1. 程式人生 > >配置DNS的正反向解析與主從同步

配置DNS的正反向解析與主從同步

dns

配置DNS的正反向解析與主從同步

準備:

  • 本實驗基於兩臺centos6.5其內核版本號為2.6.32-431.el6.x86_64

  • 配置時間同步

    # echo "#update system date by jiajie at 20170506" >>/var/spool/cron/root 
    # echo "*/5 * * * * /usr/sbin/ntpdate time.nist.gov > /dev/null 2>&1" >>/var/spool/cron/root
  • 關閉防火墻和SELINUX

    # service iptables stop
    # setenforce 0
    # sed -i  "s/SELINUX=enforcing/SELINUX=disabled/" /etc/selinux/config
  • 本實驗的主DNS服務器IP是:192.168.1.16,從DNS服務器的IP是192.168.1.20

  • 主服務器:支持正反向解析,從服務器:從正反向解析


開始 配置主服務器(IP:192.168.1.16

  1. 安裝軟件 # yum -y install bind bind-libs bind-utils 版本:bind.x86_64 32:9.8.2-0.62.rc1.el6_9.1 bind-libs.x86_64 32:9.8.2-0.62.rc1.el6_9.1 bind-utils.x86_64 32:9.8.2-0.62.rc1.el6_9.1

  2. 配置正向解析的數據庫文件 ; 配置主DNS服務器的配置文件(只列出修改的):

    # cat  /etc/named.conf
    options {
                listen-on port 53 { 192.168.1.16; 127.0.0.1; };//or delete this line
        //      listen-on-v6 port 53 { ::1; };
                directory       "/var/named";
                dump-file       "/var/named/data/cache_dump.db";
                statistics-file "/var/named/data/named_stats.txt";
                memstatistics-file "/var/named/data/named_mem_stats.txt";
                allow-query     { any; };                  
                recursion yes;
    
        //      dnssec-enable yes;
        //      dnssec-validation yes;
    
            /* Path to ISC DLV key */
        //      bindkeys-file "/etc/named.iscdlv.key";
    
        //      managed-keys-directory "/var/named/dynamic";
            };
    
    *定義正向區域
    *在該文件內添加下面的ZONE(註意格式和符號)
    # tail /etc/named.rfc1912.zones
        zone "jiajie.com" IN {
            type master;
            file "jiajie.zone";
        };
  3. 創建區域解析庫文件:

    # vim /var/named/jiajie.com.zone 
    $TTL 1D
    $ORIGIN jiajie.com.
    @       IN      SOA     ns1.jiajie.com. jjzgood.126.com. (
                    20170507
                    1H
                    10M
                    5D
                    1D )
            IN      NS      ns1
            IN      NS      ns2
            IN      MX 10   mx1
            IN      MX 20   mx2
    ns1     IN      A       192.168.1.16
    ns2     IN      A       192.168.1.20
    mx1     IN      A       192.168.1.17
    mx2     IN      A       192.168.1.18
    www     IN      A       192.168.1.16
    www     IN      A       192.169.1.20
    ftp     IN      CNAME   www
  4. 修改權限和屬組:

    # chown :named /var/named/jiajie.zone 
    # chmod 640 /var/named/jiajie.zone
  5. 查錯和重啟服務:

    # named-checkconf 
    # named-checkzone "jiajie.com" /var/named/jiajie.zone 
     zone jiajie.com/IN: loaded serial 20170507
     OK
    # service named restart
    # rndc status
  6. 現象:

    # host -t A www.jiajie.com 192.168.1.16
    Using domain server:
    Name: 192.168.1.16
    Address: 192.168.1.16#53
    Aliases: 
    
    www.jiajie.com has address 192.169.1.20
    www.jiajie.com has address 192.168.1.16
    # host -t A mx1.jiajie.com 192.168.1.16
    Using domain server:
    Name: 192.168.1.16
    Address: 192.168.1.16#53
    Aliases: 
    
    mx1.jiajie.com has address 192.168.1.17
    # host -t A ftp.jiajie.com 192.168.1.16
    Using domain server:
    Name: 192.168.1.16
    Address: 192.168.1.16#53
    Aliases: 
    
    ftp.jiajie.com is an alias for www.jiajie.com.
    www.jiajie.com has address 192.168.1.16
    www.jiajie.com has address 192.169.1.20

由現象可以看出我們配置的主DNS服務器是成功的。


  1. 配置反向解析: 添加反向zone:

    # tail /etc/named.rfc1912.zones
    zone "1.168.192.in-addr.arpa" IN {
        type  master;
        file  "192.168.1.zone";
    };
  2. 添加反向區域解析庫文件:

    # vim  /var/named/192.168.1.zone 
    
    $TTL 1D
    @       IN      SOA     ns1.jiajie.com. jjzgood.126.com. (
                    20170507
                    1H
                    10M
                    5D
                    1D )
            IN      NS      ns1.jiajie.com.
            IN      NS      ns2.jiajie.com.
            16      IN      PTR     ns1.jiajie.com.
    16      IN      PTR     www.jiajie.com.
    20      IN      PTR     ns2.jiajie.com.
    20      IN      PTR     www.jiajie.com.
    17      IN      PTR     mx1.jiajie.com.
    18      IN      PTR     mx2.jiajie.com.
  3. 檢查和重新加載:

    # named-checkconf 
    # named-checkzone "192.168.1.in-addr.arpa" /var/named/192.168.1.zone 
    zone 192.168.1.in-addr.arpa/IN: loaded serial 20170507
    OK
    # rndc reload
    server reload successful
  4. 查看現象:

    # host -t ptr 192.168.1.16 192.168.1.16
    Using domain server:
    Name: 192.168.1.16
    Address: 192.168.1.16#53
    Aliases: 
    
    16.1.168.192.in-addr.arpa domain name pointer www.jiajie.com.
    16.1.168.192.in-addr.arpa domain name pointer ns1.jiajie.com.
    
    # host -t ptr 192.168.1.20 192.168.1.16
    Using domain server:
    Name: 192.168.1.16
    Address: 192.168.1.16#53
    Aliases: 
    
    20.1.168.192.in-addr.arpa domain name pointer www.jiajie.com.
    20.1.168.192.in-addr.arpa domain name pointer ns2.jiajie.com.
    
    # host -t ptr 192.168.1.17 192.168.1.16
    Using domain server:
    Name: 192.168.1.16
    Address: 192.168.1.16#53
    Aliases: 
    
    17.1.168.192.in-addr.arpa domain name pointer mx1.jiajie.com.
  5. WINDOWS平臺查看:

技術分享



配置從服務器(IP:192.168.1.20):

註意

  1. 從服務器應該是一臺獨立的服務器

  2. 主服務器的區域解析庫裏必須有一條NS記錄誌向從服務器

  3. 從服務器只需要定義區域,並不需要配置解析庫文件

下載安裝包:

    yum -y install bind
    yum -y install bind-utils

配置從服務器的配置文件

# vim /etc/named.conf

options {
        listen-on port 53 { 192.168.1.20; 127.0.0.1; };
//      listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { any; };
        recursion yes;

//      dnssec-enable yes;
//      dnssec-validation yes;

        /* Path to ISC DLV key */
//      bindkeys-file "/etc/named.iscdlv.key";

//      managed-keys-directory "/var/named/dynamic";
};

添加區域文件:

# vim  /etc/named.rfc1912.zones

zone "jiajie.com" IN {
    type slave;
    masters { 192.168.1.16; };
    file "slaves/jiajie.com.zone";
};

zone "1.168.192.in-addr.arpa" IN {
    type slave;
    masters { 192.168.1.16; };
    file "slaves/192.168.1.zone";
};

查錯與加載:

# named-checkconf 
# rndc reload

現象:這時候你會看見在/var/named/slaves/目錄下有兩個文件(我們並沒有創建)。可知從服務已經自動把主服務器的解析庫文件復制過來了。

# ll /var/named/slaves/
192.168.1.zone   jiajie.com.zone

這時你在主服務器上的解析庫裏添加或者修改數據,然後將系列號加1,這時候主服務器會通知從服務來“復制”數據。


排錯:

  1. 一般出錯就在於格式或者符號問題,細心點就可以排除大部分問題。

  2. 本人在配置反向解析庫文件查錯時出現了下面問題:

    # named-checkzone "192.168.1.in-addr.arpa" /var/named/192.168.1.zone 
    /var/named/192.168.1.zone:3: ignoring out-of-zone data (1.168.192.in-addr.arpa)
    /var/named/192.168.1.zone:11: ignoring out-of-zone data (16.1.168.192.in-addr.arpa)
    /var/named/192.168.1.zone:12: ignoring out-of-zone data (16.1.168.192.in-addr.arpa)
    /var/named/192.168.1.zone:13: ignoring out-of-zone data (20.1.168.192.in-addr.arpa)
    /var/named/192.168.1.zone:14: ignoring out-of-zone data (20.1.168.192.in-addr.arpa)
    /var/named/192.168.1.zone:15: ignoring out-of-zone data (17.1.168.192.in-addr.arpa)
    /var/named/192.168.1.zone:16: ignoring out-of-zone data (18.1.168.192.in-addr.arpa)
    zone 192.168.1.in-addr.arpa/IN: has 0 SOA records
    zone 192.168.1.in-addr.arpa/IN: has no NS records
    zone 192.168.1.in-addr.arpa/IN: not loaded due to errors.

雖然報錯,但是反向解析依然可以使用。我在多方尋求幫助未果,最後發現只要把/var/named/192.158.1.zone中的$ORIGIN 1.168.192.in-addr.arpa刪除就可以了。這行本來就是可有可無的,寫上只是為了好理解一點。


2017/5/7 11:55:42


本文出自 “dianel簡單不簡單” 博客,請務必保留此出處http://dianel.blog.51cto.com/12170393/1922816

配置DNS的正反向解析與主從同步