目錄
準(zhǔn)備工作：
配置主服務(wù)器
配置從服務(wù)器
修改資源文件嘗試進(jìn)行主從同步
準(zhǔn)備工作：
關(guān)閉防火墻及selinux：
[root@master ~]# systemctl stop firewalld
[root@master ~]# setenforce 0
?安裝軟件包（主從服務(wù)器都需要）：
[root@slave ~]# yum install bind -y
該軟件包服務(wù)名稱為named。
配置主服務(wù)器
服務(wù)文件：
options {
listen-on port 53 { 127.0.0.1; };//監(jiān)聽對象IPV4地址
listen-on-v6 port 53 { ::1; };//IPV6地址
directory "/var/named";//數(shù)據(jù)文件主要路徑
dump-file "/var/named/data/cache_dump.db";//查詢數(shù)據(jù)備份文件
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
allow-query { localhost; };//允許哪些主機(jī)發(fā)起域名查詢
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;//是否開啟遞歸查詢
dnssec-validation yes;
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
include "/etc/crypto-policies/back-ends/bind.config";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};//域
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
配置服務(wù)文件并添加域（openlab.com）：
options {
listen-on port 53 { 192.168.91.129; };//監(jiān)聽對象IPV4地址
listen-on-v6 port 53 { ::1; };//IPV6地址
directory "/var/named";//數(shù)據(jù)文件主要路徑
dump-file "/var/named/data/cache_dump.db";//查詢數(shù)據(jù)備份文件
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
allow-query { any; };//允許哪些主機(jī)發(fā)起域名查詢
allow-transfer { 192.168.91.133; };//默認(rèn)不存在；允許向那個服務(wù)器同步資源信息
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;//是否開啟遞歸查詢
dnssec-validation yes;
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
include "/etc/crypto-policies/back-ends/bind.config";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
zone "openlab.com" IN {
type master;
file "openlab";
};//添加正向域
zone "91.168.192.in-addr.arpa" IN {
type master;
file "openlab_re";
};//添加反向域
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
反向域的ip是一個區(qū)段，不寫主機(jī)位且反著寫。
創(chuàng)建并添加正向資源記錄文件：
[root@master ~]# vim /var/named/openlab
$TTL 1D ;;將TTL值統(tǒng)一設(shè)置為1天
@ IN SOA openlab.com. admin.admin.com ( 2024011600
1M
1M
3M
1D )
IN NS dns.openlab.com.
dns IN A 192.168.91.129
www IN A 192.168.91.111
SOA資源記錄類型和NA的域名要加上根域。
每行從左到右依次是：主機(jī)名????????TTL（統(tǒng)一后就可以省略）????????INTER????????資源記錄類型????????數(shù)據(jù)。
資源記錄類型
A：通過域名能夠查詢到對應(yīng)ipv4
AAAA：通過域名能夠查詢到對應(yīng)ipv6
CNAME：別名資源記錄
PTR：指針記錄Ipv4/ipv6 查詢到一個域名
NS：dns解析記錄類型(標(biāo)記本地dns服務(wù)器的主機(jī)名)
MX：郵件解析記錄類型(標(biāo)記郵件服務(wù)器的主機(jī)名）
SOA：起始授權(quán)記錄(主從服同步)，特殊的是它有7個數(shù)據(jù)：
????????masterdns????????TTL????????INTER????????資源記錄類型????????數(shù)據(jù)????????郵箱地址????????(版本????????檢查時間? ? ? ? 重試時間????????失效時間? ? ? ? ttl)
創(chuàng)建并添加反向資源記錄文件：
[root@master ~]# vim /var/named/openlab_re
$TTL 1D ;;將TTL值統(tǒng)一設(shè)置為1天
@ IN SOA openlab.com. admin.admin.com ( 2024011600
1M
1M
3M
1D )
IN NS dns.openlab.com.
129 IN PTR dns.openlab.com
111 IN PTR www.openlab.com
重啟服務(wù)后進(jìn)行測試：
[root@master ~]# systemctl restart named
[root@master ~]# nslookup
> server 192.168.91.129
Default server: 192.168.91.129
Address: 192.168.91.129#53
> dns.openlab.com
Server: 192.168.91.129
Address: 192.168.91.129#53
Name: dns.openlab.com
Address: 192.168.91.129
> www.openlab.com
Server: 192.168.91.129
Address: 192.168.91.129#53
Name: www.openlab.com
Address: 192.168.91.111
> 192.168.91.129
129.91.168.192.in-addr.arpa name = dns.openlab.com.91.168.192.in-addr.arpa.
> 192.168.91.111
111.91.168.192.in-addr.arpa name = www.openlab.com.91.168.192.in-addr.arpa.
nslookup：可以指定dns服務(wù)器進(jìn)行域名解析。
配置從服務(wù)器
配置服務(wù)文件并添加域（openlab.com）：
options {
listen-on port 53 { 192.168.91.133; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
allow-query { any; };
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;
dnssec-validation yes;
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
include "/etc/crypto-policies/back-ends/bind.config";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
zone "openlab.com" IN {
type slave;
file "named.openlab";
masters { 192.168.91.129; };
};
zone "91.168.192.in-addr.arpa" IN {
type slave;
file "named.openlab_re";
masters { 192.168.91.129; };
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
不用添加資源文件，將會從主服務(wù)器同步過來：
[root@slave ~]# ll /var/named
total 36
drwxrwx---. 2 named named 4096 Jan 16 21:13 data
drwxrwx---. 2 named named 4096 Jan 16 21:14 dynamic
-rw-r-----. 1 root named 2253 Sep 22 02:33 named.ca
-rw-r-----. 1 root named 152 Sep 22 02:33 named.empty
-rw-r-----. 1 root named 152 Sep 22 02:33 named.localhost
-rw-r-----. 1 root named 168 Sep 22 02:33 named.loopback
-rw-r--r--. 1 named named 259 Jan 16 21:13 named.openlab //正向
-rw-r--r--. 1 named named 393 Jan 16 21:13 named.openlab_re //反向
drwxrwx---. 2 named named 4096 Sep 22 02:33 slaves
重啟服務(wù)后進(jìn)行測試：
[root@slave ~]# systemctl restart named
[root@slave ~]# nslookup
> server 192.168.91.133
Default server: 192.168.91.133
Address: 192.168.91.133#53
> dns.openlab.com
Server: 192.168.91.133
Address: 192.168.91.133#53
Name: dns.openlab.com
Address: 192.168.91.129
> www.openlab.com
Server: 192.168.91.133
Address: 192.168.91.133#53
Name: www.openlab.com
Address: 192.168.91.111
> 192.168.91.129
129.91.168.192.in-addr.arpa name = dns.openlab.com.91.168.192.in-addr.arpa.
> 192.168.91.111
111.91.168.192.in-addr.arpa name = www.openlab.com.91.168.192.in-addr.arpa.修改資源文件嘗試進(jìn)行主從同步
在主服務(wù)器中添加正向解析并修改版本號為（2024011601）：
ftp IN A 192.168.91.222
在主服務(wù)器中添加反向解析并修改版本號為（2024011601）：
222 IN PTR ftp.openlab.com
主服務(wù)器測試：
[root@master ~]# systemctl restart named
[root@master ~]# nslookup
> server 192.168.91.129
Default server: 192.168.91.129
Address: 192.168.91.129#53
> ftp.openlab.com
Server: 192.168.91.129
Address: 192.168.91.129#53
Name: ftp.openlab.com
Address: 192.168.91.222
> 192.168.91.222
222.91.168.192.in-addr.arpa name = ftp.openlab.com.91.168.192.in-addr.arpa.
因為檢查時間設(shè)置為1分鐘，所以我們等待1分鐘后在從服務(wù)器中嘗試：文章來源：http://www.zghlxwxcb.cn/news/detail-798405.html
[root@slave ~]# nslookup
> server 192.168.91.133
Default server: 192.168.91.133
Address: 192.168.91.133#53
> 192.168.91.222
222.91.168.192.in-addr.arpa name = ftp.openlab.com.91.168.192.in-addr.arpa.
> ftp.openlab.com
Server: 192.168.91.133
Address: 192.168.91.133#53
Name: ftp.openlab.com
Address: 192.168.91.222
同步成功！文章來源地址http://www.zghlxwxcb.cn/news/detail-798405.html
到了這里，關(guān)于配置DNS主從服務(wù)器，能夠?qū)崿F(xiàn)正常的正反向解析的文章就介紹完了。如果您還想了解更多內(nèi)容，請在右上角搜索TOY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
