DNS域名解析之bind应用

一、环境准备

虚拟机：vmware workstation 11

linux系统：centos7.3,centos6.8

bind安装：yum install bind

DNS主服务器A：环境:centos7.3 IP:172.16.252.35 DNS主机名：dns1.ilinux.io.

DNS从服务器B: 环境:centos6.8 IP:10.0.0.68 DNS主机名：dns2.ilinux.io (为后续实验准备)

虚拟域名:www.ilinux.io

bind主配置文件修改(centos7.3,6.8皆修改)：

  #注：仅列出options{}中更改的内容，其余不变    vi /etc/named.conf    options {        //listen-on port 53 { 127.0.0.1; }; #默认允许所有IP监听53端口        //listen-on-v6 port 53 { ::1; };        // allow-query     { localhost; };  #关闭仅允许本机解析        dnssec-enable no;              #为了方便，关闭DNS安全功能        dnssec-validation no;    };

1 正向解析

步骤

第一步：编辑解析数据库文件

vi /var/named/ilinux.io.zone      $TTL 600    ilinux.io.     IN      SOA     ilinux.io.      nsadmin.ilinux.io. (       2017052301       1H       5M       1W       6H )        IN      NS      dns1.ilinux.io.        IN      NS      dns2.ilinux.io.        IN    MX10  mx1.ilinux.io.    dns1.ilinux.io. IN      A       172.16.252.35    dns2.ilinux.io. IN      A       10.0.0.68    mx1.ilinux.io.  IN    A    10.10.1.1    www.ilinux.io.  IN      A       172.16.1.1    web             IN      CNAME   www    ftp    IN    A    172.16.0.111

第二步：编辑bind辅助配置文件

  vi /etc/named.rfc1912.zones    ...(省略部分内容)    #最后一行加入如下内容    zone "ilinux.io" IN {     type master;    file "ilinux.io.zone";    };

第三步：指定解析服务器IP

vi /etc/resolv.conf nameserver 172.16.252.35

第四步：权限及属组修改(基于安全考虑)

  chmod o= /var/named/ilinux.io.zone   chown :named /var/named/ilinux.io.zone  ls -l /var/named/ilinux.io.zone  -rw-r-----. 1 root named 454 May 28 10:17 /var/named/ilinux.io.zone

第五步：检查语法错误

named-checkconfnamed-checkzone ilinux.io ilinux.io.zone zone ilinux.io/IN: loaded serial 2017052301     OK                                         #验证正确

第六步：重新加载解析数据库文件和配置文件

  rndc reload  server reload successful  systemctl restart named.service

第七步：测试域名解析

dig www.ilinux.io     ; <<>> DiG 9.9.4-RedHat-9.9.4-37.el7 <<>> www.ilinux.io    ;; global options: +cmd    ;; Got answer:    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17242    ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3        ;; OPT PSEUDOSECTION:    ; EDNS: version: 0, flags:; udp: 4096    ;; QUESTION SECTION:                #查询部分    ;www.ilinux.io.INA        ;; ANSWER SECTION:                  #回答部分    www.ilinux.io.600INA172.16.1.1        ;; AUTHORITY SECTION:               #权威解析部分    ilinux.io.600INNSdns1.ilinux.io.    ilinux.io.600INNSdns2.ilinux.io.        ;; ADDITIONAL SECTION:              #附加信息部分    dns1.ilinux.io.600INA172.16.252.35    dns2.ilinux.io.600INA10.0.0.68        ;; Query time: 1 msec    ;; SERVER: 172.16.252.35#53(172.16.252.35)    ;; WHEN: Sun May 28 11:16:29 CST 2017    ;; MSG SIZE  rcvd: 128

2 反向解析

步骤

第一步：编辑解析数据库文件

vi /var/named/172.16.zone    $TTL 1D    @IN SOAilinux.io. nsadmin.ilinux.io. (    2017052301; serial    1D        ; refresh    1H        ; retry    1W        ; expire    3H )    ; minimum        @INNSdns1.ilinux.io.    @INNSdns2.ilinux.io.    35.252INPTRdns1.ilinux.io.    68.0INPTRdns2.ilinux.io.    1.1INPTRwww.ilinux.io.    111.0INPTRftp.ilinux.io.

第二步：编辑bind辅助配置文件

  vi /etc/named.rfc1912.zones    #最后一行加入如下信息    zone "16.172.in-addr.arpa" IN {    type master;    file "172.16.zone";    };

第三步：指定解析服务器IP

  vi /etc/resolv.conf     nameserver 172.16.252.35

第四步：权限及属组修改(安全考虑)

chmod o= 172.16.zone chown :named 172.16.zone ll 172.16.zone -rw-r-----. 1 root named 298 May 28 10:58 172.16.zone

第五步：检查语法错误

named-checkconfnamed-checkzone 16.172.in-addr.arpa 172.16.zone zone 16.172.in-addr.arpa/IN: loaded serial 2017052301OK              #验证成功

第六步：重新加载解析数据库文件和配置文件

rndc reloadserver reload successfulsystemctl restart named.service

第七步：测试域名解析

dig -x 172.16.1.1     ; <<>> DiG 9.9.4-RedHat-9.9.4-37.el7 <<>> -x 172.16.1.1    ;; global options: +cmd    ;; Got answer:    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17034    ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3        ;; OPT PSEUDOSECTION:    ; EDNS: version: 0, flags:; udp: 4096    ;; QUESTION SECTION:    ;1.1.16.172.in-addr.arpa.INPTR        ;; ANSWER SECTION:    1.1.16.172.in-addr.arpa. 86400INPTRwww.ilinux.io.        ;; AUTHORITY SECTION:    16.172.in-addr.arpa.86400INNSdns1.ilinux.io.    16.172.in-addr.arpa.86400INNSdns2.ilinux.io.        ;; ADDITIONAL SECTION:    dns1.ilinux.io.600INA172.16.252.35    dns2.ilinux.io.600INA10.0.0.68        ;; Query time: 0 msec    ;; SERVER: 172.16.252.35#53(172.16.252.35)    ;; WHEN: Sun May 28 11:45:36 CST 2017    ;; MSG SIZE  rcvd: 149

3 主从DNS服务器配置(包含正反向域名解析)

步骤

第一步：编辑bind辅助配置文件

1.DNS主服务器正反向解析文件配置上面已有配置，不再介绍

2.DNS从服务器正反向解析区域配置文件

环境：centos6.8 IP:10.0.0.68 DNS主机名：dns2.ilinux.io

vi /etc/named.rfc1912.zones          #最后一行加入如下信息        zone "ilinux.io" IN {            type slave;            file "slaves/ilinux.io.zone";            masters { 172.16.252.35; };        };                zone "16.172.in-addr.arpa" IN {                type slave;                file "slaves/172.16.zone";                masters { 172.16.252.35; };        };

第二步：检查语法错误

   named-checkconf

第三步：重新加载配置文件

  rndc reload    server reload successful    systemctl restart named.service

第四步：查看是否配置成功

  cat /var/log/messages | grep "Transfer completed"    May 28 08:46:20 localhost named[2224]: transfer of 'ilinux.io/IN' from 172.16.252.35#53: Transfer completed: 1 messages, 11 records, 271 bytes, 0.002 secs (135500 bytes/sec)    May 28 08:54:58 localhost named[2224]: transfer of '16.172.in-addr.arpa/IN' from 172.16.252.35#53: Transfer completed: 1 messages, 7 records, 227 bytes, 0.004 secs (56750 bytes/sec)

第五步：测试从服务域名解析

  正向解析测试    [root@god named]#dig www.ilinux.io @10.0.0.68    ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.47.rc1.el6 <<>> www.ilinux.io @10.0.0.68    ;; global options: +cmd    ;; Got answer:    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51468    ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2        ;; QUESTION SECTION:    ;www.ilinux.io.INA        ;; ANSWER SECTION:    www.ilinux.io.600INA172.16.1.1        ;; AUTHORITY SECTION:    ilinux.io.600INNSdns2.ilinux.io.    ilinux.io.600INNSdns1.ilinux.io.        ;; ADDITIONAL SECTION:    dns1.ilinux.io.600INA172.16.252.35    dns2.ilinux.io.600INA10.0.0.68        ;; Query time: 1 msec    ;; SERVER: 10.0.0.68#53(10.0.0.68)    ;; WHEN: Sun May 28 10:51:34 2017    ;; MSG SIZE  rcvd: 117

反向解析测试

dig -x 172.16.1.1 @10.0.0.68    ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.47.rc1.el6 <<>> -x 172.16.1.1 @10.0.0.68    ;; global options: +cmd    ;; Got answer:    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21780    ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2        ;; QUESTION SECTION:    ;1.1.16.172.in-addr.arpa.INPTR        ;; ANSWER SECTION:    1.1.16.172.in-addr.arpa. 86400INPTRwww.ilinux.io.        ;; AUTHORITY SECTION:    16.172.in-addr.arpa.86400INNSdns2.ilinux.io.    16.172.in-addr.arpa.86400INNSdns1.ilinux.io.        ;; ADDITIONAL SECTION:    dns1.ilinux.io.600INA172.16.252.35    dns2.ilinux.io.600INA10.0.0.68        ;; Query time: 0 msec    ;; SERVER: 10.0.0.68#53(10.0.0.68)    ;; WHEN: Sun May 28 10:49:23 2017    ;; MSG SIZE  rcvd: 138

4 总结

本文中DNS域名解析服务是基于bind来实验操作的。

文中仅分享了如何配置DNS域名解析服务，至于配置bind服务中相关的知识点可以参考如下：

https://www.isc.org/downloads/bind/doc/ 官方文档

《鸟哥的Linux私房菜服务器架设篇(第三版)》

本文实验包含DNS正向解析服务部署，DNS反向解析服务部署，DNS主从服务部署。

想要掌握DNS域名解析服务，深刻了解DNS域名解析知识必不可少，多多动手操作配置服务必不可少。