6月 032019
查看当前系统版本
[root@iZj6cehstgjoj3qav88fidZ ~]# cat /etc/redhat-release CentOS Linux release 7.6.1810 (Core) [root@iZj6cehstgjoj3qav88fidZ ~]#
查看bind软件包信息
[root@iZj6cehstgjoj3qav88fidZ ~]# yum info bind Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile Available Packages Name : bind Arch : x86_64 Epoch : 32 Version : 9.9.4 Release : 73.el7_6 Size : 1.8 M Repo : updates/7/x86_64 Summary : The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server URL : http://www.isc.org/products/BIND/ License : ISC Description : BIND (Berkeley Internet Name Domain) is an implementation of the DNS : (Domain Name System) protocols. BIND includes a DNS server (named), : which resolves host names to IP addresses; a resolver library : (routines for applications to use when interfacing with DNS); and : tools for verifying that the DNS server is operating properly. [root@iZj6cehstgjoj3qav88fidZ ~]#
使用yum安装bind及依赖包
[root@iZj6cehstgjoj3qav88fidZ ~]# yum install bind
安装清单
Installed: bind.x86_64 32:9.9.4-73.el7_6 Dependency Installed: audit-libs-python.x86_64 0:2.8.4-4.el7 bind-libs.x86_64 32:9.9.4-73.el7_6 checkpolicy.x86_64 0:2.5-8.el7 libcgroup.x86_64 0:0.41-20.el7 libsemanage-python.x86_64 0:2.5-14.el7 policycoreutils-python.x86_64 0:2.5-29.el7_6.1 python-IPy.noarch 0:0.75-6.el7 python-ply.noarch 0:3.4-11.el7 setools-libs.x86_64 0:3.3.8-4.el7
注册服务及启动服务
[root@iZj6cehstgjoj3qav88fidZ ~]# systemctl enable named Created symlink from /etc/systemd/system/multi-user.target.wants/named.service to /usr/lib/systemd/system/named.service. [root@iZj6cehstgjoj3qav88fidZ ~]# systemctl start named [root@iZj6cehstgjoj3qav88fidZ ~]#
查看端口监听
查看主配置文件
[root@iZj6cehstgjoj3qav88fidZ ~]# vi /etc/named.conf // // named.conf // // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS // server as a caching only nameserver (as a localhost DNS resolver only). // // See /usr/share/doc/bind*/sample/ for example named configuration files. // // See the BIND Administrator's Reference Manual (ARM) for details about the // configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html options { listen-on port 53 { 127.0.0.1; }; listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; recursing-file "/var/named/data/named.recursing"; secroots-file "/var/named/data/named.secroots"; allow-query { localhost; }; /* - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. - If you are building a RECURSIVE (caching) DNS server, you need to enable recursion. - If your recursive DNS server has a public IP address, you MUST enable access control to limit queries to your legitimate users. Failing to do so will cause your server to become part of large scale DNS amplification attacks. Implementing BCP38 within your network would greatly reduce such attack surface */ recursion yes; dnssec-enable yes; dnssec-validation yes; /* Path to ISC DLV key */ bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic"; pid-file "/run/named/named.pid"; session-keyfile "/run/named/session.key"; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "." IN { type hint; file "named.ca"; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key";
查看当前主机DNS配置
[root@iZj6cehstgjoj3qav88fidZ ~]# cat /etc/resolv.conf options timeout:2 attempts:3 rotate single-request-reopen ; generated by /usr/sbin/dhclient-script nameserver 100.100.2.136 nameserver 100.100.2.138 search localdomain [root@iZj6cehstgjoj3qav88fidZ ~]#
安装域名解析提示工具包
[root@iZj6cehstgjoj3qav88fidZ ~]# yum install bind-utils
查看软件版路径及文件
[root@iZj6cehstgjoj3qav88fidZ ~]# rpm -lq bind-utils /etc/trusted-key.key /usr/bin/dig /usr/bin/host /usr/bin/nslookup /usr/bin/nsupdate /usr/share/man/man1/dig.1.gz /usr/share/man/man1/host.1.gz /usr/share/man/man1/nslookup.1.gz /usr/share/man/man1/nsupdate.1.gz [root@iZj6cehstgjoj3qav88fidZ ~]#
修改本机DNS为当前DNS服务器并尝试域名解析操作
[root@iZj6cehstgjoj3qav88fidZ ~]# vi /etc/resolv.conf options timeout:2 attempts:3 rotate single-request-reopen ; generated by /usr/sbin/dhclient-script #nameserver 100.100.2.136 #nameserver 100.100.2.138 nameserver 127.0.0.1 search localdomain
使用nslookup命令及ping命令检查域名递归（缓存）DNS配置生效情况
为内网主机配置正向解析和反向解析
查看默认的区域配置文件
// named.rfc1912.zones: // // Provided by Red Hat caching-nameserver package // // ISC BIND named zone configuration for zones recommended by // RFC 1912 section 4.1 : localhost TLDs and address zones // and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt // (c)2007 R W Franks // // See /usr/share/doc/bind*/sample/ for example named configuration files. // zone "localhost.localdomain" IN { type master; file "named.localhost"; allow-update { none; }; }; zone "localhost" IN { type master; file "named.localhost"; allow-update { none; }; }; zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN { type master; file "named.loopback"; allow-update { none; }; }; zone "1.0.0.127.in-addr.arpa" IN { type master; file "named.loopback"; allow-update { none; }; }; zone "0.in-addr.arpa" IN { type master; file "named.empty"; allow-update { none; }; };
添加自定义区域配置
[root@iZj6cehstgjoj3qav88fidZ ~]# vi /etc/named.rfc1912.zones zone "ns-zone.com" IN { type master; file "ns-zone.com.zone"; allow-update { none; }; };
创建自定义区域配置文件
[root@iZj6cehstgjoj3qav88fidZ ~]# vi /var/named/ns-zone.com.zone $TTL 600 ; 10 minutes @ IN SOA ns1.ns-zone.com. hostmaster.ns-zone.com. ( 20190001 ; serial number 10800 ; refresh time (3 hours) 900 ; retry time (15 minutes) 604800 ; expire time (1 week) 86400 ; minimum (1 day) ) NS ns1.ns-zone.com. $ORIGIN ns-zone.com. $TTL 60 ; 1 minute ns1 A 10.22.105.60 www A 10.22.105.60
修改区域配置文件属性
检查主配置文件和自定义区域配置文件
[root@iZj6cehstgjoj3qav88fidZ ~]# named-checkconf [root@iZj6cehstgjoj3qav88fidZ ~]# [root@iZj6cehstgjoj3qav88fidZ ~]# vi /var/named/ns-zone.com.zone [root@iZj6cehstgjoj3qav88fidZ ~]# named-checkzone ns-zone.com. /var/named/ns-zone.com.zone zone ns-zone.com/IN: loaded serial 20190001 OK [root@iZj6cehstgjoj3qav88fidZ ~]#
重启bind服务并验证新增加的正向解析
[root@iZj6cehstgjoj3qav88fidZ ~]# systemctl restart named [root@iZj6cehstgjoj3qav88fidZ ~]# nslookup ns1.ns-zone.com Server: 127.0.0.1 Address: 127.0.0.1#53 Name: ns1.ns-zone.com Address: 10.22.105.60 [root@iZj6cehstgjoj3qav88fidZ ~]# nslookup www.ns-zone.com Server: 127.0.0.1 Address: 127.0.0.1#53 Name: www.ns-zone.com Address: 10.22.105.60 [root@iZj6cehstgjoj3qav88fidZ ~]#
使用dig命令查看NS记录
反向解析
增加区域配置
[root@iZj6cehstgjoj3qav88fidZ ~]# vi /etc/named.rfc1912.zones zone "105.22.10.in-addr.arpa" IN { type master; file "105.22.10.in-addr.arpa.zone"; allow-update { none; }; };
增加自定义区域配置文件
[root@iZj6cehstgjoj3qav88fidZ ~]# vi /var/named/105.22.10.in-addr.arpa.zone $TTL 600 ; 10 minutes @ IN SOA ns1.ns-zone.com. hostmaster.ns-zone.com. ( 20190001 ; serial number 10800 ; refresh time (3 hours) 900 ; retry time (15 minutes) 604800 ; expire time (1 week) 86400 ; minimum (1 day) ) NS ns1.ns-zone.com. $ORIGIN 105.22.10.in-addr.arpa. $TTL 60 ; 1 minute 60 PTR ns1.ns-zone.com.
检查主配置文件和自定义区域配置文件
[root@iZj6cehstgjoj3qav88fidZ ~]# named-checkconf [root@iZj6cehstgjoj3qav88fidZ ~]# [root@iZj6cehstgjoj3qav88fidZ ~]# named-checkzone 105.22.10.in-addr.arpa. /var/named/105.22.10.in-addr.arpa.zone zone 105.22.10.in-addr.arpa/IN: loaded serial 20190001 OK [root@iZj6cehstgjoj3qav88fidZ ~]#
验证反向解析
