首页 › RedHat/Centos论坛 › CentOS 7实现DNS+DHCP动态更新详解

小鱼急急 發表於 2017-2-17 17:19:37

CentOS 7实现DNS+DHCP动态更新详解

<p>windows域里有一个功能，dhcp把新分发的ip数据发给DNS服务器，这样只要知道一个人的电脑名字就可以很方便的远程。</p>
<p>linux当然也能很好的实现类似的功能。man 5 dhcpd.conf 有详细描述。</p>
<p>昨天运维帮组织线下的沙龙，又拍云的运维总监邵海杨先生分享了一句&ldquo;千金难买早知道&rdquo;。是啊，就在实现动态更新的功能上，在网上找了不少博客，照着做又遇到各种问题，最后不不知道到底什么原理实现的。早知道认真看一下man，问题早解决了，对实现的原理也理解得深些。所以，在这个信息爆炸的时代，很多时候真的互联网没有让人更聪明，反而大量的信息经常把人淹没了。技术，还是需要静下心来去钻研的。</p>
<p>dhcp和dns的基本配置资料比较完善，此处不再赘述。有心的朋友认真看一下man 5 dhcpd.conf，瞧一眼下面配置中标红的部分，相信就能搞定了。</p>
<p>另外分享一个dns chroot的流程，先安装 bind,调通named，然后再安装bind-chroot</p>
<p>执行/usr/libexec/setup-named-chroot.sh /var/named/chroot on</p>
<p>停用named,启用named-chroot即可</p>
<p>systemctl disabled named ; systemctl stop named</p>
<p>systemctl enable named-chroot;systemctl start named-chroot</p>
<p># cat /etc/dhcp/dhcpd.conf &nbsp;&nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ddns-update-style interim; &nbsp; &nbsp;&nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ddns-updates on; &nbsp; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; do-forward-updates on; &nbsp; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; allow client-updates; &nbsp; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; allow bootp; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; allow booting; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #allow client-updates;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp; option space Cisco_LWAPP_AP; &nbsp;&nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp; option Cisco_LWAPP_AP.server-address code 241 = array of ip-address; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp; option space pxelinux; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp; option pxelinux.magic code 208 = string; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp; option pxelinux.configfile code 209 = text; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp; option pxelinux.pathprefix code 210 = text; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp; option pxelinux.reboottime code 211 = unsigned integer 32; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp; option architecture-type code 93 = unsigned integer 16;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; subnet 192.168.1.0 netmask 255.255.255.0 { &nbsp;&nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp; authoritative; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp; option routers 192.168.1.1; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp; option subnet-mask 255.255.255.0; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp; option broadcast-address 192.168.1.255; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp; option domain-name &quot;it.lab&quot;; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp; option domain-name-servers 192.168.1.200; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp; range dynamic-bootp 192.168.1.100 192.168.1.199; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;key SEC_DDNS { &nbsp; &nbsp;&nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; algorithm hmac-md5; &nbsp; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; secret 7ObhTIhKeDFMR2SbbS5s8A==; &nbsp; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }; &nbsp; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ddns-domainname &quot;it.lab&quot;; &nbsp; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; zone it.lab.{ &nbsp; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; primary 192.168.1.200; &nbsp; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; key SEC_DDNS; &nbsp; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; } &nbsp; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; zone 1.168.192.in-addr.arpa.{ &nbsp; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; primary 192.168.1.200; &nbsp; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; key SEC_DDNS; &nbsp; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; } &nbsp; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; default-lease-time 600; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; max-lease-time 7200;</p>
<p>&nbsp;&nbsp; class &quot;pxeclients&quot; { &nbsp;&nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; match if substring (option vendor-class-identifier, 0, 9) = &quot;PXEClient&quot;; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; next-server 192.168.1.200;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if option architecture-type = 00:07 { &nbsp;&nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; filename &quot;uefi/syslinux.efi&quot;;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; } &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; else { &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; filename &quot;bios/pxelinux.0&quot;;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #filename &quot;pxelinux.0&quot;;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; } &nbsp;&nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</p>
<p>} &nbsp;&nbsp;</p>
<p># cat /etc/named.conf &nbsp;&nbsp;</p>
<p>// &nbsp; &nbsp;</p>
<p>// named.conf &nbsp; &nbsp;</p>
<p>// &nbsp; &nbsp;</p>
<p>// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS &nbsp; &nbsp;</p>
<p>// server as a caching only nameserver (as a localhost DNS resolver only). &nbsp; &nbsp;</p>
<p>// &nbsp; &nbsp;</p>
<p>// See /usr/share/doc/bind*/sample/ for example named configuration files. &nbsp; &nbsp;</p>
<p>//</p>
<p>options { &nbsp;&nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; listen-on port 53 { 127.0.0.1;192.168.1.200; }; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; listen-on-v6 port 53 { ::1; }; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; directory&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &quot;/var/named&quot;; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dump-file&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &quot;/var/named/data/cache_dump.db&quot;; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; statistics-file &quot;/var/named/data/named_stats.txt&quot;; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; memstatistics-file &quot;/var/named/data/named_mem_stats.txt&quot;; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; allow-query&nbsp;&nbsp;&nbsp;&nbsp; { any;};</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /* &nbsp;&nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - If you are building a RECURSIVE (caching) DNS server, you need to enable &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; recursion. &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - If your recursive DNS server has a public IP address, you MUST enable access &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; control to limit queries to your legitimate users. Failing to do so will &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; cause your server to become part of large scale DNS amplification &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; attacks. Implementing BCP38 within your network would greatly &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; reduce such attack surface &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; */ &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; recursion no;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dnssec-enable yes; &nbsp;&nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dnssec-validation yes; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dnssec-lookaside auto;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /* Path to ISC DLV key */ &nbsp;&nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; bindkeys-file &quot;/etc/named.iscdlv.key&quot;;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; managed-keys-directory &quot;/var/named/dynamic&quot;;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; pid-file &quot;/run/named/named.pid&quot;; &nbsp;&nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; session-keyfile &quot;/run/named/session.key&quot;; &nbsp; &nbsp;</p>
<p>};</p>
<p>logging { &nbsp;&nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; channel default_debug { &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; file &quot;data/named.run&quot;; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; severity dynamic; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }; &nbsp; &nbsp;</p>
<p>};</p>
<p>zone &quot;.&quot; IN { &nbsp;&nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; type hint; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; file &quot;named.ca&quot;; &nbsp; &nbsp;</p>
<p>};</p>
<p>include &quot;/etc/named.rfc1912.zones&quot;; &nbsp;&nbsp;</p>
<p>include &quot;/etc/named.root.key&quot;;</p>
<p>key SEC_DDNS { &nbsp; &nbsp;&nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; algorithm hmac-md5; &nbsp; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; secret 7ObhTIhKeDFMR2SbbS5s8A==; &nbsp; &nbsp; &nbsp;</p>
<p>}; &nbsp; &nbsp; &nbsp;</p>
<p>zone &quot;it.lab&quot; IN { &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; type master; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; file &quot;it.lab.forward&quot;; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;allow-update { key SEC_DDNS ; };&nbsp;&nbsp; &nbsp;</p>
<p>};</p>
<p>zone &quot;1.168.192.in-addr.arpa&quot; IN { &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; type master; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; file &quot;1.168.192.reverse&quot;; &nbsp; &nbsp;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;allow-update { key SEC_DDNS ; }; &nbsp; &nbsp;&nbsp;</p>
<p>};</p>

查看完整版本: CentOS 7实现DNS+DHCP动态更新详解