Dns
一.高速缓存
1.客户端配置dns解析地址
vim /etc/resolv.cof
-->namseserver dns服务器ip
dns服务器:
yum search dns ##搜索dns软件包
yum install bind.x86_64 ##安装dns服务
ls -l /etc/rndc.key ##etc下无此文件
##重启dns服务,生成/etc/rndc.key文件过程中,卡住新开shell随机键入,产生随机数
firewall-cmd --permanent --add-service=dns
##添加dns到防火墙
firewall-cmd --reload ## 重新加载防火墙
netstat -anlpue | grep 53 ##查看53端口,会被回环地址使用
vim /etc/named.conf 编辑dns配置文件
-->>10行:listen-on port 53 { any; }; 允许任何网管
11行: allow-query { any; };
12行: forwarders { 172.25.254.250; };
systemctl restart named 重启dns服务
客户端:
vim /etc/resolv.cof
-->namseserver dns服务器ip
dig www.baidu.com 测试 第一次测试慢,第二次换台主机测试快
实验:
1.配置好yum源,yum search dns 安装bind,安装完成后重新启动,防火墙开启的情况下允许dns服务运行,设置dns开机自动启动
2.vim /etc/named.conf
10行:listen-on port 53 { any; }; 对任何网关开放53端口
17行:allow-query { any; }; 允许任何人的请求
18行:forwarders { 192.168.43.1; }; 当本台dns服务器无法提供解析时询问此dns解析地址
systemctl restart named重启后测试:dig www.baidu.com 用时385msec,由192.168.43.1提供解析
换台虚拟机进行同样测试:dig www.baidu.com 用时0msec,由172.25.254.51提供解析
二.Dns正向解析
yum search dns 搜索dns软件包
yum install bind.x86_64 安装dns服务
ls -l /etc/rndc.key etc下无此文件
systemctl start named 重启dns服务,生成/etc/rndc.key文件过程中,卡住新开shell随机键入,产生随机数
firewall-cmd --permanent --add-service=dns 添加dns到防火墙
firewall-cmd --reload 重新加载防火墙
netstat -anlpue | grep 53 查看53端口,会被回环地址使用
vim /etc/named.conf 编辑dns配置文件
-->>10行: listen-on port 53 { any; }; 允许任何网关访问
11行: allow-query { any; }; 允许任何主机访问
vim /etc/named.rfc1912.zones 编辑配置文件
–>> 19 zone “westos.com” IN {
20 type master;
21 file “westos.com.zone”;
22 allow-update { none; };
23 };
cp -p /var/named/named.localhost /var/named/westos.com.zone 复制模板
vim /var/named/westos.com.zone
–>>
1 $TTL 1D ##缓存一天1d
2 @ IN SOA dns.westos.com. root.westos.com. ( ##@代表westos.com;dns.westos.com后不加点会自动补@(westos.com)
3 0 ; serial
4 1D ; refresh
5 1H ; retry
6 1W ; expire
7 3H ) ; minimum
8 NS dns.westos.com. ##NS nameserver dns名称
9 dns A 172.25.254.110 ##dns服务器ip
10 www A 172.25.254.111 ##www.westos.com指定解析地址
systemctl restart named
客户端:dig www.westos.com 测试
实验:
1.横线以上操作同高速缓存实验,正向解析建立于其之上:
2.编辑配置文件: vim /etc/named.rfc1912.zones
3复制/var/named/named.localhost /var/named/westos.com.zone 主机-p完全复制否则安全上下文不一致,然后编辑 /var/named/westos.com.zone
4.vim /var/named/westos.com.zone
5.测试
##三.Dns轮询
建立在正向解析的基础上,编辑/var/named/westos.com.zone
四.反向解析
1.实验基于高速缓存之上;配置文件
2.vim /etc/named.rfc1912.zones
-->>48 zone "254.25.172.in-addr.arpa" IN {
49 type master;
50 file "westos.com.ptr";
51 allow-update { none; };
52 };
3.编辑完成后 cp -p /var/named/named.loopback /var/named/westos.com.ptr 复制/var/named/named.loopback 模板到/var/named/westos.com.ptr 同样是完全复制,之后对该文件进行编辑,完后成重启dns服务
4.测试dig -x 172.25.254.111/222
五.双向解析
实验:(一)外网解析
1.假设外网解析使用网端192.0.0.
cp -p /var/named/westos.com.zone /var/named/westos.com.zone.inter
复制/var/named/westos.com.zone 到/var/named/westos.com.zone.inter
对/var/named/westos.com.zone.inter进行编辑
cp -p /var/named/westos.com.zone /var/named/westos.com.zone.inter
vim /var/named/westos.com.zone.inter
-->>1 $TTL 1D
2 @ IN SOA dns.westos.com. root.westos.com. (
3 0 ; serial
4 1D ; refresh
5 1H ; retry
6 1W ; expire
7 3H ) ; minimum
8 NS dns.westos.com.
9 dns A 192.25.254.110
10 www CNAME bbs.westos.com.
11 bbs A 192.25.254.111
12 bbs A 192.25.254.222
2. 全额复制/etc/named.rfc1912.zones到/etc/named.rfc1912.zones.inter,进行文件配置
cp -p /etc/named.rfc1912.zones /etc/named.rfc1912.zones.inter
vim /etc/named.rfc1912.zones.inter
-->>
19 zone "westos.com" IN {
20 type master;
21 file "westos.com.zone.inter";
22 allow-update { none; };
(二).内网解析
(1)配置文件1:vim /var/named/westos.com.zone
vim /var/named/westos.com.zone
1 $TTL 1D
2 @ IN SOA dns.westos.com. root.westos.com. (
3 0 ; serial
4 1D ; refresh
5 1H ; retry
6 1W ; expire
7 3H ) ; minimum
8 NS dns.westos.com.
9 dns A 172.25.254.110
10 www CNAME bbs.westos.com.
11 bbs A 172.25.254.111
12 bbs A 172.25.254.222
(2)配置文件2: vim /etc/named.rfc1912.zones
vim /etc/named.rfc1912.zones
--->>
19 zone "westos.com" IN {
20 type master;
21 file "westos.com.zone";
22 allow-update { none; };
23 };
(三)配置主配置文件
vim /etc/named.conf 注释掉51-55行
写入
view localnet {
match-clients { 172.25.254.110; };
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
};
view internet {
match-clients { any; };
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones.inter";
};
(四)dns服务器添加本机dns解析地址:nameserver 172.25.254.51 > /etc/resolv.conf
外网用户测试:dig www.westos.com;很显然192.0.0网段是我们设置的外网解析网段
六.Dns辅助解析
1.准备dns辅助解析服务器一台,vim /etc/reslov.conf添加域名解析地址,就是dns主服务器ip,nameserver 172.25.254.51,;dns主服务器ipyum安装dns服务器,并开启,关闭防火墙或者添加dns服务到防火墙,编辑主配置文件/etc/named.conf 注释11,12行,17行允许任何人访问
编辑vim /etc/named.rfc1912.zones (这个文件会随着dns服务器的开启而自动生成)
vim /etc/named.rfc1912.zones
25 zone "westos.com" IN {
26 type slave; ## 类型辅助型
27 masters {172.25.254.110; }; ##dns服务主机172.25.254.110
28 file "slaves/westos.com.zone"; ##文件/etc/named/slaves/westos.com.zone;
29 allow-update { none; };
30 };
2.dns主服务器文件配置
配置文件1: vim /etc/named.rfc1912.zones
vim /etc/named.rfc1912.zones
-->>
19 zone "westos.com" IN {
20 type master;
21 file "westos.com.zone";
22 allow-update { none; };
23 also-notify { 172.25.254.210; };
24 };
配置文件2: vim /var/named/westos.com.zone.inter
vim /var/named/westos.com.zone.inter
-->>
1 $TTL 1D
2 @ IN SOA dns.westos.com. root.westos.com. (
3 4 ; serial
4 1D ; refresh
5 1H ; retry
6 1W ; expire
7 3H ) ; minimum
8 NS dns.westos.com.
9 dns A 192.25.254.110
10 www CNAME bbs.westos.com.
11 bbs A 192.25.254.1
12 bbs A 192.25.254.22
实验:
(1)实验前:可先注释掉双向解析的文件配置:vim /etc/named.conf
(2)辅助解析dns主服务器配置主文件
配置文件1: vim /etc/named.rfc1912.zones
vim /etc/named.rfc1912.zones
-->>
19 zone "westos.com" IN {
20 type master;
21 file "westos.com.zone";
22 allow-update { none; };
23 also-notify { 172.25.254.210; };
24 };
配置文件2:vim /var/named/westos.com.zone.inter
其中解析地址变更后,辅助dns解析服务器若要同步,需修改后变更第三行serial数值,然后重新启动dns服务,辅助dns端即可同步
vim /var/named/westos.com.zone.inter
-->>
1 $TTL 1D
2 @ IN SOA dns.westos.com. root.westos.com. (
3 4 ; serial
4 1D ; refresh
5 1H ; retry
6 1W ; expire
7 3H ) ; minimum
8 NS dns.westos.com.
9 dns A 192.25.254.110
10 www CNAME bbs.westos.com.
11 bbs A 192.25.254.1
12 bbs A 192.25.254.22
七.dns远程解析
Dns主服务器配置
环境清理: vim /etc/named.conf
/*
。。。。
*/
注释掉以前双向解析实验修改,重置环境
给与/var/named “w“权限
chmod g+w /var/named/
配置文件:vim /etc/named.rfc1912.zones
vim /etc/named.rfc1912.zones
-->>
19 zone "westos.com" IN {
20 type master;
21 file "westos.com.zone";
22 allow-update { 172.25.254.210; };
23 also-notify { 172.25.254.210; };
24 };
getenforce --Enforcing
setsebool -P named_write_master_zones 1
远程客户端172.25.254.210
Dns服务器主机端重新启动dns服务器后,/var/named/下会生成westos.com.zone.jnl数据包,远程端update的hello.westos.com 随着dns主端的dns服务的重新启动/var/named/westos.com.zone会写入hello.westos.com的信息
远程客户端删除hello.westos.com信息
Dns主端/var/named/westos.com.zone中hello.westos.com与相应的172.25.254.77信息删除了
八.远程解析的加密
(一)Dns主端配置:
1生成加密文件:
dnssec-keygen -a HMAC-MD5 -b 128 -n HOST westos
cp -p /etc/rndc.key /mnt/westos.key
2.vim westos.key
-->> 1 key "westos" {
2 algorithm hmac-md5;
3 secret "1FLlfr6FM6/JGx+6N41cpg==";
4 };
- vim /etc/named.conf
-->43 include "/var/named/(路径)westos.key";
4.vim /etc/named.rfc1912.zones
-->>19 zone "westos.com" IN {
20 type master;
21 file "westos.com.zone";
22 allow-update { key westos; };
23 also-notify { 172.25.254.210; };
24 };
- systemctl restart named
- scp /var/named/Kwestos.+157+11949.* root@172.25.254.210:/mnt
Dns远程端
nsupdate -k /mnt/Kwestos.+157+11949.private
> server 172.25.254.110
> update add lo.westos.com 86400 A 172.25.254.212
> send
>
实验:1.生成加密文件dnssec-keygen -a HMAC-MD5 -b 128 -n HOST westos,在/mnt下复制/etc/rndc.key模板到/mnt/westos.key(这里的位置没要求,但配置文件中文件路径一定要和存放位置相同),把公钥中的密码写入模板第三行,第一行命名随意;编辑/etc/named.conf第43行写入加密文件“include “/mnt/westos.key”;” 注意路径一致性。更多信息man -5 rndc.key
2.vim /etc/named.conf 第43行加密文件路径
3.编辑配置文件vim /etc/named.rfc1912.zones
v im /etc/named.rfc1912.zones
-->>19 zone "westos.com" IN {
20 type master;
21 file "westos.com.zone";
22 allow-update { key westos; };
23 also-notify { 172.25.254.210; };
24 };
systemctl restart named
3.scp /mnt/Kwestos.+157+11949.* root@172.25.254.210:/mnt把公钥私钥分发给远程客户机
重新启动dns报错因为实验前没备份,复制/var/named/westos.com.zone 到/mnt下,删除/var/named/westos.com.zone 在复制/mnt/westos.com.zone 到/var/named/下,就可以重新启动了
(二)dns辅助端
nsupdate -k /mnt/Kwestos.+157+11949.private
> server 172.25.254.110
> update add lo.westos.com 86400 A 172.25.254.212
> send
>
Dns主服务端:
八.dns动态解析
服务端ip地址随着dns的启动会自动产生不用管/etc/resolv.conf
实验:
Dns主机:
cp -p /mnt/westos.com.zone /var/named/westos.com.zone
systemctl restart named ##复制完成后重新开启dns服务
yum install dhcp ##安装dhcp软件包
cat /etc/dhcp/dhcpd.conf ##查看dhcp配置文件
cp /usr/share/doc/dhcp*/dhcpd.conf.example
cp /usr/share/doc/dhcp*/dhcpd.conf.example /etc/dhcp/dhcpd.conf 复制模板覆盖dhcp配置空文件
systemctl start dhcpd ##重新开启dhcpd服务
vim /etc/dhcp/dhcpd.conf
—–>>>
完成后重启dhcp服务
systemctl restart dhcpd
2.远程客户端:
网络设置dhcp方式获取ip地址,重启网络查看,ip,dns动态测试
修改/etc/dhcp/dhcpd.conf的ip池,重启dhcp服务