配置DNS的正反向解析與主從同步
阿新 • • 發佈：2017-05-07
dns
配置DNS的正反向解析與主從同步
準備：
本實驗基於兩臺centos6.5其內核版本號為
2.6.32-431.el6.x86_64配置時間同步
# echo "#update system date by jiajie at 20170506" >>/var/spool/cron/root # echo "*/5 * * * * /usr/sbin/ntpdate time.nist.gov > /dev/null 2>&1" >>/var/spool/cron/root
關閉防火墻和SELINUX
# service iptables stop # setenforce 0 # sed -i "s/SELINUX=enforcing/SELINUX=disabled/" /etc/selinux/config
本實驗的主DNS服務器IP是：
192.168.1.16，從DNS服務器的IP是192.168.1.20。主服務器：支持正反向解析，從服務器：從正反向解析
開始 配置主服務器（IP：192.168.1.16）
安裝軟件
# yum -y install bind bind-libs bind-utils版本：bind.x86_64 32:9.8.2-0.62.rc1.el6_9.1 bind-libs.x86_64 32:9.8.2-0.62.rc1.el6_9.1 bind-utils.x86_64 32:9.8.2-0.62.rc1.el6_9.1配置正向解析的數據庫文件 ； 配置主DNS服務器的配置文件(只列出修改的)：
# cat /etc/named.conf options { listen-on port 53 { 192.168.1.16; 127.0.0.1; };//or delete this line // listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; allow-query { any; }; recursion yes; // dnssec-enable yes; // dnssec-validation yes; /* Path to ISC DLV key */ // bindkeys-file "/etc/named.iscdlv.key"; // managed-keys-directory "/var/named/dynamic"; }; *定義正向區域 *在該文件內添加下面的ZONE(註意格式和符號) # tail /etc/named.rfc1912.zones zone "jiajie.com" IN { type master; file "jiajie.zone"; };創建區域解析庫文件：
# vim /var/named/jiajie.com.zone $TTL 1D $ORIGIN jiajie.com. @ IN SOA ns1.jiajie.com. jjzgood.126.com. ( 20170507 1H 10M 5D 1D ) IN NS ns1 IN NS ns2 IN MX 10 mx1 IN MX 20 mx2 ns1 IN A 192.168.1.16 ns2 IN A 192.168.1.20 mx1 IN A 192.168.1.17 mx2 IN A 192.168.1.18 www IN A 192.168.1.16 www IN A 192.169.1.20 ftp IN CNAME www修改權限和屬組：
# chown :named /var/named/jiajie.zone # chmod 640 /var/named/jiajie.zone
查錯和重啟服務：
# named-checkconf # named-checkzone "jiajie.com" /var/named/jiajie.zone zone jiajie.com/IN: loaded serial 20170507 OK # service named restart # rndc status
現象：
# host -t A www.jiajie.com 192.168.1.16 Using domain server: Name: 192.168.1.16 Address: 192.168.1.16#53 Aliases: www.jiajie.com has address 192.169.1.20 www.jiajie.com has address 192.168.1.16 # host -t A mx1.jiajie.com 192.168.1.16 Using domain server: Name: 192.168.1.16 Address: 192.168.1.16#53 Aliases: mx1.jiajie.com has address 192.168.1.17 # host -t A ftp.jiajie.com 192.168.1.16 Using domain server: Name: 192.168.1.16 Address: 192.168.1.16#53 Aliases: ftp.jiajie.com is an alias for www.jiajie.com. www.jiajie.com has address 192.168.1.16 www.jiajie.com has address 192.169.1.20
由現象可以看出我們配置的主DNS服務器是成功的。
配置反向解析： 添加反向zone：
# tail /etc/named.rfc1912.zones zone "1.168.192.in-addr.arpa" IN { type master; file "192.168.1.zone"; };添加反向區域解析庫文件：
# vim /var/named/192.168.1.zone $TTL 1D @ IN SOA ns1.jiajie.com. jjzgood.126.com. ( 20170507 1H 10M 5D 1D ) IN NS ns1.jiajie.com. IN NS ns2.jiajie.com. 16 IN PTR ns1.jiajie.com. 16 IN PTR www.jiajie.com. 20 IN PTR ns2.jiajie.com. 20 IN PTR www.jiajie.com. 17 IN PTR mx1.jiajie.com. 18 IN PTR mx2.jiajie.com.檢查和重新加載：
# named-checkconf # named-checkzone "192.168.1.in-addr.arpa" /var/named/192.168.1.zone zone 192.168.1.in-addr.arpa/IN: loaded serial 20170507 OK # rndc reload server reload successful
查看現象：
# host -t ptr 192.168.1.16 192.168.1.16 Using domain server: Name: 192.168.1.16 Address: 192.168.1.16#53 Aliases: 16.1.168.192.in-addr.arpa domain name pointer www.jiajie.com. 16.1.168.192.in-addr.arpa domain name pointer ns1.jiajie.com. # host -t ptr 192.168.1.20 192.168.1.16 Using domain server: Name: 192.168.1.16 Address: 192.168.1.16#53 Aliases: 20.1.168.192.in-addr.arpa domain name pointer www.jiajie.com. 20.1.168.192.in-addr.arpa domain name pointer ns2.jiajie.com. # host -t ptr 192.168.1.17 192.168.1.16 Using domain server: Name: 192.168.1.16 Address: 192.168.1.16#53 Aliases: 17.1.168.192.in-addr.arpa domain name pointer mx1.jiajie.com.
WINDOWS平臺查看：
配置從服務器（IP:192.168.1.20）：
註意
從服務器應該是一臺獨立的服務器
主服務器的區域解析庫裏必須有一條NS記錄誌向從服務器
從服務器只需要定義區域，並不需要配置解析庫文件
下載安裝包：
yum -y install bind
yum -y install bind-utils配置從服務器的配置文件
# vim /etc/named.conf
options {
listen-on port 53 { 192.168.1.20; 127.0.0.1; };
// listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
recursion yes;
// dnssec-enable yes;
// dnssec-validation yes;
/* Path to ISC DLV key */
// bindkeys-file "/etc/named.iscdlv.key";
// managed-keys-directory "/var/named/dynamic";
};添加區域文件：
# vim /etc/named.rfc1912.zones
zone "jiajie.com" IN {
type slave;
masters { 192.168.1.16; };
file "slaves/jiajie.com.zone";
};
zone "1.168.192.in-addr.arpa" IN {
type slave;
masters { 192.168.1.16; };
file "slaves/192.168.1.zone";
};查錯與加載：
# named-checkconf # rndc reload
現象：這時候你會看見在/var/named/slaves/目錄下有兩個文件（我們並沒有創建）。可知從服務已經自動把主服務器的解析庫文件復制過來了。
# ll /var/named/slaves/ 192.168.1.zone jiajie.com.zone
這時你在主服務器上的解析庫裏添加或者修改數據，然後將系列號加1，這時候主服務器會通知從服務來“復制”數據。
排錯：
一般出錯就在於格式或者符號問題，細心點就可以排除大部分問題。
本人在配置反向解析庫文件查錯時出現了下面問題：
# named-checkzone "192.168.1.in-addr.arpa" /var/named/192.168.1.zone /var/named/192.168.1.zone:3: ignoring out-of-zone data (1.168.192.in-addr.arpa) /var/named/192.168.1.zone:11: ignoring out-of-zone data (16.1.168.192.in-addr.arpa) /var/named/192.168.1.zone:12: ignoring out-of-zone data (16.1.168.192.in-addr.arpa) /var/named/192.168.1.zone:13: ignoring out-of-zone data (20.1.168.192.in-addr.arpa) /var/named/192.168.1.zone:14: ignoring out-of-zone data (20.1.168.192.in-addr.arpa) /var/named/192.168.1.zone:15: ignoring out-of-zone data (17.1.168.192.in-addr.arpa) /var/named/192.168.1.zone:16: ignoring out-of-zone data (18.1.168.192.in-addr.arpa) zone 192.168.1.in-addr.arpa/IN: has 0 SOA records zone 192.168.1.in-addr.arpa/IN: has no NS records zone 192.168.1.in-addr.arpa/IN: not loaded due to errors.
雖然報錯，但是反向解析依然可以使用。我在多方尋求幫助未果，最後發現只要把/var/named/192.158.1.zone中的$ORIGIN 1.168.192.in-addr.arpa刪除就可以了。這行本來就是可有可無的，寫上只是為了好理解一點。
2017/5/7 11:55:42
本文出自 “dianel簡單不簡單” 博客，請務必保留此出處http://dianel.blog.51cto.com/12170393/1922816
配置DNS的正反向解析與主從同步