02.安装前准备-安装bind

1.涉及服务器：server10

2.安装bind（server10 安装bind）
[root@server10 ~]# yum install -y bind

2.1修改主配置文件 （forwarders为网关或者dns）

[root@server10 ~]# cat /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {
        listen-on port 53 { 20.0.0.10; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
        allow-query     { any; };
        forwarders      { 20.0.0.2; };

        /* 
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable 
           recursion. 
         - If your recursive DNS server has a public IP address, you MUST enable access 
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification 
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface 
        */
        recursion yes;  

        dnssec-enable no;
        dnssec-validation no;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.root.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

[root@server10 ~]# 

2.2 配置区域文件
增加末尾增加两个zone配置，leon.com为业务域，host.com.zone为主机域

[root@server10 ~]# tail -12  /etc/named.rfc1912.zones 

zone "host.com" IN {
        type master;
        file "host.com.zone";
        allow-update { 20.0.0.10; };
};

zone "leon.com" IN {
        type  master;
        file  "leon.com.zone";
        allow-update { 20.0.0.10; };
};
[root@server10 ~]# 

2.3 配置主机域文件
line6中时间需要修改，注意格式为2020010501共10位数字，少了或多了会报错。

[root@server10 ~]# cat /var/named/host.com.zone
$ORIGIN host.com.
$TTL 600  ; 10 minutes
@       IN SOA  dns.host.com. dnsadmin.host.com. (
        2020112401 ; serial
        10800      ; refresh (3 hours)
        900        ; retry (15 minutes)
        604800     ; expire (1 week)
        86400      ; minimum (1 day)
        )
      NS   dns.host.com.
$TTL 60 ; 1 minute
dns                A    20.0.0.10
server10           A    20.0.0.10
server11           A    20.0.0.11
server12           A    20.0.0.12
server13           A    20.0.0.13
server14           A    20.0.0.14
[root@server10 ~]# 

2.4 配置业务域文件

[root@server10 ~]# cat /var/named/leon.com.zone 
$ORIGIN leon.com.
$TTL 600  ; 10 minutes
@       IN SOA  dns.leon.com. dnsadmin.leon.com. (
        2020112401 ; serial
        10800      ; refresh (3 hours)
        900        ; retry (15 minutes)
        604800     ; expire (1 week)
        86400      ; minimum (1 day)
        )
        NS   dns.leon.com.
$TTL 60 ; 1 minute
dns                A    20.0.0.10
[root@server10 ~]# 

2.5 启动bind服务

[root@server10 ~]# named-checkconf
[root@server10 ~]# systemctl start named ; systemctl enable named
[root@server10 ~]# 

2.6 修改所有服务器的dns为server10的ip，并配置/etc/resolv.conf

[root@server11 ~]# cat /etc/sysconfig/network-scripts/ifcfg-ens33
TYPE=Ethernet
NAME=ens33
DEVICE=ens33
ONBOOT=yes
BOOTPROTO=static
IPADDR=20.0.0.11
NETMASK=255.0.0.0
GATEWAY=20.0.0.2
DNS1=20.0.0.10
[root@server13 ~]# 

[root@server11 ~]# systemctl restart network
[root@server11 ~]# cat /etc/resolv.conf
; generated by /usr/sbin/dhclient-script
search host.com
nameserver 20.0.0.10
[root@server11 ~]#

实际操作过程中发现重启网卡后 /etc/resolv.conf里加的search host.com 会还原，考虑用计划任务每分钟执行：echo "search host.com" >> /etc/resolv.conf

2.7 测试：
host 主机名 dns地址

[root@server11 ~]# host  server10  20.0.0.10
Using domain server:
Name: 20.0.0.10
Address: 20.0.0.10#53
Aliases: 

server10.host.com has address 20.0.0.10

[root@server11 ~]# host  server11  20.0.0.10
Using domain server:
Name: 20.0.0.10
Address: 20.0.0.10#53
Aliases: 

server11.host.com has address 20.0.0.11

[root@server11 ~]# host  server12  20.0.0.10
Using domain server:
Name: 20.0.0.10
Address: 20.0.0.10#53
Aliases: 

server12.host.com has address 20.0.0.12
[root@server11 ~]# 

2.8 也可以使用dig测试：

[root@server11 ~]# dig -t A server10.host.com @20.0.0.10 +short
20.0.0.10
[root@server11 ~]# dig -t A server11.host.com @20.0.0.10 +short
20.0.0.11
[root@server11 ~]# dig -t A server12.host.com @20.0.0.10 +short
20.0.0.12
[root@server11 ~]# dig -t A server13.host.com @20.0.0.10 +short
20.0.0.13
[root@server11 ~]# dig -t A server14.host.com @20.0.0.10 +short
20.0.0.14
[root@server11 ~]#