Linux DNS之bind详解

BIND:

Berkeley Internet Name Domain

目前由ISC进行维护。DHCP也是其维护。


安装:

注意:默认情况下,安装好BIND后,默认配置为缓存DNS,然后才配置为住DNS及从DNS服务器。

1.使用rpm包安装:

所需rpm包:

bind97-

libs 库文件包

utils 工具包

devel 包含头文件和库文件的开发包

chroot 将根临时切换到其他目录

caching-nameserver

通过提供配置文件,让BIND服务器成为缓存DNS服务器。新版本中已经集成。不需要专门安装。


#yum install bind97


2.使用源码包安装:


配置文件:

/etc/named.conf

权限为640,属主为root,属组为named。

ZONEFILE可以使用相对路径,是对于DATAFILEDIR来说的相对路径。


文件定义格式:

每一个完整的语句都要以分号(;)结尾,花括号({})只要不在同一行,前后必须有空格。中间的指令也要以分号(;)结尾。


ACL:

访问控制列表,必须先定义后使用。定义在在配置文件最上部。

acl ACLNAME {

ADDR1;

ADDR2;

...

};


none;无

any; 任意的


全局选项:

options {

listen-on prot PORT {IP;}; 

指定监听在IP上PORT端口,省略{IP;};表示接收所有地址。


directory "DATAFILEDIR"; 

确定数据库存放位置。


recursion yes; 

允许递归。


allow-recursion{IP|ACL;};

定义允许递归的客户端来源。


allow-qurey IP|ACL;}; 

定义允许进行查询的客户端来源。


allow-transfer {IP|ACL;};

允许指定的DNS服务器进行进行区域传送,可以定义在区域的内部。


notify yes; 

启动通知功能,主服务端修改后将通知从服务器进行同步。


forward only|first;

only:接受到的请求都转发给指定的服务器,无结果,则无应答。


first:接受到的请求都转发给指定的服务器,无结果后向根查询。


fowarders {IP;};

定义将请求转发到指定的服务器上。


querylog yes:是否启动解析日志记录。



};


视图:

view VIEWNAME { 

OPTIONS;

match-clients{IP1;...;}; 匹配客户端来源

};

注意:全局选项绝大部分都可以在视图中使用,所有的区域都必须定义在视图中。根区域只定义在需要递归的视图中。


日志系统:

格式如下:

logging {

channel CHANNELNAME {

file "FILE" versions NUM size SIZE;

severity LEVEL

};


channel CHANNELNAME {

syslog FILE;

severity LEVEL;


};

catagory CATAGORY { FILE };

};


catagory 日志源。

default

general

client

config

dispatch

dnssec

lame-servers

network

notify

querise

resovler

security

update

xfer-in

xfer-out



channel 定义日志目标。

LOGTYPE:

syslog /var/log/messages

FILE 自定义日志文件。


channel "CHANNELNAME" (LOGTYPE WRITER LEVEL)



例如:

logging {

channel my_file {

file "log.msgs" versions 3 size 20k;

serverity dynamic;

};

channel my_syslog {

syslog local0;

severity info;


};


category xfer-in { my_file; };

categroy upate { my_syslog; }

};



根区域:

zone "." IN {

type hint;

file "named.ca"


};


主区域:

zone "ZONEFILE" IN {

type master|;

file "ZONEFILE";

};


从区域:

zone "ZONENAME" IN {

type slave

file "slave/ZONEFILE"

master {MASTER1IP;MASTER2IP ;...};

};



例如:

有域为test.com. 10.0.0.0/8

dns ns1为10.0.0.3

ns2为 10.0.0.6

www为10.0.0.2 10.0.0.5

mail为10.0.0.4

ftp 在www主机上


1.创建缓存名称服务器并检测错误:

#vim /etc/named.conf

options { 

directory "/var/named";

};

zone "." IN {

type hint;

file "named.ca"


};


zone "localhost" IN {

type master;

file "named.localhost";

};

zone "0.0.127.in-addr.arpa" IN {

type master;

file "named.loopback"

};


#chowm root:named /etc/named.conf

#chmod 640 /etc/named.conf

#named-checkconf 

#named-checkzone "." /var/named/named.ca

#named-checkzone "localhost" /var/named/named.local

#named-checkzone "0.0.172.in-addr.arpa" /var/named/named.loopback

#service named start


2.接上题,创建主服务器:

#vim /etc/named.conf

options { 

directory "/var/named";

};

zone "." IN {

type hint;

file "named.ca"


};


zone "localhost" IN {

type master;

file "named.localhost";

};

zone "0.0.127.in-addr.arpa" IN {

type master;

file "named.loopback"

};


zone "test.com" IN {

type master;

file "test.com.zone";

};


zone "0.0.10.in-addr.arpa" IN {

type master;

file "10.0.0.zone";

};


#vim /var/named/test.com.zone

$TLL 600

test.com. IN SOA ns1.test.com. admin.test.com (

1

1H

5M

1W

1D)


test.com. IN NS ns1.test.com.

IN MX 10 mail


ns1 IN A 10.0.0.3

mail IN A 10.0.0.4

www IN A 10.0.0.2

www IN A 10.0.0.5

ftp IN CNAME www


#vim /var/named/10.0.0.zone

$TLL 600

@ IN SOA ns1.test.com. admin.test.com (

1

1H

5M

1W

1D)


IN NS ns1.test.com.

3 IN PTR ns1.test.com.

4 IN PTR mail.test.com.

2 IN PTR www.test.com.

5 IN PTR www.test.com.


#chmod 640 /var/named/test.com.zone

#chown root:named /var/name/test.com.zone

#named-checkconf

#named-chcekzone "test.com" /var/named/test.com.zone

#name-checkzone "10.0.0.zone" /var/named/10.0.0.zone

#service named restart


3.设置服务器的递归和主从复制选项:

#vim /etc/named.conf

options { 

directory "/var/named";

allow recursion {172.16.0.0/16;};


}; 

zone "." IN {

type hint;

file "named.ca"


};


zone "localhost" IN {

type master;

file "named.localhost";

allow-transfer {none;};

};


zone "0.0.127.in-addr.arpa" IN {

type master;

file "named.loopback"

allow-transfer {none;};

};


zone "test.com" IN {

type master;

file "test.com.zone";

allow-transfer {10.0.0.6;};

}

zone "0.0.10.in-addr.arpa" IN {

type master;

file "10.0.0.zone";

allow-transfer {10.0.0.6;};

};


4.创建DNS从服务器:

在从服务器上配置:

#vim /etc/named.conf

options { 

directory "/var/named";

allow-recursion {172.16.0.0/16;};

};

zone "." IN {

type hint;

file "named.ca"


};


zone "localhost" IN {

type master;

file "named.localhost";

allow-transfer {none;};

};


zone "0.0.127.in-addr.arpa" IN {

type master;

file "named.loopback"

allow-transfer {none;};

};


zone "test.com" IN {

type slave;

master {10.0.0.3;};

file "slaves/test.com.zone";

allow-transfer {none;};

};


zone "0.0.10.in-addr.arpa" IN {

type slave;

master {10.0.0.3;};

file "slaves/10.0.0.zone";

allow-transfer {none;};

};


编辑主服务器上的区域文件:

#vim /var/named/test.com.zone

$TLL 600

test.com. IN SOA ns1.test.com. admin.test.com (

1

1H

5M

1W

1D)


test.com. IN NS ns1.test.com.

IN MX 10 mail

IN NS ns2.test.com.


ns1 IN A 10.0.0.3

mail IN A 10.0.0.4

www IN A 10.0.0.2

www IN A 10.0.0.5

ns2 IN A 10.0.0.6

ftp IN CNAME www


#vim /var/named/10.0.0.zone

$TLL 600

@ IN SOA ns1.test.com. admin.test.com (

1

1H

5M

1W

1D)


IN NS ns1.test.com.

IN NS ns2.test.com.


3 IN PTR ns1.test.com.

4 IN PTR mail.test.com.

2 IN PTR www.test.com.

5 IN PTR www.test.com.

6 IN PTR ns2.test.com.


5.创建转发服务器:

全局转发:

#vim /etc/named.conf

options { 

directory "/var/named";

allow recursion {172.16.0.0/16;};

forward first;

forwarder {10.0.1.2;};

};

zone "." IN {

type hint;

file "named.ca"


};


zone "localhost" IN {

type master;

file "named.localhost";

allow-transfer {none;};

};


zone "0.0.127.in-addr.arpa" IN {

type master;

file "named.loopback"

allow-transfer {none;};

};


zone "test.com" IN {

type master;

file "test.com.zone";

allow-transfer {10.0.0.6;};

};


zone "0.0.10.in-addr.arpa" IN {

type master;

file "10.0.0.zone";

allow-transfer {10.0.0.6;};

};


区域转发:

#vim /etc/named.conf

options { 

directory "/var/named";

allow-recursion {172.16.0.0/16;};

};

zone "." IN {

type hint;

file "named.ca"


};


zone "localhost" IN {

type master;

file "named.localhost";

allow-transfer {none;};

};


zone "0.0.127.in-addr.arpa" IN {

type master;

file "named.loopback"

allow-transfer {none;};

};


zone "test.com" IN {

type master;

file "test.com.zone";

allow-transfer {10.0.0.6;};

forward first;

forwarder {10.0.1.2;};

};


zone "0.0.10.in-addr.arpa" IN {

type master;

file "10.0.0.zone";

allow-transfer {10.0.0.6;};

};


6.视图和ACL:

NET1网段中中客户端访问www.test.com解析为10.0.0.2,其他网段客户端访问解析的地址为192.168.0.2。a.net域中的主机访问www.a.net一律解析为10.0.0.2。


#vim /etc/named.conf

acl NET1 {

172.16.0.0/16;

192.168.100.0/24;

127.0.0.0/8;

};


options { 

directory "/var/named";

allow-recursion {NET1;};

};


view NET1{

match-client {NET1;};

zone "test.com" IN {

type master;

file "NET1.test.com.zone"

};


zone "0.0.10.in-addr.arpa" IN {

type master;

file "NET1.192.0.0.zone";

};


zone "a.net" IN {

type master;

file "a.net.zone"

};

};


view NET2{

match-client {any;};

zone "test.com" IN {

type master;

file "ANY.test.com.zone"

};


zone "0.0.10.in-addr.arpa" IN {

type master;

file "ANY.10.0.0.zone";

};


zone "a.net" IN {

type master;

file "a.net.zone"


};

};


zone "." IN {

type hint;

file "named.ca"


};


zone "localhost" IN {

type master;

file "named.localhost";

allow-transfer {none;};

};


zone "0.0.127.in-addr.arpa" IN {

type master;

file "named.loopback"

allow-transfer {none;};

};


#vim NET1.test.com.zone

$TLL 86400

$ORIGIN test.com.

@ IN SOA ns1.test.com. admin.test.com.(

1

1D

15M

1W

1D

)

IN NS ns1.test.com.

IN NS ns2.test.com.

IN MX 10 mail.test.com.

ns1 IN A 10.0.0.3

ns2 IN A 10.0.0.6

www IN A 10.0.0.2

www IN A 10.0.0.5

mail IN A 10.0.0.4

ftp IN CNAME www


#vim ANY.test.com.zone

$TLL 86400

$ORIGIN test.com.

@ IN SOA ns1.test.com. admin.test.com.(

1

1D

15M

1W

1D

)

IN NS ns1.test.com.

IN NS ns2.test.com.

IN MX 10 mail.test.com.

ns1 IN A 10.0.0.3

ns2 IN A 10.0.0.6

www IN A 192.168.0.2

www IN A 192.168.0.5

mail IN A 10.0.0.4

ftp IN CNAME www


#vim a.net.zone

$TLL 86400

$ORIGIN a.net.

@ IN SOA ns1.a.net. admin.a.net.(

1

1D

15M

1W

1D

)

IN NS ns1.a.net

ns1 IN A 10.0.0.3

www IN A 10.0.0.2


/etc/rndc.key

Remote Name Domain Controller 远程域名控制器。

让rndc能够正常工作的密钥文件。


/etc/rndc.conf

rndc工具的配置信息。


/var/named/*

区域数据文件,由管理员自行定义。


name.ca 

13个根DNS服务器的地址,若没有此文件可以通过dig命令来生成。


name.localhost

专门将localhost解析为127.0.0.1


name.loopback

专门将loopback解析为127.0.0.1



/etc/rc.d/init.d/named

服务脚本,支持start|stop|status|restart|reload|try-restart|force-reload


主程序:

/usr/sbin/named


监听的端口:

TCP 53端口 主从复制时使用,保证数据完整性。


UTP 53端口 查询请求时使用,速度快。


TCP 953端口 rndc工具监听端口。


日志:

/var/log/message



工具:

/usr/sbin/named-checkconf 检查配置文件

/usr/sbin/named-checkzone 检查区域文件


/usr/sbin/named-compliezone 将区域文件编译为其他格式

/usr/sbin/named-journalprint 


/usr/sbin/rndc 远程控制工具

/usr/sbin/rndc-confgen 

rndc工具的配置文件生成器,生成/etc/rndc.conf文件。


DNS子域授权:

正向区域:

SUB_ZONE_NAME IN NS SUB_ZONE_DNS_NMAE

SUB_ZONE_DNS_NMAE IN A SUB_DNS_IP


反向区域:



例如:

有域为.com

test.com为子域。

DNS服务器如下:

ns1.test.com 10.0.0.3

ns2.test.com 10.0.0.4


其中有:fi、market、it3个子域,各部门中的DNS服务器如下:

ns1.fi.test.com 172.16.0.2

ns2.fi.test.com 172.16.0.5


ns1.market.test.com 172.16.0.3

ns2.market.test.com 172.16.0.6


ns1.it.test.com 172.16.0.4

ns2.it.test.com 172.16.0.7



在.com上:

正向区域:

test.com. IN NS ns1.test.com.

test.com. IN NS ns2.test.com.;

ns1.test.com. IN A 10.0.0.3

ns2.test.com. IN A 10.0.0.4




在test.com上:

正向区域:

fi.test.com. IN NS ns1.fi.test.com.

fi.test.com. IN NS ns2.fi.test.com.

ns1.fi.test.com. IN A 172.16.0.2

ns2.fi.test.com. IN A 172.16.0.5


market.test.cfom. IN NS ns1.market.test.com.

market.test.cfom. IN NS ns2.market.test.com.

ns1.market.test.com. IN A 172.16.0.3

ns1.market.test.com. IN A 172.16.0.6


it.test.com. IN NS ns1.it.test.com.

it.test.com. IN NS ns2.it.test.com.

ns1.it.test.com. IN A 172.16.0.4

ns1.it.test.com. IN A 172.16.0.7



#vim /var/named/test.com.zone

$TLL 600

test.com. IN SOA ns1.test.com. admin.test.com (

1

1H

5M

1W

1D)


test.com. IN NS ns1.test.com.

IN MX 10 mail

IN NS ns2.test.com.


ns1 IN A 10.0.0.3

mail IN A 10.0.0.4

www IN A 10.0.0.2

www IN A 10.0.0.5

ns2 IN A 10.0.0.6

ftp IN CNAME www

fi IN NS ns1.fi

ns1.fi IN A 172.16.0.2

market IN NS ns1.market

ns1.market IN A 172.16.0.3


it IN NS ns1.it

ns1.it IN A 172.16.0.4




#vim /var/named/10.0.0.zone

$TLL 600

@ IN SOA ns1.test.com. admin.test.com (

1

1H

5M

1W

1D)


IN NS ns1.test.com.

IN NS ns2.test.com.


3 IN PTR ns1.test.com.

4 IN PTR mail.test.com.

2 IN PTR www.test.com.

5 IN PTR www.test.com.

6 IN PTR ns2.test.com.




win:

nsloolup

server IP 指定DNS服务器

set q=A 指定资源记录类型


你可能感兴趣的:(linux,bind,dns)