Bind+DLZ构建企业智能DNS

目录：
一、简介
二、服务规划
三、安装BIND及基本环境
四、配置Bind-View-DLZ-MYSQL
五、添加相关记录并进行测试
六、配置从DNS
七、补充

一、简介：
1、智能DNS（Bind-view）：
智能DNS 原理很简单：在用户解析一个域名的时候的，判断一下用户使用的IP，然后跟DNS 服务器内
部的IP 表匹配一下，看看用户是电信还是网通用户，然后给用户返回对应的IP 地址。目前的域名服
务运营商不提供智能DNS 服务，所以必须自行架设DNS 服务或者使用网上免费的智能DNS 服务，如
DNSPOD.
2．Bind-DLZ
Bind-DLZ主页：http://bind-dlz.sourceforge.net/
DLZ(Dynamically Loadable Zones)与传统的BIND9不同，BIND的不足之处：
* BIND从文本文件中获取数据，这样容易因为编辑错误出现问题。
* BIND需要将数据加载到内存中，如果域或者记录较多，会消耗大量的内存。
* BIND启动时解析Zone文件，对于一个记录较多的DNS来说，会耽误更多的时间。
* 如果近修改一条记录，那么要重新加载或者重启BIND 才能生效，那么需要时间，可能会影响客户端查询。
而Bind-dlz 即将帮你解决这些问题, 对Zone文件操作也更方便了，直接对数据库操作,可以很方便扩充及开发管理程序。

二、服务规划：
1、nameserver服务器注册（需要到域名服务商那里注册）
   主从dns之间实现mysql主从数据库同步：
   主DNS：       ns1.larry.com    192.168.1.60
   从DNS:        ns2.larry.com    192.168.1.61
 
   网站(cnc):    www.larry.com   192.168.1.51
   网站(ct):     www.larry.com   192.168.1.52
   网站(cmcc):   www.larry.com   192.168.1.53
   网站(edu):    www.larry.com   192.168.1.54
   网站(any):    www.larry.com   192.168.1.55
注：当一个网通用户向本地DNS发www.larry.com的请求时，本地DNS会递归查询，最后把请求发给ns1.larry.com这台DNS服务器上，
    ns1.larry.com会根据请求的用户IP所属的范围来择优选择，将www.larry.com在网通的ip返回给本地DNS.
2、Bind-view规划：
   网通CNC      cnc.txt
   电信CT       ct.txt
   移动CMCC     cmcc.txt
   教育网EDU    edu.txt
   include "/usr/local/bind/etc/view.conf";(ip库里面没有的IP,属于any区域)
IP库及ACL，如果你有比较详细的按城市或者地域的IP库，在设计BIND-VIEW这个字段的时候，VIEW就可以以城市或地区来命名和规划.

三、安装BIND及基本环境:
 1、安装mysql：
wget http://soft.vpser.net/datebase/mysql/mysql-5.1.54.tar.gz
groupadd mysql
useradd -g mysql -s /sbin/nologin -M  mysql
tar zxvf mysql-5.1.54.tar.gz
cd mysql-5.1.54
./configure --prefix=/usr/local/mysql/ --enable-assembler --with-extra-charsets=complex --enable-thread-safe-client -with-big-tables --with-readline --with-ssl --with-embedded-server --enable-local-infile --with-plugins=partition,innobase,myisammrg
make && make install
chown mysql:mysql -R /usr/local/mysql/
/usr/local/mysql/bin/mysql_install_db   --basedir=/usr/local/mysql   --datadir=/usr/local/mysql/var  --user=mysql
cd /usr/local/mysql/
cp share/mysql/my-medium.cnf? /etc/my.cnf
cp share/mysql/mysql.server? /etc/rc.d/init.d/mysqld
chmod 755 /etc/rc.d/init.d/mysqld
chkconfig --add mysqld
sed -i 's/skip-locking/skip-external-locking/g' /etc/my.cnf
echo "/usr/local/mysql/lib/mysql" >> /etc/ld.so.conf
echo "/usr/local/lib" >>/etc/ld.so.conf
ldconfig
ln -s /usr/local/mysql/lib/mysql /usr/lib/mysql
ln -s /usr/local/mysql/include/mysql /usr/include/mysql
/usr/local/mysql/bin/mysqld_safe --defaults-file=/etc/my.cnf --user=mysql &
echo 'export PATH=$PATH:/usr/local/mysql/bin' >>/etc/profile
source /etc/profile
/etc/init.d/mysql start
/usr/local/mysql/bin/mysqladmin -u root password 123456
 2、编译安装bind:
 wget http://ftp.isc.org/isc/bind9/9.6.0-P1/bind-9.6.0-P1.tar.gz
tar zxvf bind-9.6.0-P1.tar.gz
cd bind-9.6.0-P1
./configure --with-dlz-mysql --enable-largefile --enable-threads=no --prefix=/usr/local/bind --disable-openssl-version-check
make && make install
3、创建相关配置文件:
cd /usr/local/bind/etc/
../sbin/rndc-confgen >rndc.conf
tail -n10 rndc.conf | head -n9 | sed -e s/#\//g >named.conf
vim localhost.zone
ttl 86400
@ IN SOA localhost. root.localhost. (
1997022700 ; Serial
28800 ; Refresh
14400 ; Retry
3600000 ; Expire
86400 ) ; Minimum
IN NS localhost.
1 IN PTR localhost.

dig >named.root(需要连接外网)

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_4.2 <<>>
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25148
;; flags: qr rd ra; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 14

;; QUESTION SECTION:
;.                              IN      NS

;; ANSWER SECTION:
.                       408518  IN      NS      f.root-servers.net.
.                       408518  IN      NS      g.root-servers.net.
.                       408518  IN      NS      h.root-servers.net.
.                       408518  IN      NS      i.root-servers.net.
.                       408518  IN      NS      j.root-servers.net.
.                       408518  IN      NS      k.root-servers.net.
.                       408518  IN      NS      l.root-servers.net.
.                       408518  IN      NS      m.root-servers.net.
.                       408518  IN      NS      a.root-servers.net.
.                       408518  IN      NS      b.root-servers.net.
.                       408518  IN      NS      c.root-servers.net.
.                       408518  IN      NS      d.root-servers.net.
.                       408518  IN      NS      e.root-servers.net.

;; ADDITIONAL SECTION:
a.root-servers.net.     585058  IN      A       198.41.0.4
a.root-servers.net.     153174  IN      AAAA    2001:503:ba3e::2:30
b.root-servers.net.     15676   IN      A       192.228.79.201
c.root-servers.net.     20756   IN      A       192.33.4.12
d.root-servers.net.     494933  IN      A       128.8.10.90
d.root-servers.net.     153058  IN      AAAA    2001:500:2d::d
e.root-servers.net.     21330   IN      A       192.203.230.10
f.root-servers.net.     325589  IN      A       192.5.5.241
f.root-servers.net.     325589  IN      AAAA    2001:500:2f::f
g.root-servers.net.     249133  IN      A       192.112.36.4
h.root-servers.net.     494933  IN      A       128.63.2.53
h.root-servers.net.     494933  IN      AAAA    2001:500:1::803f:235
i.root-servers.net.     325589  IN      A       192.36.148.17
i.root-servers.net.     325589  IN      AAAA    2001:7fe::53

;; Query time: 5 msec
;; SERVER: 211.157.97.1#53(211.157.97.1)
;; WHEN: Thu Jun  9 15:58:52 2011
;; MSG SIZE  rcvd: 512

4、配置DNSTSIG:
用dnssec-keygen产生加密密钥,一个为public key,另一个为private key
#./dnssec-keygen -a hmac-md5 -b 128 -n HOST cnc
#./dnssec-keygen -a hmac-md5 -b 128 -n HOST ct
#./dnssec-keygen -a hmac-md5 -b 128 -n HOST edu
#./dnssec-keygen -a hmac-md5 -b 128 -n HOST cmcc
#./dnssec-keygen -a hmac-md5 -b 128 -n HOST any

named.conf内容如下：
key "rndc-key" {
        algorithm hmac-md5;
        secret "s6nZpVLBaIor85SFx4hvog==";
        };
controls {
        inet 127.0.0.1 port 953
        allow { 127.0.0.1; } keys { "rndc-key"; };
        };
logging {
        channel query_log {
        file "/var/log/named.log" versions 3 size 20m;
        severity info;
        print-time yes;
        print-category yes;
        print-severity yes;
        };
        category queries {query_log;};
        category lame-servers { null; };
        };
options {
        directory "/usr/local/bind/etc";
        pid-file "named.pid";
        allow-query { any; };
        #allow-recursion { none; };
        recursion no;
        listen-on port 53 { 192.168.1.60;127.0.0.1;};
        listen-on-v6 port 53 { any;};
        };
#TSIG-key
key "cnc" {
        algorithm hmac-md5;
        secret "R9S1fBP2sZFpPilKfjyg==";};
key "ct" {
        algorithm hmac-md5;
        secret "B770VaC6LdwDgt3Sy59Vlw==";};
key "edu" {
        algorithm hmac-md5;
        secret "DFsPQkIPB/HXsV7vToKatw==";};
key "cmcc" {
        algorithm hmac-md5;
        secret "APpxsffFQLFyYZ0sIIKbrw==";};
key "any" {
        algorithm hmac-md5;
        secret "UUADyQriCDB8U6cZVVcprr==";};
acl "dns-ip-list"{
        192.168.1.60; #master DNS IP
        192.168.1.61; #slave DNS IP
        };
include "/usr/local/bind/etc/ip_base/cnc.txt";
include "/usr/local/bind/etc/ip_base/ct.txt";
include "/usr/local/bind/etc/ip_base/cmcc.txt";
include "/usr/local/bind/etc/ip_base/edu.txt";
include "/usr/local/bind/etc/view.conf";

配置各个服务商的对应的ACL：
#cat cnc.txt  (在此之举一个例子)
acl cnc{
202.85.216.0/22;
202.85.221.0/24;
202.85.222.0/23;
202.95.18.145/32;
202.95.18.146/31;
202.95.18.148/30;
202.95.18.152/29;
202.95.18.160/27;
202.95.18.192/26;
 };

四、配置Bind-View-DLZ-MYSQL：
 1、配置view.conf
vim /usr/local/bind/etc/view/view.conf
view "CMCC_view" {
        match-clients { key cmcc;dns-ip-list;CMCC;};
        allow-query-cache       { none; };
        allow-recursion         { none; };
        allow-transfer          { none; };
        recursion               no;
dlz "Mysql zone" {
database "mysql
{host=127.0.0.1 dbname=dns_view ssl=false port=3306 user=root pass=pass%!#@larry }
{select zone from dnstb where zone = '%zone%' and view = 'CMCC' limit 1 }
{select ttl, type, mx_priority, case when lower(type)='txt' then concat('\"', data,
'\"') when lower(type) = 'soa' then concat_ws(' ', data, resp_person, serial,
refresh, retry, expire, minimum) else data end as mydata from DNS_ALL where zone
= '%zone%' and host = '%record%' and (view = 'CMCC' or view = 'OP')}
{}
{select ttl, type, host, mx_priority, case when lower(type)='txt' then concat('\"',
data, '\"') else data end as mydata, resp_person, serial, refresh, retry, expire,
minimum from dnstb where zone = '%zone%' and view='CMCC'}
{select zone from xfr_table where zone = '%zone%' and client = '%client%' and
view='CMCC' limit 1}
{update data_count set count = count + 1 where zone ='%zone%' and view='CMCC'}";
};
};

view "CNC_view" {
        match-clients { key cnc;dns-ip-list;CNC;};
        allow-query-cache       { none; };
        allow-recursion         { none; };
        allow-transfer          { none; };
        recursion               no;
dlz "Mysql zone" {
database "mysql
{host=127.0.0.1 dbname=dns_view ssl=false port=3306 user=root pass=pass%!#@larry }
{select zone from dnstb where zone = '%zone%' and view = 'CNC' limit 1 }
{select ttl, type, mx_priority, case when lower(type)='txt' then concat('\"', data,
'\"') when lower(type) = 'soa' then concat_ws(' ', data, resp_person, serial,
refresh, retry, expire, minimum) else data end as mydata from DNS_ALL where zone
= '%zone%' and host = '%record%' and (view = 'CNC' or view = 'OP')}
{}
{select ttl, type, host, mx_priority, case when lower(type)='txt' then concat('\"',
data, '\"') else data end as mydata, resp_person, serial, refresh, retry, expire,
minimum from dnstb where zone = '%zone%' and view='CNC'}
{select zone from xfr_table where zone = '%zone%' and client = '%client%' and
view='CNC' limit 1}
{update data_count set count = count + 1 where zone ='%zone%' and view='CNC'}";
};
};

view "EDU_view" {
        match-clients { key edu;dns-ip-list;EDU;};
        allow-query-cache       { none; };
        allow-recursion         { none; };
        allow-transfer          { none; };
        recursion               no;
dlz "Mysql zone" {
database "mysql
{host=127.0.0.1 dbname=dns_view ssl=false port=3306 user=root pass=pass%!#@larry }
{select zone from DNS_ALL where zone = '%zone%' and view = 'EDU' limit 1 }
{select ttl, type, mx_priority, case when lower(type)='txt' then concat('\"', data,
'\"') when lower(type) = 'soa' then concat_ws(' ', data, resp_person, serial,
refresh, retry, expire, minimum) else data end as mydata from DNS_ALL where zone
= '%zone%' and host = '%record%' and (view = 'EDU' or view = 'OP')}
{}
{select ttl, type, host, mx_priority, case when lower(type)='txt' then concat('\"',
data, '\"') else data end as mydata, resp_person, serial, refresh, retry, expire,
minimum from dnstb where zone = '%zone%' and view='EDU'}
{select zone from xfr_table where zone = '%zone%' and client = '%client%' and
view='EDU' limit 1}
{update data_count set count = count + 1 where zone ='%zone%' and view='EDU'}";
};
};

view "CT_view" {
        match-clients { key ct;dns-ip-list;CT;};
        allow-query-cache       { none; };
        allow-recursion         { none; };
        allow-transfer          { none; };
        recursion               no;
dlz "Mysql zone" {
database "mysql
{host=127.0.0.1 dbname=dns_view ssl=false port=3306 user=root pass=pass%!#@larry }
{select zone from DNS_ALL where zone = '%zone%' and view = 'CT' limit 1 }
{select ttl, type, mx_priority, case when lower(type)='txt' then concat('\"', data,
'\"') when lower(type) = 'soa' then concat_ws(' ', data, resp_person, serial,
refresh, retry, expire, minimum) else data end as mydata from DNS_ALL where zone
= '%zone%' and host = '%record%' and (view = 'CT' or view = 'OP')}
{}
{select ttl, type, host, mx_priority, case when lower(type)='txt' then concat('\"',
data, '\"') else data end as mydata, resp_person, serial, refresh, retry, expire,
minimum from dnstb where zone = '%zone%' and view='CT'}
{select zone from xfr_table where zone = '%zone%' and client = '%client%' and
view='CT' limit 1}
{update data_count set count = count + 1 where zone ='%zone%' and view='CT'}";
};
};
view "any_view" {
        match-clients { key any;dns-ip-list;ANY;};
        allow-query-cache       { none; };
        allow-recursion         { none; };
        allow-transfer          { none; };
        recursion               no;
dlz "Mysql zone" {
database "mysql
{host=127.0.0.1 dbname=dns_view ssl=false port=3306 user=root pass=pass%!#@larry }
{select zone from dnstb where zone = '%zone%' and view = 'ANY' limit 1 }
{select ttl, type, mx_priority, case when lower(type)='txt' then concat('\"', data,
'\"') when lower(type) = 'soa' then concat_ws(' ', data, resp_person, serial,
refresh, retry, expire, minimum) else data end as mydata from DNS_ALL where zone
= '%zone%' and host = '%record%' and (view = 'ANY' or view='OP')}
{}
{select ttl, type, host, mx_priority, case when lower(type)='txt' then concat('\"',
data, '\"') else data end as mydata, resp_person, serial, refresh, retry, expire,
minimum from dnstb  where zone = '%zone%' and view='ANY'}
{select zone from xfr_table where zone = '%zone%' and client = '%client%' and
view='ANY' limit 1}
{update data_count set count = count + 1 where zone ='%zone%' and view='ANY'}";
};
};

 2、DLZ相关数据库表结构建立
 mysql>create database dns_view; //创建数据库名为dns_view与view中的dbname对应
mysql>use dns_view;
CREATE TABLE `dnstb` (
`id` int(10) unsigned NOT NULL auto_increment,
`zone` varchar(255) NOT NULL,
`host` varchar(255) NOT NULL default '@',
`type` enum('MX','CNAME','NS','SOA','A','PTR') NOT NULL,
`data` varchar(255) default NULL,
`ttl` int(11) NOT NULL default '600',
`view` char(20) default 'OP',
`mx_priority` int(11) default NULL,
`refresh` int(11) NOT NULL default '600',
`retry` int(11) NOT NULL default '3600',
`expire` int(11) NOT NULL default '86400',
`minimum` int(11) NOT NULL default '3600',
`serial` bigint(20) NOT NULL default '2011061200',
`resp_person` varchar(64) NOT NULL default 'root.larry.com.',
`primary_ns` varchar(64) NOT NULL default 'ns1.larry.com.',
`data_count` int(11) NOT NULL default '0',
PRIMARY KEY (`id`),
KEY `type` (`type`),
KEY `host` (`host`),
KEY `zone` (`zone`)
) ENGINE=MyISAM AUTO_INCREMENT=1 DEFAULT CHARSET=gbk;
3、查看表结构
desc dnstb 查看数据库的表结构
4、启动bind服务
#ln -s /usr/local/mysql/lib/mysql/libmysqlclient.so.16 /usr/lib/
#ldconfig
#/usr/local/bind/sbin/named -uroot -g -d 9 //调试状态，如果没有报错说明环境配置正确。
做成启动服务. Debug的时候多用此模式启动bind. ,如果没问题，杀掉进程使用下面的命令启
动服务
# /usr/local/bind/sbin/rndc reload 重载named.conf相关配置文件.
# /usr/local/bind/sbin/named -uroot -c /usr/local/bind/etc/named.conf 启动bind 服务.

五、添加相关记录并进行测试
--SOA
INSERT INTO `dnstb` (`zone`, `host`, `type`, `data`, `ttl`,`mx_priority`,
`refresh`, `retry`, `expire`, `minimum`, `serial`, `resp_person`, `primary_ns`,
`data_count`) VALUES
('larry.com', '@', 'SOA', 'ns1.larry.com.', 10, NULL, 600, 3600, 86400,
10, 2011061200, 'root.larry.com.', 'ns1.larry.com.', 0);
--@ NS
INSERT INTO `dnstb` (`zone`, `host`, `type`, `data`) VALUES
('larry.com', '@', 'NS', 'ns1.larry.com.'),
('larry.com', '@', 'NS', 'ns2.larry.com.');
--NS A
INSERT INTO `dnstb` (`zone`, `host`, `type`, `data`) VALUES
('larry.com', 'ns', 'A', '192.168.1.60'),
('larry.com', 'ns1', 'A', '192.168.1.61');
--A
INSERT INTO `dnstb` (`zone`, `host`, `type`, `data`, `ttl`, `view`) VALUES
('larry.com', 'www', 'A', '192.168.1.51', 360, 'CNC'),
('larry.com', 'www', 'A', '192.168.1.52', 360, 'CT'),
('larry.com', 'www', 'A', '192.168.1.53', 360, 'CMCC'),
('larry.com', 'www', 'A', '192.168.1.54', 360, 'EDU'),
('larry.com', 'www', 'A', '192.168.1.55', 360, 'ANY'),
--CNAME
INSERT INTO dnstb (zone,host,type,DATA,view) VALUES
('larry.com', 'bbs', 'CNAME', 'www','OP');

2、测试。试着换客户ip 来解析就能解析出不同的地址
通过dig @192.168.1.60 www.larry.com测试


六、配置从DNS:
 1、安装mysql（略）
 2、安装bind配置和主的一样，可以通过rsync同步过来。
 3、Mysql主从复制：
 1）Master 配置
 创建同步用户
 mysql -u root
mysql>UNLOCK TABLES；
mysql>GRANT ALL PRIVILEGES ON *. TO 'larry'@'%' IDENTIFIED BY 'pass%!#@larry' WITH
GRANT OPTION;
mysql>exit

修改配置文件，并打包var文件到Slave 端
vim /etc/my.cnf
[mysqld] 在mysqld 里添加如下几项
long_query_time = 5
expire_logs_days= 3
binlog-do-db=cdn_view  ==>要同步的数据库
binlog-ignore-db=mysql ==>不同步的数据库
binlog_format=mixed
server-id = 160  ==>同一个网络唯一

mysqladmin -u root -S /tmp/mysql.sock shutdown 重启mysql
/usr/local/mysql/bin/mysqld_safe --defaults-file=/etc/my.cnf &
 2)Slave配置:
 将my.cnf 中的server-id=1 改成161
 #log-bin=mysql-bin //注释掉这两行。
 #binlog_format=mixed //修改成如下内容
 server-id = 161
 replicate-do-db=dns_view
 replicate-ignore-db=mysql
 log-slave-updates
 slave-skip-errors=all
 slave-net-timeout=60

mysqladmin -u root -S /tmp/mysql.sock shutdown //重启Mysql
/usr/local/mysql/bin/mysqld_safe --defaults-file=/etc/my.cnf &
msql -u root
mysql>CHANGE MASTER TO
MASTER_HOST='192.168.1.60', //Master IP
MASTER_USER='larry', //用户
MASTER_PASSWORD='larrypasswd', //密码
MASTER_LOG_FILE='mysql-bin.000002',
MASTER_LOG_POS=2272;
以上两行必须按照Master 端的master 状态写show master status;
 3)验证：
 dig @192.168.1.60 www.larry.com
 dig @192.168.1.61 www.larry.com
 在Master端修改A记录的IP地址，看从是否有变化，如果变化一致说明mysql主从复制成功。

七、根据职能DNS可以轻松实现企业DNS功能，同时还可以结合Squid,Nginx,Varnish打造CDN架构.