基于BIND實現的DNS正反解析及主從DNS的配置
標簽： DNS正反解析 DNS主從復制
測試環境
準備2臺虛擬機，一臺為主DNS，IP地址為：192.168.103.161。另一臺為從DNS，IP地址為：192.168.103.162
兩臺都裝好bind，所需包有：bind，bind-utils，bind-libs
主DNS的配置文件
配置主文件/etc/named.conf，如下所示
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
listen-on port 53 { any; };
// listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
recursion yes;
// dnssec-enable yes;
// dnssec-validation yes;
// dnssec-lookaside auto;
/* Path to ISC DLV key */
// bindkeys-file "/etc/named.iscdlv.key";
// managed-keys-directory "/var/named/dynamic";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
編輯/etc/named.rfc1912.zones文件，如下所示
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
zone "localhost.localdomain" IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "localhost" IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
};
zone "1.0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
};
zone "0.in-addr.arpa" IN {
type master;
file "named.empty";
allow-update { none; };
};
zone "evan.org.cn" IN { #正向解析
type master; #類型為主DNS
file "evan.org.cn.zone"; #正向解析文件位置
allow-update { none; }; #允許自動更新
};
zone "103.168.192.in-addr.arpa" IN { #反向解析
type master; #類型為主DNS
file "192.168.103.zone"; #反向解析文件位置
allow-update { none; }; #允許自動更新
};
在/var/named/目錄中添加正反向解析文件
添加正向解析文件：evan.org.cn.zone
$TTL 86440 @ IN SOA ns1.evan.org.cn. admin.evan.org.cn ( #SOA字段 2016040502 #版本號，同步一次+1 1H #更新時間 2M #更新失敗，重試更新時間 3D #更新失敗多長時間后此DNS失效時間 1D #解析不到請求不予回復的時間 ) IN NS ns1.evan.org.cn. #有兩個域名服務器 IN NS ns2.evan.org.cn. IN MX 10 mx1.evan.org.cn. #定義郵件服務器，10指優先級 0-99數字越小優先級越高 IN MX 20 mx2.evan.org.cn. ns1 IN A 192.168.103.161 #ns1域名服務器的ip地址 ns2 IN A 192.168.103.162 #ns2域名服務器的ip地址 mx1 IN A 192.168.103.161 #mx1郵件服務器的ip地址 mx2 IN A 192.168.103.162 #mx2郵件服務器的ip地址 www IN A 192.168.103.161 #www.evan.org.cn的ip地址 ftp IN CNAME www #ftp的正式名字是www
添加反向解析文件：192.168.103.zone
$TTL 86440 @ IN SOA ns1.evan.org.cn. admin.evan.org.cn ( 2016040501 1H 2M 2D 1D ) IN NS ns1.evan.org.cn. IN NS ns2.evan.org.cn. 161 IN PTR ns1.evan.org.cn. #反向解析PTR格式 162 IN PTR ns2.evan.org.cn. 161 IN PTR mx1.evan.org.cn. 162 IN PTR mx2.evan.org.cn. 161 IN PTR www.evan.org.cn. 162 IN PTR www.evan.org.cn.
檢查語法錯誤
[root@www named]# named-checkconf [root@www named]# named-checkzone "192.168.103.zone" /var/named/192.168.103.zone zone 192.168.103.zone/IN: loaded serial 2016040501 OK [root@www named]# named-checkzone "evan.org.cn.zone" /var/named/evan.org.cn.zone zone evan.org.cn.zone/IN: loaded serial 2016040501 OK
更改兩個自定義區域文件的權限640及屬組為named
[root@www named]# chmod 640 evan.org.cn.zone 192.168.103.zone [root@www named]# chown :named evan.org.cn.zone [root@www named]# chown :named 192.168.103.zone
重啟主DNS，然后進行正反向解析測試
[root@www named]# dig -t A www.evan.org.cn @192.168.103.161 #正向解析測試 ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.37.rc1.el6_7.7 <<>> -t A www.evan.org.cn @192.168.103.161 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4306 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2 ;; QUESTION SECTION: ;www.evan.org.cn. IN A ;; ANSWER SECTION: www.evan.org.cn. 86440 IN A 192.168.103.161 ;; AUTHORITY SECTION: evan.org.cn. 86440 IN NS ns2.evan.org.cn. evan.org.cn. 86440 IN NS ns1.evan.org.cn. ;; ADDITIONAL SECTION: ns1.evan.org.cn. 86440 IN A 192.168.103.161 ns2.evan.org.cn. 86440 IN A 192.168.103.162 ;; Query time: 0 msec ;; SERVER: 192.168.103.161#53(192.168.103.161) ;; WHEN: Wed Apr 6 22:28:58 2016 ;; MSG SIZE rcvd: 117 [root@www named]# dig -x 192.168.103.161 @192.168.103.161 #反向解析測試 ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.37.rc1.el6_7.7 <<>> -x 192.168.103.161 @192.168.103.161 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50415 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 2, ADDITIONAL: 2 ;; QUESTION SECTION: ;161.103.168.192.in-addr.arpa. IN PTR ;; ANSWER SECTION: 161.103.168.192.in-addr.arpa. 86440 IN PTR www.evan.org.cn. 161.103.168.192.in-addr.arpa. 86440 IN PTR ns1.evan.org.cn. 161.103.168.192.in-addr.arpa. 86440 IN PTR mx1.evan.org.cn. ;; AUTHORITY SECTION: 103.168.192.in-addr.arpa. 86440 IN NS ns1.evan.org.cn. 103.168.192.in-addr.arpa. 86440 IN NS ns2.evan.org.cn. ;; ADDITIONAL SECTION: ns1.evan.org.cn. 86440 IN A 192.168.103.161 ns2.evan.org.cn. 86440 IN A 192.168.103.162 ;; Query time: 1 msec ;; SERVER: 192.168.103.161#53(192.168.103.161) ;; WHEN: Wed Apr 6 22:32:53 2016 ;; MSG SIZE rcvd: 175
從DNS的配置文件
/etc/named.conf和主DNS配置一樣
編輯區域文件/etc/named.rf1912.zones，緊接著添加正反解析，如下所示：
zone "evan.org.cn" IN { #正向解析
type slave; #類型從DNS
masters { 192.168.103.161; }; #主DNS ip地址
file "slaves/evan.org.cn.zone"; #evan.org.cn.zone拷貝到slaves目錄下
allow-update { none; }; #允許自動更新
};
zone "103.168.192.in-addr.arpa" IN { #反向解析
type slave; #類型從DNS
masters { 192.168.103.161; }; #主DNS ip地址
file "slaves/192.168.103.zone"; #192.168.103.zone拷貝到slaves目錄下
allow-update { none; }; #允許自動更新
};
重啟從DNS，查看/var/named/slaves/目錄，會出現192.168.103.zone和evan.org.cn.zone兩個文件
測試正向解析
[root@ns2 ~]# dig -t NS evan.org.cn @192.168.103.161 ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.37.rc1.el6_7.7 <<>> -t NS evan.org.cn @192.168.103.161 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18709 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2 ;; QUESTION SECTION: ;evan.org.cn. IN NS ;; ANSWER SECTION: evan.org.cn. 86440 IN NS ns1.evan.org.cn. evan.org.cn. 86440 IN NS ns2.evan.org.cn. ;; ADDITIONAL SECTION: ns1.evan.org.cn. 86440 IN A 192.168.103.161 ns2.evan.org.cn. 86440 IN A 192.168.103.162 ;; Query time: 2 msec ;; SERVER: 192.168.103.161#53(192.168.103.161) ;; WHEN: Wed Apr 6 22:45:02 2016 ;; MSG SIZE rcvd: 97
主從同步
在主DNS /var/named/evan.org.cn.zone 中加一條A記錄
$TTL 86440 @ IN SOA ns1.evan.org.cn. admin.evan.org.cn ( 2016040502 #版本號+1 1H 2M 3D 1D ) IN NS ns1.evan.org.cn. IN NS ns2.evan.org.cn. IN MX 10 mx1.evan.org.cn. IN MX 20 mx2.evan.org.cn. ns1 IN A 192.168.103.161 ns2 IN A 192.168.103.162 mx1 IN A 192.168.103.161 mx2 IN A 192.168.103.162 www IN A 192.168.103.161 ftp IN CNAME www img IN A 192.168.103.161 #添加的新紀錄
主DNS重讀配置文件
[root@www named]# service named reload Reloading named: [ OK ]
到從DNS上查看是否同步復制過來
$ORIGIN . $TTL 86440 ; 1 day 40 seconds evan.org.cn IN SOA ns1.evan.org.cn. admin.evan.org.cn.evan.org.cn. ( 2016040502 ; serial #版本號也隨著更新了 3600 ; refresh (1 hour) 120 ; retry (2 minutes) 259200 ; expire (3 days) 86400 ; minimum (1 day) ) NS ns1.evan.org.cn. NS ns2.evan.org.cn. MX 10 mx1.evan.org.cn. MX 20 mx2.evan.org.cn. $ORIGIN evan.org.cn. ftp CNAME www img A 192.168.103.163 #新增加的A記錄 mx1 A 192.168.103.161 mx2 A 192.168.103.162 ns1 A 192.168.103.161 ns2 A 192.168.103.162 www A 192.168.103.161 A 192.168.103.162
到這里，基于BIND實現的DNS正反解析及主從DNS的配置已經結束了。如果有不足之處，敬請見諒！
原創文章，作者：黑白子，如若轉載，請注明出處：http://www.www58058.com/14333
