BIND之子域授权、区域转发、view
BIND子域授权的实现：
在父域的配置文件中添加如下项：
授权的子区域名称子区域的名称服务器子区域的名称服务器的IP地址
1.在父域的区域配置件/var/named/mageedu.com.zone中添加子域子区域名称、子区域名称、子区域的名称服务器的IP地址
# vim /var/named/mageedu.com.zone $TTL 86400 @ IN SOA dsn.mageedu.com. admin.mageedu.com ( 2014031901 1D 12H 1D 12H ) IN NS dns IN NS ns IN MX 20mail dns IN A 172.16.19.100 ns IN A 172.16.19.1 mail IN A 172.16.19.2 www IN A 172.16.19.3 pop IN CNAME mail ftp IN CNAME www zhou IN NS dns.zhou dns.zhou IN A 172.16.251.100
3.重启服务
# rndc reload server reload successful
3.使用dig命令测试
# dig -t NS zhou.dns.mageedu.com ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6 <<>> -t NS zhou.dns.mageedu.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 12799 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;zhou.dns.mageedu.com. IN NS ;; AUTHORITY SECTION: mageedu.com. 43200IN SOA dsn.mageedu.com. admin.mageedu.com.mageedu.com. 201403190186400432008640043200 ;; Query time: 1msec ;; SERVER: 172.16.19.100#53(172.16.19.100) ;; WHEN: Sun Mar 1617:21:352014 ;; MSG SIZE rcvd: 96
4.在子域的服务器中安装bind同第一次安装，在/etc/named.rfc1912.zones中添加正向区域和反向区域
zone "zhou.mageedu.com"IN {
type master;
file "zhou.mageedu.com.zone";
};
zone "251.16.172.in-addr.arpa"IN {
type master;
file "172.16.251.zone";
};
5.为区域zhou.mageedu.com提供区域数据文件
# vim /var/named/zhou.mageedu.com.zone $TTL 86400 @ IN SOA dns.zhou.mageedu.com. admin.zhou.mageedu.com. ( 2014031901 1D 10M 3D 12H ) IN NS dns IN NS 20mail dns IN A 172.16.251.100 www IN A 172.16.251.101 mail IN A 172.16.251.102 pop IN CNAME mail ftp IN CNAME www
6.为添加的正向区域数据文件设置属主和属组以及权限
# chown root:named /var/named/zhou.mageedu.com.zone # chmod 640/var/named/zhou.mageedu.com.zone # ls -l /var/named/zhou.mageedu.com.zone -rw-r----- 1root named 246Mar 1723:13/var/named/zhou.mageedu.com.zone
7.为区域251.16.172.inaddr.arpa提供区域数据文件
# vim /var/named/172.16.251.zone $TTL 86400 @ IN SOA dsn.zhou.mageedu.com. admin.zhou.mageedu.com. ( 2014031902 1D 12H 1D 12H ) IN NS dns.zhou.mageedu.com. 100IN PTR dns.zhou.mageedu.com. 102IN PTR mail.mageedu.com. 101IN PTR www.mageedu.com.
8.为添加的反向区域数据文件设置属主和属组以及权限
# chown root:named /var/named/172.16.251.zone # chmod 640/var/named/172.16.251.zone # ls -l /var/named/172.16.251.zone -rw-r----- 1root named 230Mar 1723:44/var/named/172.16.251.zone
9.测试文件是否有语法错误
# service named configtest zone localhost.localdomain/IN: loaded serial 0 zone localhost/IN: loaded serial 0 zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 0 zone 1.0.0.127.in-addr.arpa/IN: loaded serial 0 zone 0.in-addr.arpa/IN: loaded serial 0 zone zhou.mageedu.com/IN: loaded serial 2014031901 zone 251.16.172.in-addr.arpa/IN: loaded serial 2014031902
10.使用dig测试
# dig -t NS zhou.mageedu.com @172.16.251.100 ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6 <<>> -t NS zhou.mageedu.com @172.16.251.100 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1352 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; QUESTION SECTION: ;zhou.mageedu.com. IN NS ;; ANSWER SECTION: zhou.mageedu.com. 86400IN NS dns.zhou.mageedu.com. ;; ADDITIONAL SECTION: dns.zhou.mageedu.com. 86400IN A 172.16.251.100 ;; Query time: 1msec ;; SERVER: 172.16.251.100#53(172.16.251.100) ;; WHEN: Mon Mar 1723:53:212014 ;; MSG SIZE rcvd: 68
11.子域能够在本机中解析
# dig -t A www.zhou.mageedu.com @172.16.251.100 ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6 <<>> -t A www.zhou.mageedu.com @172.16.251.100 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30650 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1 ;; QUESTION SECTION: ;www.zhou.mageedu.com. IN A ;; ANSWER SECTION: www.zhou.mageedu.com. 86400IN A 172.16.251.101 ;; AUTHORITY SECTION: zhou.mageedu.com. 86400IN NS dns.zhou.mageedu.com. ;; ADDITIONAL SECTION: dns.zhou.mageedu.com. 86400IN A 172.16.251.100 ;; Query time: 5msec ;; SERVER: 172.16.251.100#53(172.16.251.100) ;; WHEN: Mon Mar 1723:54:502014 ;; MSG SIZE rcvd: 88
实现区域转发
允许使用转发的前提：本机要在对方的允许的递归主机列表中；
区域转发：解析某本机不负责的区域内的名称时不转发给根，而是转给指定的主机
在子域的服务器中添加一条区域的转发（需要注释住配置文件中的include "/etc/named.root.key";）
zone "mageedu.com"IN {
type forward;
forwarders {172.16.19.100;};
};
重启服务
# service named reload
区域转发配置成功
# dig -t A www.mageedu.com @172.16.251.100 ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6 <<>> -t A www.mageedu.com @172.16.251.100 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55304 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2 ;; QUESTION SECTION: ;www.mageedu.com. IN A ;; ANSWER SECTION: www.mageedu.com. 86112IN A 172.16.19.3 ;; AUTHORITY SECTION: mageedu.com. 86112IN NS ns.mageedu.com. mageedu.com. 86112IN NS dns.mageedu.com. ;; ADDITIONAL SECTION: ns.mageedu.com. 86112IN A 172.16.19.1 dns.mageedu.com. 86112IN A 172.16.19.100 ;; Query time: 1msec ;; SERVER: 172.16.251.100#53(172.16.251.100) ;; WHEN: Tue Mar 1800:20:312014 ;; MSG SIZE rcvd: 116
在options选项中添加全局转发可以所有的区域转发192.168.1.1能够访问互联网
options {
directory "/var/named";
recursion yes;
forward first;
forwarders { 192.168.1.1; };
};
在本机中使用dig解析www.goole.com
# dig -t A www.goole.com @172.16.251.100 ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6 <<>> -t A www.goole.com @172.16.251.100 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13592 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2 ;; QUESTION SECTION: ;www.goole.com. IN A ;; ANSWER SECTION: www.goole.com. 3600IN A 213.165.70.39 ;; AUTHORITY SECTION: goole.com. 100722IN NS ns67.1and1.co.uk. goole.com. 100722IN NS ns68.1and1.co.uk. ;; ADDITIONAL SECTION: ns67.1and1.co.uk. 75290IN A 217.160.80.173 ns68.1and1.co.uk. 75290IN A 217.160.81.173 ;; Query time: 148msec ;; SERVER: 172.16.251.100#53(172.16.251.100) ;; WHEN: Tue Mar 1800:41:
ACL: BIND支持使用访问控制列表
自定义ACL
acl ACL_NAME {
ACL列表；（每一行定义一项，并以";"结束） }; 访问控制列表只有定义后才能使用；通常acl要定义在named.conf的最上方； BIND有四个内置的acl: any: 任何主机 none: 无一主机
local: 本机
localnet: 本机的所在的网络；
只允许本机和172.16.0.0/16网络进行递归，在named.conf的最上方定义ACL，并在option中使用
acl clientrecursion {
172.16.0.0/16;
127.0.0.1;
};
options {
// listen-on port 53 { 127.0.0.1; };
// listen-on-v6 port 53 { ::1; };
directory "/var/named";
// recursion yes;
allow-recursion { clientrecursion; };
};
DNS视图：view
根据来自不同网络用户的访问请求，对相同的域名解析成不同的IP，使用户可以访问离他最近的那台服务器，以增加用户的访问速度。
场景：来自内网和外网的所有IP都解析到dns.mageedu.com中，使得反馈给用户同一结果。
配置 view：
1.编辑配置文件，将所有的区域加入视图中
view Innernet {
match-clients { 172.16.0.0/16;};
zone "."IN {
type hint;
file "named.ca";
};
zone "localhost.localdomain"IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "localhost"IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.a rpa"IN {
type master;
file "named.loopback";
allow-update { none; };
};
zone "1.0.0.127.in-addr.arpa"IN {
type master;
file "named.loopback";
allow-update { none; };
};
zone "0.in-addr.arpa"IN {
type master;
file "named.empty";
allow-update { none; };
};
zone "19.16.172.in-addr.arpa"IN {
type master;
file "172.16.19.zone";
allow-transfer {127.0.0.1;172.16.19.1;};
};
zone "mageedu.com"IN {
type master;
file "mageedu.com.Innernet";
};
};
view default{
match-clients { any; };
zone "mageedu.com"IN {
type master;
file "mageedu.com.default";
};
};
2 为内网解析添加区域数据文件
# vim /var/named/mageedu.com.Innernet $TTL 86400 @ IN SOA dsn.mageedu.com. admin.mageedu.com ( 2014031901 1D 12H 1D 12H ) IN NS dns IN MX 20mail dns IN A 172.16.19.100 mail IN A 172.16.19.101 www IN A 172.16.19.102 pop IN CNAME mail ftp IN CNAME ww
3.为其他网段添加区域数据文件
# vim /var/named/mageedu.com.default $TTL 86400 @ IN SOA dsn.mageedu.com. admin.mageedu.com ( 2014031901 1D 12H 1D 12H ) IN NS dns IN MX 20mail dns IN A 192.168.1.100 mail IN A 192.168.1.101 www IN A 192.168.1.102 pop IN CNAME mail ftp IN CNAME www
4.为区域数据文件改变属主、属组hequanxian
# chown root:named /var/named/mageedu.com.default/var/named/mageedu.com.Innernet ]# chmod 640/var/named/mageedu.com.default/var/named/mageedu.com.Innernet # ll /var/named/mageedu.com.* -rw-r----- 1root named 233Mar 1619:40/var/named/mageedu.com.default -rw-r----- 1root named 232Mar 1619:31/var/named/mageedu.com.Innernet
5.验证配置文件是否有错误
# service named configtest zone localhost.localdomain/IN: loaded serial 0 zone localhost/IN: loaded serial 0 zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 0 zone 1.0.0.127.in-addr.arpa/IN: loaded serial 0 zone 0.in-addr.arpa/IN: loaded serial 0 zone 19.16.172.in-addr.arpa/IN: loaded serial 2014031902 zone mageedu.com/IN: loaded serial 2014031901 zone mageedu.com/IN: loaded serial 2014031901
6.启动named服务
# named -u named
7.使用dig命令验证，view视图配置成功
# dig -t A www.mageedu.com @192.168.1.100 ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6 <<>> -t A www.mageedu.com @192.168.1.100 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33369 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1 ;; QUESTION SECTION: ;www.mageedu.com. IN A ;; ANSWER SECTION: www.mageedu.com. 86400IN A 192.168.1.102 ;; AUTHORITY SECTION: mageedu.com. 86400IN NS dns.mageedu.com. ;; ADDITIONAL SECTION: dns.mageedu.com. 86400IN A 192.168.1.100 ;; Query time: 1msec ;; SERVER: 192.168.1.100#53(192.168.1.100) ;; WHEN: Sun Mar 1614:38:512014 ;; MSG SIZE rcvd: 83 # dig -t A www.mageedu.com @172.16.19.100 ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6 <<>> -t A www.mageedu.com @172.16.19.100 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8257 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1 ;; QUESTION SECTION: ;www.mageedu.com. IN A ;; ANSWER SECTION: www.mageedu.com. 86400IN A 172.16.19.102 ;; AUTHORITY SECTION: mageedu.com. 86400IN NS dns.mageedu.com. ;; ADDITIONAL SECTION: dns.mageedu.com. 86400IN A 172.16.19.100 ;; Query time: 2msec ;; SERVER: 172.16.19.100#53(172.16.19.100) ;; WHEN: Sun Mar 1614:39:032014 ;; MSG SIZE rcvd: 83