1、詳細描述一次加密通訊的過程，結合圖示最佳。

加密過程

1.使用單向加密算法，提取A的文件的特征碼。
2.使用A的私鑰對提取出來的特征碼進行加密，把加密后的特征碼附加在A的文件的后面。
3.使用對稱加密對剛剛的A的文件和加密后的特征碼進行加密，生成對稱加密密鑰
4.使用B的公鑰對第3步驟的對稱加密的密鑰進行加密，加密后附加在文件的后面。

解密過程

1.使用B的私鑰對傳輸過來的文件進行解密，得出來文件的對稱密鑰。
2.使用解密出來的對稱密鑰進行解密，得出來A發來的文件和加密后的特征碼。
3.使用A的公鑰對加密后的特征碼進行解密，得到特征碼。
4.使用形同的單向加密算法提取原文件的特征碼，與解密后得到的特征碼進行對比，驗證數據完整性。

2、描述創建私有CA的過程，以及為客戶端發來的證書請求進行頒發證書。

構建私有CA

1.為CA提供所需目錄和文件
[root@CA?~]#?yum?install?openssl?-y
[root@CA?~]#?mkdir?/etc/pki/CA/{certs,crl,newcerts}
[root@CA?~]#?touch?/etc/pki/CA/{serial,index.txt}
[root@CA?~]#?echo?01>/etc/pki/CA/serial

2.生成CA的私鑰????
[root@CA?~]#?(umask?077;openssl?genrsa?-out?/etc/pki/CA/private/cakey.pem?2048)

3.CA自簽證書
[root@CA?~]#?openssl?req?-new?-x509?-key?/etc/pki/CA/private/cakey.pem?
?????????????-out?/etc/pki/CA/cacert.pem?-days?365
???Country?Name?(2?letter?code)?[XX]:CN
???State?or?Province?Name?(full?name)?[]:BeiJing
???Locality?Name?(eg,?city)?[Default?City]:BeiJing
???Organization?Name?(eg,?company)?[Default?Company?Ltd]:DevOps
???Organizational?Unit?Name?(eg,?section)?[]:DevOps
???Common?Name?(eg,?your?name?or?your?server's?hostname)?[]:CA.example.com
???Email?Address?[]:caadmin@example.com


為客戶端頒發證書

1.客戶端生成一個私鑰
[root@HOST?~]#?(umask?077;openssl?genrsa?-out?/etc/pki/tls/private/http.key?2048)

2.生成一個證書請求
[root@HOST?~]#?openssl?req?-new?-key?/etc/pki/tls/private/http.key?
??????????????-out?/etc/pki/tls/certs/http.csr?-days?365
???Country?Name?(2?letter?code)?[XX]:CN
???State?or?Province?Name?(full?name)?[]:BeiJing?
???Locality?Name?(eg,?city)?[Default?City]:BeiJing
???Organization?Name?(eg,?company)?[Default?Company?Ltd]:DevOps
???Organizational?Unit?Name?(eg,?section)?[]:DevOps
???Common?Name?(eg,?your?name?or?your?server's?hostname)?[]:www.example.com
???Email?Address?[]:webadmin@example.com

???Please?enter?the?following?'extra'?attributes
???to?be?sent?with?your?certificate?request
???A?challenge?password?[]:
???An?optional?company?name?[]:

3.將HOST上的證書請求文件傳輸到CA上
[root@HOST?~]#?scp?/etc/pki/tls/certs/http.csr?CA:/etc/pki/CA/certs/

4.CA簽署HOST的證書請求文件
[root@CA?~]#?openssl?ca?-in?/etc/pki/CA/certs/http.csr?
?????????????????????-out?/etc/pki/CA/certs/http.key?-days?365

5.將CA上的簽署的證書傳輸到HOST上
[root@CA?~]#?scp?/etc/pki/CA/certs/http.key?HOST:/etc/pki/tls/certs/

3、描述DNS查詢過程以及DNS服務器類別。

DNS查詢類型：
???遞歸查詢：發出一次請求，一定能得到最終的查詢結果。
???迭代查詢：需要經過多次查詢才能獲得最終的結果。
DNS查詢過程：
???Client?-->?hosts文件?-->?DNS?Service?-->?Local?Cache?
???-->?DNS?Server?(recursion)?-->?Server?Cache?-->?iteration(迭代)
DNS服務器的類型：
???主DNS服務器:維護所負責解析的域內解析庫服務器
???輔助DNS服務器：從主DNS服務器或其他從DNS服務器復制一份解析庫
???緩存DNS服務器：為客戶端緩存DNS的記錄，緩存DNS中沒有的執行迭代查詢
???轉發器：DNS記錄不在自己負責的解析域內，轉發器去迭代查詢

4、搭建一套DNS服務器，負責解析magedu.com域名（自行設定主機名及IP）

(1)、能夠對一些主機名進行正向解析和逆向解析；
(2)、對子域cdn.magedu.com進行子域授權，子域負責解析對應子域中的主機名；
(3)、為了保證DNS服務系統的高可用性，請設計一套方案，并寫出詳細的實施過程

正向解析和逆向解析

1.主域服務器上安裝DNS
[root@ns1?~]#?yum?install?bind.x86_64?bind-utils.x86_64?-y

2.主域服務器上編輯主配置文件/etc/named.conf
[root@ns1?~]#?vim?/etc/named.conf
????????options?{
????????//??listen-on?port?53?{?127.0.0.1;?};
????????//??listen-on-v6?port?53?{?::1;?};
????????????directory???"/var/named";
????????????dump-file???"/var/named/data/cache_dump.db";
????????statistics-file?"/var/named/data/named_stats.txt";
????????memstatistics-file?"/var/named/data/named_mem_stats.txt";
????????????allow-query?{?any;?};
????????????recursion?yes;

????????????dnssec-enable?no;
????????????dnssec-validation?no;
????????//??dnssec-lookaside?auto;

????????????/*?Path?to?ISC?DLV?key?*/
????????//??bindkeys-file?"/etc/named.iscdlv.key";

????????//??managed-keys-directory?"/var/named/dynamic";
????????};

3.主域服務器上在主配置文件中定義區域
[root@ns1?~]#?vim?/etc/named.rfc1912.zones?
????????zone?"magedu.com"?IN?{
????????type?master;
????????file?"magedu.com.zone";
????????};

????????zone?"200.168.192.in-addr.arpa"?IN{
????????????type?master;
????????????file?"192.168.200.zone";
????????};

4.主域服務器上區域解析庫文件
[root@ns1?~]#?vim?/var/named/magedu.com.zone
????????$TTL?86400
????????$ORIGIN?magedu.com.
????????@???IN??SOA?ns1.magedu.com.?admin.magedu.com(
????????????????????2016112901
????????????????????1H
????????????????????5M
????????????????????7D
????????????????????1D)
????????????IN??NS??ns1
????????????IN??NS??ns2
????????????IN??MX?10???mx1
????????????IN??MX?20???mx2
????????ns1?IN??A???192.168.200.201
????????ns2?IN??A???192.168.200.202
????????mx1?IN??A???192.168.200.203
????????mx2?IN??A???192.168.200.204
????????www?IN??A???192.16.200.201
????????ftp?IN??CNAME???www
????????magedu.com.??IN??A??192.168.200.201
?????????*??IN??A???192.168.200.201

[root@ns1?~]#?vim?/var/named/192.168.200.zone?
????????$TTL?86400
????????$ORIGIN?200.168.192.in-addr.arpa.
????????@???IN??SOA?ns1.magedu.com.?admin.magedu.com.(
????????????2016112901
????????????1H
????????????5M
????????????7D
????????????1D)
????????????IN??NS??ns1.magedu.com.
????????????IN??NS??ns2.magedu.com.
????????201?IN??PTR?ns1.magedu.com.
????????201?IN??PTR?www.magedu.com.
????????202?IN??PTR?ns2.magedu.com.
????????203?IN??PTR?mx1.magedu.com.
????????204?IN??PTR?mx2.magedu.com.

5.主域服務器上檢查主配置文件和區域解析庫文件語法并賦予解析庫文件對應的權限
[root@ns1?~]#?named-checkconf

[root@ns1?~]#?named-checkzone?"magedu.com"?/var/named/magedu.com.zone
[root@ns1?~]#?chmod?640?/var/named/magedu.com.zone?
[root@ns1?~]#?chgrp?named?/var/named/magedu.com.zone

[root@ns1?~]#?named-checkzone?"200.168.192.in-addr.arpa"?/var/named/192.168.200.zone
[root@ns1?~]#?chmod?640?/var/named/192.168.200.zone?
[root@ns1?~]#?chgrp?named?/var/named/192.168.200.zone

[root@ns1?~]#?service?named?start

6.主域服務器上使用dig命令測試
[root@ns1?~]#?dig?-t?A?www.magedu.com?@192.168.200.201

????????;?<<>>?DiG?9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6_4.4?<<>>?-t?A?www.magedu.com?@192.168.200.201
????????;;?global?options:?+cmd
????????;;?Got?answer:
????????;;?->>HEADER<<-?opcode:?QUERY,?status:?NOERROR,?id:?18673
????????;;?flags:?qr?aa?rd?ra;?QUERY:?1,?ANSWER:?1,?AUTHORITY:?2,?ADDITIONAL:?2

????????;;?QUESTION?SECTION:
????????;www.magedu.com.????????????IN??A

????????;;?ANSWER?SECTION:
????????www.magedu.com.?????86400???IN??A???192.16.200.201

????????;;?AUTHORITY?SECTION:
????????magedu.com.?????86400???IN??NS??ns2.magedu.com.
????????magedu.com.?????86400???IN??NS??ns1.magedu.com.

????????;;?ADDITIONAL?SECTION:
????????ns1.magedu.com.?????86400???IN??A???192.168.200.201
????????ns2.magedu.com.?????86400???IN??A???192.168.200.202

????????;;?Query?time:?2?msec
????????;;?SERVER:?192.168.200.201#53(192.168.200.201)
????????;;?WHEN:?Mon?Nov?21?19:39:10?2016
????????;;?MSG?SIZE??rcvd:?116

[root@ns1?~]#?dig?-x?192.168.200.201?@192.168.200.201

????????;?<<>>?DiG?9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6_4.4?<<>>?-x?192.168.200.201?@192.168.200.201
????????;;?global?options:?+cmd
????????;;?Got?answer:
????????;;?->>HEADER<<-?opcode:?QUERY,?status:?NOERROR,?id:?64095
????????;;?flags:?qr?aa?rd?ra;?QUERY:?1,?ANSWER:?2,?AUTHORITY:?2,?ADDITIONAL:?2

????????;;?QUESTION?SECTION:
????????;201.200.168.192.in-addr.arpa.??IN??PTR

????????;;?ANSWER?SECTION:
????????201.200.168.192.in-addr.arpa.?86400?IN??PTR?ns1.magedu.com.
????????201.200.168.192.in-addr.arpa.?86400?IN??PTR?www.magedu.com.

????????;;?AUTHORITY?SECTION:
????????200.168.192.in-addr.arpa.?86400?IN??NS??ns2.magedu.com.
????????200.168.192.in-addr.arpa.?86400?IN??NS??ns1.magedu.com.

????????;;?ADDITIONAL?SECTION:
????????ns1.magedu.com.?????86400???IN??A???192.168.200.201
????????ns2.magedu.com.?????86400???IN??A???192.168.200.202

????????;;?Query?time:?0?msec
????????;;?SERVER:?192.168.200.201#53(192.168.200.201)
????????;;?WHEN:?Mon?Nov?21?21:42:36?2016
????????;;?MSG?SIZE??rcvd:?156

子域授權

1.子域服務器上安裝DNS
[root@centos?~]#?yum?install?bind.x86_64?bind-utils.x86_64?-y

2.子域服務器上編輯主配置文件/etc/named.conf
[root@centos?~]#?vim?/etc/named.conf
????????options?{
????????//??listen-on?port?53?{?127.0.0.1;?};
????????//??listen-on-v6?port?53?{?::1;?};
????????????directory???"/var/named";
????????????dump-file???"/var/named/data/cache_dump.db";
????????statistics-file?"/var/named/data/named_stats.txt";
????????memstatistics-file?"/var/named/data/named_mem_stats.txt";
????????????allow-query?{?any;?};
????????????recursion?yes;

????????????dnssec-enable?no;
????????????dnssec-validation?no;
????????//??dnssec-lookaside?auto;

????????????/*?Path?to?ISC?DLV?key?*/
????????//??bindkeys-file?"/etc/named.iscdlv.key";

????????//??managed-keys-directory?"/var/named/dynamic";
????????};

3.子域服務器上在主配置文件中定義區域
[root@centos?~]#?vim?/etc/named.rfc1912.zones?
????????zone?"cdn.magedu.com"?IN?{
????????type?master;
????????file?"cdn.magedu.com.zone";
????????};

????????zone?"magedu.com"?IN{
????????type?forward;
????????forward?only;
????????forwarders?{?192.168.200.201;?};
????????};

4.子域服務器上區域解析庫文件
[root@centos?~]#?cat?/var/named/cdn.magedu.com.zone?
????????????$TTL?86400
????????????$ORIGIN?cdn.magedu.com.
????????????@???IN??SOA?centos.cdn.magedu.com.?admin.centos.cdn.magedu.com.(
????????????????????2016112901
????????????????????1H
????????????????????5M
????????????????????7D
????????????????????1D)
????????????????????IN??NS??centos
????????????centos??IN??A???192.168.200.212
????????????www?????IN??A???192.168.200.215
????????????cdn.magedu.com.??IN??A??192.168.200.212
????????????*???????IN??A???192.168.200.212

5.子域服務器上檢查主配置文件和區域解析庫文件語法并賦予解析庫文件對應的權限
[root@centos?~]#?named-checkconf

[root@centos?~]#?named-checkzone?"cdn.magedu.com"?/var/named/cdn.magedu.com.zone
[root@centos?~]#?chmod?640?/var/named/cdn.magedu.com.zone?
[root@centos?~]#?chgrp?named?/var/named/cdn.magedu.com.zone
[root@centos?~]#?service?named?start

注：出現Generating?/etc/rndc.key的解決方法，[root@centos?~]#?rndc-confgen?-r?/dev/urandom?-a

6.子域服務器上使用dig命令測試
[root@centos?~]#?dig?-t?A?mx1.magedu.com?@192.168.200.212

????????????;?<<>>?DiG?9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6?<<>>?-t?A?mx1.magedu.com?@192.168.200.202
????????????;;?global?options:?+cmd
????????????;;?Got?answer:
????????????;;?->>HEADER<<-?opcode:?QUERY,?status:?NOERROR,?id:?42191
????????????;;?flags:?qr?rd?ra;?QUERY:?1,?ANSWER:?1,?AUTHORITY:?2,?ADDITIONAL:?2

????????????;;?QUESTION?SECTION:
????????????;mx1.magedu.com.????????????IN??A

????????????;;?ANSWER?SECTION:
????????????mx1.magedu.com.?????86388???IN??A???192.168.200.203

????????????;;?AUTHORITY?SECTION:
????????????magedu.com.?????85483???IN??NS??ns2.magedu.com.
????????????magedu.com.?????85483???IN??NS??ns1.magedu.com.

????????????;;?ADDITIONAL?SECTION:
????????????ns1.magedu.com.?????85483???IN??A???192.168.200.201
????????????ns2.magedu.com.?????85483???IN??A???192.168.200.202

????????????;;?Query?time:?0?msec
????????????;;?SERVER:?192.168.200.202#53(192.168.200.212)
????????????;;?WHEN:?Thu?Jun??9?20:14:01?2016
????????????;;?MSG?SIZE??rcvd:?116


[root@centos?~]#?dig?-t?A?mx2.cdn.magedu.com?@192.168.200.212

????????????;?<<>>?DiG?9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6?<<>>?-t?A?mx2.cdn.magedu.com?@192.168.200.202
????????????;;?global?options:?+cmd
????????????;;?Got?answer:
????????????;;?->>HEADER<<-?opcode:?QUERY,?status:?NOERROR,?id:?18318
????????????;;?flags:?qr?aa?rd?ra;?QUERY:?1,?ANSWER:?1,?AUTHORITY:?1,?ADDITIONAL:?1

????????????;;?QUESTION?SECTION:
????????????;mx2.cdn.magedu.com.????????IN??A

????????????;;?ANSWER?SECTION:
????????????mx2.cdn.magedu.com.?86400???IN??A???192.168.200.212

????????????;;?AUTHORITY?SECTION:
????????????cdn.magedu.com.?????86400???IN??NS??centos.cdn.magedu.com.

????????????;;?ADDITIONAL?SECTION:
????????????centos.cdn.magedu.com.??86400???IN??A???192.168.200.212

????????????;;?Query?time:?0?msec
????????????;;?SERVER:?192.168.200.202#53(192.168.200.212)
????????????;;?WHEN:?Thu?Jun??9?20:15:02?2016
????????????;;?MSG?SIZE??rcvd:?89

DNS高可用

DNS采取主從DNS服務器方式

1.在從域服務器上安裝DNS
[root@ns2?~]#?yum?install?bind.x86_64?bind-utils.x86_64?-y

2.在從域服務器上編輯主配置文件/etc/named.conf
[root@centos?~]#?vim?/etc/named.conf
????????options?{
????????//??listen-on?port?53?{?127.0.0.1;?};
????????//??listen-on-v6?port?53?{?::1;?};
????????????directory???"/var/named";
????????????dump-file???"/var/named/data/cache_dump.db";
????????statistics-file?"/var/named/data/named_stats.txt";
????????memstatistics-file?"/var/named/data/named_mem_stats.txt";
????????????allow-query?{?any;?};
????????????recursion?yes;

????????????dnssec-enable?no;
????????????dnssec-validation?no;
????????//??dnssec-lookaside?auto;

????????????/*?Path?to?ISC?DLV?key?*/
????????//??bindkeys-file?"/etc/named.iscdlv.key";

????????//??managed-keys-directory?"/var/named/dynamic";
????????};

3.在從域服務器上在主配置文件中定義區域
????????????zone?"magedu.com"?IN{
????????????????type?slave;
????????????????file?"slaves/magedu.com.zone";
????????????????masters?{?192.168.200.201;?};
????????????};

????????????zone?"200.168.192.in-addr.arpa"{
????????????????type?slave;
????????????????file?"slaves/192.l68.200.zone";
????????????????masters?{?192.168.200.201;?};
????????????};

4.在從域服務器上檢查主配置文件和區域解析庫文件語法并賦予解析庫文件對應的權限
[root@centos?~]#?named-checkconf

[root@centos?~]#?service?named?start

5.子域服務器上使用dig命令測試
[root@ns2?~]#?dig?-t?A?www.magedu.com?@192.168.200.202

????????????;?<<>>?DiG?9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6?<<>>?-t?A?www.magedu.com?@192.168.200.202
????????????;;?global?options:?+cmd
????????????;;?Got?answer:
????????????;;?->>HEADER<<-?opcode:?QUERY,?status:?NOERROR,?id:?18749
????????????;;?flags:?qr?aa?rd?ra;?QUERY:?1,?ANSWER:?2,?AUTHORITY:?2,?ADDITIONAL:?2

????????????;;?QUESTION?SECTION:
????????????;www.magedu.com.????????????IN??A

????????????;;?ANSWER?SECTION:
????????????www.magedu.com.?????86400???IN??A???192.16.200.202
????????????www.magedu.com.?????86400???IN??A???192.16.200.201

????????????;;?AUTHORITY?SECTION:
????????????magedu.com.?????86400???IN??NS??ns1.magedu.com.
????????????magedu.com.?????86400???IN??NS??ns2.magedu.com.

????????????;;?ADDITIONAL?SECTION:
????????????ns1.magedu.com.?????86400???IN??A???192.168.200.201
????????????ns2.magedu.com.?????86400???IN??A???192.168.200.202

????????????;;?Query?time:?0?msec
????????????;;?SERVER:?192.168.200.202#53(192.168.200.202)
????????????;;?WHEN:?Thu?Jun??9?20:43:23?2016
????????????;;?MSG?SIZE??rcvd:?132

主從復制：
????1.應該為一臺獨立的名稱服務器
????2.主服務器的區域解析庫文件中必須有一條NS記錄指向從服務器
????3.從服務器只需要定義區域，無需提供解析庫文件，只需指定目錄/var/named/slaves/
????4.主服務器必須允許從服務器作區域傳送
????5.主從服務器的時間應該保持同步
????6.bind程序的版本應該保持一致，如果不一致必須保證主服務器的版本高

本文來自投稿，不代表Linux運維部落立場，如若轉載，請注明出處：http://www.www58058.com/87435

11.網絡解析和網絡加密

1、詳細描述一次加密通訊的過程，結合圖示最佳。

2、描述創建私有CA的過程，以及為客戶端發來的證書請求進行頒發證書。

3、描述DNS查詢過程以及DNS服務器類別。

4、搭建一套DNS服務器，負責解析magedu.com域名（自行設定主機名及IP）

相關推薦

HAProxy

第八周 服務管理與文本處理

編譯安裝Apache

什么是網站流量、UV、PV、IP

基于Keepalived實現LVS雙主高可用集群

N25第六周作業

1、詳細描述一次加密通訊的過程，結合圖示最佳。

2、描述創建私有CA的過程，以及為客戶端發來的證書請求進行頒發證書。

3、描述DNS查詢過程以及DNS服務器類別。

4、搭建一套DNS服務器，負責解析magedu.com域名（自行設定主機名及IP）

第八周服務管理與文本處理

什么是網站流量、UV、PV、IP