沐之静夏 發表於 2020-6-28 11:30:00

CentOS7搭建DNS域名解析服务器

<div>
<div>
<h1>1. 安装 BIND 服务器软件并启动</h1>
<pre><code class="shell">yum -y install bind bind-utils
systemctl start named.service// 启动服务
systemctl enable named// 设为开机启动
</code></pre>
<h2>1.1. 查看named进程是否正常启动</h2>
<pre><code class="shell">ps -eaf|grep named // 检查进程
ss -nult|grep :53 // 检查监听端口
</code></pre>
<p>如图:</p>
<div class="image-package">
<div class="image-container">
<div class="image-container-fill">&nbsp;</div>
<div class="image-view" data-width="646" data-height="150"><img src="//upload-images.jianshu.io/upload_images/1486248-19f735ecf6d4825f.png?imageMogr2/auto-orient/strip|imageView2/2/w/646/format/webp"></div>
</div>
<div class="image-caption">&nbsp;</div>
</div>
<h2>1.2. 开放 TCP 和 UDP 的 53 端口</h2>
<pre><code class="shell">firewall-cmd --permanent --add-port=53/tcp
firewall-cmd --permanent --add-port=53/udp
firewall-cmd --reload// 重新加载防火墙配置，让配置生效
</code></pre>
<h1>2. DNS 服务的相关配置文件</h1>
<h2>2.1. 修改主要文件 <code>/etc/named.conf</code></h2>
<p>修改前先备份： <code>cp -p /etc/named.conf /etc/named.conf.bak</code> // 参数-p表示备份文件与源文件的属性一致。<br>
修改配置：<code>vi /etc/named.conf</code>， 配置内容如下：</p>
<pre><code class="shell">options {
      listen-on port 53 { any; };
      listen-on-v6 port 53 { any; };
      directory       "/var/named";
      dump-file       "/var/named/data/cache_dump.db";
      statistics-file "/var/named/data/named_stats.txt";
      memstatistics-file "/var/named/data/named_mem_stats.txt";
      allow-query   { any; };

      /*
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable
         recursion.
         - If your recursive DNS server has a public IP address, you MUST enable access
         control to limit queries to your legitimate users. Failing to do so will
         cause your server to become part of large scale DNS amplification
         attacks. Implementing BCP38 within your network would greatly
         reduce such attack surface
      */
      recursion yes;

      dnssec-enable yes;
      dnssec-validation yes;

      /* Path to ISC DLV key */
      bindkeys-file "/etc/named.iscdlv.key";

      managed-keys-directory "/var/named/dynamic";

      pid-file "/run/named/named.pid";
      session-keyfile "/run/named/session.key";
};
</code></pre>
<p>检查一波</p>
<pre><code class="shell">named-checkconf// 检查named.conf是否有语法问题
</code></pre>
<h2>2.2. 配置正向解析和反向解析</h2>
<h3>2.2.1. 修改/etc/named.rfc1912.zones</h3>
<p>添加配置： <code>vi /etc/named.rfc1912.zones</code> ， 配置内容如下：</p>
<pre><code class="shell">zone "reading.zt" IN {
      type master;
      file "named.reading.zt";
      allow-update { none; };
};

zone "0.168.192.in-addr.arpa" {
      type master;
      file "named.192.168.0";
      allow-update { none; };
};
</code></pre>
<h3>2.2.2. 添加正向解析域</h3>
<p>基于 name.localhost 模板，创建配置文件：<code>cp -p /var/named/named.localhost /var/named/named.reading.zt</code><br>
配置正向域名解析文件 named.reading.zt ： <code>vi /var/named/named.reading.zt</code> ，配置内容如下：</p>
<pre><code class="shell">$TTL 1D
@   IN SOA@ rname.invalid. (
                  0   ; serial
                  1D; refresh
                  1H; retry
                  1W; expire
                  3H )    ; minimum
    NS@
    A   127.0.0.1
    AAAA    ::1
mirrorA   192.168.0.233
test    A   192.168.0.232
</code></pre>
<p>说明：</p>
<ul>
<li>http://mirror.reading.zt/ 将会解析为 http://192.168.0.233/</li>
</ul>
<p>授权 named 用户 <code>chown :named /var/named/named.reading.zt</code><br>
检查区域文件是否正确<code>named-checkzone "reading.zt" "/var/named/named.reading.zt"</code> ，如图：</p>
<div class="image-package">
<div class="image-container">
<div class="image-container-fill">&nbsp;</div>
<div class="image-view" data-width="468" data-height="62"><img src="//upload-images.jianshu.io/upload_images/1486248-a862661e70d382e2.png?imageMogr2/auto-orient/strip|imageView2/2/w/468/format/webp"></div>


</div>
<div class="image-caption">&nbsp;</div>


</div>
<h3>2.2.3. 添加反向解析域</h3>
<p>基于 name.localhost 模板，创建配置文件： <code>cp -p /var/named/named.localhost /var/named/named.192.168.0</code><br>
配置反向域名解析文件 named.192.168.0 ： <code>vi /var/named/named.192.168.0</code></p>
<pre><code class="shell">$TTL 1D
@   IN SOA@ rname.invalid. (
                  0   ; serial
                  1D; refresh
                  1H; retry
                  1W; expire
                  3H )    ; minimum
    NS@
    A   127.0.0.1
    AAAA    ::1
233 PTR mirror.reading.zt
232 PTR test.reading.zt
</code></pre>
<p>授权 named 用户 <code>chown :named /var/named/named.192.168.0</code><br>
检查区域文件是否正确 <code>named-checkzone "0.168.192.in-addr.arpa" "/var/named/named.192.168.0"</code> ，如图：</p>
<div class="image-package">
<div class="image-container">
<div class="image-container-fill">&nbsp;</div>
<div class="image-view" data-width="631" data-height="61"><img src="//upload-images.jianshu.io/upload_images/1486248-72944e7c0c495cc2.png?imageMogr2/auto-orient/strip|imageView2/2/w/631/format/webp"></div>


</div>
<div class="image-caption">&nbsp;</div>


</div>
<h3>2.2.4. 重启 named 服务，让配置生效</h3>
<p>重启 named 服务，让配置生效 <code>systemctl restart named</code></p>
<h1>3. 在 Linux 下的 DNS 客户端的设置及测试</h1>
<h2>3.1. 注册域名解析服务器到配置文件</h2>
<p>配置 ifcfg-xxxx <code>vi /etc/sysconfig/network-scripts/ifcfg-enp0s3</code> ， 具体内容如下：</p>
<pre><code class="shell">TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=static
DEFROUTE=yes
IPADDR=192.168.0.236
NETMASK=255.255.255.0
GATEWAY=192.168.0.1
DNS1=192.168.0.236// 新增，本机就是域名解析服务器
DNS2=8.8.8.8
DNS3=114.114.114.114
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=enp0s3
UUID=1639f78b-d515-4110-80ad-f1700bf7db84
DEVICE=enp0s3
ONBOOT=yes
ZONE=public
</code></pre>
<p>如图：</p>
<div class="image-package">
<div class="image-container">
<div class="image-container-fill">&nbsp;</div>
<div class="image-view" data-width="478" data-height="349"><img src="//upload-images.jianshu.io/upload_images/1486248-213955279f1382e8.png?imageMogr2/auto-orient/strip|imageView2/2/w/478/format/webp"></div>
</div>
<div class="image-caption">&nbsp;</div>
</div>
<p>重启网络服务，让配置生效 <code>systemctl restart network.service</code></p>
<h2>3.2. 使用 nslookup 测试</h2>
<p>bind-utils 软件包本身提供了测试工具 nslookup</p>
<h3>3.3.1. 正向域名解析测试</h3>
<p><code>nslookup test.reading.zt</code> , 或者，如下图：</p>
<div class="image-package">
<div class="image-container">
<div class="image-container-fill">&nbsp;</div>
<div class="image-view" data-width="242" data-height="195"><img src="//upload-images.jianshu.io/upload_images/1486248-573607c8c2450de7.png?imageMogr2/auto-orient/strip|imageView2/2/w/242/format/webp"></div>
</div>
<div class="image-caption">&nbsp;</div>
</div>
<h3>3.3.2. 反响域名解析测试</h3>
<p><code>nslookup 192.168.0.232</code> , 或者，如下图：</p>
<div class="image-package">
<div class="image-container">
<div class="image-container-fill">&nbsp;</div>
<div class="image-view" data-width="571" data-height="166"><img src="//upload-images.jianshu.io/upload_images/1486248-8c037c3cfc0217ee.png?imageMogr2/auto-orient/strip|imageView2/2/w/571/format/webp"></div>
</div>
<div class="image-caption">&nbsp;</div>
</div>
</div>
<br><br>作者：Abbott思宇<br>链接：https://www.jianshu.com/p/ceaa2cc5715c<br>来源：简书<br>著作权归作者所有。商业转载请联系作者获得授权，非商业转载请注明出处。</div><br><br>
来源：https://www.cnblogs.com/cash/p/13201999.html
頁: [1]
查看完整版本: CentOS7搭建DNS域名解析服务器