RHEL7.0 DNS服务配置

系统版本：

[root@localhostnamed]# uname -a

Linuxmainserver.fengslab.com 3.10.0-123.el7.x86_64 #1 SMP Mon May 5 11:16:57 EDT2014 x86_64 x86_64 x86_64 GNU/Linux

 

1, resolv.conf

[root@localhostnamed]# cat /etc/resolv.conf

# Generated byNetworkManager

domain fengslab.com

search localdomain

nameserver 192.168.2.2

[root@localhostnamed]#

 

合法的参数及其意义如下：

nameserver　表明DNS服务器的IP地址。可以有很多行的nameserver，每一个带一个IP地址。在查询时就按nameserver在本文件中的顺序进行，且只有当第一个nameserver没有反应时才查询下面的nameserver。 

domain　　　声明主机的域名。很多程序用到它，如邮件系统；当为没有域名的主机进行DNS查询时，也要用到。如果没有域名，主机名将被使用，删除所有在第一个点(.)前面的内容。 

search　　　它的多个参数指明域名查询顺序。当要查询没有域名的主机，主机将在由search声明的域中分别查找。domain和search不能共存；如果同时存在，后面出现的将会被使用。  

sortlist　　允许将得到域名结果进行特定的排序。它的参数为网络/掩码对，允许任意的排列顺序。 

 

Red Hat中没有提供缺省的/etc/resolv.conf文件，它的内容是根据在安装时给出的选项动态创建的。

来自 <http://www.linuxidc.com/Linux/2007-09/7645.htm>

 

2, host.conf

[root@localhostnamed]# cat /etc/host.conf

multi on

关于/etc/host.conf

移步至：http://lxsym.blog.51cto.com/1364623/311989

 

3, 安装的bind：

 

[root@localhostnamed]# yum install bind-*

Loaded plugins:langpacks, product-id, subscription-manager

This system is notregistered to Red Hat Subscription Management. You can use subscription-managerto register.

ResolvingDependencies

--> Runningtransaction check

---> Packagebind.x86_64 32:9.9.4-14.el7 will be reinstalled

---> Packagebind-chroot.x86_64 32:9.9.4-14.el7 will be reinstalled

---> Packagebind-dyndb-ldap.x86_64 0:3.5-4.el7 will be reinstalled

---> Packagebind-libs.x86_64 32:9.9.4-14.el7 will be reinstalled

---> Packagebind-libs-lite.x86_64 32:9.9.4-14.el7 will be reinstalled

---> Packagebind-license.noarch 32:9.9.4-14.el7 will be reinstalled

---> Packagebind-utils.x86_64 32:9.9.4-14.el7 will be reinstalled

--> FinishedDependency Resolution

 

DependenciesResolved

 

============================================================================================================================================

 Package                               Arch                         Version                               Repository                   Size

============================================================================================================================================

Reinstalling:

 bind                                  x86_64                       32:9.9.4-14.el7                       rhel7                       1.8 M

 bind-chroot                           x86_64                       32:9.9.4-14.el7                       rhel7                        81 k

 bind-dyndb-ldap                       x86_64                       3.5-4.el7                             rhel7                        91 k

 bind-libs                             x86_64                       32:9.9.4-14.el7                       rhel7                       1.0 M

 bind-libs-lite                        x86_64                       32:9.9.4-14.el7                       rhel7                       709 k

 bind-license                          noarch                       32:9.9.4-14.el7                       rhel7                        79 k

 bind-utils                            x86_64                       32:9.9.4-14.el7                       rhel7                       198 k

 

Transaction Summary

============================================================================================================================================

Reinstall  7 Packages

 

Total download size:3.9 M

Installed size: 9.2M

Is this ok [y/d/N]:y

Downloadingpackages:

--------------------------------------------------------------------------------------------------------------------------------------------

Total                                                                                                       74 MB/s | 3.9 MB  00:00:00    

Running transactioncheck

Running transactiontest

Transaction testsucceeded

Running transaction

  Installing :32:bind-license-9.9.4-14.el7.noarch                                                                                     1/7

  Installing :32:bind-libs-9.9.4-14.el7.x86_64                                                                                        2/7

  Installing : 32:bind-9.9.4-14.el7.x86_64                                                                                             3/7

  Installing :32:bind-chroot-9.9.4-14.el7.x86_64                                                                                      4/7

  Installing :bind-dyndb-ldap-3.5-4.el7.x86_64                                                                                        5/7

  Installing :32:bind-utils-9.9.4-14.el7.x86_64                                                                                       6/7

  Installing :32:bind-libs-lite-9.9.4-14.el7.x86_64                                                                                   7/7

  Verifying : 32:bind-9.9.4-14.el7.x86_64                                                                                             1/7

  Verifying : 32:bind-libs-lite-9.9.4-14.el7.x86_64                                                                                   2/7

  Verifying : 32:bind-utils-9.9.4-14.el7.x86_64                                                                                       3/7

  Verifying : 32:bind-libs-9.9.4-14.el7.x86_64                                                                                        4/7

  Verifying : 32:bind-license-9.9.4-14.el7.noarch                                                                                     5/7

  Verifying : 32:bind-chroot-9.9.4-14.el7.x86_64                                                                                      6/7

  Verifying : bind-dyndb-ldap-3.5-4.el7.x86_64                                                                                        7/7

 

Installed:

  bind.x86_64 32:9.9.4-14.el7                 bind-chroot.x86_6432:9.9.4-14.el7             bind-dyndb-ldap.x86_64 0:3.5-4.el7          

  bind-libs.x86_64 32:9.9.4-14.el7            bind-libs-lite.x86_6432:9.9.4-14.el7          bind-license.noarch 32:9.9.4-14.el7         

  bind-utils.x86_64 32:9.9.4-14.el7         

 

Complete!

 

4，修改named.conf

[root@localhostnamed]#cp /etc/named.conf /etc/named.conf.backup

[root@localhostnamed]# vi /etc/named.conf

[root@localhostnamed]# cat /etc/named.conf

//

// named.conf

//

// Provided by RedHat bind package to configure the ISC BIND named(8) DNS

// server as acaching only nameserver (as a localhost DNS resolver only).

//

// See/usr/share/doc/bind*/sample/ for example named configuration files.

//

 

options {

listen-on port 53 { any; };

listen-on-v6port 53 { ::1; };

directory        "/var/named";

dump-file        "/var/named/data/cache_dump.db";

statistics-file"/var/named/data/named_stats.txt";

memstatistics-file"/var/named/data/named_mem_stats.txt";

allow-query     { any; };

 

/*

 - If you are building an AUTHORITATIVE DNSserver, do NOT enable recursion.

 - If you are building a RECURSIVE (caching)DNS server, you need to enable

   recursion.

 - If your recursive DNS server has a public IPaddress, you MUST enable access

   control to limit queries to your legitimateusers. Failing to do so will

   cause your server to become part of largescale DNS amplification

   attacks. Implementing BCP38 within yournetwork would greatly

   reduce such attack surface

*/

recursionyes;

 

dnssec-enableyes;

dnssec-validationyes;

dnssec-lookasideauto;

 

/*Path to ISC DLV key */

bindkeys-file"/etc/named.iscdlv.key";

 

managed-keys-directory"/var/named/dynamic";

 

pid-file"/run/named/named.pid";

session-keyfile"/run/named/session.key";

};

 

logging {

        channel default_debug {

                file"data/named.run";

                severity dynamic;

        };

};

 

zone "."IN {

typehint;

file"named.ca";

};

 

include"/etc/named.rfc1912.zones";

include"/etc/named.root.key";

 

5, 修改/etc/named.rfc1912.zones

[root@localhostnamed]# cp/etc/named.rfc1912.zones/etc/named.rfc1912.zones.backup

[root@localhostnamed]# vi/etc/named.rfc1912.zones

[root@localhostnamed]# cat /etc/named.rfc1912.zones

//named.rfc1912.zones:

//

// Provided by RedHat caching-nameserver package

//

// ISC BIND namedzone configuration for zones recommended by

// RFC 1912 section4.1 : localhost TLDs and address zones

// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt

// (c)2007 R WFranks

//

// See/usr/share/doc/bind*/sample/ for example named configuration files.

//

 

zone"localhost.localdomain" IN {

typemaster;

file"named.localhost";

allow-update{ none; };

};

 

zone"localhost" IN {

typemaster;

file"named.localhost";

allow-update{ none; };

};

 

zone"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa"IN {

typemaster;

file"named.loopback";

allow-update{ none; };

};

 

zone"1.0.0.127.in-addr.arpa" IN {

typemaster;

file"named.loopback";

allow-update{ none; };

};

 

zone"0.in-addr.arpa" IN {

typemaster;

file"named.empty";

allow-update{ none; };

};

 

zone "fengslab.com" IN {

type master;

file"fengslab.com.forward";

};

 

zone "2.168.192.in-addr.arap" IN{

type master;

file"fengslab.com.reverse";

};

6, 修改具体的zone配置文件

 

[root@localhostnamed]# cp -rf named.localhost fengslab.com.forward

[root@localhost named]# cp -rf named.loopback fengslab.com.reverse

[root@localhost named]# cat fengslab.com.forward

$TTL 1D

@        INSOA        @ root.fengslab.com. (

0        ;serial

1D        ;refresh

1H        ;retry

1W        ;expire

3H)        ; minimum

NS        @

A        192.168.2.2

esxihost1 A 192.168.2.101

esxihost2 A 192.168.2.102

esxihost3 A 192.168.2.103

[root@localhostnamed]#

[root@localhostnamed]# cat fengslab.com.reverse

$TTL 1D

@        INSOA        @ root.fengslab.com. (

0        ;serial

1D        ;refresh

1H        ;retry

1W        ;expire

3H)        ; minimum

NS        @

A        192.168.2.2

PTR        localhost.

101 PTR esxihost1

102 PTR esxihost2

103 PTR esxihost3

[root@localhostnamed]#

 

7，测试：

[root@localhostnamed]# dig -x 192.168.2.201

 

; <<>>DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> -x 192.168.2.201

;; global options:+cmd

;; Got answer:

;;->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 57644

;; flags: qr aa rdra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

 

;; OPTPSEUDOSECTION:

; EDNS: version: 0,flags:; udp: 4096

;; QUESTION SECTION:

;201.2.168.192.in-addr.arpa.        IN        PTR

 

;; AUTHORITYSECTION:

168.192.in-addr.arpa.        86400        IN        SOA        168.192.in-addr.arpa.. 0 28800 7200 604800 86400

 

;; Query time: 3msec

;; SERVER:192.168.2.2#53(192.168.2.2)

;; WHEN: Thu Feb 0421:31:05 CST 2016

;; MSG SIZE  rcvd: 90

 

[root@localhostnamed]#

[root@localhostnamed]# nslookup

>esxihost1.fengslab.com

Server:                192.168.2.2

Address:        192.168.2.2#53

 

Name:        esxihost1.fengslab.com

Address:192.168.2.101

>esxihost2.fengslab.com

Server:                192.168.2.2

Address:        192.168.2.2#53

 

Name:        esxihost2.fengslab.com

Address:192.168.2.102

>esxihost3.fengslab.com

Server:                192.168.2.2

Address:        192.168.2.2#53

 

Name:        esxihost3.fengslab.com

Address:192.168.2.103

>

 

 

 

8, 参考注释（部分内容与本实验无关，参考用）

 

来自 <http://www.linuxde.net/2011/11/2000.html>

以下是一个整理的主配文件参数解释（仅供参考）/**/代表注释：

options { /*OPTIONS选项用来定义一些影响整个DNS服务器的环境，如这里的DI RECTORY用来指定在本文件指定的文件的路径，如这里的是将其指定到 /var/named 下,在这里你还可以指定端口等等。不指定则端口是53
*/
directory "/var/named";
}; //

//
// a caching only nameserver config
//
controls {
inet 127.0.0.1 allow { localhost; } keys { rndckey; };
};
zone "." IN { //在这个文件中是用zone关键字来定义域区的，一个zone关键字定义一个域区
type hint;
/*在这里type类型有三种，它们分别是master,slave和hint它们的含义分别是：
master:表示定义的是主域名服务器
slave :表示定义的是辅助域名服务器
hint:表示是互联网中根域名服务器
*/
file "named.ca"; //用来指定具体存放DNS记录的文件
};

zone"localhost" IN { //定义一具域名为localhost的正向区域
type master;
file "localhost.zone" ;
allow-update { none; };
};
zone "test.net" IN { //指定一个域名为test.net的正向区域
type master;
file "test.net”
allow-update { none;};
};

zone"0.0.127.in-addr.arpa" IN { //定义一个IP为127.0.0.*的反向域区
type master;
file "named.local";
allow-update { none; };
};
zone "0.192.168.in-addr.arpa" IN { //定义一个IP为168.192.0.*反向域区
type master;
file "168.192.0";

/var/named/test.net文件
@ IN SOA linux.test.net. Webmaster.test.net. (SOA表示授权开始
/*上面的IN表示后面的数据使用的是INTERNET标准。而@则代表相应的域名，如在这里代表test.net,即表示一个域名记录定义的开始。而linux.test.net则是这个域的主域名服务器，而webmaster.test.net则是管理员的邮件地址。注意这是邮件地址中用.来代替常见的邮件地址中的@.而SOA表示授权的开始
*/
2003012101 ; serial (d. adams)/*本行前面的数字表示配置文件的修改版本，格式是年月日当日修改的修改的次数，每次修改这个配置文件时都应该修改这个数字，要不然你所作的修改不会更新到网上的其它DNS服务器的数据库上，即你所做的更新很可能对于不以你的所配置的DNS服务器为DNS服务器的客户端来说就不会反映出你的更新，也就对他们来说你更新是没有意义的。
*/
28800 ; refresh
/*定义的是以为单位的刷新频率 即规定从域名服务器多长时间查询一个主服务器，以保证从服务器的数据是最新的
*/
7200;retry
/*上面的这个值是规定了以秒为单位的重试的时间间隔，即当从服务试图在主服务器上查询更时，而连接失败了，则这个值规定了从服务多长时间后再试
*/
3600000 ;expiry
/*上面这个用来规定从服务器在向主服务更新失败后多长时间后清除对应的记录，上述的数值是以分钟为单位的
*/
8400 )
/*上面这个数据用来规定缓冲服务器不能与主服务联系上后多长时间清除相应的记
录
*/
IN NS linux
IN MX 10 linux
linux IN A 168.192.0.14
it-test1 IN A 168.192.0.133
www IN CNAME linux

/*上面的第一列表示是主机的名字，省去了后面的域。
NS：表示是这个主机是一个域名服务器，
A：定义了一条A记录，即主机名到IP地址的对应记录
MX 定义了一邮件记录
CNAME：定义了对应主机的一个别名

/var/named/168.192.0
@ IN SOA linux.test.net. webmastert.linux.net. (
1997022700 ; Serial
28800 ; Refresh
14400 ; Retry
3600000 ; Expire
86400 ) ; Minimum
IN NS linux.test.net.
/*以上的各关键字的含义跟test.net是相同的
14 IN PTR linux.test.net.
133 IN PTRit-test1.test.net.
/*
上面的第一列表示的是主机的IP地址。省略了网络地址部分。如14完整应该是：
168.192.0.14
PTR：表示反向记录
最后一列表示的是主机的域名。

本文出自 “悟空” 博客，转载请与作者联系！