服務管理-DNS

DNS服務

DNS（Domain Names System，域名系統），因特網上做爲域名和IP地址相互映射的一個分佈式數據庫，可以使用戶更方便的訪問互聯網，而不用去記住可以被機器直接讀取的IP地址。經過主機名，最終獲得該主機名對應的IP地址的過程叫作域名解析。DNS協議運行在UDP之上，使用的端口號是53.

BIND實現正向區解析

[root@localhost ~]# yum install bind
[root@localhost ~]# vim /etc/named.conf 
[root@localhost ~]# 

[root@localhost ~]# cd /var/named/
[root@localhost named]# ls
data  dynamic  named.ca  named.empty  named.localhost  named.loopback  slaves
[root@localhost named]# cp named.localhost named.zyg
[root@localhost named]# vim named.zyg 
[root@localhost named]# 

[root@localhost named]# chgrp named named.zyg 
[root@localhost named]# systemctl start named

 在啓動的時候可能會報：Failed to start Berkeley Internet Name Domain (DNS)

原來是我在寫配置文件的時候少寫了兩個分號致使的。。

[root@localhost named]# vim /etc/resolv.conf 

bind實現方向區解析

[root@localhost named]# vim /etc/named.conf 

[root@localhost named]# cp named.zyg named.210.29.172
[root@localhost named]# vim named.210.29.172 
[root@localhost named]# 

[root@localhost named]# chgrp named named.210.29.172 
[root@localhost named]# systemctl restart named
[root@localhost named]# 

智能DNS

普通的DNS服務器只負責爲用戶解析出IP記錄，而不去判斷用戶從哪裏來，這樣會形成全部用戶都只能解析到固定的IP地址上。

智能DNS顛覆了這個概念。智能DNS會判斷用戶的來路，而作出一些智能化的處理，而後把智能化判斷後的IP地址返回給用戶，好比：智能DNS就會自動判斷用戶的上網線路是網通仍是典型，而後智能返回網通或者典型的服務器IP地址。

server：

--------------------------------------------------------------------------------------------------------------------------

[root@localhost named]# cat /etc/named.conf 
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {
    listen-on port 53 { 127.0.0.1; any; };
    listen-on-v6 port 53 { ::1; };
    directory     "/var/named";
    dump-file     "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    allow-query     { localhost; any; };

    /* 
     - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
     - If you are building a RECURSIVE (caching) DNS server, you need to enable 
       recursion. 
     - If your recursive DNS server has a public IP address, you MUST enable access 
       control to limit queries to your legitimate users. Failing to do so will
       cause your server to become part of large scale DNS amplification 
       attacks. Implementing BCP38 within your network would greatly
       reduce such attack surface 
    */
    recursion yes;

    dnssec-enable yes;
    dnssec-validation yes;

    /* Path to ISC DLV key */
    bindkeys-file "/etc/named.iscdlv.key";

    managed-keys-directory "/var/named/dynamic";

    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
    type hint;
    file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

zone "zyg.com" {
    type master;
    file "named.zyg";
};

zone "210.29.172.in-addr.arpa" {
    type master;
    file "named.210.29.172";
};
[root@localhost named]# 

client：

-------------------------------------------------------------------------------------------------------------------------

[root@localhost named]# cat /etc/resolv.conf 
# Generated by NetworkManager
search zyg.com
nameserver 10.0.0.2
[root@localhost named]# 

 

更多請百度度。。用到了會補全的，如今沒空研究。。