DNS

最新推荐文章于 2025-05-15 21:31:02 发布

原创最新推荐文章于 2025-05-15 21:31:02 发布 · 345 阅读

1 ·

CC 4.0 BY-SA版权

实验是在redhat7.2的系统进行的

主机名：server102 ；IP：172.25.254.102

server101 172.25.254.101

实验所需安装包 bind.x86_64 dhcp.x86_64

[root@server102 ~]# yum install -y bind dhcp -y

正向解析配置：

[root@server102 ~]# vim /etc/named.conf

10 options {
11         listen-on port 53 { any; };                                              ##默认是监听本机53端口，设置为监听所有
12         listen-on-v6 port 53 { ::1; };
13         directory       "/var/named";
14         dump-file       "/var/named/data/cache_dump.db";
15         statistics-file "/var/named/data/named_stats.txt";
16         memstatistics-file "/var/named/data/named_mem_stats.txt";
17         allow-query     { any; };                                                ##允许任何人来查询

[root@server102 ~]# vim /etc/named.rfc1912.zones

25 zone "westos.com" IN {                                                  ##指定域名
26         type master;
27         file "westos.com.zone";                                           ##指定读取A记录文件
28         allow-update { none; };
29 };

[root@server102 ~]# cp -p /var/named/named.localhost /var/named/westos.com.zone

[root@server102 ~]# vim /var/named/westos.com.zone

1 $TTL 1D
2 @ IN SOA dns root ( ##IN表示后面的数据使用的是INTERNET标准。而@则代表相应的域名DSOA表示授权的开始，

3 0 ; serial ##本行前面的数字表示配置文件的修改版本，格式是年月日当日修改的修改的次数，

每次修改这个配置文件时都应该修改这个数字，要不然你所作的修改不会更新到网上的其它DNS服务器的数据库上，

即你所做的更新很可能对于不以你的所配置的其他DNS服务器为DNS服务器的客户端来说就不会反映出你的更新，

也就对它们来说你更新是没有意义的

4                                         1D      ; refresh        ## 定义的是以为单位的刷新频率即规定从域名服务器多长时间查询一个主服务器，以保证从服务器的数据是最新的
5                                         1H      ; retry                 ## 上面的这个值是规定了以秒为单位的重试的时间间隔
6                                         1W      ; expire             ## 上面这个用来规定从服务器在向主服务更新失败后多长时间后清除对应的记录，上述的数值是以分钟为单位的
7                                         3H )    ; minimum        ## 这个数据用来规定缓冲服务器不能与主服务联系上后多长时间清除相应的记录
8         NS      dns
9 dns     A       172.25.254.101                    ##前面为主机名会自动接设置的该配置文件的域名，后面为对应ip
10 www     A       172.25.254.222
11 sss     A       172.25.254.100

[root@server102 ~]# vim /etc/resolv.conf
[root@server102 ~]# cat /etc/resolv.conf
# Generated by NetworkManager

# No nameservers found; try putting DNS servers into your
# ifcfg files in /etc/sysconfig/network-scripts like so:
#
# DNS1=xxx.xxx.xxx.xxx
# DNS2=xxx.xxx.xxx.xxx
# DOMAIN=lab.foo.com bar.foo.com
nameserver 172.25.254.102                              ## 设定dns服务器

[root@server102 ~]# systemctl restart named

测试：

[root@server102 ~]# dig www.westos.com

; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7 <<>> www.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14134
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.westos.com.           IN   A

;; ANSWER SECTION:
www.westos.com.       86400   IN   A   172.25.254.222

;; AUTHORITY SECTION:
westos.com.       86400   IN   NS   dns.westos.com.

;; ADDITIONAL SECTION:
dns.westos.com.       86400   IN   A   172.25.254.101

;; Query time: 0 msec
;; SERVER: 172.25.254.102#53(172.25.254.102)
;; WHEN: Sat Aug 12 14:50:43 CST 2017
;; MSG SIZE rcvd: 93

[root@server102 ~]#

反向解析的配置：

[root@server102 ~]# vim /etc/named.rfc1912.zones

49 zone "254.25.172.in-addr.arpa" IN {                       ##前面是对应ip段，应该反着写，
50         type master;
51         file "westos.com.ptr";                                          ##对应读取的文件名
52         allow-update { none; };
53 };

[root@server102 ~]# cp -p /var/named/named.loopback /var/named/westos.com.ptr
[root@server102 ~]# vim /var/named/westos.com.ptr

1 $TTL 1D
2 @       IN SOA dns root (
3                                         0       ; serial
4                                         1D      ; refresh
5                                         1H      ; retry
6                                         1W      ; expire
7                                         3H )    ; minimum
8         NS      dns
9 dns     A       172.25.254.102
10 111     PTR     www.westos.com.                   ##前面为对应ip地址，会自动补齐所属ip段，后面为对应域名
11 222     PTR     bbs.westos.com.

[root@server102 ~]# systemctl restart named

测试：

[root@server102 ~]# dig -x 172.25.254.111

; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7 <<>> -x 172.25.254.111
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11712
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;111.254.25.172.in-addr.arpa.   IN   PTR

;; ANSWER SECTION:
111.254.25.172.in-addr.arpa. 86400 IN   PTR   www.westos.com.

;; AUTHORITY SECTION:
254.25.172.in-addr.arpa. 86400   IN   NS   dns.254.25.172.in-addr.arpa.

;; ADDITIONAL SECTION:
dns.254.25.172.in-addr.arpa. 86400 IN   A   172.25.254.102

;; Query time: 0 msec
;; SERVER: 172.25.254.102#53(172.25.254.102)
;; WHEN: Sat Aug 12 15:05:19 CST 2017
;; MSG SIZE rcvd: 118

[root@server102 ~]#

内网，外网给不同答案配置：

[root@server102 ~]# vim /etc/named.conf

49 /*
50 zone "." IN {
51         type hint;
52         file "named.ca";
53 };
54
55 include "/etc/named.rfc1912.zones";
56 include "/etc/named.root.key";
57 */                                                                             ##将本身默认指定读取文件注释掉
58
59 view localhost {
60         match-clients { 172.25.254.102; };                  ##指定ip
61
62 zone "." IN {
63         type hint;
64         file "named.ca";
65 };
66
67 include "/etc/named.rfc1912.zones";                        ##指定读取文件
68 };
69
70 view any {
71         match-clients { any; };
72
73 zone "." IN {
74         type hint;
75         file "named.ca";
76 };
77
78 include "/etc/named.rfc1913.zones";
79 };

[root@server102 ~]# cp -p /etc/named.rfc1912.zones /etc/named.rfc1913.zones
[root@server102 ~]# vim /etc/named.rfc1913.zones

25 zone "westos.com" IN {
26         type master;
27         file "westos.com.inter";
28         allow-update { none; };
29 };

[root@server102 ~]# cp -p /var/named/westos.com.zone /var/named/westos.com.inter

[root@server102 ~]# vim /var/named/westos.com.inter

1 $TTL 1D
2 @       IN SOA dns root (
3                                         0       ; serial
4                                         1D      ; refresh
5                                         1H      ; retry
6                                         1W      ; expire
7                                         3H )    ; minimum
8         NS      dns
9 dns     A       1.1.1.101
10 www     A       1.1.1.222
11 sss     A       1.1.1.100
[root@server102 ~]# systemctl restart named

测试：

[root@server101 ~]# vim /etc/resolv.conf
[root@server101 ~]# cat /etc/resolv.conf
# Generated by NetworkManager

# No nameservers found; try putting DNS servers into your
# ifcfg files in /etc/sysconfig/network-scripts like so:
#
# DNS1=xxx.xxx.xxx.xxx
# DNS2=xxx.xxx.xxx.xxx
# DOMAIN=lab.foo.com bar.foo.com
nameserver 172.25.254.102

[root@server101 ~]# dig www.westos.com

; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7 <<>> www.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19897
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.westos.com.           IN   A

;; ANSWER SECTION:
www.westos.com.       86400   IN   A   1.1.1.222

;; AUTHORITY SECTION:
westos.com.       86400   IN   NS   dns.westos.com.

;; ADDITIONAL SECTION:
dns.westos.com.       86400   IN   A   1.1.1.101

;; Query time: 0 msec
;; SERVER: 172.25.254.102#53(172.25.254.102)
;; WHEN: Sat Aug 12 15:25:21 CST 2017

;; MSG SIZE rcvd: 93

[root@server102 ~]# dig www.westos.com

; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7 <<>> www.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41683
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.westos.com.           IN   A

;; ANSWER SECTION:
www.westos.com.       86400   IN   A   172.25.254.222

;; AUTHORITY SECTION:
westos.com.       86400   IN   NS   dns.westos.com.

;; ADDITIONAL SECTION:
dns.westos.com.       86400   IN   A   172.25.254.101

;; Query time: 0 msec
;; SERVER: 172.25.254.102#53(172.25.254.102)
;; WHEN: Sat Aug 12 15:26:17 CST 2017
;; MSG SIZE rcvd: 93

新建立主机自动更新自己的解析记录到dnsserver端

借助dhcp自动分配IP给新主机时，同时通知dns，通过key认证更新

配置：

[root@server102 ~]# vim /etc/named.conf

42 include "/etc/westos.key";

[root@server102 ~]# vim /etc/named.rfc1913.zones
25 zone "westos.com" IN {
26         type master;
27         file "westos.com.inter";
28         allow-update { key westos; };                           ##指定westos.com域使用westos key更新
29 };

[root@server102 ~]# dnssec-keygen -a HMAC-MD5 -b 128 -n HOST westos ##生成128位，加密方式为hmac-md5，名字为为westos的钥匙

[root@server102 ~]# cat Kwestos.+157+01702.key
westos. IN KEY 512 3 157 vEgPJZlWGEmzA/7BOgqYKw==

[root@server102 ~]# cp -p /etc/rndc.key /etc/westos.key
[root@server102 ~]# vim /etc/westos.key

[root@server102 ~]# cat /etc/westos.key
key "westos" {
algorithm hmac-md5;
secret "vEgPJZlWGEmzA/7BOgqYKw==";
};

[root@server102 named]# chmod g+w /var/named ##给目录组用户写权限，不然内容更新不进来
[root@server102 ~]# cp /usr/share/doc/dhcp*/dhcpd.conf.example /etc/dhcp/dhcpd.conf
cp: overwrite ‘/etc/dhcp/dhcpd.conf’? y
[root@server102 ~]# vim /etc/dhcp/dhcpd.conf

7 option domain-name "westos.com";
8 option domain-name-servers 172.25.254.102;

14 ddns-update-style interim;                                                 ##DHCP服务器与DNS服务器的动态信息更新模式：interim为DNS互动更新模式，ad-hoc为特>殊DNS更新模式，none为不支持动态更新模式。
30 subnet 172.25.254.0 netmask 255.255.255.0 {
31   range 172.25.254.155 172.25.254.166;
32   option routers 172.25.254.250;
33 }

27 28以及35行以后的全部删掉

35 key westos {                                                                      ##指定key
36         algorithm hmac-md5;                                             ##加密方式
37         secret vEgPJZlWGEmzA/7BOgqYKw==;
38 };
39
40 zone westos.com {                                                       ##指定更新域名
41         primary 127.0.0.1;
42         key westos;
43 }

[root@server102 ~]# systemctl restart dhcpd
[root@server102 ~]# systemctl restart named

测试：

设定一台主机网络的工作方式为dhcp
设定这台主机的主机名 music.westos.com，这个名称在原有的dns服务中是没有解析的
重启网络看ip 和主机名称的解析