基於bind搭建DNS主從

使用bind的主從複製功能能夠實現的功能：
提供冗餘，避免單點故障；
均衡負載查詢需求，從而提升系統可用性。

1、安裝

#bind-chroot 負責DNS安全做用，將bind進程嚴格限制在特定的目錄中
yum install bind bind-chroot bind-utils

2、配置文件

• bind主服務器

#bind主配置文件
cat /etc/named.conf
options {
listen-on port 53 { any; };
listen-on-v6 port 53 {：1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

#bind正向解析配置
cat /etc/named.rfc1912.zones
zone "ms.com" IN {
type master;
file "openapi-dev.ms.com.zone";
allow-update { none;};
allow-transfer { 172.20.16.3;};
};

cd /var/named/
cat openapi-dev.ms.com.zone 
$TTL 1D
@       IN SOA  ms.com. admin.ms.com. (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
                        NS      dns1.ms.com.
                        NS      dns2.ms.com.
dns1      IN A 172.20.16.2
dns2      IN A 172.20.16.3

mysql    IN A 172.20.16.2
rabbitmq IN A 172.20.16.2
eureka   IN A 172.20.16.2
redis    IN A 172.20.16.2
oauth    IN A 172.20.16.2
config   IN A 172.20.16.2

• bind從服務器

#bind從節點配置文件
cat /etc/named.conf
options {
listen-on port 53 { any; };
listen-on-v6 port 53 {：1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

#bind正向解析配置
cat /etc/named.rfc1912.zones 
zone "ms.com" IN {
type slave;
file "slaves/openapi-dev.ms.com.zone";
masters {172.20.16.2;};
masterfile-format text;
allow-transfer { none; };
};

#說明：masterfile-format text;（格式能夠是text或者是raw格式，默認不用添加此行，可是本次出現亂碼後，添加此行後，亂碼消失）

3、啓動服務

#檢查配置文件是否有語法錯誤：
named-checkconf

#啓動bind服務
systemctl start named

4、更改騰訊雲服務器DNS解析

sed -i '$a\DNS1=172.20.16.2\nDNS2=172.20.16.3' /etc/sysconfig/network-scripts/ifcfg-eth0
sed -i '2,3d' /etc/resolv.conf
sed -i '$a\nameserver=172.20.16.2\nnameserver=172.20.16.3' /etc/resolv.conf