智能DNS构建

智能DNS：
view


1）
# yum install caching-nameserver
#

若使用view，则所有的zone则必须要声明在view中！


DDNS:Dynamic DNS


benchmark：压力测试
bind queryperf（需要编译）
queryperf -d datafile

bind-dlz:不用预加载数据到内存

dnstop :监听本机的dns被查询的记录
前提：libpcap 、 libpcap-devel 、ncurses-devel
dnstop -4 -R -Q eth0 #查询收集信息
profile：评估服务器瓶颈



www.dnspod.cn
www.dns.la

bind
9.9.0 最新版本
www.isc.org 官方网站
named 进程名
TCP|UDP 53端口（UDP）
DNS 协议

/etc/named.conf 主配置文件
/etc/rc.d/init.d/named 进程控制脚本
/var/named :named


allow-transfer { host_list; };
allow-recuesion { host_list; };
listen-on port 53 { ip; };


zone "zone_name" IN {
type forward;
forwarders { ip; };
forward first|only;
};

options {
forward only;
forwarders { ip; };
};

zone "magedu.com" IN {
type master;
forwarders { ip; };
file "";
};



magedu.com

tech.magedu.com IN NS na.tech.magedu.com
na.tech.magedu.com IN A 172.16.100.1



/etc/rndc.conf 953端口 辅助控制器

========================================================================
DMZ



地址转换：NAT
SNAT：源地址转换
DNAT：目标地址转换
PNAT：端口地址转换



智能DNS，实现缓存。

allow-update: 允许更新

CDN： 内容分发网络


DDNS: Dynamic DNS 动态DNS



view

# man named.conf
view string optional_class {
match-clients { address_match_element; ... };
match-destinations { address_match_element; ... };
match-recursive-only boolean;



查询日志：
# tail /var/log/messages


清除原有ＤＮＳ：
# service named stop
# mv /etc/named.conf /root
# cd /var/named
# ls
# mv 172.16.zone localhost.zone named.ca named.local magedu.com.zone stats /root
#


安装智能DNS：
# yum install caching-nameserver
# ls /var/named
# ls /etc | grep named
# vim /etc/named.conf
acl lnet {
172.16.0.0/16;
127.0.0.0/8;
};

options {
directory "/var/named";
};

view internal {
match-clients { lnet; };
recursion yes;

zone "." IN {
type hint;
file "named.ca";
};

zone "localhost" IN {
type master;
file "localhost.zone";
};

zone "0.0.127.in-addr.arpa" IN {
type master;
file "named.local";
};

zone "magedu.com" IN {
type master;
file "magedu.com.internal";
allow-transfer { none; };
allow-update { none; };
};
};

view external {
match-clients { any; };
recursion no;

zone "magedu.com" IN {
type master;
file "magedu.com.external";
allow-transfer { none; };
allow-update { none; };
};
};
# cd /var/named
# vim magedu.com.internal
$TTL 600
$ORIGIN magedu.com.
@ IN SOA ns.magedu.com. admin.magedu.com. (
2012030801
1H
10M
1W
1D)
IN NS ns
IN MX 10 mail
ns IN A 172.16.100.1
mail IN A 172.16.100.2
www IN A 172.16.0.1
# vim magedu.com.external
$TTL 600
$ORIGIN magedu.com.
@ IN SOA ns.magedu.com. admin.magedu.com. (
2012030801
1H
10M
1W
1D)
IN NS ns
IN MX 10 mail
ns IN A 1.1.1.1
mail IN A 1.1.1.2
www IN A 1.1.1.1
# chown :named magedu.com.* #更改文件数组为named
# service named configtest #测试named的配置文件是否有错误
# service named start
#

#[root@stu33 named]# dig -t A @172.16.33.1 www.magedu.com

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5 <<>> -t A @172.16.33.1 www.magedu.com
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14495
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;www.magedu.com. IN A

;; ANSWER SECTION:
www.magedu.com. 600 IN A 172.16.0.1

;; AUTHORITY SECTION:
magedu.com. 600 IN NS ns.magedu.com.

;; ADDITIONAL SECTION:
ns.magedu.com. 600 IN A 172.16.100.1

;; Query time: 21 msec
;; SERVER: 172.16.33.1#53(172.16.33.1)
;; WHEN: Fri Mar 9 10:07:14 2012
;; MSG SIZE rcvd: 81




==============================================================
benchmark:压力测试工具
####profile:评估DNS性能工具
bind:queryperf(子组件） 信息装入内存中。
# lftp 172.16.0.1
get /pub/Sources/bind/bind-9.9.0.tar.gz
# tar xvf bind-9.9.0.tar.gz
# cd bind-9.9.0/contrib/queryperf/
# ./configure
# make
# mv queryperf /bin #将可执行的queryperf移动到/bin目录下
# queryperf -h #显示帮助信息
# vim /tmp/queryperftest #建立一个测试文件供压力测试用
www.magedu.com A
magedu.com NS
ns.magedu.com A
magedu.com MX
# queryperf -d /tmp/queryperftest -s 172.16.100.1 #使用这个ip作为DNS智能服务器测试文件queryperftest，做压力测试


=============================================================
DNS日志功能:
# vim /etc/named.conf
options {
directory "/var/named";
querylog yes;
};
速度慢

=============================================================
重读文件，生效速度很慢。


bind-sdb.i386安装后，配置文件放入数据库中。

bind-dlz 配置文件放入数据库中且不用预加载数据到内存。
A, bind --> select
www.magedu.com A --> select --> 可以通过Web接口修改配置文件



动态加载
================================================================
dnstop:监控本机DNS服务信息。
# lftp 172.16.0.1
get /pub/Sources/bind/dnstop-20110502.tar.gz
安装软件包libpcap和libpcap-devel、ncurses-devel
# yum install libpcap-devel -y
# yum install ncurses-devel -y
# tar xvf dnstop-20110502.tar.gz
# cd dnstop-20110502
# ./config
# make
# make install
# dnstop -4 -R -Q eth0 #监控本机这个块网卡的DNS请求信息（用其他机器来请求这个DNS服务器解析，以监控这个DNS服务器的信息）

================================================================
编译方式named
不受selinux限制
自己建立/var/named
自己制定安装位置，可以安装在同一个目录中。
# lftp 172.16.0.1
get /pub/Sources/bind/bind-9.9.0.tar.gz (named-9.tar.gz || named)
# yum grouplist 确保所有软件包组都已安装
# rpm-q bind 确保bind软件包没有安装
# hwclock -s 确保时间同步，防止系统时间超过软件包的发布时间，造成低级错误
# yum groupinstall "Development Tools" "Development Libraries" "DNS Name Server"

# tar
# cd bind-
#


/etc/rc.d/init.d/named 进程控制脚本
编译安装named:
#./configure --sysconfdir=/etc --disable-ipv6 --enable-largefile --enable-threads=no --prefix=/usr/local/named --disable-openssl-version-check --localstatedir=/var


#!/bin/bash
#
# named This shell script takes care of starting and stopping
# named (BIND DNS server).
#
# chkconfig: - 13 87
# description: named (BIND) is a Domain Name Server (DNS) \
# that is used to resolve host names to IP addresses.
# probe: true

# Source function library.
. /etc/rc.d/init.d/functions

# Source networking configuration.
[ -r /etc/sysconfig/network ] && . /etc/sysconfig/network

named=named
named_conf=/etc/named/named.conf

start() {
echo -n $"Starting $named: "
if [ -n "`/sbin/pidof -o %PPID $named`" ]; then
echo -n $"$named: already running"
failure
echo
return 1
fi

conf_ok=0;
if [ -x /usr/sbin/named-checkconf ] && [ -x /usr/sbin/named-checkzone ] && /usr/sbin/named-checkconf $ckcf_options ${named_conf} >/dev/null 2>&1; then
conf_ok=1;
else
RETVAL=$?;
fi
if [ $conf_ok -eq 1 ]; then
daemon /usr/sbin/$named -u named;
RETVAL=$?;
[ $RETVAL -eq 0 ] && touch /var/lock/subsys/named
echo
return $RETVAL
}


stop() {
# Stop daemons.
echo -n $"Stopping $named: "
/usr/sbin/rndc stop >/dev/null 2>&1
RETVAL=$?
[ "$RETVAL" -eq 0 ] || killproc "$named" -TERM >/dev/null 2>&1

timeout=0
RETVAL=0
while /sbin/pidof -o %PPID "$named" >/dev/null; do
if [ $timeout -ge $NAMED_SHUTDOWN_TIMEOUT ]; then
RETVAL=1
break
else
sleep 2 && echo -n "."
timeout=$((timeout+2))
fi;
done
if [ $RETVAL -eq 0 ]; then
rm -f /var/lock/subsys/named
rm -f /var/run/named.pid
fi;

if [ $RETVAL -eq 0 ]; then
success
else
failure
fi;
echo
return $RETVAL
}

restart() {
stop
sleep 2
start
}

status() {
/usr/sbin/rndc status
status /usr/local/named/sbin/$named
return $?
}

reload() {
echo -n $"Reloading $named: "
p=`/sbin/pidof -o %PPID $named`
RETVAL=$?
if [ "$RETVAL" -eq 0 ]; then
/usr/sbin/rndc reload >/dev/null 2>&1 || /bin/kill -HUP $p;
RETVAL=$?
fi
[ "$RETVAL" -eq 0 ] && success $"$named reload" || failure $"$named reload"
echo
return $RETVAL
}

checkconfig() {
if [ -x /usr/sbin/named-checkconf ] && [ -x /usr/sbin/named-checkzone ] && /usr/sbin/named-checkconf | cat ; then
return 0;
else
return 1;
fi
}


case "$1" in
start)
start
;;
stop)
stop
;;
status)
rhstatus
;;
restart)
restart
;;
condrestart)
[ -e /var/lock/subsys/named ] && restart;
;;
reload)
reload
;;
probe)
probe
;;
checkconfig|configtest|check|test)
checkconfig
;;
*)
echo $"Usage: $0 {start|stop|status|restart|condrestart|reload|configtest|probe}"
exit 2
esac

exit $?


=================================================================================
修改后的/etc/rc.d/init.d/named文件：
#!/bin/bash
#
# named This shell script takes care of starting and stopping
# named (BIND DNS server).
#
# chkconfig: - 13 87
# description: named (BIND) is a Domain Name Server (DNS) \
# that is used to resolve host names to IP addresses.
# probe: true

# Source function library.
. /etc/rc.d/init.d/functions

# Source networking configuration.
[ -r /etc/sysconfig/network ] && . /etc/sysconfig/network


named=named
named_conf="/etc/named/named.conf"
ROOTDIR="/usr/local/named"
CHKCONF="$ROOTDIR/sbin/named-checkconf"
CHKZONE="$ROOTDIR/sbin/named-checkzone"
RNDC="$ROOTDIR/sbin/rndc"

start() {
echo -n $"Starting $named: "
if [ -n "`/sbin/pidof -o %PPID $named`" ]; then
echo -n $"$named: already running"
failure
echo
return 1
fi

conf_ok=0;
if [ -x $CHKCONF ] && [ -x $CHKZONE ] && $CHKCONF ${named_conf} >/dev/null 2>&1; then
conf_ok=1;
else
RETVAL=$?;
fi
if [ $conf_ok -eq 1 ]; then
daemon $ROOTDIR/sbin/$named -u named;
RETVAL=$?;
[ $RETVAL -eq 0 ] && touch /var/lock/subsys/named
echo
return $RETVAL
fi
}


stop() {
# Stop daemons.
echo -n $"Stopping $named: "
$RNDC stop >/dev/null 2>&1
RETVAL=$?
[ "$RETVAL" -eq 0 ] || killproc "$named" -TERM >/dev/null 2>&1


if [ $RETVAL -eq 0 ]; then
rm -f /var/lock/subsys/named &> /dev/null
rm -f /var/run/named.pid &> /dev/null
fi;

if [ $RETVAL -eq 0 ]; then
success
else
failure
fi;
echo
return $RETVAL
}

restart() {
stop
sleep 2
start
}

status() {
$RNDC status
status $ROOTDIR/sbin/$named
return $?
}

reload() {
echo -n $"Reloading $named: "
p=`/sbin/pidof -o %PPID $named`
RETVAL=$?
if [ "$RETVAL" -eq 0 ]; then
$RNDC reload >/dev/null 2>&1 || /bin/kill -HUP $p;
RETVAL=$?
fi
[ "$RETVAL" -eq 0 ] && success $"$named reload" || failure $"$named reload"
echo
return $RETVAL
}

checkconfig() {
if [ -x $CHKCONF ] && [ -x $CHKZONE ] && $CHKCONF ${named_conf} ; then
return 0;
else
return 1;
fi
}


case "$1" in
start)
start
;;
stop)
stop
;;
status)
status
;;
restart)
restart
;;
reload)
reload
;;
checkconfig|configtest|check|test)
checkconfig
;;
*)
echo $"Usage: $0 {start|stop|status|restart|condrestart|reload|configtest|probe}"
exit 2
;;
esac

exit $?