DNS 域名系统，万维网上作为域名和IP地址相互映射的一个分布式数据库，能够使用户更方便的访问互联网，而不用去记住能够被机器直接读取的IP数串。通过域名，最终得到该域名对应的IP地址的过程叫做域名解析（或主机名解析）。DNS协议运行在UDP协议之上，使用端口号UDP 53号端口作为数据通信端口(域名解析)，使用TCP53号端口实现数据同步(主从同步)。
[root@localhost ~]# wget ftp://ftp.isc.org/isc/bind9/9.6.1/bind-9.6.1.tar.gz [root@localhost ~]# tar -xzvf bind-9.6.1.tar.gz [root@localhost ~]# cd bind-9.6.1/ [root@localhost ~]# ./configure --enable-largefile --enable-threads --prefix=/usr/local/named [root@localhost ~]# make && make install
Yum安装Bind
[root@localhost ~]# yum install -y bind bind-chroot bind-libs Loaded plugins: product-id, search-disabled-repos, subscription-manager This system is not registered with an entitlement server. You can use subscription-manager. Package 32:bind-9.9.4-61.el7.x86_64 already installed and latest version Package 32:bind-chroot-9.9.4-61.el7.x86_64 already installed and latest version Package 32:bind-libs-9.9.4-61.el7.x86_64 already installed and latest version Nothing to do
[root@localhost ~]# yum install -y bind bind-chroot bind-libs Loaded plugins: product-id, search-disabled-repos, subscription-manager This system is not registered with an entitlement server. You can use subscription-manager. Package 32:bind-9.9.4-61.el7.x86_64 already installed and latest version Package 32:bind-chroot-9.9.4-61.el7.x86_64 already installed and latest version Package 32:bind-libs-9.9.4-61.el7.x86_64 already installed and latest version Nothing to do
zone "lyshark.org" IN { #正向区域名 type master; #区域类型（master/slave） file "lyshark.org.zone"; #区域文件名（/usr/named/lyshark.org.zone） }; zone "1.168.192.in-addr.arpa" IN { #反向区域名（IP地址应反写） type master; #区域类型（master/slave） file "lyshark.org.arpa"; #区域文件名（/var/named/lyshark.org.aone） };
4.拷贝默认区域配置模板,分别拷贝正向和反向模板
[root@localhost ~]# cp -a /var/named/named.localhost /var/named/lyshark.org.zone #复制正向模板 [root@localhost ~]# cp -a /var/named/named.loopback /var/named/lyshark.org.arpa #复制反向模板
5.编辑正向模板的zone记录,修改正向解析
[root@localhost ~]# vim /var/named/lyshark.org.zone
$TTL 1D @ IN SOA dns.lyshark.org. rname.invalid. ( #区域名 #SOA标识 #主域名服务器(FQDN) #管理员邮件地址
[root@localhost ~]# yum install -y bind bind-chroot bind-libs Loaded plugins: product-id, search-disabled-repos, subscription-manager This system is not registered with an entitlement server. You can use subscription-manager. Package 32:bind-9.9.4-61.el7.x86_64 already installed and latest version Package 32:bind-chroot-9.9.4-61.el7.x86_64 already installed and latest version Package 32:bind-libs-9.9.4-61.el7.x86_64 already installed and latest version Nothing to do
[root@localhost ~]# systemctl restart named [root@localhost ~]# systemctl enable named
配置从DNS服务
1.首先通过yum仓库,安装bind域名解析系统,和bind-chroot
[root@localhost ~]# yum install -y bind bind-chroot bind-libs Loaded plugins: product-id, search-disabled-repos, subscription-manager This system is not registered with an entitlement server. You can use subscription-manager. Package 32:bind-9.9.4-61.el7.x86_64 already installed and latest version Package 32:bind-chroot-9.9.4-61.el7.x86_64 already installed and latest version Package 32:bind-libs-9.9.4-61.el7.x86_64 already installed and latest version Nothing to do
zone "lyshark.org" IN { #正向区域名 type slave; #指定为从服务器 masters { 192.168.1.20; }; #指定主服务器IP file "slaves/lyshark.org.zone"; #指定同步后的文件 allow-update { none; }; #不允许动态更新 }; zone "1.168.192.in-addr.arpa" IN { #反向区域名 type slave; #指定为从服务器 masters { 192.168.1.20; }; #指定主服务器IP file "slaves/lyshark.org.arpa"; #指定同步后的文件 allow-update { none; }; #不允许动态更新 };
4.重启bind服务,并设置成开机自启动
[root@localhost ~]# systemctl restart named [root@localhost ~]# systemctl enable named
5.验证环节,如果在/var/named/slaves目录下出现了文件则说明同步成功啦
[root@localhost slaves]# pwd /var/named/slaves [root@localhost slaves]# ls -l total 8 -rw-r--r--. 1 named named 251 Nov 6 04:12 lyshark.org.arpa -rw-r--r--. 1 named named 249 Nov 6 04:12 lyshark.org.zone
部署DNS缓存服务
DNS缓存服务器(Caching DNS Server),是一种不负责域名数据维护的DNS服务器,简单来说,缓存服务器就是把用户经常使用到的,域名与IP地址的解析记录保存在本机,从而提升下次解析请求的效率.
[root@localhost ~]# yum install -y bind bind-chroot bind-libs Loaded plugins: product-id, search-disabled-repos, subscription-manager This system is not registered with an entitlement server. You can use subscription-manager. Package 32:bind-9.9.4-61.el7.x86_64 already installed and latest version Package 32:bind-chroot-9.9.4-61.el7.x86_64 already installed and latest version Package 32:bind-libs-9.9.4-61.el7.x86_64 already installed and latest version Nothing to do
zone "lyshark.com" IN { #正向区域名 type master; #区域类型 file "lyshark.com.zone"; #区域文件名 }; zone "lyshark.org" IN { #正向区域名 type master; #区域类型 file "lyshark.org.zone"; #区域文件名 }; zone "lyshark.net" IN { #正向区域名 type master; #区域类型 file "lyshark.net.zone"; #区域文件名 };
4.拷贝默认区域配置模板,这里只做正向的拷贝即可
[root@localhost ~]# cp -a /var/named/named.localhost /var/named/lyshark.com.zone [root@localhost ~]# cp -a /var/named/named.localhost /var/named/lyshark.org.zone [root@localhost ~]# cp -a /var/named/named.localhost /var/named/lyshark.net.zone
5.分别编辑正向模板的zone记录,修改正向解析,改为以下形式
[root@localhost named]# cat lyshark.com.zone $TTL 1D @ IN SOA dns.lyshark.com. rname.invalid. ( 0 ; serial 1D ; refresh 1H ; retry 1W ; expire 3H ) ; minimum NS dns.lyshark.com. dns A 127.0.0.1 www A 192.168.1.20
[root@localhost named]# cat lyshark.org.zone $TTL 1D @ IN SOA dns.lyshark.org. rname.invalid. ( 0 ; serial 1D ; refresh 1H ; retry 1W ; expire 3H ) ; minimum NS dns.lyshark.org. dns A 127.0.0.1 www A 192.168.1.20
[root@localhost named]# cat lyshark.net.zone $TTL 1D @ IN SOA dns.lyshark.net. rname.invalid. ( 0 ; serial 1D ; refresh 1H ; retry 1W ; expire 3H ) ; minimum NS dns.lyshark.net. dns A 127.0.0.1 www A 192.168.1.20
6.重启bind服务,并设置成开机自启动
[root@localhost ~]# systemctl restart named [root@localhost ~]# systemctl enable named
7.通过其他主机配置成本DNS地址,并测试,看到以下结果则说明成功
Microsoft Windows [版本 10.0] (c) 2018 Microsoft Corporation。保留所有权利。
[root@localhost ~]# yum install -y dnsmasq Loaded plugins: product-id, search-disabled-repos, subscription-manager This system is not registered with an entitlement server. You can use subscription-manager. Package dnsmasq-2.76-5.el7.x86_64 already installed and latest version Nothing to do
2.打开dnsmasq的主配置文件,在配置文件底部写入要缓存的条目
[root@localhost ~]# vim /etc/dnsmasq.conf
# Include all files in /etc/dnsmasq.d except RPM backup files conf-dir=/etc/dnsmasq.d,.rpmnew,.rpmsave,.rpmorig
[root@localhost ~]# yum install -y bind bind-chroot bind-libs Loaded plugins: product-id, search-disabled-repos, subscription-manager This system is not registered with an entitlement server. You can use subscription-manager. Package 32:bind-9.9.4-61.el7.x86_64 already installed and latest version Package 32:bind-chroot-9.9.4-61.el7.x86_64 already installed and latest version Package 32:bind-libs-9.9.4-61.el7.x86_64 already installed and latest version Nothing to do
1 // 2 // named.conf 3 // 4 // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS 5 // server as a caching only nameserver (as a localhost DNS resolver only). 6 // 7 // See /usr/share/doc/bind*/sample/ for example named configuration files. 8 // 9 // See the BIND Administrator s Reference Manual (ARM) for details about the 10 // configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html 11 12 include "/etc/transfer.key"; #添加本行,导入密钥 13 14 options { 15 listen-on port 53 { any; }; #改为any允许 16 listen-on-v6 port 53 { ::1; }; 17 directory "/var/named"; 18 dump-file "/var/named/data/cache_dump.db"; 19 statistics-file "/var/named/data/named_stats.txt"; 20 memstatistics-file "/var/named/data/named_mem_stats.txt"; 21 allow-query { any; }; #改为any 22 allow-transfer { key master-slave; }; #添加本行,允许加载key 23 /*
5.重启bind服务,并设置成开机自启动
[root@localhost ~]# systemctl restart named [root@localhost ~]# systemctl enable named
配置加密从DNS
1.首先通过yum仓库,安装bind域名解析系统,和bind-chroot禁锢模块
[root@localhost ~]# yum install -y bind bind-chroot bind-libs Loaded plugins: product-id, search-disabled-repos, subscription-manager This system is not registered with an entitlement server. You can use subscription-manager. Package 32:bind-9.9.4-61.el7.x86_64 already installed and latest version Package 32:bind-chroot-9.9.4-61.el7.x86_64 already installed and latest version Package 32:bind-libs-9.9.4-61.el7.x86_64 already installed and latest version Nothing to do
[root@localhost ~]# yum install -y bind bind-chroot bind-libs Loaded plugins: product-id, search-disabled-repos, subscription-manager This system is not registered with an entitlement server. You can use subscription-manager. Package 32:bind-9.9.4-61.el7.x86_64 already installed and latest version Package 32:bind-chroot-9.9.4-61.el7.x86_64 already installed and latest version Package 32:bind-libs-9.9.4-61.el7.x86_64 already installed and latest version Nothing to do
[root@localhost ~]# yum install -y bind bind-chroot bind-libs Loaded plugins: product-id, search-disabled-repos, subscription-manager This system is not registered with an entitlement server. You can use subscription-manager. Package 32:bind-9.9.4-61.el7.x86_64 already installed and latest version Package 32:bind-chroot-9.9.4-61.el7.x86_64 already installed and latest version Package 32:bind-libs-9.9.4-61.el7.x86_64 already installed and latest version Nothing to do