配置主配置文件/etc/named.conf
[root@xinfeng named]# vim /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
listen-on port 53 { 172.16.11.55; 127.0.0.1; };
#这里要加入对外监听53端口的主机地址
// listen-on-v6 port 53 { ::1; };
#注释掉ipv6的设置
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
#将这里改为any，表示服务器允许所有地址来查询
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;
#这里为yes表示允许递归查询
// dnssec-enable yes;
// dnssec-validation yes;
/* Path to ISC DLV key */
// bindkeys-file "/etc/named.iscdlv.key";
// managed-keys-directory "/var/named/dynamic";
从dnssec开始到此全部注释掉
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key"; 改完之后重启服务，查看53号端口是否对外监听
[root@xinfeng named]# systemctl restart named.service
[root@xinfeng named]# ss -tunl | grep 53
udp UNCONN 0 0 172.16.11.55:53 *:*
udp UNCONN 0 0 127.0.0.1:53 *:*
tcp LISTEN 0 10 172.16.11.55:53 *:*
tcp LISTEN 0 10 127.0.0.1:53 *:*
tcp LISTEN 0 128 127.0.0.1:953 *:*
tcp LISTEN 0 128 ::1:953 :::*
#可以看到已经监听到53号端口上了 在主配置文件中定义区域，编辑/etc/named.rfc1912.zones
[root@xinfeng named]# vim /etc/named.rfc1912.zones
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
zone "localhost.localdomain" IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "localhost" IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
};
zone "1.0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
};
zone "0.in-addr.arpa" IN {
type master;
file "named.empty";
allow-update { none; };
};
#在最后增加了一个区域叫xinfeng.com
zone "xinfeng.com" IN {
#type是服务器类型，master表示为主服务器
type master;
#file是区域解析库文件的名称，这个文件放在/var/named/下
file "xinfeng.com.zone";
};2、配置正向区域解析，并用dig测试
编辑完后保存，然后到/var/named/下面去创建一个xinfeng.com.zone的文件
[root@xinfeng named]# vim xinfeng.com.zone
$TTL 86400
#TTL表示客户端得到结果后的可缓存时长，单位是秒，这里是1天，可从全局继承
$ORIGIN xinfeng.com.
#ORIGIN定义为xinfeng.com.【注意最后有一个点】，这里定义之后，就可用后面@代替xinfeng.com.
@ IN SOA ns1.xinfeng.com. admin.xinfeng.com. (
#SOA表示起始授权纪录，之后跟上当前区域主DNS的名称，然后跟上当前主区域的管理员邮箱，邮箱中的@用.替换
2016041718
#2016041718表示序列号，编辑一次此文件就必须手动加1
1H
#1H表示刷新时间为1消失
5M
#5M表示重试时间为5分钟
7D
#7D表示过期时间为7天，也可以写成1W
1D )
#1D表示否定答案的时间为1天
IN NS ns1
#NS专用于表示当前区域的DNS服务器，之后必须跟一个A纪录
ns1 IN A 172.16.11.55
#A表示ipv4正向解析，ipv6为AAAA，这里解析ns1.xinfeng.com到172.16.11.55
www IN A 172.16.11.55
#这里解析www.xinfeng.com到172.16.11.55
ftp IN CNAME www
#CNAME表示别名，这里解析ftp.xinfeng.com到www.xinfeng.com，最终解析到172.16.11.55 保存之后用named-check来检查主配置文件和区域解析文件是否有语法错误
[root@xinfeng named]# named-checkconf
[root@xinfeng named]# named-checkzone "xinfeng.com" /var/named/xinfeng.com.zone
zone xinfeng.com/IN: loaded serial 2016041718
OK OK表示没有语法错误
编辑正向区域解析文件/var/nemad/xinfeng.com.zone，在其中加入*的A纪录，并且序列号加1
[root@xinfeng named]# vim /var/named/xinfeng.com.zone
$TTL 86400
$ORIGIN xinfeng.com.
@ IN SOA ns1.xinfeng.com. admin.xinfeng.com. (
2016041719
1H
5M
7D
1D )
IN NS ns1
ns1 IN A 172.16.11.55
www IN A 172.16.11.55
ftp IN CNAME www
* IN A 172.16.11.55 检查语法错误
[root@xinfeng named]# named-checkzone "xinfeng.com" /var/named/xinfeng.com.zone
zone xinfeng.com/IN: loaded serial 2016041719
OK 重载文件并用dig测试
[root@xinfeng2 ~]# vim /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
listen-on port 53 { 172.16.11.57; 127.0.0.1; };
// listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
recursion yes;
// dnssec-enable yes;
// dnssec-validation yes;
// dnssec-lookaside auto;
/* Path to ISC DLV key */
// bindkeys-file "/etc/named.iscdlv.key";
// managed-keys-directory "/var/named/dynamic";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
"/etc/named.conf" 43L, 1027C 编辑/etc/named.rfc1912.zone文件，在最后加入
[root@xinfeng2 ~]# vim /etc/named.rfc1912.zones
zone "xinfeng.com" IN {
type slave;
masters { 172.16.11.55; };
file "slaves/xinfeng.com.zone";
}; 也就是说他的区域解析库文件放置在/var/named/slaves/下叫xinfeng.com.zone，这里我们不需要去创建编辑这个区域解析库文件，因为之后主从同步之后，会自动获得这个文件，重启服务
[root@xinfeng2 ~]# service named restart
Stopping named: . [ OK ]
Starting named: [ OK ]3、在主服务器上定义从服务器的正向解析库文件
编辑主DNS服务器的/var/named/xinfeng.com.zone文件在其中加入从服务器的A纪录和NS纪录，这里是ns2
[root@xinfeng named]# vim /var/named/xinfeng.com.zone
$TTL 86400
$ORIGIN xinfeng.com.
@ IN SOA ns1.xinfeng.com. admin.xinfeng.com. (
2016041720
1H
5M
7D
1D )
IN NS ns1
IN NS ns2
ns1 IN A 172.16.11.55
ns2 IN A 172.16.11.57
www IN A 172.16.11.55
ftp IN CNAME www 主服务器重载服务
[root@xinfeng named]# rndc reload
server reload successful 到从服务器也就是172.16.11.57下查看区域解析库文件是否同步
[root@xinfeng2 ~]# cd /var/named/slaves/
[root@xinfeng2 slaves]# ls
xinfeng.com.zone 可以看到区域解析库文件已同步成功 4、在从服务器上定义主配置文件，定义反向解析库文件位置
编辑主服务器也就是172.16.11.55的反向解析文件，加入ns2的A纪录和NS纪录，然后重载服务
[root@xinfeng named]# vim /var/named/172.16.11.zone
$TTL 86400
$ORIGIN 11.16.172.in-addr.arpa.
@ IN SOA ns1.xinfeng.com. admin.xinfeng.com. (
2016041720
1H
5M
7D
1D )
IN NS ns1.xinfeng.com.
IN NS ns2.xinfeng.com.
55 IN PTR ns1.xinfeng.com.
57 IN PTR ns2.xinfeng.com.
55 IN PTR www.xinfeng.com.
[root@xinfeng named]# rndc reload
server reload successful 在从服务器上也就是172.16.11.57上编辑/etc/named.rfc1912.zone文件，在最后加入
[root@xinfeng2 ~]# vim /etc/named.rfc1912.zones
zone "11.16.172.in-addr.arpa" IN {
type slave;
masters { 172.16.11.55; };
file "slaves/172.16.11.zone";
}; 完成后重载从服务器，就会同步主服务器上的反向解析库文件
[root@xinfeng2 ~]# rndc reload
server reload successful
[root@xinfeng2 ~]# cd /var/named/slaves/
[root@xinfeng2 slaves]# ls
172.16.11.zone xinfeng.com.zone
[root@xinfeng2 slaves]# cat 172.16.11.zone
$ORIGIN .
$TTL 86400; 1 day
11.16.172.in-addr.arpaIN SOAns1.xinfeng.com. admin.xinfeng.com. (
2016041720 ; serial
3600 ; refresh (1 hour)
300 ; retry (5 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
NSns1.xinfeng.com.
$ORIGIN 11.16.172.in-addr.arpa.
55PTRns1.xinfeng.com.
PTRwww.xinfeng.com. 区域解析库文件同步成功
需要注意的是，主从服务器的bind版本需要一致，而且一定不要更改从服务器的区域解析库文件，只需要改主服务器的区域解析库文件。 三、子域授权
父域为172.16.11.55，子域为172.16.9.9 1、定义父域
进入父域服务器172.16.11.55，编辑/var/named/xinfeng.com.zone也就是父域的正向解析库文件，在其中加入子域的NS纪录和A纪录
[root@xinfeng ~]# vim /var/named/xinfeng.com.zone
$TTL 86400
$ORIGIN xinfeng.com.
@ IN SOA ns1.xinfeng.com. admin.xinfeng.com. (
2016041720
1H
5M
7D
1D )
IN NS ns1
IN NS ns2
ns1 IN A 172.16.11.55
ns2 IN A 172.16.11.57
www IN A 172.16.11.55
ftp IN CNAME www
tv IN NS ns1.ops
ns1.ops IN A 172.16.9.9
[root@xinfeng ~]# named-checkzone "xinfeng.com" /var/named/xinfeng.com.zone
zone xinfeng.com/IN: loaded serial 2016041720
OK
[root@xinfeng ~]# rndc reload
server reload successful 检查语法正确，并重载后， 2、定义子域
进入子域服务器172.16.9.9
新服务器重新编辑/etc/named.conf，之后开起服务
[root@tv.xinfeng.com ~]# vim /etc/named.conf
[root@tv.xinfeng.com ~]# systemctl start named.service
[root@tv.xinfeng.com ~]# ss -tunl | grep 53
udp UNCONN 0 0 172.16.9.9:53 *:*
udp UNCONN 0 0 127.0.0.1:53 *:*
tcp LISTEN 0 10 172.16.9.9:53 *:*
tcp LISTEN 0 10 127.0.0.1:53 *:*
tcp LISTEN 0 128 127.0.0.1:953 *:*
tcp LISTEN 0 128 ::1:953 :::* 编辑子域172.16.9.9的/etc/named.rfc1912.zones ，在后面加入
[root@tv.xinfeng.com ~]# vim /etc/named.rfc1912.zones
zone "tv.xinfeng.com" IN {
type master;
file "tv.xinfeng.com.zone";
};
[root@tv.xinfeng.com ~]# rndc reload
server reload successful 编辑子域172.16.9.9的/var/named/tv.xinfeng.com.zone
[root@tv.xinfeng.com ~]# vim /var/named/tv.xinfeng.com.zone
$TTL 1d
$ORIGIN tv.xinfeng.com.
@ IN SOA ns1.tv.xinfeng.com. admin.tv.xinfeng.com. (
2016041722
1H
10M
3D
1D )
IN NS ns1
ns1 IN A 172.16.9.9
www IN A 172.16.9.9
[root@tv.xinfeng.com]# chown :named tv.xinfeng.com.zone
[root@tv.xinfeng.com]# chmod 640 tv.xinfeng.com.zone
[root@tv.xinfeng.com ~]# rndc reload
server reload successful3、测试解析
测试子域能否解析自己范围的
[root@tv.xinfeng.com]# dig -t A ns1.tv.xinfeng.com @172.16.9.9
; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7_2.3 <<>> -t A ns1.tv.xinfeng.com @172.16.9.9
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56031
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;ns1.tv.xinfeng.com.INA
;; ANSWER SECTION:
ns1.tv.xinfeng.com. 86400 IN A 172.16.9.9
;; AUTHORITY SECTION:
tv.xinfeng.com. 86400 IN NS ns1.tv.xinfeng.com.
;; Query time: 0 msec
;; SERVER: 172.16.9.9#53(172.16.9.9)
;; WHEN: 一 3月 21 07:58:01 CST 2016
;; MSG SIZE rcvd: 77 测试成功，测试父域能否解析子域的
[root@xinfeng ~]# dig -t A www.tv.xinfeng.com @172.16.11.55
; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7_2.3 <<>> -t A www.tv.xinfeng.com @172.16.11.55
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 61635
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.tv.xinfeng.com.INA
;; Query time: 2 msec
;; SERVER: 172.16.11.55#53(172.16.11.55)
;; WHEN: 四 4月 14 06:38:48 CST 2016
;; MSG SIZE rcvd: 47 测试成功
QQ群⑧：
窥视卡
雷达卡
发表于 2018-4-26 11:47:18
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
千斤顶
显身卡