本次测试有两台主机，主DNS服务器：192.168.1.131 从DNS服务器：192.168.1.132
1、安装DNS服务
# yum -y install bind-* # 安装dns服务 # rpm -qa | grep -w "bind" # 查看bind和bind-chroot是否安装
2、启动DNS服务，并配置DNS文件
# service named restart # 启动DNS服务 # vim /etc/resolv.conf nameserver 192.168.1.131 search 192.168.1.1 # vim /etc/sysconfig/network-scrips/ifcfg-bond0 # 修改网卡配置文件 DNS1=192.168.1.131
3、配置DNS服务解析 ：houzq.cn
# vim /var/named/chroot/etc/named.conf
options {
listen-on port 53 { any; }; # 改为any
listen-on-v6 port 53 { any; }; # 改为any
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; }; # 改为any
recursion yes;
添加如下内容
zone "houzq.cn" IN {
type master;
file "houzq.cn.zone";
};
4、创建ZONE文件
# cd /var/named/chroot/var/named # cp -rp named.localhost houzq.cn.zone # 创建houzq.cn.zone文件
5、修改ZONE文件
# vim /var/named/chroot/var/named/houzq.cn.zone $TTL 1D @ IN SOA ns.houzq.cn. admin.houzq.cn ( 0 ; serial 1D ; refresh 1H ; retry 1W ; expire 3H ) ; minimum NS ns.houzq.cn. ns A 192.168.1.131 www A 192.168.1.131 mail A 192.168.1.132 smtp CNAME mail.houzq.cn.
说明：
0 ；更新序列号，用于标示数据库的变换，可以在10位以内，如果存在辅助DNS区域,建议每次更新完数据库，手动加1.
1D ；刷新时间，从域名服务器更新该地址数据库文件的间隔时间，默认为1天
1H ；重试延时，从域名服务器更新地址数据库失败以后，等待多长时间，默认为为1小时
1W ; 到期，失效时间，超过该时间仍无法更新地址数据库，则不再尝试，默认为一周
3H ；设置无效地址解析记录（该数据库中不存在的地址）默认缓存时间。设置无效记录，最少缓存时间为3小时.
6、重启DNS服务
# cd # 必须在跟目录下重启DNS服务 # service named restart # 重启DNS
7、验证
# ping PING www.houzq.cn (192.168.1.131) 56(84) bytes of data. 64 bytes from houzq01.localdomain (192.168.1.131): icmp_seq=1 ttl=64 time=0.014 ms 64 bytes from houzq01.localdomain (192.168.1.131): icmp_seq=2 ttl=64 time=0.027 ms 64 bytes from houzq01.localdomain (192.168.1.131): icmp_seq=3 ttl=64 time=0.026 m
8、使DNS支持迭代查询
# /var/named/chroot/etc/named.conf
options {
listen-on port 53 { any; };
listen-on-v6 port 53 { any; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
recursion yes; # 默认支持迭代功能
#dnssec-enable yes; # 注释掉这三行
#dnssec-validation yes;
#dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
};
9、配置DNS转发功能
# /var/named/chroot/etc/named.conf
options {
listen-on port 53 { any; };
listen-on-v6 port 53 { any; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;
forward only; # 添加以后两行
forwarders { 8.8.8.8; };
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
};
10、配置DNS主从服务器
配置主DNS服务器
# cd /var/named/chroot/etc/named.conf
zone "houzq.cn" IN {
type master;
file "houzq.cn.zone";
allow-transfer { 192.168.1.0/24; }; # 指定允许哪个网段的从DNS服务器，可以同步主DNS服务器zone文件，不写默认所有
# service named restart
配置从DNS服务器
# yum -y install bind-* # 安装DNS服务
# service named restart # 重启服务
# vim /var/named/chroot/etc/named.conf
options {
listen-on port 53 { any; };
listen-on-v6 port 53 { any; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
recursion yes;
添加如下内容
zone "houzq.cn" IN {
type slave;
file "slaves/houzq.cn.zone.file";
masters { 192.168.1.131; };
};
# service named restart
验证：
# cd /var/named/chroot/var/named/slaves # cat houzq.cn.zone.file # 和主DNS服务器上的配置文件相同
11、DNS主从密钥认证
11-1、首先保证主从服务器时间一致
使用ntp来同步时间
11-2、生成密钥，在主dns服务器上执行
# rpm -qf `which dnssec-keygen` # dnssec-keygen -a hmac-md5 -b 128 -n HOST abc
注：
-a hmac-md5：采用hmac-md5加密算法。
-b128：生成的密钥长度为128位。
-n 密钥类型。我们选择主机类型：HOST 。
-n
(DNSKEY generation defaults to ZONE)
abc #为生成密钥的名字
11-3、修改主DNS配置
# vim /var/named/chroot/etc/named.conf
key abckey {
algorithm hmac-md5;
secret "0MULoHdASGLbYl8qZLRssA==";
};
zone "houzq.cn" IN {
type master;
file "houzq.cn.zone";
allow-transfer { key abckey; };
};
# service named restart
修改从DNS配置
# vim /var/named/chroot/etc/named.conf
key abckey {
algorithm hmac-md5;
secret "0MULoHdASGLbYl8qZLRssA==";
};
zone "houzq.cn" IN {
type slave;
file "slaves/houzq.cn.zone.file";
masters { 192.168.1.131 key abckey; };
};
# service named restart
12、测试工具
12-1、nslookup命令
# yum provides */nslookup # 查找安装nslookup的安装包 # nslookup www.houzq.cn Server: 192.168.1.131 Address: 192.168.1.131#53 Name: www.houzq.cn Address: 192.168.1.131
12-2、dig命令
# dig @114.114.114.114 www.houzq.cn