1、詳細描述一次加密通訊的過程,結合圖示最佳。
點對點加密過程如下:
-
發送方根據單向加密算法計算數據的特征碼
-
用私鑰加密這段特征碼,生產數字簽名,將數字簽名附著在數據后面
-
發送方生產臨時對稱密鑰,用對稱加密算法結合對稱加密密鑰加密整段數據(數據+數字簽名)
-
為保證接收方可以解密,發送方用接收方的公鑰加密對稱加密密鑰,附加在數據后面
-
接收方用自己的私鑰解密數據(加密的對稱密鑰),得到密碼,這就是密鑰交換
-
根據對稱密鑰解密得到數據和數字簽名
-
用發送方的公鑰解密數字簽名
-
用單向加密算法計算真正數據的特征碼,與解密出來的特征碼作比較,驗證數據完整性
整個過程實現了
-
驗證發送者身份
-
保證數據的完整性
-
數據保密性
-
密鑰交換
遺留問題:
問題: 被其他人偽裝成接收者同時和發送者,接收者通信,這叫做中間人攻擊,因為發送者和接收者沒有接受過通信,獲取公鑰過程無法保證,這是需引入第三方機構CA-證書頒發機構!
2、描述創建私有CA的過程,以及為客戶端發來的證書請求進行頒發證書。
創建私有CA的過程:
(1) 生成私鑰;
~]# (umask 077; openssl genrsa -out /etc/pki/CA/private/cakey.pem 4096)
(2) 生成自簽證書;
~]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem -days 3655
-new:生成新證書簽署請求;
-x509:生成自簽格式證書,專用于創建私有CA時;
-key:生成請求時用到的私鑰文件路徑;
-out:生成的請求文件路徑;如果自簽操作將直接生成簽署過的證書;
-days:證書的有效時長,單位是day;
(3) 為CA提供所需的目錄及文件;
~]# mkdir -pv /etc/pki/CA/{certs,crl,newcerts}
~]# touch /etc/pki/CA/{serial,index.txt}
~]# echo 01 > /etc/pki/CA/serial
為客戶端的請求頒發證書:
要用到證書進行安全通信的服務器,需要向CA請求簽署證書:
步驟:(以httpd為例)
(1) 用到證書的主機生成私鑰;
~]# mkdir /etc/httpd/ssl
~]# cd /etc/httpd/ssl
~]# (umask 077; openssl genrsa -out /etc/httpd/ssl/httpd.key 2048)
(2) 生成證書簽署請求
~]# openssl req -new -key /etc/httpd/ssl/httpd.key -out /etc/httpd/ssl/httpd.csr -days 365
(3) 將請求通過可靠方式發送給CA主機;
scp
(4) 在CA主機上簽署證書;
~]# openssl ca -in /tmp/httpd.csr -out /etc/pki/CA/certs/httpd.crt -days 365
查看證書中的信息:(ca和客戶機都可以查看)
~]# openssl x509 -in /etc/pki/CA/certs/httpd.crt -noout -serial -subject
3、描述DNS查詢過程以及DNS服務器類別。
名稱解析過程:
瀏覽器鍵入域名,先檢查本地hosts,沒有條目,接著查找本地緩存,緩存中沒有,再查找DSN服務器(udp53),dns查找出結果后,通過網絡相應給客戶端,并將結果存入本地緩沖中,然后客戶端用獲得ip地址訪問目標服務器
解析順序:
-
hosts
-
本地緩存(有生存周期) 緩存時間由服務端定義
-
dns 以www.magedu.com.為例
(1) 查找本地指定dns,如果查不到
(2) 本地指定的dns向根查詢,根返回.com域的dns地址
(3) 本地dns向.com的dns查詢,返回.magedu域的dns服務器
(4) 本地dns向.magedu域的dns服務器查詢,得到www.magedu.com.的ip
DNS服務器類別:
負責解析至少一個域:
-
主名稱服務器;
-
輔助名稱服務器;
不負責域解析:
-
緩存名稱服務器;
4、搭建一套DNS服務器,負責解析magedu.com域名(自行設定主機名及IP)
(1)、能夠對一些主機名進行正向解析和逆向解析;
(2)、對子域cdn.magedu.com進行子域授權,子域負責解析對應子域中的主機名;
(3)、為了保證DNS服務系統的高可用性,請設計一套方案,并寫出詳細的實施過程
環境: CentOS7.2
-
主DNS服務器: 172.16.0.10
-
從DNS服務器:172.16.0.11
-
子域DNS服務器: 172.16.0.13
-
httpd服務器: 172.16.0.15
正向解析和逆向解析
(1) 安裝dns程序
[root@node1 ~]# yum -y install bind*
(2) 配置hosts
[root@node1 ~]# vim /etc/hosts
172.16.0.15 www.magedu.com bbs.magedu.com
172.16.0.13 www.cdn.magedu.com
(3) 配置主配置文件
[root@node1 ~]# vim /etc/named.conf
listen-on port 53 { any; };
allow-query { any; };
dnssec-enable no;
dnssec-validation no;
[root@node1 ~]# systemctl restart named.service
(4) 定義區域
[root@node1 ~]# vim /etc/named.rfc1912.zones
//正向解析
zone "magedu.com" IN {
type master;
file "magedu.com.zone";
};
//反向解析
zone "16.172.in-addr.arpa" IN {
type master;
file "172.16.zone";
};
(5) 建立區域數據文件
修改配置文件:
[root@node1 ~]# vim /var/named/magedu.com.zone
$TTL 3600
$ORIGIN magedu.com.
@ IN SOA ns1.magedu.com. dnsadmin.magedu.com. (
2017032701
1H
10M
3D
1D )
IN NS ns1
ns1 IN A 172.16.0.10
www IN A 172.16.0.15
bbs IN A 172.16.0.15
反向區域文件:
[root@node1 ~]# vim /var/named/172.16.zone
$TTL 3600
$ORIGIN 16.172.in-addr.arpa.
@ IN SOA ns1.magedu.com nsadmin.magedu.com (
2017032701
1H
10M
3D
12H )
IN NS ns1.magedu.com.
10.0 IN PTR ns1.magedu.com.
15.0 IN PTR www.magedu.com.
15.0 IN PTR bbs.magedu.com.
(6) 權限及屬性修改:
[root@node1 ~]# chgrp named /var/named/magedu.com.zone
[root@node1 ~]# chmod o= /var/named/magedu.com.zone
[root@node1 ~]# chgrp named /var/named/172.16.zone
[root@node1 ~]# chmod o= /var/named/172.16.zone
(7)語法檢查
配置文件語法檢查:
[root@node1 ~]# named-checkconf
檢查區域文件:
[root@node1 ~]# named-checkzone magedu.com /var/named/magedu.com.zone
zone magedu.com/IN: loaded serial 2017032701
OK
[root@node1 ~]# named-checkzone 16.172.in-addr.arpa /var/named/172.16.zone
zone 16.172.in-addr.arpa/IN: loaded serial 2017032701
OK
(8) 載入新區域:
[root@node1 ~]# rndc status
version: 9.9.4-RedHat-9.9.4-38.el7_3.2 <id:8f9657aa>
CPUs found: 1
worker threads: 1
UDP listeners per interface: 1
number of zones: 102
debug level: 0
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is OFF
recursive clients: 0/0/1000
tcp clients: 0/100
server is up and running
[root@node1 ~]# rndc reload
server reload successful
[root@node1 ~]# rndc status
version: 9.9.4-RedHat-9.9.4-38.el7_3.2 <id:8f9657aa>
CPUs found: 1
worker threads: 1
UDP listeners per interface: 1
number of zones: 102
debug level: 0
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is OFF
recursive clients: 0/0/1000
tcp clients: 0/100
server is up and running
或者:
[root@node1 ~]# systemctl reload named.service
(9) 測試正向解析
[root@node1 ~]# dig -t A www.magedu.com @172.16.0.10
; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.2 <<>> -t A www.magedu.com @172.16.0.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18127
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.magedu.com. IN A
;; ANSWER SECTION:
www.magedu.com. 3600 IN A 172.16.0.15
;; AUTHORITY SECTION:
magedu.com. 3600 IN NS ns1.magedu.com.
;; ADDITIONAL SECTION:
ns1.magedu.com. 3600 IN A 172.16.0.10
;; Query time: 1 msec
;; SERVER: 172.16.0.10#53(172.16.0.10)
;; WHEN: 一 3月 27 18:16:16 CST 2017
;; MSG SIZE rcvd: 93
[root@node1 ~]# dig -t A bbs.magedu.com @172.16.0.10
; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.2 <<>> -t A bbs.magedu.com @172.16.0.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6927
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;bbs.magedu.com. IN A
;; ANSWER SECTION:
bbs.magedu.com. 3600 IN A 172.16.0.15
;; AUTHORITY SECTION:
magedu.com. 3600 IN NS ns1.magedu.com.
;; ADDITIONAL SECTION:
ns1.magedu.com. 3600 IN A 172.16.0.10
;; Query time: 0 msec
;; SERVER: 172.16.0.10#53(172.16.0.10)
;; WHEN: 一 3月 27 18:17:01 CST 2017
;; MSG SIZE rcvd: 93
(10) 測試反向解析
[root@node1 ~]# dig -x 172.16.0.15 @172.16.0.10
; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.2 <<>> -x 172.16.0.15 @172.16.0.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14910
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;15.0.16.172.in-addr.arpa. IN PTR
;; ANSWER SECTION:
15.0.16.172.in-addr.arpa. 3600 IN PTR www.magedu.com.
15.0.16.172.in-addr.arpa. 3600 IN PTR bbs.magedu.com.
;; AUTHORITY SECTION:
16.172.in-addr.arpa. 3600 IN NS ns1.magedu.com.
;; ADDITIONAL SECTION:
ns1.magedu.com. 3600 IN A 172.16.0.10
;; Query time: 0 msec
;; SERVER: 172.16.0.10#53(172.16.0.10)
;; WHEN: 一 3月 27 19:10:06 CST 2017
;; MSG SIZE rcvd: 133
子域授權
(1) 父域授權
[root@node1 ~]# vim /var/named/magedu.com.zone
增加以下內容:
cdn IN NS ns1.cdn
ns1.cdn IN A 172.16.0.13
(2) 重載
[root@node1 ~]# rndc reload
server reload successful
子域服務器:
(3) 修改主配置文件
[root@node1 ~]# yum -y install bind bind-utils
[root@node1 ~]# vim /etc/named.conf
listen-on port 53 { any; };
dnssec-enable no;
dnssec-validation no;
[root@localhost ~]# systemctl start named.service
[root@localhost ~]# systemctl status named.service
[root@localhost ~]# ss -tuln
(4) 定義區域
[root@localhost ~]# vim /etc/named.rfc1912.zones
zone "cdn.magedu.com" IN {
type master;
file "cdn.magedu.com.zone";
};
(5) 配置區域文件
$TTL 3600
$ORIGIN cdn.magedu.com.
@ IN SOA ns1.cdn.magedu.com. nsadmin.cdn.magedu.com. (
2017032701
1H
10M
1D
2H )
IN NS ns1
ns1 IN A 172.16.0.13
www IN A 172.16.0.13
[root@localhost ~]# chgrp named /var/named/cdn.magedu.com.zone
[root@localhost ~]# chmod o= /var/named/cdn.magedu.com.zone
(6) 語法檢查
[root@localhost ~]# named-checkconf
[root@localhost ~]# named-checkzone cdn.magedu.com /var/named/cdn.magedu.com.zone
zone cdn.magedu.com/IN: loaded serial 2017032701
OK
(7) 重載
[root@localhost ~]# rndc reload
server reload successful
(8) 驗證
[root@localhost ~]# dig -t A www.cdn.magedu.com @172.16.0.13
; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.2 <<>> -t A www.cdn.magedu.com @172.16.0.13
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34977
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.cdn.magedu.com. IN A
;; ANSWER SECTION:
www.cdn.magedu.com. 3600 IN A 172.16.0.13
;; AUTHORITY SECTION:
cdn.magedu.com. 3600 IN NS ns1.cdn.magedu.com.
;; ADDITIONAL SECTION:
ns1.cdn.magedu.com. 3600 IN A 172.16.0.13
;; Query time: 1 msec
;; SERVER: 172.16.0.13#53(172.16.0.13)
;; WHEN: Mon Mar 27 19:59:45 CST 2017
;; MSG SIZE rcvd: 97
定義區域轉發
子域服務器:
[root@localhost ~]# vim /etc/named.rfc1912.zones
增加:
zone "magedu.com" IN {
type forward;
forward only;
forwarders {172.16.0.10;};
};
[root@localhost ~]# named-checkconf
[root@localhost ~]# rndc reload
子域解析父域測試:
[root@localhost ~]# dig -t A www.magedu.com @172.16.0.13
; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.2 <<>> -t A www.magedu.com @172.16.0.13
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4749
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.magedu.com. IN A
;; ANSWER SECTION:
www.magedu.com. 3600 IN A 172.16.0.15
;; AUTHORITY SECTION:
magedu.com. 3600 IN NS ns1.magedu.com.
;; ADDITIONAL SECTION:
ns1.magedu.com. 3600 IN A 172.16.0.10
;; Query time: 2 msec
;; SERVER: 172.16.0.13#53(172.16.0.13)
;; WHEN: Mon Mar 27 20:21:17 CST 2017
;; MSG SIZE rcvd: 93
問題1:
[root@node1 ~]# rndc status
rndc: neither /etc/rndc.conf nor /etc/rndc.key was found
原因: 修改主配置文件后,未重啟服務, 服務沒有監聽在所有端口
問題2:
父域解析子域不成功
[root@node1 ~]# dig -t A www.cdn.magedu.com @172.16.0.10
; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.2 <<>> -t A www.cdn.magedu.com @172.16.0.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 6585
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.cdn.magedu.com. IN A
;; Query time: 3 msec
;; SERVER: 172.16.0.10#53(172.16.0.10)
;; WHEN: 一 3月 27 20:28:22 CST 2017
;; MSG SIZE rcvd: 47
方法: /etc/named.conf注釋掉近本機查詢選項
子域服務器:
[root@ns1 ~]# vim /etc/named.conf
//allow-query { localhost; };
[root@ns1 ~]# systemctl restart named.service
測試:
[root@node1 ~]# dig -t A www.cdn.magedu.com @172.16.0.10
; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.2 <<>> -t A www.cdn.magedu.com @172.16.0.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60945
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.cdn.magedu.com. IN A
;; ANSWER SECTION:
www.cdn.magedu.com. 3490 IN A 172.16.0.13
;; AUTHORITY SECTION:
cdn.magedu.com. 3490 IN NS ns1.cdn.magedu.com.
;; ADDITIONAL SECTION:
ns1.cdn.magedu.com. 3490 IN A 172.16.0.13
DNS主從
(1) 同步主從服務器時間
ntpdate
(2) 從服務器配置
[root@localhost ~]# yum -y install bind
主配置文件:
[root@localhost ~]# vim /etc/named.conf
listen-on port 53 { any; };
dnssec-enable no;
dnssec-validation no;
啟動
[root@localhost ~]# systemctl restart named.service
配置正向區域:
[root@localhost ~]# vim /etc/named.rfc1912.zones
zone "magedu.com" IN {
type slave;
file "slaves/magedu.com.zone";
masters { 172.16.0.10; };
};
[root@localhost ~]# named-checkconf
(3) 主服務器配置
修改定義區域,僅允許從服務器與主服務器同步,默認允許所有主機
[root@node1 ~]# vim /etc/named.rfc1912.zones
zone "magedu.com" IN {
type master;
file "magedu.com.zone";
allow-transfer { 172.16.0.11; }; #允許從服務器同步
};
添加從服務器信息
[root@node1 ~]# vim /var/named/magedu.com.zone
.
.
.
IN NS ns2
ns2 IN A 172.16.0.11
.
.
.
注意: 如果在配置該區域文件時,從服務器已經啟動,需修改序列號,否則從服務器無法檢測到改變
[root@node1 ~]# named-checkzone magedu.com /var/named/magedu.com.zone
重載
[root@node1 ~]# rndc reload
(4) 從服務器
重載
[root@localhost ~]# rndc reload
查看狀態
[root@localhost ~]# systemctl status named.service
● named.service - Berkeley Internet Name Domain (DNS)
Loaded: loaded (/usr/lib/systemd/system/named.service; disabled; vendor preset: disabled)
Active: active (running) since Wed 2017-03-29 23:46:46 CST; 29min ago
Process: 2568 ExecStart=/usr/sbin/named -u named $OPTIONS (code=exited, status=0/SUCCESS)
Process: 2566 ExecStartPre=/bin/bash -c if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z /etc/named.conf; else echo "Checking of zone files is disabled"; fi (code=exited, status=0/SUCCESS)
Main PID: 2571 (named)
CGroup: /system.slice/named.service
└─2571 /usr/sbin/named -u named
Mar 30 00:14:55 localhost.localdomain named[2571]: automatic empty zone: 8.B.D.0.1.0.0.2.IP6.ARPA
Mar 30 00:14:55 localhost.localdomain named[2571]: reloading configuration succeeded
Mar 30 00:14:55 localhost.localdomain named[2571]: reloading zones succeeded
Mar 30 00:14:55 localhost.localdomain named[2571]: all zones loaded
Mar 30 00:14:55 localhost.localdomain named[2571]: running
Mar 30 00:14:55 localhost.localdomain named[2571]: zone magedu.com/IN: Transfer started.
Mar 30 00:14:55 localhost.localdomain named[2571]: transfer of 'magedu.com/IN' from 172.16.0.10#53...290
Mar 30 00:14:56 localhost.localdomain named[2571]: zone magedu.com/IN: transferred serial 2017033001
Mar 30 00:14:56 localhost.localdomain named[2571]: transfer of 'magedu.com/IN' from 172.16.0.10#53...ec)
Mar 30 00:14:56 localhost.localdomain named[2571]: zone magedu.com/IN: sending notifies (serial 20...01)
Hint: Some lines were ellipsized, use -l to show in full.
檢查傳輸過來的區域文件
[root@localhost ~]# ll /var/named/slaves/
total 4
-rw-r--r--. 1 named named 455 Mar 30 00:14 magedu.com.zone
(5) 測試
[root@localhost ~]# dig -t A www.magedu.com @172.16.0.11
; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.2 <<>> -t A www.magedu.com @172.16.0.11
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24829
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.magedu.com. IN A
;; ANSWER SECTION:
www.magedu.com. 3600 IN A 172.16.0.15
;; AUTHORITY SECTION:
magedu.com. 3600 IN NS ns1.magedu.com.
magedu.com. 3600 IN NS ns2.magedu.com.
;; ADDITIONAL SECTION:
ns1.magedu.com. 3600 IN A 172.16.0.10
ns2.magedu.com. 3600 IN A 172.16.0.11
;; Query time: 1 msec
;; SERVER: 172.16.0.11#53(172.16.0.11)
;; WHEN: Thu Mar 30 00:21:20 CST 2017
;; MSG SIZE rcvd: 127
1、詳細描述一次加密通訊的過程,結合圖示最佳。
點對點加密過程如下:
- 發送方根據單向加密算法計算數據的特征碼
- 用私鑰加密這段特征碼,生產數字簽名,將數字簽名附著在數據后面
- 發送方生產臨時對稱密鑰,用對稱加密算法結合對稱加密密鑰加密整段數據(數據+數字簽名)
- 為保證接收方可以解密,發送方用接收方的公鑰加密對稱加密密鑰,附加在數據后面
- 接收方用自己的私鑰解密數據(加密的對稱密鑰),得到密碼,這就是密鑰交換
- 根據對稱密鑰解密得到數據和數字簽名
- 用發送方的公鑰解密數字簽名
- 用單向加密算法計算真正數據的特征碼,與解密出來的特征碼作比較,驗證數據完整性
整個過程實現了
- 驗證發送者身份
- 保證數據的完整性
- 數據保密性
- 密鑰交換
遺留問題:
問題: 被其他人偽裝成接收者同時和發送者,接收者通信,這叫做中間人攻擊,因為發送者和接收者沒有接受過通信,獲取公鑰過程無法保證,這是需引入第三方機構CA-證書頒發機構!
2、描述創建私有CA的過程,以及為客戶端發來的證書請求進行頒發證書。
創建私有CA的過程:
(1) 生成私鑰; ~]# (umask 077; openssl genrsa -out /etc/pki/CA/private/cakey.pem 4096) (2) 生成自簽證書; ~]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem -days 3655 -new:生成新證書簽署請求; -x509:生成自簽格式證書,專用于創建私有CA時; -key:生成請求時用到的私鑰文件路徑; -out:生成的請求文件路徑;如果自簽操作將直接生成簽署過的證書; -days:證書的有效時長,單位是day; (3) 為CA提供所需的目錄及文件; ~]# mkdir -pv /etc/pki/CA/{certs,crl,newcerts} ~]# touch /etc/pki/CA/{serial,index.txt} ~]# echo 01 > /etc/pki/CA/serial
為客戶端的請求頒發證書:
要用到證書進行安全通信的服務器,需要向CA請求簽署證書: 步驟:(以httpd為例) (1) 用到證書的主機生成私鑰; ~]# mkdir /etc/httpd/ssl ~]# cd /etc/httpd/ssl ~]# (umask 077; openssl genrsa -out /etc/httpd/ssl/httpd.key 2048) (2) 生成證書簽署請求 ~]# openssl req -new -key /etc/httpd/ssl/httpd.key -out /etc/httpd/ssl/httpd.csr -days 365 (3) 將請求通過可靠方式發送給CA主機; scp (4) 在CA主機上簽署證書; ~]# openssl ca -in /tmp/httpd.csr -out /etc/pki/CA/certs/httpd.crt -days 365 查看證書中的信息:(ca和客戶機都可以查看) ~]# openssl x509 -in /etc/pki/CA/certs/httpd.crt -noout -serial -subject
3、描述DNS查詢過程以及DNS服務器類別。
名稱解析過程:
瀏覽器鍵入域名,先檢查本地hosts,沒有條目,接著查找本地緩存,緩存中沒有,再查找DSN服務器(udp53),dns查找出結果后,通過網絡相應給客戶端,并將結果存入本地緩沖中,然后客戶端用獲得ip地址訪問目標服務器
解析順序:
- hosts
- 本地緩存(有生存周期) 緩存時間由服務端定義
-
dns 以www.magedu.com.為例
(1) 查找本地指定dns,如果查不到
(2) 本地指定的dns向根查詢,根返回.com域的dns地址
(3) 本地dns向.com的dns查詢,返回.magedu域的dns服務器
(4) 本地dns向.magedu域的dns服務器查詢,得到www.magedu.com.的ip
DNS服務器類別:
負責解析至少一個域:
- 主名稱服務器;
- 輔助名稱服務器;
不負責域解析:
- 緩存名稱服務器;
4、搭建一套DNS服務器,負責解析magedu.com域名(自行設定主機名及IP)
(1)、能夠對一些主機名進行正向解析和逆向解析;
(2)、對子域cdn.magedu.com進行子域授權,子域負責解析對應子域中的主機名;
(3)、為了保證DNS服務系統的高可用性,請設計一套方案,并寫出詳細的實施過程
環境: CentOS7.2
- 主DNS服務器: 172.16.0.10
- 從DNS服務器:172.16.0.11
- 子域DNS服務器: 172.16.0.13
- httpd服務器: 172.16.0.15
正向解析和逆向解析
(1) 安裝dns程序
[root@node1 ~]# yum -y install bind*
(2) 配置hosts
[root@node1 ~]# vim /etc/hosts 172.16.0.15 www.magedu.com bbs.magedu.com 172.16.0.13 www.cdn.magedu.com
(3) 配置主配置文件
[root@node1 ~]# vim /etc/named.conf listen-on port 53 { any; }; allow-query { any; }; dnssec-enable no; dnssec-validation no; [root@node1 ~]# systemctl restart named.service
(4) 定義區域
[root@node1 ~]# vim /etc/named.rfc1912.zones //正向解析 zone "magedu.com" IN { type master; file "magedu.com.zone"; }; //反向解析 zone "16.172.in-addr.arpa" IN { type master; file "172.16.zone"; };
(5) 建立區域數據文件
修改配置文件:
[root@node1 ~]# vim /var/named/magedu.com.zone $TTL 3600 $ORIGIN magedu.com. @ IN SOA ns1.magedu.com. dnsadmin.magedu.com. ( 2017032701 1H 10M 3D 1D ) IN NS ns1 ns1 IN A 172.16.0.10 www IN A 172.16.0.15 bbs IN A 172.16.0.15 反向區域文件: [root@node1 ~]# vim /var/named/172.16.zone $TTL 3600 $ORIGIN 16.172.in-addr.arpa. @ IN SOA ns1.magedu.com nsadmin.magedu.com ( 2017032701 1H 10M 3D 12H ) IN NS ns1.magedu.com. 10.0 IN PTR ns1.magedu.com. 15.0 IN PTR www.magedu.com. 15.0 IN PTR bbs.magedu.com.
(6) 權限及屬性修改:
[root@node1 ~]# chgrp named /var/named/magedu.com.zone [root@node1 ~]# chmod o= /var/named/magedu.com.zone [root@node1 ~]# chgrp named /var/named/172.16.zone [root@node1 ~]# chmod o= /var/named/172.16.zone
(7)語法檢查
配置文件語法檢查:
[root@node1 ~]# named-checkconf
檢查區域文件:
[root@node1 ~]# named-checkzone magedu.com /var/named/magedu.com.zone zone magedu.com/IN: loaded serial 2017032701 OK [root@node1 ~]# named-checkzone 16.172.in-addr.arpa /var/named/172.16.zone zone 16.172.in-addr.arpa/IN: loaded serial 2017032701 OK
(8) 載入新區域:
[root@node1 ~]# rndc status version: 9.9.4-RedHat-9.9.4-38.el7_3.2 <id:8f9657aa> CPUs found: 1 worker threads: 1 UDP listeners per interface: 1 number of zones: 102 debug level: 0 xfers running: 0 xfers deferred: 0 soa queries in progress: 0 query logging is OFF recursive clients: 0/0/1000 tcp clients: 0/100 server is up and running [root@node1 ~]# rndc reload server reload successful [root@node1 ~]# rndc status version: 9.9.4-RedHat-9.9.4-38.el7_3.2 <id:8f9657aa> CPUs found: 1 worker threads: 1 UDP listeners per interface: 1 number of zones: 102 debug level: 0 xfers running: 0 xfers deferred: 0 soa queries in progress: 0 query logging is OFF recursive clients: 0/0/1000 tcp clients: 0/100 server is up and running 或者: [root@node1 ~]# systemctl reload named.service
(9) 測試正向解析
[root@node1 ~]# dig -t A www.magedu.com @172.16.0.10 ; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.2 <<>> -t A www.magedu.com @172.16.0.10 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18127 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;www.magedu.com. IN A ;; ANSWER SECTION: www.magedu.com. 3600 IN A 172.16.0.15 ;; AUTHORITY SECTION: magedu.com. 3600 IN NS ns1.magedu.com. ;; ADDITIONAL SECTION: ns1.magedu.com. 3600 IN A 172.16.0.10 ;; Query time: 1 msec ;; SERVER: 172.16.0.10#53(172.16.0.10) ;; WHEN: 一 3月 27 18:16:16 CST 2017 ;; MSG SIZE rcvd: 93 [root@node1 ~]# dig -t A bbs.magedu.com @172.16.0.10 ; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.2 <<>> -t A bbs.magedu.com @172.16.0.10 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6927 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;bbs.magedu.com. IN A ;; ANSWER SECTION: bbs.magedu.com. 3600 IN A 172.16.0.15 ;; AUTHORITY SECTION: magedu.com. 3600 IN NS ns1.magedu.com. ;; ADDITIONAL SECTION: ns1.magedu.com. 3600 IN A 172.16.0.10 ;; Query time: 0 msec ;; SERVER: 172.16.0.10#53(172.16.0.10) ;; WHEN: 一 3月 27 18:17:01 CST 2017 ;; MSG SIZE rcvd: 93
(10) 測試反向解析
[root@node1 ~]# dig -x 172.16.0.15 @172.16.0.10 ; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.2 <<>> -x 172.16.0.15 @172.16.0.10 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14910 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;15.0.16.172.in-addr.arpa. IN PTR ;; ANSWER SECTION: 15.0.16.172.in-addr.arpa. 3600 IN PTR www.magedu.com. 15.0.16.172.in-addr.arpa. 3600 IN PTR bbs.magedu.com. ;; AUTHORITY SECTION: 16.172.in-addr.arpa. 3600 IN NS ns1.magedu.com. ;; ADDITIONAL SECTION: ns1.magedu.com. 3600 IN A 172.16.0.10 ;; Query time: 0 msec ;; SERVER: 172.16.0.10#53(172.16.0.10) ;; WHEN: 一 3月 27 19:10:06 CST 2017 ;; MSG SIZE rcvd: 133
子域授權
(1) 父域授權
[root@node1 ~]# vim /var/named/magedu.com.zone 增加以下內容: cdn IN NS ns1.cdn ns1.cdn IN A 172.16.0.13
(2) 重載
[root@node1 ~]# rndc reload server reload successful
子域服務器:
(3) 修改主配置文件
[root@node1 ~]# yum -y install bind bind-utils [root@node1 ~]# vim /etc/named.conf listen-on port 53 { any; }; dnssec-enable no; dnssec-validation no; [root@localhost ~]# systemctl start named.service [root@localhost ~]# systemctl status named.service [root@localhost ~]# ss -tuln
(4) 定義區域
[root@localhost ~]# vim /etc/named.rfc1912.zones zone "cdn.magedu.com" IN { type master; file "cdn.magedu.com.zone"; };
(5) 配置區域文件
$TTL 3600 $ORIGIN cdn.magedu.com. @ IN SOA ns1.cdn.magedu.com. nsadmin.cdn.magedu.com. ( 2017032701 1H 10M 1D 2H ) IN NS ns1 ns1 IN A 172.16.0.13 www IN A 172.16.0.13 [root@localhost ~]# chgrp named /var/named/cdn.magedu.com.zone [root@localhost ~]# chmod o= /var/named/cdn.magedu.com.zone
(6) 語法檢查
[root@localhost ~]# named-checkconf [root@localhost ~]# named-checkzone cdn.magedu.com /var/named/cdn.magedu.com.zone zone cdn.magedu.com/IN: loaded serial 2017032701 OK
(7) 重載
[root@localhost ~]# rndc reload server reload successful
(8) 驗證
[root@localhost ~]# dig -t A www.cdn.magedu.com @172.16.0.13 ; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.2 <<>> -t A www.cdn.magedu.com @172.16.0.13 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34977 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;www.cdn.magedu.com. IN A ;; ANSWER SECTION: www.cdn.magedu.com. 3600 IN A 172.16.0.13 ;; AUTHORITY SECTION: cdn.magedu.com. 3600 IN NS ns1.cdn.magedu.com. ;; ADDITIONAL SECTION: ns1.cdn.magedu.com. 3600 IN A 172.16.0.13 ;; Query time: 1 msec ;; SERVER: 172.16.0.13#53(172.16.0.13) ;; WHEN: Mon Mar 27 19:59:45 CST 2017 ;; MSG SIZE rcvd: 97
定義區域轉發
子域服務器:
[root@localhost ~]# vim /etc/named.rfc1912.zones 增加: zone "magedu.com" IN { type forward; forward only; forwarders {172.16.0.10;}; }; [root@localhost ~]# named-checkconf [root@localhost ~]# rndc reload
子域解析父域測試:
[root@localhost ~]# dig -t A www.magedu.com @172.16.0.13 ; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.2 <<>> -t A www.magedu.com @172.16.0.13 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4749 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;www.magedu.com. IN A ;; ANSWER SECTION: www.magedu.com. 3600 IN A 172.16.0.15 ;; AUTHORITY SECTION: magedu.com. 3600 IN NS ns1.magedu.com. ;; ADDITIONAL SECTION: ns1.magedu.com. 3600 IN A 172.16.0.10 ;; Query time: 2 msec ;; SERVER: 172.16.0.13#53(172.16.0.13) ;; WHEN: Mon Mar 27 20:21:17 CST 2017 ;; MSG SIZE rcvd: 93
問題1:
[root@node1 ~]# rndc status
rndc: neither /etc/rndc.conf nor /etc/rndc.key was found
原因: 修改主配置文件后,未重啟服務, 服務沒有監聽在所有端口
問題2:
父域解析子域不成功
[root@node1 ~]# dig -t A www.cdn.magedu.com @172.16.0.10 ; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.2 <<>> -t A www.cdn.magedu.com @172.16.0.10 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 6585 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;www.cdn.magedu.com. IN A ;; Query time: 3 msec ;; SERVER: 172.16.0.10#53(172.16.0.10) ;; WHEN: 一 3月 27 20:28:22 CST 2017 ;; MSG SIZE rcvd: 47
方法: /etc/named.conf注釋掉近本機查詢選項
子域服務器:
[root@ns1 ~]# vim /etc/named.conf //allow-query { localhost; }; [root@ns1 ~]# systemctl restart named.service
測試:
[root@node1 ~]# dig -t A www.cdn.magedu.com @172.16.0.10 ; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.2 <<>> -t A www.cdn.magedu.com @172.16.0.10 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60945 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;www.cdn.magedu.com. IN A ;; ANSWER SECTION: www.cdn.magedu.com. 3490 IN A 172.16.0.13 ;; AUTHORITY SECTION: cdn.magedu.com. 3490 IN NS ns1.cdn.magedu.com. ;; ADDITIONAL SECTION: ns1.cdn.magedu.com. 3490 IN A 172.16.0.13
DNS主從
(1) 同步主從服務器時間
ntpdate
(2) 從服務器配置
[root@localhost ~]# yum -y install bind
主配置文件:
[root@localhost ~]# vim /etc/named.conf listen-on port 53 { any; }; dnssec-enable no; dnssec-validation no; 啟動 [root@localhost ~]# systemctl restart named.service
配置正向區域:
[root@localhost ~]# vim /etc/named.rfc1912.zones zone "magedu.com" IN { type slave; file "slaves/magedu.com.zone"; masters { 172.16.0.10; }; }; [root@localhost ~]# named-checkconf
(3) 主服務器配置
修改定義區域,僅允許從服務器與主服務器同步,默認允許所有主機 [root@node1 ~]# vim /etc/named.rfc1912.zones zone "magedu.com" IN { type master; file "magedu.com.zone"; allow-transfer { 172.16.0.11; }; #允許從服務器同步 }; 添加從服務器信息 [root@node1 ~]# vim /var/named/magedu.com.zone . . . IN NS ns2 ns2 IN A 172.16.0.11 . . . 注意: 如果在配置該區域文件時,從服務器已經啟動,需修改序列號,否則從服務器無法檢測到改變 [root@node1 ~]# named-checkzone magedu.com /var/named/magedu.com.zone 重載 [root@node1 ~]# rndc reload
(4) 從服務器
重載 [root@localhost ~]# rndc reload 查看狀態 [root@localhost ~]# systemctl status named.service ● named.service - Berkeley Internet Name Domain (DNS) Loaded: loaded (/usr/lib/systemd/system/named.service; disabled; vendor preset: disabled) Active: active (running) since Wed 2017-03-29 23:46:46 CST; 29min ago Process: 2568 ExecStart=/usr/sbin/named -u named $OPTIONS (code=exited, status=0/SUCCESS) Process: 2566 ExecStartPre=/bin/bash -c if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z /etc/named.conf; else echo "Checking of zone files is disabled"; fi (code=exited, status=0/SUCCESS) Main PID: 2571 (named) CGroup: /system.slice/named.service └─2571 /usr/sbin/named -u named Mar 30 00:14:55 localhost.localdomain named[2571]: automatic empty zone: 8.B.D.0.1.0.0.2.IP6.ARPA Mar 30 00:14:55 localhost.localdomain named[2571]: reloading configuration succeeded Mar 30 00:14:55 localhost.localdomain named[2571]: reloading zones succeeded Mar 30 00:14:55 localhost.localdomain named[2571]: all zones loaded Mar 30 00:14:55 localhost.localdomain named[2571]: running Mar 30 00:14:55 localhost.localdomain named[2571]: zone magedu.com/IN: Transfer started. Mar 30 00:14:55 localhost.localdomain named[2571]: transfer of 'magedu.com/IN' from 172.16.0.10#53...290 Mar 30 00:14:56 localhost.localdomain named[2571]: zone magedu.com/IN: transferred serial 2017033001 Mar 30 00:14:56 localhost.localdomain named[2571]: transfer of 'magedu.com/IN' from 172.16.0.10#53...ec) Mar 30 00:14:56 localhost.localdomain named[2571]: zone magedu.com/IN: sending notifies (serial 20...01) Hint: Some lines were ellipsized, use -l to show in full. 檢查傳輸過來的區域文件 [root@localhost ~]# ll /var/named/slaves/ total 4 -rw-r--r--. 1 named named 455 Mar 30 00:14 magedu.com.zone
(5) 測試
[root@localhost ~]# dig -t A www.magedu.com @172.16.0.11 ; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.2 <<>> -t A www.magedu.com @172.16.0.11 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24829 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;www.magedu.com. IN A ;; ANSWER SECTION: www.magedu.com. 3600 IN A 172.16.0.15 ;; AUTHORITY SECTION: magedu.com. 3600 IN NS ns1.magedu.com. magedu.com. 3600 IN NS ns2.magedu.com. ;; ADDITIONAL SECTION: ns1.magedu.com. 3600 IN A 172.16.0.10 ns2.magedu.com. 3600 IN A 172.16.0.11 ;; Query time: 1 msec ;; SERVER: 172.16.0.11#53(172.16.0.11) ;; WHEN: Thu Mar 30 00:21:20 CST 2017 ;; MSG SIZE rcvd: 127
原創文章,作者:hansj,如若轉載,請注明出處:http://www.www58058.com/72161
非常的好,1題還欠一個圖哈~~~加油?。?!
@馬哥教育:嗯,有時間補上