CentOS 7DNS服務器架設

項目背景和要求

要保證即可以解析內網域名bigcloud.local的解析，又能解析互聯網的域名。

主DNS服務器：ZZYH1.BIGCLOUD.LOCAL

輔助DNS服務器：ZZYH2.BIGCLOUD.LOCAL

包含如下域的信息：

1、bigcloud.local域的信息：

FQDN	IP地址	備註
zzyh1.bigcloud.local	192.168.188.15	DNS1服務器
zzyh2.bigcloud.local	192.168.188.16	DNS2服務器
ftp.bigcloud.local	192.168.188.15
mailyh1.bigcloud.local	192.168.188.22
smtp.bigcloud.local	192.168.188.22
pop3.bigcloud.local	192.168.188.22
www.bigcloud.local	192.168.188.15
crm.bigcloud.local	192.168.188.15

2、192.168.188.0/24、192.168.189.0/24反向解析域

要求實現chroot功能，以提升安全性

實現到202.102.224.68、202.102.227.68的DNS轉發。

防止非受權用戶的DNS記錄的枚舉(防止出現相似上海菸草公司的安全隱患)。僅容許管理員在192.168.188.10上進行操做。

DNS網絡配置

除了傳統的修改/etc/resolv.conf以外，還有經過在ifcfg文件中添加配置的方式。

Tip: 與Windows在某個網卡中設置DNS服務器的IP地址相似

 

# vi/etc/sysconfig/network-scripts/ifcfg-eno16777728

# Generated by parse-kickstart IPV6INIT=no BOOTPROTO=static DEVICE=eno16777728 ONBOOT=yes TYPE=Ethernet DEFROUTE=yes PEERDNS=yes PEERROUTES=yes IPV4_FAILURE_FATAL=no NAME="System eno16777728" IPADDR=192.168.188.15 NETMASK=255.255.255.0 GATEWAY=192.168.188.2 DNS1=192.168.188.15 DNS2=192.168.188.16

這樣，當從新啓動network服務時，會生成/etc/resolv.conf中的配置

# servicenetwork restart

Restarting network (via systemctl):                        [  OK  ]

# cat/etc/resolv.conf

# Generated by NetworkManager search bigcloud.local nameserver 192.168.188.15 nameserver192.168.188.16

配置Yum庫

[root@zzyh2 ~]# cd /etc/yum.repos.d/

[root@zzyh2 yum.repos.d]# ls

CentOS-Base.repo  CentOS-Debuginfo.repo  CentOS-Sources.repo  CentOS-Vault.repo

[root@zzyh2 yum.repos.d]#

[root@zzyh1 yum.repos.d]# cpCentOS-Base.repo CentOS-Base.repo.origin

[root@zzyh1 yum.repos.d]# viCentOS-Base.repo

配置內容

[base]

name=CentOS-$releasever - Base

baseurl=file:///media

gpgcheck=1

gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7

安裝DNS支持包

#yum -y installbind bind-util bind-chroot     //

[root@zzyh1 ~]# cd /media/Packages/

[root@zzyh1 Packages]# yum -y install bindbind-util bind-chroot

Warning: RPMDB altered outside of yum.

 Installing : 32:bind-libs-9.9.4-14.el7.x86_64                             1/3

 Installing : 32:bind-9.9.4-14.el7.x86_64                                  2/3

 Installing : 32:bind-chroot-9.9.4-14.el7.x86_64                           3/3

 Verifying  :32:bind-9.9.4-14.el7.x86_64                                  1/3

 Verifying  : 32:bind-libs-9.9.4-14.el7.x86_64                             2/3

 Verifying  :32:bind-chroot-9.9.4-14.el7.x86_64                           3/3

 

Installed:

 bind.x86_64 32:9.9.4-14.el7        bind-chroot.x86_64 32:9.9.4-14.el7

 

Dependency Installed:

  bind-libs.x86_6432:9.9.4-14.el7

 Complete!

查看bind的生成包

[root@zzyh2 ~]# rpm -qc bind

/etc/logrotate.d/named

/etc/named.conf

/etc/named.iscdlv.key

/etc/named.rfc1912.zones

/etc/named.root.key

/etc/rndc.conf

/etc/rndc.key

/etc/sysconfig/named

/var/named/named.ca

/var/named/named.empty

/var/named/named.localhost

/var/named/named.loopback

配置文件

[root@zzyh1 ~]# cd /etc

[root@zzyh1 etc]# cp named.confnamed.conf.origin

[root@zzyh1 etc]# vi /etc/named.conf

[root@zzyh1 etc]# cat /etc/named.conf、

 //listen-on port 53 { 127.0.0.1; };

       listen-on port 53 { any; };

 //dnssec-enable yes;

       //dnssec-validation yes;

       dnssec-enable no;

       dnssec-validation no;

配置轉發地址：

 forwarders {202.102.224.68; 202.102.227.68;};

       allow-transfer {192.168.188.15; 192.168.188.12;};

查看狀態

[root@zzyh1 etc]# rndc status

version: 9.9.4-RedHat-9.9.4-14.el7<id:8f9657aa>

CPUs found: 1

worker threads: 1

UDP listeners per interface: 1

number of zones: 101

debug level: 0

xfers running: 0

xfers deferred: 0

soa queries in progress: 0

query logging is OFF

recursive clients: 0/0/1000

tcp clients: 0/100

server is up and running

測試一下解析

補充一下

#find / -name nslookup /usr/bin/nslookup #rpm -qf/usr/bin/nslookup  //查詢這個命令依附於那個包 bind-utils-9.9.4-14.el7.x86_64.rpm

執行

#nslookup              //若是找不到nslookup那是由於沒有安裝bind-utils-9.9.4-14.el7.x86_64.rpm

> server 192.168.188.15

Default server: 192.168.188.15

Address: 192.168.188.15#53

> g.cn                                //嘗試解析g.cn

Server:         192.168.188.15

Address:        192.168.188.15#53

 

Non-authoritative answer:

Name:  g.cn

Address: 203.208.36.17

Name:  g.cn

Address: 203.208.36.18

Name:  g.cn

Address: 203.208.36.16

Name:  g.cn

Address: 203.208.36.20

Name:  g.cn

Address: 203.208.36.19

//解析成功

添加自定義zone

自定義，修改配置文件

[root@zzyh1~]# vi /etc/named.conf

在最後添加

zone "bigcloud.local" IN {

    type mester;

    file "bigcloud.local.zone";

}

zone "188.168.192.in-addr.arpa"IN {

    type master;

    file "192.168.188.zone";

}

zone "189.168.192.in-addr.arpa"IN {

    type master;

    file "192.168.189.zone";

}

 

include"/etc/named.rfc1912.zones";

include "/etc/named.root.key";

 

 

[root@zzyh1named]# cp named.empty bigcloud.local.zone   //修改前備份一下

[root@zzyh1 named]# ls

bigcloud.local.zone  data    named.ca     named.localhost  slaves

chroot               dynamic  named.empty named.loopback

配置文件

[root@zzyh1named]# vi  bigcloud.local.zone

$TTL 3H

@      IN SOA  zzyh1.bigcloud.local.  chenzhou312.blog.51cto.com (

                                        0       ; serial

                                        1D      ; refresh

                                        1H      ; retry

                                        1W      ; expire

                                        3H)    ; minimum

                      IN      NS           zzyh1.bigcloud.local.

                      IN      NS          zzyh2.bigcloud.local.

zzyh1                IN      A            192.168.188.15

zzyh2                IN      A            192.168.188.16

ftp                   IN      A            192.168.188.15

mailyh1              IN      A            192.168.188.22

smtp                  IN      CNAME        mailyh1.bigcloud.local.

pop3                  IN      CNAME        mailyh1.bigcloud.local.

www                   IN      A            192.168.188.15

crm                   IN      A            192.168.188.15

 

#vi192.168.188.zone

$TTL 3H

@      IN SOA  zzyh1.bigcloud.local.  chenzhou312.blog.51cto.com (

                                        0       ; serial

                                        1D      ; refresh

                                        1H      ; retry

                                        1W      ; expiredgG

                                        3H)    ; minimum

        IN        NS           zzyh1.bigcloud.local.

        IN        NS           zzyh2.bigcloud.local.

15      IN        PTR           zzyh1.bigcloud.local.

15      IN        PTR           ftp.bigcloud.local.

16      IN        PTR           zzyh2.bigcloud.local.

16      IN        PTR           mailyh1.bigcloud.local.

 

#vi192.168.189.zone

 

$TTL 3H

@       IN SOA zzyh1.bigcloud.local. chenzhou312.blog.51cto.com (

                                        0       ; serial

                                        1D      ; refresh

                                        1H      ; retry

                                        1W      ; expire

                                        3H)    ; minimum

        IN    NS                   zzyh1.bigcloud.local.

        IN    NS                   zzyh2.bigcloud.local.

www     IN    NS                   192.168.188.15

重啓服務

[root@zzyh1 named]# systemctl restartnamed.service

[root@zzyh1 named]# service named restart

Redirecting to /bin/systemctl restart  named.service

 

[root@zzyh1 named]# rndc status

version: 9.9.4-RedHat-9.9.4-14.el7<id:8f9657aa>

CPUs found: 1

worker threads: 1

UDP listeners per interface: 1

number of zones: 104

debug level: 0

xfers running: 0

xfers deferred: 0

soa queries in progress: 0

query logging is OFF

recursive clients: 0/0/1000

tcp clients: 0/100

server is up and running

設置爲自動啓動

# systemctl enable named

[root@zzyh1 named]# systemctl status named named.service - Berkeley Internet NameDomain (DNS)   Loaded: loaded (/usr/lib/systemd/system/named.service; enabled)   Active: active (running) since Mon 2014-08-25 00:36:59 CST; 3min 47s ago  MainPID: 2807 (named)   CGroup: /system.slice/named.service           a」」a」2807 /usr/sbin/named -u named   Aug 25 00:36:59 zzyh1.bigcloud.localnamed[2807]: zone 189.168.192.in-addr.ar... Aug 25 00:36:59 zzyh1.bigcloud.localnamed[2807]: zone 189.168.192.in-addr.ar... Aug 25 00:36:59 zzyh1.bigcloud.localnamed[2807]: zone 1.0.0.127.in-addr.arpa... Aug 25 00:36:59 zzyh1.bigcloud.localnamed[2807]: zone 1.0.0.0.0.0.0.0.0.0.0.... Aug 25 00:36:59 zzyh1.bigcloud.localnamed[2807]: all zones loaded Aug 25 00:36:59 zzyh1.bigcloud.localnamed[2807]: running Aug 25 00:36:59 zzyh1.bigcloud.localnamed[2807]: zone 188.168.192.in-addr.ar... Aug 25 00:36:59 zzyh1.bigcloud.localnamed[2807]: zone 189.168.192.in-addr.ar... Aug 25 00:36:59 zzyh1.bigcloud.localsystemd[1]: Started Berkeley Internet N.... Aug 25 00:37:00 zzyh1.bigcloud.localnamed[2807]: managed-keys-zone: No DNSKE... Hint: Some lines were ellipsized, use -l toshow in full.

測試

# nslookup

> server192.168.188.15

Default server: 192.168.188.15

Address: 192.168.188.15#53

>www.bigcloud.local.

Server:        192.168.188.15

Address:       192.168.188.15#53

 

Name:  www.bigcloud.local

Address: 192.168.188.15

>smtp.bigcloud.local.

Server:        192.168.188.15

Address:       192.168.188.15#53

 

smtp.bigcloud.local     canonical name = mailyh1.bigcloud.local.

Name:  mailyh1.bigcloud.local

Address: 192.168.188.22

>192.168.188.15

Server:        192.168.188.15

Address:       192.168.188.15#53

 

15.188.168.192.in-addr.arpa     name = ftp.bigcloud.local.

15.188.168.192.in-addr.arpa     name = zzsrv1.bigcloud.local.

> exit

 

zzyh2上的DNS配置

      安裝BIND

與zzyh1上的主DNS配安裝同樣。

操做略。        

      配置

Cache Only Server

與zzyh1上的主DNS配安裝同樣。

操做略。

 

添加輔助Zone

# vi /etc/named.conf

添加以下zone信息

 

zone "bigcloud.local" IN {

       type slave;

       masters {192.168.188.15; };

       file "bigcloud.local.zone";

};

 

zone "188.168.192.in-addr.arpa"IN {

       type slave;

       masters {192.168.188.15; };

       file "192.168.188.zone";

};

 

zone "189.168.192.in-addr.arpa"IN {

       type slave;

       masters {192.168.188.15; };

       file "192.168.189.zone";

};

 

 

修改目錄權限

[root@zzyh2 named]# ll /var/named/ -d

drwxr-x--- 6 root named 133 Aug 15 14:06/var/named/

[root@zzyh2 named]# chmod g+w /var/named/

[root@zzyh2 named]# ll /var/named/ -d

drwxrwx--- 6 root named 133 Aug 15 14:06/var/named/

 

 

 

啓動服務

[root@zzyh2 ~]# systemctl startnamed.service

Redirecting to /bin/systemctl restart  named.service

設置爲自動啓動

[root@zzyh2 ~]# systemctl enable named

ln -s'/usr/lib/systemd/system/named.service''/etc/systemd/system/multi-user.target.wants/named.service'

 

查看日誌，檢查是否有報錯信息。（建議在啓動時，就在另一個會話時就打開）

# tail -f /var/log/messages

測試BIND

在zzyh1上生成了相應的zone文件

[root@zzyh2 ~]# ll /var/named/

total 28

-rw-r--r-- 1 named named  451 Aug 15 14:58 192.168.188.zone

-rw-r--r-- 1 named named  254 Aug 15 15:05 192.168.189.zone

-rw-r--r-- 1 named named  647 Aug 15 15:16 bigcloud.local.zone

drwxr-x--- 7 root  named  56 Aug 15 14:06 chroot

drwxrwx--- 2 named named   22 Aug 15 14:19 data

drwxrwx--- 2 named named   58 Aug 15 16:20 dynamic

-rw-r----- 1 root  named 2076 Jan 28  2013 named.ca

-rw-r----- 1 root  named 152 Dec 15  2009 named.empty

-rw-r----- 1 root  named 152 Jun 21  2007 named.localhost

-rw-r----- 1 root  named 168 Dec 15  2009 named.loopback

drwxrwx--- 2 named named    6 Jun 10 16:13 slaves

 

 

[root@zzyh1 ~]# vi /var/named/bigcloud.local.zone

添加一個A記錄

test    IN A 10.0.0.1

而且將，zone的序列號增大

 

[root@zzyh1 ~]# rndc reload

server reload successful

 

在zzyh1的日誌中會看到

zone bigcloud.local/IN: sending notifiesrial 15)

client 192.168.188.16#41658 (bigcloud.loc:transfer of 'bigcloud.local/IN': AXFR-style IXFR started

client 192.168.188.16#41658 (bigcloud.loc:transfer of 'bigcloud.local/IN': AXFR-style IXFR ended

 

 

在zzyh2的日誌中會看到

client 192.168.188.15#33856: received notifyfor zone 'bigcloud.local'

zone bigcloud.local/IN: Transfer started.

transfer of 'bigcloud.local/IN' from192.168.188.15#53: connected using 192.168.188.16#41658

zone bigcloud.local/IN: transferred serial15

transfer of 'bigcloud.local/IN' from192.168.188.15#53: Transfer completed: 1 messages, 13 records, 339 bytes, 0.005secs (67800 bytes/sec)

zone bigcloud.local/IN: sending notifies(serial 15)

測試

# nslookup

> server 192.168.188.16

Default server: 192.168.188.16

Address: 192.168.188.16#53

> test.bigcloud.local.

Server:         192.168.188.16

Address:        192.168.188.16#53

 

Name:  test.bigcloud.local

Address: 10.0.0.1

> exit