bind97:
/etc/named.conf BIND进程的工作属性 区域的定义 /etc/rndc.key rndc: Remote Name Domain Controller 密钥文件 配置信息:/etc/rndc.conf /var/named/ 区域数据文件 /etc/rc.d/init.d/named {start|stop|restart|status|reload} 二进制程序:namedbind-chroot: 默认:named 用户:named 组:named /var/named/chroot/ etc/named.conf etc/rdnc.key sbin/named var/named/[root@test ~]# yum list all |grep bind
This system is not registered with RHN.RHN support will be disabled.bind-libs.i386 30:9.3.6-4.P1.el5 installed bind-utils.i386 30:9.3.6-4.P1.el5 installed[root@test ~]# rpm -e bind-libs bind-utils
[root@test ~]# yum list all |grep bindThis system is not registered with RHN.RHN support will be disabled.bind.i386 30:9.3.6-4.P1.el5 Media bind-chroot.i386 30:9.3.6-4.P1.el5 Media一、bind安装
bind97下载地址:http://mirrors.ctyun.cn/centos/5/os/i386/CentOS/
[root@test ~]# rpm -ivh bind97-libs-9.7.0-21.P2.el5.i386.rpm
warning: bind97-libs-9.7.0-21.P2.el5.i386.rpm: Header V3 DSA signature: NOKEY, key ID e8562897Preparing... ################################### [100%] 1:bind97-libs ################################# [100%][root@test ~]# rpm -ivh bind97-utils-9.7.0-21.P2.el5.i386.rpm
warning: bind97-utils-9.7.0-21.P2.el5.i386.rpm: Header V3 DSA signature: NOKEY, key ID e8562897Preparing... ############################## [100%] 1:bind97-utils ############################ [100%][root@test ~]# rpm -ivh bind97-9.7.0-21.P2.el5.i386.rpm warning: bind97-9.7.0-21.P2.el5.i386.rpm: Header V3 DSA signature: NOKEY, key ID e8562897Preparing... ############################## [100%] 1:bind97 ############################### [100%]
二、语法错误判断、日志查看、服务启动状态
[root@test etc]# vi named.conf
options { directory "/var/named";};zone "." IN { type hint; file "named.ca";};zone "localhost" IN { type master; file "named.localhost";};zone "0.0.127.in-addr.arpa" IN { type master; file "named.loopback";};[root@test etc]# named-checkconf
[root@test etc]# named-checkzone "." /var/named/named.ca
zone ./IN: has 0 SOA recordszone ./IN: not loaded due to errors.[root@test etc]# named-checkzone "localhost" /var/named/named.localhost zone localhost/IN: loaded serial 0OK[root@test etc]# named-checkzone "0.0.127.in-addr.arpa" /var/named/named.loopback zone 0.0.127.in-addr.arpa/IN: loaded serial 0OK[root@test etc]# service named startStarting named: named: already running [ OK ][root@test etc]# service named restartStopping named: . [ OK ]Starting named: [ OK ][root@test etc]# tail /var/log/messagesDec 13 15:37:16 test named[29856]: command channel listening on 127.0.0.1#953Dec 13 15:37:16 test named[29856]: zone 0.0.127.in-addr.arpa/IN: loaded serial 0Dec 13 15:37:16 test named[29856]: zone localhost/IN: loaded serial 0Dec 13 15:37:16 test named[29856]: running[root@test ~]# vi /etc/resolv.conf
nameserver 110.19.131.131search localdomain[root@test ~]# dig -t NS .
; <<>> DiG 9.7.0-P2-RedHat-9.7.0-21.P2.el5 <<>> -t NS .
;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6718;; flags: qr rd ra; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 12;; QUESTION SECTION:;. IN NS;; ANSWER SECTION:. 16803 IN NS i.root-servers.net.. 16803 IN NS a.root-servers.net.. 16803 IN NS e.root-servers.net.. 16803 IN NS k.root-servers.net.. 16803 IN NS d.root-servers.net.. 16803 IN NS b.root-servers.net.. 16803 IN NS g.root-servers.net.. 16803 IN NS c.root-servers.net.. 16803 IN NS l.root-servers.net.. 16803 IN NS h.root-servers.net.. 16803 IN NS f.root-servers.net.. 16803 IN NS j.root-servers.net.. 16803 IN NS m.root-servers.net.;; ADDITIONAL SECTION:i.root-servers.net. 86400 IN A 192.36.148.17i.root-servers.net. 17019 IN AAAA 2001:7fe::53a.root-servers.net. 17019 IN A 198.41.0.4a.root-servers.net. 17019 IN AAAA 2001:503:ba3e::2:30e.root-servers.net. 29300 IN A 192.203.230.10e.root-servers.net. 86400 IN AAAA 2001:500:a8::ek.root-servers.net. 29300 IN A 193.0.14.129k.root-servers.net. 17019 IN AAAA 2001:7fd::1d.root-servers.net. 29300 IN A 199.7.91.13d.root-servers.net. 17019 IN AAAA 2001:500:2d::db.root-servers.net. 16803 IN A 192.228.79.201b.root-servers.net. 17019 IN AAAA 2001:500:84::b;; Query time: 38 msec;; SERVER: 10.109.131.131#53(10.109.131.131);; WHEN: Wed Dec 14 08:14:20 2016;; MSG SIZE rcvd: 505[root@test ~]# ping www.163.comPING 163.xdwscache.ourglb0.com (113.107.57.41) 56(84) bytes of data.64 bytes from 113.107.57.41: icmp_seq=1 ttl=53 time=39.4 ms64 bytes from 113.107.57.41: icmp_seq=2 ttl=53 time=38.3 ms--- 163.xdwscache.ourglb0.com ping statistics ---2 packets transmitted, 2 received, 0% packet loss, time 1013msrtt min/avg/max/mdev = 38.381/38.924/39.468/0.578 ms[root@test ~]# chkconfig --list named
named 0:off 1:off 2:off 3:off 4:off 5:off 6:off[root@test ~]# chkconfig named on[root@test ~]# chkconfig --list namednamed 0:off 1:off 2:on 3:on 4:on 5:on 6:off[root@test ~]#三、创建本地NS正向域
[root@test ~]# vi /etc/named.conf
... #新增以下部分
zone "jacktest.com" IN {
type master; file "jacktest.com.zone";};[root@test ~]# named-checkconf /etc/named.conf
/etc/named.conf:24: missing ';' before end of file[root@test named]# vi jacktest.com.zone #正向区域名称
$TTL 600 #宏要加$
jacktest.com. IN SOA ns1.jacktest.com. admin.jacktest.com. ( 20161214 1H 5M 2D 6H )jacktest.com. IN NS ns1.jacktest.com. IN MX 10 mail #域名可省,10为邮件等级ns1 IN A 10.109.131.131mail IN A 10.109.131.209www IN A 10.109.131.209www IN A 10.109.131.209ftp IN CNAME www[root@test named]# chown root:named jacktest.com.zone
[root@test named]# lltotal 32drwxrwx--- 2 named named 4096 Dec 13 14:57 datadrwxrwx--- 2 named named 4096 Dec 13 14:58 dynamic-rw-r----- 1 root named 207 Dec 14 10:08 jacktest.com.zone-rw-r----- 1 root named 1892 Feb 18 2008 named.ca-rw-r----- 1 root named 152 Dec 15 2009 named.empty-rw-r----- 1 root named 152 Jun 21 2007 named.localhost-rw-r----- 1 root named 168 Dec 15 2009 named.loopbackdrwxrwx--- 2 named named 4096 Dec 13 15:48 slaves[root@test named]# vi jacktest.com.zone #正向区域名称
$TTL 600 #宏要加$
jacktest.com. IN SOA ns1.jacktest.com. admin.jacktest.com. ( 20161214 1H 5M 2D 6H )jacktest.com. IN NS ns1.jacktest.com. IN MX 10 mail #域名可省,10为邮件等级ns1 IN A 10.109.131.131mail IN A 10.109.131.209www IN A 10.109.131.209www IN A 10.109.131.209ftp IN CNAME www四、语创建本地NS反向域
[root@test ~]# vi /etc/named.conf
... #新增以下部分
zone "1.168.192.in-addr.arpa" IN {
type master; file "192.168.1.zone";};[root@test named]# cp -p jacktest.com.zone 192.168.1.zone #将正向复制为反向区域名称
[root@test named]# vi jacktest.com.zone #修改反向区域名称
$TTL 600 #宏要加$
@ IN SOA ns1.jacktest.com. admin.jacktest.com. ( 20161214 1H 5M 2D 6H )IN NS ns1.jacktest.com. // 最后一项必须是完整的记录,句尾不可忘记写上" . "
3 IN PTR ns1.jacktest.com.
3 IN PTR www.jacktest.com.
4 IN PTR mail.jacktest.com.
5 IN PTR
dig -x 192.168.1.3
dig -x 192.168.1.4
dig +norecurse -t A www.163.com @192.168.1.3 #不递归查询
dig +trace -t A www.baidu.com @192.168.1.3 #递归显示查询结果
五、更改配制文件后即可限定查询段
[root@test etc]# vi named.conf
options { directory "/var/named";allow-recursion { 192.168.1.0/24; }; //只允许此IP段递归查询
};
zone "." IN {
type hint; file "named.ca";};zone "localhost" IN { type master; file "named.localhost"; allow-transfer { none; }; //none不允许所有客户端发出传送请求 };zone "0.0.127.in-addr.arpa" IN { type master; file "named.loopback"; allow-transfer { none; };};zone "jacktest.com" IN { type master; file "jacktest.com.zone"; allow-transfer { 192.168.1.5; }; //只允许此IP发出传送请求 };zone "1.168.192.in-addr.arpa" IN { type master; file "192.168.1.zone"; allow-transfer { 192.168.1.5; };};[root@test etc]# tail /var/log/messages
Dec 15 14:11:41 test named[7276]: zone 1.168.192.in-addr.arpa/IN: loaded serial 2016121401Dec 15 14:11:41 test named[7276]: zone jacktest.com/IN: loaded serial 20161214Dec 15 14:11:41 test named[7276]: zone localhost/IN: loaded serial 0Dec 15 14:11:41 test named[7276]: runningDec 15 14:13:31 test named[7276]: client 192.168.1.5#58423: transfer of 'jacktest.com/IN': AXFR startedDec 15 14:13:31 test named[7276]: client 192.168.1.5#58423: transfer of 'jacktest.com/IN': AXFR ended六、设置从DNS服务器
[root@jacktest named]# setenforce 0
setenforce: SELinux is disabled[root@jacktest named]# scp 192.168.1.3:/etc/named.conf /etc/
The authenticity of host '192.168.1.3 (192.168.1.3)' can't be established.RSA key fingerprint is c2:f2:75:5c:ab:4a:43:d3:e1:76:bc:d2:0f:c7:d6:32.Are you sure you want to continue connecting (yes/no)? yesWarning: Permanently added '192.168.1.3' (RSA) to the list of known hosts.root@192.168.1.3's password: named.conf[root@test etc]# vi /etc/named.conf
...
zone "jacktest.com" IN {
type slave; file "slaves/jacktest.com.zone"; allow-transfer { 192.168.1.5; };};zone "1.168.192.in-addr.arpa" IN { type slave; file "slaves/192.168.1.zone"; allow-transfer { 192.168.1.5; };};验证:
[root@test slaves]# tail /var/log/messages #192.168.1.3主
Dec 15 15:43:35 test named[7595]: zone 1.168.192.in-addr.arpa/IN: loaded serial 2016121401Dec 15 15:43:35 test named[7595]: zone jacktest.com/IN: loaded serial 20161214Dec 15 15:43:35 test named[7595]: zone localhost/IN: loaded serial 0Dec 15 15:43:35 test named[7595]: runningDec 15 15:44:12 test named[7595]: client 192.168.1.5#47432: transfer of 'jacktest.com/IN': AXFR startedDec 15 15:44:12 test named[7595]: client 192.168.1.5#47432: transfer of 'jacktest.com/IN': AXFR endedDec 15 17:25:29 test named[7595]: client 192.168.1.5#34268: transfer of 'jacktest.com/IN': AXFR startedDec 15 17:25:29 test named[7595]: client 192.168.1.5#34268: transfer of 'jacktest.com/IN': AXFR endedDec 15 17:25:29 test named[7595]: client 192.168.1.5#59389: transfer of '1.168.192.in-addr.arpa/IN': AXFR started #传送开始 Dec 15 17:25:29 test named[7595]: client 192.168.1.5#59389: transfer of '1.168.192.in-addr.arpa/IN': AXFR ended #传送结果[root@jacktest named]# tail /var/log/messages #192.168.1.5
Dec 15 17:28:13 jacktest named[10089]: zone localhost/IN: loaded serial 0Dec 15 17:28:13 jacktest named[10089]: runningDec 15 17:28:13 jacktest named[10089]: zone jacktest.com/IN: Transfer started.Dec 15 17:28:13 jacktest named[10089]: transfer of 'jacktest.com/IN' from 192.168.1.3#53: connected using 192.168.1.5#34268Dec 15 17:28:13 jacktest named[10089]: zone jacktest.com/IN: transferred serial 20161214Dec 15 17:28:13 jacktest named[10089]: transfer of 'jacktest.com/IN' from 192.168.1.3#53: Transfer completed: 1 messages, 9 records, 233 bytes, 0.004 secs (58250 bytes/sec)Dec 15 17:28:13 jacktest named[10089]: zone 1.168.192.in-addr.arpa/IN: Transfer started.Dec 15 17:28:13 jacktest named[10089]: transfer of '1.168.192.in-addr.arpa/IN' from 192.168.1.3#53: connected using 192.168.1.5#59389Dec 15 17:28:13 jacktest named[10089]: zone 1.168.192.in-addr.arpa/IN: transferred serial 2016121401Dec 15 17:28:13 jacktest named[10089]: transfer of '1.168.192.in-addr.arpa/IN' from 192.168.1.3#53: Transfer completed: 1 messages, 7 records, 219 bytes, 0.002 secs (109500 bytes/sec)七、测试NS自动更新到从服务器
[root@test named]# vi jacktest.com.zone #192.168.1.3主
$TTL 600jacktest.com. IN SOA ns1.jacktest.com. admin.jacktest.com. ( 2016121404 #3改成4...imap IN A 192.168.1.6haha IN A 192.168.1.7 #新增一条记录
[root@test named]# service named reloadReloading named: [ OK ][root@test named]# tail /var/log/messages #192.168.1.3主NS Dec 16 10:05:53 test named[10112]: reloading configuration succeededDec 16 10:05:53 test named[10112]: reloading zones succeededDec 16 10:05:53 test named[10112]: zone jacktest.com/IN: loaded serial 2016121404Dec 16 10:05:53 test named[10112]: zone jacktest.com/IN: sending notifies (serial 2016121404)Dec 16 10:05:53 test named[10112]: client 192.168.1.5#50038: transfer of 'jacktest.com/IN': AXFR-style IXFR startedDec 16 10:05:53 test named[10112]: client 192.168.1.5#50038: transfer of 'jacktest.com/IN': AXFR-style IXFR ended[root@test named]# tail /var/log/messages #192.168.1.5从NS Dec 16 10:08:38 jacktest named[12536]: client 192.168.1.3#6791: received notify for zone 'jacktest.com'Dec 16 10:08:38 jacktest named[12536]: zone jacktest.com/IN: Transfer started.Dec 16 10:08:38 jacktest named[12536]: transfer of 'jacktest.com/IN' from 192.168.1.3#53: connected using 192.168.1.5#50038Dec 16 10:08:38 jacktest named[12536]: zone jacktest.com/IN: transferred serial 2016121404Dec 16 10:08:38 jacktest named[12536]: transfer of 'jacktest.com/IN' from 192.168.1.3#53: Transfer completed: 1 messages, 13 records, 309 bytes, 0.002 secs (154500 bytes/sec)Dec 16 10:08:38 jacktest named[12536]: zone jacktest.com/IN: sending notifies (serial 2016121404)[root@jacktest slaves]# cat jacktest.com.zone #192.168.1.5从NS
jacktest.com IN SOA ns1.jacktest.com. admin.jacktest.com. ( 2016121404 ; serial...ftp CNAME wwwhaha A 192.168.1.7 #自动学习成功八、开放远程访问DC
Remote Name Daemon Control # [di:mn]守护进程
[root@test ~]# rndc-confgen > /etc/rndc.conf
[root@test ~]# cat /etc/rndc.conf# Start of rndc.confkey "rndc-key" { algorithm hmac-md5; secret "PElKGniJbHk/esQ9zpN+xg==";};options { default-key "rndc-key"; default-server 127.0.0.1; default-port 953;};# End of rndc.conf# Use with the following in named.conf, adjusting the allow list as needed:# key "rndc-key" { # algorithm hmac-md5;# secret "PElKGniJbHk/esQ9zpN+xg==";# };# # controls { # inet 127.0.0.1 port 953# allow { 127.0.0.1; } keys { "rndc-key"; };# }; # End of named.conf #绿色部分复制添加到named.conf [root@test ~]# rndc -c /etc/rndc.conf statusrndc: connection to remote host closedThis may indicate that* the remote server is using an older version of the command protocol,* this host is not authorized to connect,* the clocks are not synchronized, or* the key is invalid.[root@test ~]# rm /etc/rndc.key rm: remove regular file `/etc/rndc.key'? y[root@test ~]# rndc -c /etc/rndc.conf statusrndc: connection to remote host closedThis may indicate that* the remote server is using an older version of the command protocol,* this host is not authorized to connect,* the clocks are not synchronized, or* the key is invalid.[root@test ~]# service named restartStopping named: . [ OK ]Generating /etc/rndc.key: [ OK ]Starting named: [ OK ][root@test ~]# rndc -c /etc/rndc.conf statusversion: 9.7.0-P2-RedHat-9.7.0-21.P2.el5CPUs found: 8worker threads: 8number of zones: 16debug level: 0xfers running: 0xfers deferred: 0soa queries in progress: 0query logging is OFFrecursive clients: 0/0/1000tcp clients: 0/100server is up and running[root@test ~]# rndc -c /etc/rndc.conf notify "jacktest.com"zone notify queued[root@test ~]# tail /var/log/messagesDec 16 10:36:32 test named[10285]: received control channel command 'notify jacktest.com'Dec 16 10:36:32 test named[10285]: zone jacktest.com/IN: sending notifies (serial 2016121404)[root@test ~]# rndc -c /etc/rndc.conf flush[root@test ~]# rndc -c /etc/rndc.conf stop
...
controls {
inet 192.168.1.3 port 953 #监听地址 allow { 192.168.1.5; } keys { "rndc-key"; }; #允许访问192.168.1.3的IP };[root@test ~]# scp /etc/rndc.conf 192.168.1.5:/root/
[root@jacktest ~]# vi /etc/rndc.conf #192.168.1.5从NS
# Start of rndc.conf
key "rndc-key" { algorithm hmac-md5; secret "PElKGniJbHk/esQ9zpN+xg==";};options { default-key "rndc-key"; default-server 192.168.1.3; default-port 953;};[root@jacktest ~]# rndc -c rndc.conf status #192.168.1.5从NS,已可远程访问
version: 9.7.0-P2-RedHat-9.7.0-21.P2.el5 #一般不开放远程允许访问,非常危险 CPUs found: 8worker threads: 8number of zones: 16debug level: 0xfers running: 0xfers deferred: 0soa queries in progress: 0query logging is OFFrecursive clients: 0/0/1000tcp clients: 0/100server is up and running[root@test ~]#
九、子域及子域转发(forward)
forward {only|first}
forwarders {};zone "ZONE_NAME" IN { type forward; forward first; forwarders {172.168.1.3};};
新增子域服务器192.168.1.8
[root@test2 ~]# vi fin.jacktest.com.zone #192.168.1.8 子DNS
$TTL 600 ; 10 minutes
@ IN SOA ns1.fin.jacktest.com. admin.fin.jacktest.com. ( 2016121701 ; serial 3600 ; refresh (1 hour) 300 ; retry (5 minutes) 172800 ; expire (2 days) 21600 ; minimum (6 hours) ) NS ns1.fin.jacktest.com. MX 10 mail.fin.jacktest.com.ns1 A 192.168.1.8mail A 192.168.1.9www A 192.168.1.10[root@test2 ~]# service named restart
Stopping named: . [ OK ]Starting named: [ OK ]验证子域
[root@test named]# dig -t A ns1.fin.jacktest.com @192.168.1.3 #通过主域可解析子域IP
; <<>> DiG 9.7.0-P2-RedHat-9.7.0-21.P2.el5 <<>> -t A ns1.fin.jacktest.com @192.168.1.3;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57664;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0;; QUESTION SECTION:;ns1.fin.jacktest.com. IN A;; ANSWER SECTION:ns1.fin.jacktest.com. 600 IN A 192.168.1.8;; AUTHORITY SECTION:fin.jacktest.com. 600 IN NS ns1.fin.jacktest.com.;; Query time: 3 msec;; SERVER: 192.168.1.3#53(192.168.1.3);; WHEN: Sat Dec 17 11:11:13 2016;; MSG SIZE rcvd: 68[root@test named]# dig -t A ns1.fin.jacktest.com @192.168.1.8 #通过子域可解析子域IP ; <<>> DiG 9.7.0-P2-RedHat-9.7.0-21.P2.el5 <<>> -t A ns1.fin.jacktest.com @192.168.1.8;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53646;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0;; QUESTION SECTION:;ns1.fin.jacktest.com. IN A;; ANSWER SECTION:ns1.fin.jacktest.com. 600 IN A 192.168.1.8;; AUTHORITY SECTION:fin.jacktest.com. 600 IN NS ns1.fin.jacktest.com.;; Query time: 2 msec;; SERVER: 192.168.1.8#53(192.168.1.8);; WHEN: Sat Dec 17 11:12:39 2016;; MSG SIZE rcvd: 68[root@test named]# nslookup > server 192.168.1.3Default server: 192.168.1.3Address: 192.168.1.3#53> set q=A> www.jacktest.comServer: 192.168.1.3 #通过服务器192.168.1.3查找Address: 192.168.1.3#53Name: www.jacktest.com #查找出两条记录 Address: 192.168.1.3Name: www.jacktest.comAddress: 192.168.1.5> set q=A> www.fin.jacktest.comServer: 192.168.1.3 #通过此服务器查找 Address: 192.168.1.3#53Non-authoritative answer: #查找出一条记录,有为非官方记录 Name: www.fin.jacktest.comAddress: 192.168.1.10> server 192.168.1.8Default server: 192.168.1.8Address: 192.168.1.8#53> set q=A > www.fin.jacktest.comServer: 192.168.1.8 #通过服务器192.168.1.8查找 Address: 192.168.1.8#53Name: www.fin.jacktest.com #查找出一条记录 Address: 192.168.1.10> set q=A > www.jacktest.com #通过子域服务器192.168.1.8查找父域的A记录 Server: 192.168.1.8Address: 192.168.1.8#53** server can't find www.jacktest.com.localdomain: SERVFAIL #子域无法查找父域的A记录 >默认子域无法查找父域信息,定义转发即可告诉子域
[root@jacktest2 ~]# vi /etc/rndc.conf #192.168.1.8 子DNS 中新增以下部分
zone "jacktest.com" IN {
type forward; forward first; forwarders { 192.168.1.3; }; };验证:
[root@test named]# nslookup
> set q=A
> www.jacktest.comServer: 192.168.1.8 #通过服务器192.168.1.8查找 Address: 192.168.1.8#53Non-authoritative answer:Name: www.jacktest.com #新增forward后查找出两条记录 Address: 192.168.1.5Name: www.jacktest.comAddress: 192.168.1.3>---end---