// // named.conf // // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS // server as a caching only nameserver (as a localhost DNS resolver only). // // See /usr/share/doc/bind*/sample/ for example named configuration files. //
/* - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. - If you are building a RECURSIVE (caching) DNS server, you need to enable recursion. - If your recursive DNS server has a public IP address, you MUST enable access control to limit queries to your legitimate users. Failing to do so will cause your server to become part of large scale DNS amplification attacks. Implementing BCP38 within your network would greatly reduce such attack surface */ recursion yes; //允许递归查询
[root@localhost ~]# tail -n5 /etc/named.rfc1912.zones zone "host.com." IN { type master; file "host.com.zone"; allow-update { none; }; };
zone: 定义一个区域写法为 zone "域名." IN {配置} type: 设置类型为master file: 设置区域的解析记录文件名称为host.com.zone allow-update: 设置动态更新的ip，我这写的是none即不允许动态更新
现在设置此域名的解析记录，在/var/named/下创建对应文件host.com.zone并编辑
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
[root@localhost named]# pwd /var/named [root@localhost named]# touch host.com.zone [root@localhost named]# vim host.com.zone host.com. 600 IN SOA ns1.host.com. chai.simplefish.cn. ( 202212101 ;序列号，每次更新记录则需要修改 10800 ;刷新时间，没隔多久到主服务器更新一次 900 ;重试时间，应该小于刷新时间 604800 ;过期时间，当辅助dns服务器无法联系主服务器的时间，超过这个时间则过期 86400 ;非权威应答的ttl，缓存DNS记录多长时间 ) host.com. 600 IN NS ns1.host.com. ns1.host.com. 60 IN A 192.160.0.100 dns.host.com. 60 IN A 192.160.0.100 bind.host.com. 60 IN A 192.160.0.100 www.host.com. 60 IN A 192.160.0.100 [root@localhost named]# systemctl start named //启动服务
一共有六条记录，其中SOA和NS记录时必须要有的。 记录写法为: 主机名 TTL值 IN 记录类型 值 在bind9里的所有配置文件中 所有的域名最后都必须带有”.”，这个”.”意味着根域的意思所以必须要有，不然启动服务的时候会报语法错误。
100.0.168.192.in-addr.arpa name = dns.host.com 100.0.168.192.in-addr.arpa name = www.host.com 100.0.168.192.in-addr.arpa name = bind.host.com 0.168.192.in-addr.arpa nameserver = ns1.host.com ns1.host.com internet address = 192.160.0.100
委派DNS
委派DNS的意思实质上就是指自己域名的下一级域名交给另一台主机来管理，也可以叫做子域。具体配置如下
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
[root@linux-1 ~]# tail -n 5 /etc/named.rfc1912.zones zone "host.com." IN { type master; file "host.com.zone"; allow-update { none; }; }; [root@linux-1 ~]# cat /var/named/host.com.zone host.com. 600 IN SOA dns1.host.com. chai.simplefish.cn. ( 0 ; serial 10800 ; refresh 900 ; retry 604800 ; expire 86400 ) ; minimum host.com. 600 IN NS ns1.host.com. dns1.host.com. 60 IN A 192.168.1.111 ns1.host.com. 60 IN A 192.168.1.111 www.host.com. 60 IN A 192.168.1.111 shanghai.host.com. 600 IN NS ns2.host.com. ns2.host.com. 60 IN A 192.168.1.112
[root@linux-2 ~]# tail -5 /etc/named.rfc1912.zones zone "shanghai.host.com." IN { type master; file "shanghai.host.com.zone"; allow-update { none; }; }; [root@linux-2 ~]# cat /var/named/shanghai.host.com.zone shanghai.host.com. 600 IN SOA dns1.shanghai.host.com. chai.simplefish.cn. ( 0 ; serial 1D ; refresh 1H ; retry 1W ; expire 3H ) ; minimum shanghai.host.com. 600 IN NS ns1.shanghai.host.com. ns1.shanghai.host.com. 60 IN A 192.168.1.112 dns1.shanghai.host.com. 60 IN A 192.168.1.112 www.shanghai.host.com. 60 IN A 192.168.1.112
被委派的则就可以正常配置，测试的话只需要指定第一台dns即可查询到委派的信息 第三台主机测试如下
1 2 3 4
[root@linux-3 ~]# dig -t A www.host.com @192.168.1.111 +short 192.168.1.111 [root@linux-3 ~]# dig -t A www.shanghai.host.com @192.168.1.111 +short 192.168.1.112
辅助DNS
主DNS的配置需要修改的参数如下
listen-on port 53 { 服务器的IP; }; //监听的ipv4端口以及ip，需要改成自己的主机ip
[root@master ~]# tail -n5 /etc/named.rfc1912.zones zone "host.com." IN { type master; file "host.com.zone"; allow-update { none; }; }; [root@master ~]# cat /var/named/host.com.zone host.com. 600 IN SOA ns1.host.com. chai.simplefish.cn. ( 202212201 ;序列号，每次更新记录则需要修改 10800 ;刷新时间，没隔多久到主服务器更新一次 900 ;重试时间，应该小于刷新时间 604800 ;过期时间，当辅助dns服务器无法联系主服务器的时间 86400 ;非权威应答的ttl，缓存DNS记录多长时间 ) host.com. 600 IN NS ns1.host.com. ns1.host.com. 60 IN A 192.160.0.101 dns.host.com. 60 IN A 192.160.0.101 bind.host.com. 60 IN A 192.160.0.101 www.host.com. 60 IN A 192.160.0.101 [root@master ~]# systemctl restart named
辅助DNS的区域配置和解析配置如下
1 2 3 4 5 6 7
[root@slave ~]# tail -n5 /etc/named.rfc1912.zones zone "host.com." IN { type slave; masters { 192.168.0.101; }; file "slaves/host.com.zone"; }; [root@slave ~]# systemctl restart named
[root@localhost ~]# yum -y install bind [root@localhost ~]# yum -y install bind-chroot [root@localhost ~]# cd /var/named/chroot/etc/ [root@localhost etc]# ln /etc/named* ./ ln: /etc/named: hard link not allowed for directory [root@localhost etc]# cd ../var/named/ [root@localhost named]# ln /var/named/* ./ ln: /var/named/chroot: hard link not allowed for directory ln: /var/named/data: hard link not allowed for directory ln: /var/named/dynamic: hard link not allowed for directory ln: /var/named/slaves: hard link not allowed for directory [root@localhost named]# mkdir data dynamic slaves [root@localhost named]# chown named:named data dynamic slaves [root@localhost named]# systemctl start named-chroot
options { default-key "rndc-key"; default-server 127.0.0.1; default-port 953; }; # End of rndc.conf
# Use with the following in named.conf, adjusting the allow list as needed: # key "rndc-key" { # algorithm hmac-md5; # secret "e7SaG876PM54+/1bRFh/JQ=="; # }; # # controls { # inet 127.0.0.1 port 953 # allow { 127.0.0.1; } keys { "rndc-key"; }; # }; # End of named.conf
