-server named]# cat /etc/named.conf | tail -n 25
##需要注释的内容为蓝色，用符号/*内容*/；需要添加的内容为红色；其余不需要修改的此处就不显示了
/*
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
*/
view localnet {
match-clients { 172.25.254.129; };
zone "." IN{
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
};
view inter {
match-clients { any; };
zone "." IN{
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.inter";
};
[root@dns-server named]# systemctl restart named
[root@dns-server named]# dig csdn.westos.com
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> csdn.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5741
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;csdn.westos.com. IN A
;; ANSWER SECTION:
csdn.westos.com. 86400 IN CNAME node1.westos.com.
node1.westos.com. 86400 IN A 172.25.254.66
node1.westos.com. 86400 IN A 172.25.254.88
;; AUTHORITY SECTION:
westos.com. 86400 IN NS dns.westos.com.
;; ADDITIONAL SECTION:
dns.westos.com. 86400 IN A 172.25.254.129
;; Query time: 0 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 08:49:48 EDT 2018
;; MSG SIZE rcvd: 130
[root@dns-server named]#- 另一台主机一测试
[root@localhost ~]# cat /etc/resolv.conf
# Generated by NetworkManager
domain ilt.example.com
search ilt.example.com example.com
nameserver 172.25.254.129
[root@localhost ~]# dig csdn.westos.com
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> csdn.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17264
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;csdn.westos.com. IN A
;; ANSWER SECTION:
csdn.westos.com. 86400 IN CNAME node1.westos.com.
node1.westos.com. 86400 IN A 192.168.0.66
node1.westos.com. 86400 IN A 192.168.0.88
;; AUTHORITY SECTION:
westos.com. 86400 IN NS dns.westos.com.
;; ADDITIONAL SECTION:
dns.westos.com. 86400 IN A 192.168.0.129
;; Query time: 1 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 08:50:35 EDT 2018
;; MSG SIZE rcvd: 130
[root@localhost ~]#- 另一台主机二测试
[root@foundation50 Desktop]# cat /etc/resolv.conf
# Generated by NetworkManager
search lan ilt.example.com example.com lan.
nameserver 172.25.254.129
[root@foundation50 Desktop]# dig tutu.westos.com
; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7 <<>> tutu.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62593
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;tutu.westos.com. IN A
;; ANSWER SECTION:
tutu.westos.com. 86400 IN A 192.168.0.120
;; AUTHORITY SECTION:
westos.com. 86400 IN NS dns.westos.com.
;; ADDITIONAL SECTION:
dns.westos.com. 86400 IN A 192.168.0.129
;; Query time: 1 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Wed May 23 20:55:52 CST 2018
;; MSG SIZE rcvd: 94
[root@foundation50 Desktop]#五、辅助DNS——Slave DNS
主DNS服务器
[root@dns-server named]# vim /etc/named.rfc1912.zones
25 zone "westos.com" IN {
26 type master;
27 file "westos.com.zone";
28 allow-update { none; };
29 also-notify { 172.25.254.229; };
30 };
[root@dns-server named]# vim /etc/named.conf
50
51 zone "." IN {
52 type hint;
53 file "named.ca";
54 };
55
56 include "/etc/named.rfc1912.zones";
57 include "/etc/named.root.key";
58 /*
59 view localnet {
60 match-clients { 172.25.254.129; };
61 zone "." IN{
62 type hint;
63 file "named.ca";
64 };
65 include "/etc/named.rfc1912.zones";
66 };
67 view inter {
68 match-clients { any; };
69 zone "." IN{
70 type hint;
71 file "named.ca";
72 };
73 include "/etc/named.rfc1912.inter";
74 };
75 */
[root@dns-server named]# cat westos.com.zone
$TTL 1D
@ IN SOA dns.westos.com. root.westos.com. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.westos.com.
dns A 172.25.254.129
tutu A 172.25.254.120
csdn CNAME node1.westos.com.
node1 A 172.25.254.77
node1 A 172.25.254.99
[root@dns-server named]# systemctl restart named
Slave DNS
[root@localhost ~]# hostnamectl set-hostname dns-slave.example.com
[root@localhost ~]# hostname
dns-slave.example.com
[root@localhost ~]#reboot
[root@dns-slave ~]# vim /etc/yum.repos.d/rhel_dvd.repo
[root@dns-slave ~]# cat /etc/yum.repos.d/rhel_dvd.repo
# Created by cloud-init on Thu, 10 Jul 2014 22:19:11 +0000
[rhel_dvd]
gpgcheck = 0
enabled = 1
baseurl = http://172.25.254.50/rhel7.0
name = Remote classroom copy of dvd
[root@dns-slave ~]# yum clean all
Loaded plugins: langpacks
Cleaning repos: rhel_dvd
Cleaning up everything
[root@dns-slave named]# cat /etc/resolv.conf
# Generated by NetworkManager
search example.com
nameserver 172.25.254.229
[root@dns-slave ~]# yum install bind -y
##安装过程略
[root@dns-slave ~]# vim /etc/named.conf
11 listen-on port 53 { any; };
17 allow-query { any; };
32 dnssec-validation no;
[root@dns-slave named]# vim /etc/named.rfc1912.zones
25 zone "westos.com" IN {
26 type slave;
27 masters { 172.25.254.129; };
28 file "slaves/westos.com.zone";
29 allow-update { none; };
30 };
[root@dns-slave named]# systemctl restart named
[root@dns-slave named]# dig csdn.westos.com
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> csdn.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3164
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;csdn.westos.com. IN A
;; ANSWER SECTION:
csdn.westos.com. 86400 IN CNAME node1.westos.com.
node1.westos.com. 86400 IN A 192.168.0.88
node1.westos.com. 86400 IN A 192.168.0.66
;; AUTHORITY SECTION:
westos.com. 86400 IN NS dns.westos.com.
;; ADDITIONAL SECTION:
dns.westos.com. 86400 IN A 192.168.0.129
;; Query time: 1 msec
;; SERVER: 172.25.254.229#53(172.25.254.229)
;; WHEN: Wed May 23 10:07:12 EDT 2018
;; MSG SIZE rcvd: 130
[root@dns-slave named]# systemctl stop firewalld
[root@dns-slave named]# systemctl disable firewalld
rm '/etc/systemd/system/basic.target.wants/firewalld.service'
rm '/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service'
[root@dns-slave named]# systemctl restart named
[root@dns-slave named]# dig csdn.westos.com
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> csdn.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44326
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;csdn.westos.com. IN A
;; ANSWER SECTION:
csdn.westos.com. 86400 IN CNAME node1.westos.com.
node1.westos.com. 86400 IN A 172.25.254.77
node1.westos.com. 86400 IN A 172.25.254.99
;; AUTHORITY SECTION:
westos.com. 86400 IN NS dns.westos.com.
;; ADDITIONAL SECTION:
dns.westos.com. 86400 IN A 192.168.0.129
;; Query time: 1 msec
;; SERVER: 172.25.254.229#53(172.25.254.229)
;; WHEN: Wed May 23 10:16:53 EDT 2018
;; MSG SIZE rcvd: 130六、nsupdate（动态DNS更新工具）
DNS服务器端
[root@dns-server named]# ls
data named.ca named.localhost slaves westos.com.ptr
dynamic named.empty named.loopback westos.com.inter westos.com.zone
[root@dns-server named]# cp -p westos.com.zone /mnt/ ##做备份
[root@dns-server named]# vim /etc/named.rfc1912.zones
25 zone "westos.com" IN {
26 type master;
27 file "westos.com.zone";
28 allow-update { 172.25.254.50; };
29 also-notify { 172.25.254.229; };
30 };
[root@dns-server named]# systemctl restart named
此时用ip为172.25.254.50的主机实验：（实验结果失败）
[root@foundation50 Desktop]# nsupdate
> server 172.25.254.129
> update add test.westos.com 86400 A 172.25.254.133
> send
update failed: SERVFAIL
> quit
[root@dns-server named]# ll -d /var/named/
drwxr-x--- 5 root named 4096 May 23 10:36 /var/named/
[root@dns-server named]# chmod 770 /var/named/ ##添加权限
[root@dns-server named]# ll -d /var/named/
drwxrwx--- 5 root named 4096 May 23 10:36 /var/named/
此时再用ip为172.25.254.50的主机实验：（实验结果成功）
[root@foundation50 Desktop]# nsupdate
> server 172.25.254.129
> update add test.westos.com 86400 A 172.25.254.133
> send
> quit
[root@dns-server named]# ls
data named.empty slaves westos.com.zone
dynamic named.localhost westos.com.inter westos.com.zone.jnl
named.ca named.loopback westos.com.ptr
[root@dns-server named]# ll
total 36
drwxrwx--- 2 named named 22 May 22 10:39 data
drwxrwx--- 2 named named 4096 May 23 10:36 dynamic
-rw-r----- 1 root named 2076 Jan 28 2013 named.ca
-rw-r----- 1 root named 152 Dec 15 2009 named.empty
-rw-r----- 1 root named 152 Jun 21 2007 named.localhost
-rw-r----- 1 root named 168 Dec 15 2009 named.loopback
drwxrwx--- 2 named named 6 Jan 29 2014 slaves
-rw-r----- 1 root named 292 May 23 08:40 westos.com.inter
-rw-r----- 1 root named 232 May 23 08:15 westos.com.ptr
-rw-r----- 1 root named 296 May 23 10:36 westos.com.zone
-rw-r--r-- 1 named named 717 May 23 11:21 westos.com.zone.jnl
[root@dns-server named]# cat westos.com.zone
$TTL 1D
@ IN SOA dns.westos.com. root.westos.com. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.westos.com.
dns A 172.25.254.129
tutu A 172.25.254.120
csdn CNAME node1.westos.com.
node1 A 172.25.254.77
node1 A 172.25.254.99
[root@dns-server named]# systemctl restart named
[root@dns-server named]# cat westos.com.zone
$ORIGIN .
$TTL 86400 ; 1 day
westos.com IN SOA dns.westos.com. root.westos.com. (
1 ; serial
86400 ; refresh (1 day)
3600 ; retry (1 hour)
604800 ; expire (1 week)
10800 ; minimum (3 hours)
)
NS dns.westos.com.
$ORIGIN westos.com.
csdn CNAME node1
dns A 172.25.254.129
node1 A 172.25.254.77
A 172.25.254.99
test A 172.25.254.133
tutu A 172.25.254.120
[root@dns-server named]#加密的方式
利用ip指定DNS动态更新不安全，设定加密，有钥匙的才可以成功更新DNS
[root@dns-server named]# cd /mnt/
[root@dns-server mnt]# ls
westos.com.zone
[root@dns-server mnt]# dnssec-keygen -a HMAC-MD5 -b 128 -n HOST westos
Kwestos.+157+26053
[root@dns-server mnt]# ls
Kwestos.+157+26053.key Kwestos.+157+26053.private westos.com.zone
[root@dns-server mnt]# cat Kwestos.+157+26053.private
Private-key-format: v1.3
Algorithm: 157 (HMAC_MD5)
Key: +4CdGcPfu8EGinUoYo9pqg==
Bits: AAA=
Created: 20180520063433
Publish: 20180520063433
Activate: 20180520063433
[root@dns-server mnt]# cat Kwestos.+157+26053.key
westos. IN KEY 512 3 157 +4CdGcPfu8EGinUoYo9pqg==
[root@dns-server mnt]# cp -p /etc/rndc.key /etc/westos.key
[root@dns-server mnt]# vim /etc/westos.key
key "westos" {
algorithm hmac-md5;
secret "+4CdGcPfu8EGinUoYo9pqg==";
};
[root@dns-server mnt]# vim /etc/named.conf
43 include "/etc/westos.key"; ##添加第43行
[root@dns-server mnt]# vim /etc/named.rfc1912.zones
25 zone "westos.com" IN {
26 type master;
27 file "westos.com.zone";
28 allow-update { key westos; };
29 also-notify { 172.25.254.229; };
30 };
[root@dns-server mnt]# cd /var/named/
[root@dns-server named]# ll
total 32
drwxrwx--- 2 named named 22 May 19 03:09 data
drwxrwx--- 2 named named 4096 May 20 02:05 dynamic
-rw-r----- 1 root named 2076 Jan 28 2013 named.ca
-rw-r----- 1 root named 152 Dec 15 2009 named.empty
-rw-r----- 1 root named 152 Jun 21 2007 named.localhost
-rw-r----- 1 root named 168 Dec 15 2009 named.loopback
drwxrwx--- 2 named named 6 Jan 29 2014 slaves
-rw-r----- 1 root named 304 May 19 22:45 westos.com.inter
-rw-r----- 1 root named 229 May 19 22:02 westos.com.ptr
-rw-r----- 1 root named 308 May 20 00:05 westos.com.zone
[root@dns-server named]# systemctl restart named
[root@dns-server named]# cd /mnt/
[root@dns-server mnt]# ls
Kwestos.+157+26053.key Kwestos.+157+26053.private westos.com.zone
[root@dns-server mnt]# scp Kwestos.+157+26053.* [email protected]:/mnt/ ##传钥匙给slave
The authenticity of host '172.25.254.227 (172.25.254.227)' can't be established.
ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.25.254.227' (ECDSA) to the list of known hosts.
[email protected]'s password:
Kwestos.+157+26053.key 100% 50 0.1KB/s 00:00
Kwestos.+157+26053.private 100% 165 0.2KB/s 00:00
[root@dns-server mnt]#没有钥匙的主机——没有钥匙，不能动态更新DNS
[root@foundation50 Desktop]$ nsupdate
> server 172.25.254.129
> update add test.westos.com 86400 A 172.25.254.133
> send
update failed: REFUSED
> quit
[root@foundation50 Desktop]$ cd /mnt/
[root@foundation50 Desktop]$ ls
[kiosk@foundation27 mnt]$有钥匙的主机——dns-server传过来钥匙，有了钥匙，才能被允许动态更新DNS
[root@dns-slave named]# cd /mnt/
[root@dns-slave mnt]# ls
boot etc kernel-3.10.0-123.el7.x86_64.rpm lib
[root@dns-slave mnt]# ls
boot etc kernel-3.10.0-123.el7.x86_64.rpm Kwestos.+157+26053.key Kwestos.+157+26053.private lib
[root@dns-slave mnt]# nsupdate -k Kwestos.+157+26053.private
> server 172.25.254.127
> update add butter.westos.com 86400 A 172.25.254.111
> send
> quit
[root@dns-slave mnt]#七、DNS服务器不受动态IP的影响
DNS服务端
[root@dns-server mnt]# yum install dhcp -y
[root@dns-server mnt]# cp /usr/share/doc/dhcp-4.2.5/dhcpd.conf.example /etc/dhcp/dhcpd.conf
cp: overwrite ‘/etc/dhcp/dhcpd.conf’? y
[root@dns-server mnt]# vim /etc/dhcp/dhcpd.conf ##祥见DHCP配置
[root@dns-server mnt]# systemctl restart dhcpd
[root@dns-server mnt]# cd /var/named/
[root@dns-server named]# ls
data named.empty slaves westos.com.zone
dynamic named.localhost westos.com.inter westos.com.zone.jnl
named.ca named.loopback westos.com.ptr
[root@dns-server named]# vim westos.com.zone
[root@dns-server named]# ls /mnt/
Kwestos.+157+26053.key Kwestos.+157+26053.private westos.com.zone
[root@dns-server named]# rm -fr westos.com.zone*
[root@dns-server named]# cat /etc/westos.key
key "westos" {
algorithm hmac-md5;
secret "+4CdGcPfu8EGinUoYo9pqg==";
};
[root@dns-server named]# vim /etc/dhcp/dhcpd.conf
14 ddns-update-style initerim;
35 key westos {
36 algorithm hmac-md5;
37 secret +4CdGcPfu8EGinUoYo9pqg==;
38 };
39 zone westos.com. {
40 primary 127.0.0.1;
41 key westos;
42 }
[root@dns-server named]# systemctl restart dhcpd
另一台主机
[root@linux Desktop]# ifconfig
eth0: flags=4163 mtu 1500
inet 172.25.254.60 netmask 255.255.255.0 broadcast 172.25.254.255
inet6 fe80::5054:ff:fe00:1b0b prefixlen 64 scopeid 0x20
ether 52:54:00:00:1b:0b txqueuelen 1000 (Ethernet)
RX packets 87 bytes 7810 (7.6 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 111 bytes 10939 (10.6 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73 mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10
loop txqueuelen 0 (Local Loopback)
RX packets 12 bytes 976 (976.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 12 bytes 976 (976.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
[root@linux Desktop]# hostname
linux.westos.com
[root@linux Desktop]# hostnamectl set-hostname hello.westos.com
[root@linux Desktop]# hostname
hello.westos.com
[root@linux Desktop]# dig hello.westos.com
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> hello.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 4895
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;hello.westos.com. IN A
;; AUTHORITY SECTION:
westos.com. 10800 IN SOA dns.westos.com. root.westos.com. 3 86400 3600 604800 10800
;; Query time: 1 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Sun May 23 04:45:51 EDT 2018
;; MSG SIZE rcvd: 90
[root@linux Desktop]# systemctl restart network
[root@linux Desktop]# dig hello.westos.com
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> hello.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23853
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;hello.westos.com. IN A
;; ANSWER SECTION:
test.westos.com. 300 IN A 172.25.254.60
;; AUTHORITY SECTION:
westos.com. 86400 IN NS dns.westos.com.
;; ADDITIONAL SECTION:
dns.westos.com. 86400 IN A 172.25.254.127
;; Query time: 1 msec
;; SERVER: 172.25.254.129#53(172.25.254.129)
;; WHEN: Sun May 23 04:46:33 EDT 2018
;; MSG SIZE rcvd: 95
[root@linux Desktop]#