【Linux】【Services】【DNS】使用Bind搭建DNS服务
1. 简介
1.1. 实现的功能：DNS解析以及智能转发
1.2. 官方文档：
1.3. 基础概念：http://www.cnblogs.com/demonzk/p/6494968.html
2. 环境：
2.1. OS：Red Hat Enterprise Linux Server release 7.4 (Maipo)
2.2. Kernel：3.10.0-693.el7.x86_64
2.3. Bind：9.9.4-51.el7_4.1
3. 安装：
3.1. 操作系统：（略）
3.2. 配置yum：（略）
3.2. 安装bind
yum install bind
3.3. 在主节点172.16.0.81上修改配置文件/etc/named.conf，监听端口打开，不必要的选项注释掉或者写no
options { listen-on port 53 { 172.16.0.81; }; listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; //allow-query { localhost; }; /* - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. - If you are building a RECURSIVE (caching) DNS server, you need to enable recursion. - If your recursive DNS server has a public IP address, you MUST enable access control to limit queries to your legitimate users. Failing to do so will cause your server to become part of large scale DNS amplification attacks. Implementing BCP38 within your network would greatly reduce such attack surface */ recursion yes; dnssec-enable no; dnssec-validation no; /* Path to ISC DLV key */ bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic"; pid-file "/run/named/named.pid"; session-keyfile "/run/named/session.key"; }; logging { channel default_debug { file "/var/log/named/default.log"; severity dynamic; }; channel query_logs { file "/var/log/named/bind.log"; severity info; print-severity yes; print-time yes; print-category yes; }; }; zone "." IN { type hint; file "named.ca"; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key"; zone "hccos.cn" IN { type master; file "hccos.cn.zone"; allow-transfer { 172.16.0.82; }; notify yes; also-notify { 172.16.0.82; }; }; zone "0.16.172.in-addr.arpa" IN { type master; file "0.16.172.in-addr.arpa.zone"; allow-transfer { 172.16.0.82; }; notify yes; also-notify { 172.16.0.82; }; };
在主节点上配置正向解析文件/var/named/hccos.cn.zone
$TTL 3600 $ORIGIN hccos.cn. @ IN SOA hctjosinfra01.hccos.cn. hctjosinfra01.hccos.cn. ( 2018010301 ; serial 2H ; refresh 10M ; retry 1W ; expire 1D ; negative answer ttl ) ;ns server IN NS hctjosinfra01 IN NS hctjosinfra02 ;docker+k8s hctjosinfra01 IN A 172.16.0.81 hctjosinfra02 IN A 172.16.0.82 hctjosetcd01 IN A 172.16.0.83 hctjosetcd02 IN A 172.16.0.84 hctjosetcd03 IN A 172.16.0.85 hctjcephmon01 IN A 172.16.0.86 hctjcephmon02 IN A 172.16.0.87 hctjcephmon03 IN A 172.16.0.88 hctjcephadm01 IN A 172.16.0.89 hctjosk8smaster01 IN A 172.16.0.90 hctjosk8sslave01 IN A 172.16.0.91 hctjosk8sslave02 IN A 172.16.0.92 hctjcephblock01 IN A 172.16.0.93 hctjcephblock02 IN A 172.16.0.94 hctjosk8snode01 IN A 172.16.0.95 hctjosk8snode02 IN A 172.16.0.96 hctjosk8snode03 IN A 172.16.0.97 hctjosk8snode04 IN A 172.16.0.98 ;openstack hctjosmysql01 IN A 172.16.0.25 hctjosmysql02 IN A 172.16.0.26 hctjosmysql03 IN A 172.16.0.27 hctjoscache01 IN A 172.16.0.45 hctjoscache02 IN A 172.16.0.46 hctjoscache03 IN A 172.16.0.47 hctjosdr01 IN A 172.16.0.48 hctjosdr02 IN A 172.16.0.49
在主节点上配置反向解析文件/var/named/0.16.172.in-addr.arpa.zone
$TTL 3600 $ORIGIN 0.16.172.in-addr.arpa. @ IN SOA hctjosinfra01.hccos.cn. hctjosinfra01.hccos.cn. ( 20180103 1H 10M 3D 12H ) IN NS hctjosinfra01.hccos.cn. IN NS hctjosinfra02.hccos.cn. ;docker+k8s 81 IN PTR hctjosinfra01.hccos.cn. 82 IN PTR hctjosinfra02.hccos.cn. 83 IN PTR hctjosetcd01.hccos.cn. 84 IN PTR hctjosetcd02.hccos.cn. 85 IN PTR hctjosetcd03.hccos.cn. 86 IN PTR hctjcephmon01.hccos.cn. 87 IN PTR hctjcephmon02.hccos.cn. 88 IN PTR hctjcephmon03.hccos.cn. 89 IN PTR hctjcephadm01.hccos.cn. 90 IN PTR hctjosk8smaster01.hccos.cn. 91 IN PTR hctjosk8sslave01.hccos.cn. 92 IN PTR hctjosk8sslave02.hccos.cn. 93 IN PTR hctjcephblock01.hccos.cn. 94 IN PTR hctjcephblock02.hccos.cn. 95 IN PTR hctjosk8snode01.hccos.cn. 96 IN PTR hctjosk8snode02.hccos.cn. 97 IN PTR hctjosk8snode03.hccos.cn. 98 IN PTR hctjosk8snode04.hccos.cn. ;openstack 25 IN PTR hctjosmysql01.hccos.cn. 26 IN PTR hctjosmysql02.hccos.cn. 27 IN PTR hctjosmysql03.hccos.cn. 45 IN PTR hctjoscache01.hccos.cn. 46 IN PTR hctjoscache02.hccos.cn. 47 IN PTR hctjoscache03.hccos.cn. 48 IN PTR hctjosdr01.hccos.cn. 49 IN PTR hctjosdr02.hccos.cn.
3.4. 在slave节点上配置/etc/named.conf
options { listen-on port 53 { 172.16.0.82; }; listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; //allow-query { localhost; }; /* - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. - If you are building a RECURSIVE (caching) DNS server, you need to enable recursion. - If your recursive DNS server has a public IP address, you MUST enable access control to limit queries to your legitimate users. Failing to do so will cause your server to become part of large scale DNS amplification attacks. Implementing BCP38 within your network would greatly reduce such attack surface */ recursion yes; //dnssec-enable yes; //dnssec-validation yes; /* Path to ISC DLV key */ bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic"; pid-file "/run/named/named.pid"; session-keyfile "/run/named/session.key"; }; logging { channel default_debug { file "/var/log/named/default.log"; severity dynamic; }; channel query_logs { file "/var/log/named/bind.log"; severity info; print-severity yes; print-time yes; print-category yes; }; }; zone "." IN { type hint; file "named.ca"; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key"; zone "hccos.cn" IN { type slave; file "slaves/hccos.cn.zone"; masters { 172.16.0.81; }; }; zone "0.16.172.in-addr.arpa" IN { type slave; file "slaves/0.16.172.in-addr.arpa.zone"; masters { 172.16.0.81; }; };
