DNS故障解决小记
|
|
|
/etc/named.conf配置文件如下： options { directory "/var/named"; pid-file "/var/run/named/named.pid"; forwarders {202.106.0.20;}; }; key "rndckey" { algorithm hmac-md5; secret "lFatFBZddzbn4IxnKOvZpDrVkBbqsWK4f8UIm3uGnPAJwRR1OsbHouMeDRAA"; }; controls { inet 127.0.0.1 port 953 allow { 127.0.0.1; } keys { "rndckey"; }; }; zone "." { type hint; file "named.ca"; }; zone "localhost" { type master; file "named.local"; }; zone "0.0.127.in-addr.arpa" { type master; file "named.127.0.0"; }; zone "keywise.cn" { type master; file "named.keywise.cn"; }; zone "0.0.10.in-addr.arpa" { type master; file "named.10.0.0"; }; 各区域文件如下： [root@server ~]# vi /var/named/named.keywise.cn $TTL 86400 @ IN SOA server.keywise.cn root.server.keywise.cn. ( 42 ; serial (d. adams) 3H ; refresh 15M ; retry 1W ; expiry 1D ) ; minimum @ IN NS server.keywise.cn. server IN A 192.168.1.50 www IN A 192.168.1.50 winxp IN A 192.168.1.210 [root@server ~]# vi /var/named/named.10.0.0 @ IN SOA server.keywise.cn. root.server.keywise.cn. ( 1997022700 ; Serial 28800 ; Refresh 14400 ; Retry 3600000 ; Expire 86400 ) ; Minimum @ IN NS server.keywise.cn. 50 IN PTR server.keywise.cn. 50 IN PTR [url]www.keywise.cn.[/url] 210 IN PTR winxp.keywise.cn. 确何区域配置文件都没有错误，开始进行测试； 启动并观察端口情况； [root@server ~]# service named start [root@server ~]# netstat -ntulp | grep named tcp 0 0 192.168.1.50:53 0.0.0.0:* LISTEN 13879/named tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 13879/named tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 13879/named udp 0 0 0.0.0.0:32796 0.0.0.0:* 13879/named udp 0 0 192.168.1.50:53 0.0.0.0:* 13879/named udp 0 0 127.0.0.1:53 0.0.0.0:* 13879/named udp 0 0 :::32797 :::* 13879/named 之前由于没有查看日志，直接开始下面的操作；强烈建议，安装完某服务后一定查看相关日志，确保服务能正常运行。 [root@server ~]# nslookup > www Server: 192.168.1.50 Address: 192.168.1.50#53 ** server can't find www: NXDOMAIN > [url]www.keywise.cn[/url] Server: 192.168.1.50 Address: 192.168.1.50#53 ** server can't find [url]www.keywise.cn:[/url] SERVFAIL 查看日志得知是由于权限问题引起的； Jul 7 23:26:49 server named[2788]: starting BIND 9.3.3rc2 -u named Jul 7 23:26:49 server named[2788]: found 1 CPU, using 1 worker thread Jul 7 23:26:49 server named[2788]: loading configuration from '/etc/named.conf' Jul 7 23:26:49 server named[2788]: listening on IPv4 interface lo, 127.0.0.1#53 Jul 7 23:26:49 server named[2788]: listening on IPv4 interface eth0, 192.168.1.50#53 Jul 7 23:26:49 server named[2788]: command channel listening on 127.0.0.1#953 Jul 7 23:26:49 server named[2788]: command channel listening on ::1#953 Jul 7 23:26:49 server named[2788]: zone 0.0.10.in-addr.arpa/IN: loading master file named.10.0.0: permission denied Jul 7 23:26:49 server named[2788]: zone 0.0.127.in-addr.arpa/IN: loaded serial 1997022700 Jul 7 23:26:49 server named[2788]: zone keywise.cn/IN: loading master file named.keywise.cn: permission denied Jul 7 23:26:49 server named[2788]: zone localhost/IN: loaded serial 42 Jul 7 23:26:49 server named[2788]: running 查看配置文件的权限； drwxr-x--- 5 root named 4096 07-07 22:27 chroot drwxrwx--- 2 named named 4096 2007-03-14 data -rw-r----- 1 root named 198 2007-03-14 localdomain.zone -rw-r----- 1 root root 521 07-07 23:24 named.10.0.0 -rw-r----- 1 root named 426 2007-03-14 named.127.0.0 -rw-r----- 1 root named 427 2007-03-14 named.broadcast -rw-r----- 1 root named 2518 2007-03-14 named.ca -rw-r----- 1 root named 424 2007-03-14 named.ip6.local -rw-r----- 1 root root 293 07-07 23:09 named.keywise.cn -rw-r----- 1 root named 211 07-07 23:13 named.local -rw-r----- 1 root named 427 2007-03-14 named.zero drwxrwx--- 2 named named 4096 2007-03-14 slaves 将以下这两区域文件的所属组为named， rw-r----- 1 root root 521 07-07 23:24 named.10.0.0 -rw-r----- 1 root root 293 07-07 23:09 named.keywise.cn [root@server ~]# service named restart 停止 named： [确定] 启动 named： [确定] [root@server ~]# nslookup > server Default server: 192.168.1.50 Address: 192.168.1.50#53 > www Server: 192.168.1.50 Address: 192.168.1.50#53 Name: [url]www.keywise.cn[/url] Address: 192.168.1.50 > 客户端测试也通过； 
日志中还有一错误提示 Jul 7 23:26:49 server named[2788]: command channel listening on 127.0.0.1#953 [root@server ~]# rndc reload rndc: connection to remote host closed This may indicate that the remote server is using an older version of the command protocol, this host is not authorized to connect, or the key is invalid. 经过仔细查找资料，找到如下解决方法：出现rndc: connection to remote host close多半是rndc.conf中secret与rndc.key中的secret不一致引起的。我的rndc.key内定如下： key "rndckey" { algorithm hmac-md5; secret "lFatFBZddzbn4IxnKOvZpDrVkBbqsWK4f8UIm3uGnPAJwRR1OsbHouMeDRAA"; }; [root@server ~]# vi /etc/rndc.conf /etc/named.conf 2 files to edit 修改rndc.conf中的secret与rndc.key中的一致就可以了。 key "rndckey" { algorithm hmac-md5; secret "lFatFBZddzbn4IxnKOvZpDrVkBbqsWK4f8UIm3uGnPAJwRR1OsbHouMeDRAA"; }; 重新加载OK！ [root@server ~]# rndc reload server reload successful [root@server ~]# rndc status number of zones: 4 debug level: 0 xfers running: 0 xfers deferred: 0 soa queries in progress: 0 query logging is OFF recursive clients: 0/1000 tcp clients: 0/100 server is up and running |