第十一周作業
1、詳細描述一次加密通訊的過程，結合圖示最佳
第一階段：ClientHello：
支持的協議版本，比如tls 1.2；
客戶端生成一個隨機數，稍后用戶生成“會話密鑰”
支持的加密算法，比如AES、3DES、RSA；
支持的壓縮算法；
第二階段：ServerHello
確認使用的加密通信協議版本，比如tls 1.2；
服務器端生成一個隨機數，稍后用于生成“會話密鑰”
確認使用的加密方法；
服務器證書；
第三階段：
驗正服務器證書，在確認無誤后取出其公鑰；（發證機構、證書完整性、證書持有者、證書有效期、吊銷列表）
發送以下信息給服務器端：
一個隨機數；
編碼變更通知，表示隨后的信息都將用雙方商定的加密方法和密鑰發送；
客戶端握手結束通知；
第四階段：
收到客戶端發來的第三個隨機數pre-master-key后，計算生成本次會話所有到的“會話密鑰”；
向客戶端發送如下信息：
編碼變更通知，表示隨后的信息都將用雙方商定的加密方法和密鑰發送；
服務端握手結束通知；2、描述創建私有CA的過程，以及為客戶端發來的證書請求進行頒發證書
首先配置CA服務器
1）生成私鑰
~]# (umask 077; openssl genrsa -out /etc/pki/CA/private/cakey.pem 4096)
2）生成自簽證書
~]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem -days 3655
3）創建所需的目錄及文件
~]# mkdir -pv /etc/pki/CA/{certs,crl,newcerts}
~]# touch /etc/pki/CA/{serial,index.txt}
~]# echo 01 > /etc/pki/CA/serial
客戶端
(1) 用到證書的主機生成私鑰；
~]# mkdir /etc/httpd/ssl
~]# cd /etc/httpd/ssl
~]# (umask 077; openssl genrsa -out /etc/httpd/ssl/httpd.key 2048)
(2) 生成證書簽署請求
~]# openssl req -new -key /etc/httpd/ssl/httpd.key -out /etc/httpd/ssl/httpd.csr -days 365
(3) 將請求通過可靠方式發送給CA主機；
scp /etc/httpd/ssl/httpd.csr root@CAIPADRESS:/tmp/httpd.csr
CA簽署證書并發放證書給請求者
#openssl ca -in /tmp/httpd.csr -out /etc/pki/CA/certs/httpd.crt -days 365
scp /tmp/httpd.csr root@HTTPIPADRESS:/etc/httpd/ssl/httpd.crt3、描述DNS查詢過程以及DNS服務器類別
詳情可參見http://blog.chinaunix.net/uid-28216282-id-3757849.html這篇博客，寫的很詳細4、搭建一套DNS服務器，負責解析magedu.com域名（自行設定主機名及IP）
1）能夠對一些主機名進行正向解析和逆向解析
#yum -y install bind*
#[root@localhost ~]# vim /etc/named.conf
listen-on port 53 { any; };
dnssec-enable no;
dnssec-validation no;
修改配置文件
vim /etc/named.rfc1912.zones
zone "shoushangdezhu.com" IN {
type master;
file "shoushangdezhu.com.zone";
allow-transfer { slaves; };
};
zone "68.168.192.in-addr.arpa" IN {
type master;
file "192.168.68.134.zone";
};
配置正向，反向zone文件
]# vim /var/named/shoushangdezhu.com.zone
$TTL 3600
$ORIGIN shoushangdezhu.com.
@ IN SOA ns1.shoushangdezhu.com. 18717961178.163.com. (
20170931
1H
10M
3D
1D )
IN NS ns2
IN NS ns3
IN NS ns1.shoushangdezhu.com.
IN MX 10 MX1
ns1 IN A 192.168.68.134
MX1 IN A 192.168.68.150
www IN A 192.168.68.134
web IN CNAME www
bbs IN A 192.168.68.151
ns2 IN A 192.168.68.130
pop3 IN A 192.168.68.135
ppp IN A 192.168.68.156
ns3 IN A 192.168.68.141
ns1.ops IN A 192.168.68.139
]# vim /var/named/192.168.68.134.zone
$TTL 3600
$ORIGIN 68.168.192.in-addr.arpa.
@ IN SOA ns1.shoushangdezhu.com. 18717961178.163.com. (
201709235
1H
10M
3D
12H )
IN NS ns1.shoushangdezhu.com.
IN NS ns2.shoushangdezhu.com.
IN NS ns3.shoushangdezhu.com.
134 IN PTR ns1.shoushangdezhu.com.
134 IN PTR www.shoushangdezhu.com.
151 IN PTR bbs.shoushangdezhu.com.
150 IN PTR pop3.shoushangdezhu.com.
130 IN PTR ns2shoushangdezhu.com.
155 IN PTR bb3.shoushangdezhu.com.
141 IN PTR ns3.shoushangdezhu.com.
添加文件權限
[root@localhost ~]# chgrp named /var/named/shoushangdezhu.cmo.zone
[root@localhost ~]# chmod o= /var/named/ shoushangdezhu.cmo.zone
[root@localhost ~]# chgrp named /var/named/192.168.134.zone
[root@localhost ~]# chmod o= /var/named/192.168.134.zone
檢查語法
[root@localhost ~]# named-checkconf
[root@localhost~]#named-checkzone "shoushangdehzu.com" /var/named/magedu.com.zone
[root@localhost ~]# named-checkzone "134.68.168.192.in-addr.arpa" /var/named/192.168.68.134.zone
測試
[root@localhost named]# dig -x 192.168.68.134 @192.168.68.134
; <<>> DiG 9.9.4-RedHat-9.9.4-51.el7 <<>> -x 192.168.68.134 @192.168.68.134
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17798
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 3, ADDITIONAL: 4
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;134.68.168.192.in-addr.arpa. IN PTR
;; ANSWER SECTION:
134.68.168.192.in-addr.arpa. 3600 IN PTR ns1.shoushangdezhu.com.
134.68.168.192.in-addr.arpa. 3600 IN PTR www.shoushangdezhu.com.
;; AUTHORITY SECTION:
68.168.192.in-addr.arpa. 3600 IN NS ns2.shoushangdezhu.com.
68.168.192.in-addr.arpa. 3600 IN NS ns3.shoushangdezhu.com.
68.168.192.in-addr.arpa. 3600 IN NS ns1.shoushangdezhu.com.
;; ADDITIONAL SECTION:
ns1.shoushangdezhu.com. 3600 IN A 192.168.68.134
ns2.shoushangdezhu.com. 3600 IN A 192.168.68.130
ns3.shoushangdezhu.com. 3600 IN A 192.168.68.141
;; Query time: 1 msec
;; SERVER: 192.168.68.134#53(192.168.68.134)
;; WHEN: Sun Oct 29 12:52:42 CST 2017
;; MSG SIZE rcvd: 208
[root@localhost named]# dig -t A www.shoushangdezhu.com @192.168.68.134
; <<>> DiG 9.9.4-RedHat-9.9.4-51.el7 <<>> -t A www.shoushangdezhu.com @192.168.68.134
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7856
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 4
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.shoushangdezhu.com. IN A
;; ANSWER SECTION:
www.shoushangdezhu.com. 3600 IN A 192.168.68.134
;; AUTHORITY SECTION:
shoushangdezhu.com. 3600 IN NS ns2.shoushangdezhu.com.
shoushangdezhu.com. 3600 IN NS ns1.shoushangdezhu.com.
shoushangdezhu.com. 3600 IN NS ns3.shoushangdezhu.com.
;; ADDITIONAL SECTION:
ns2.shoushangdezhu.com. 3600 IN A 192.168.68.130
ns3.shoushangdezhu.com. 3600 IN A 192.168.68.141
ns1.shoushangdezhu.com. 3600 IN A 192.168.68.134
;; Query time: 0 msec
;; SERVER: 192.168.68.134#53(192.168.68.134)
;; WHEN: Sun Oct 29 12:53:30 CST 2017
;; MSG SIZE rcvd: 169
2）對子域cdn.magedu.com進行子域授權，子域負責解析對應子域中的主機名
3）為了保證DNS服務系統的高可用性，請設計一套方案，并寫出詳細的實施過程本文來自投稿，不代表Linux運維部落立場，如若轉載，請注明出處：http://www.www58058.com/88118
