CentOS 7 yum搭建DNS Bind主从集群

1 概述

DNS域名解析服务(Domain Name System)是用于解析域名与IP地址对应关系的服务,功能上可以实现正向解析反向解析

  正向解析:根据主机名(域名)查找对应的IP地址。

  反向解析:根据IP地址查找对应的主机名(域名)。

 

工作形式上又分主服务器从服务器缓存服务器

  主服务器:在特定区域内具有唯一性、负责维护该区域内的域名与IP地址对应关系。

  从服务器:从主服务器中获得域名与IP地址对应关系并维护,以防主服务器宕机等情况。

  缓存服务器:通过向其他域名解析服务器查询获得域名与IP地址对应关系,提高重复查询时的效率

2 安装Bind服务程序:

2.1 准备环境

Centos 7.x

 

 

yum install bind bind-utils -y

#备注:如下操作无效
#yum -y install bind-chroot

域名解析服务Bind的程序名称叫做named,服务程序的配置文件如下:

主程序 /usr/sbin/named
主配置文件 /etc/named.conf
区域配置文件 /etc/named.rfc1912.zones

2.2 编辑主配置文件

[root@Centos ~]# cp /etc/named.conf{,.ori}

[root@Centos ~]# vim /etc/named.conf    #注释的为要修改的行
修改1:
listen-on port 53 { 127.0.0.1; }; //127.0.0.1修改为any,代表允许监听任何IP地址。修改为如下:

listen-on port 53 { any; };

修改2:
allow-query { localhost; }; //localhost修改为any,代表允许任何主机查询。修改为如下:
allow-query { any; };

 

2.3 正向解析

第1步:配置区域数据信息。

正向解析的作用是根据主机名(域名)查找到对应的IP地址,区域文件中已有一些默认信息,可不必理会,直接在下面追加即可:

vim /etc/named.rfc1912.zones

zone "music.com" IN {
        type master;
        file "music.com.zone";
        allow-update { none; };
};

第2步:配置解析数据信息:

  我们可以直接复制正向解析模板文件:"/var/named/named.localhost",填写信息后即可直接使用。

[root@Centos ~]# cd /var/named/
[root@Centos named]# cp -a named.localhost music.com.zone
[root@Centos named]# vim music.com.zone 

$TTL 1D      
@       IN SOA  music.com. scottcho.qq.com. (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      ns.music.com.
ns      IN A    192.168.0.85
        IN MX 10 mail.music.com.
mail    IN A     192.168.0.85
www     IN A     192.168.0.85
bbs     IN A     192.168.0.95

重启named服务让配置文件立即生效:

[root@Centos named]# systemctl restart named

 

第3步:检验解析结果。

将本机的DNS设置为本机的IP 192.168.0.85

[root@Centos named]# cat /etc/resolv.conf
# Generated by NetworkManager
search test

nameserver 192.168.0.85

nslookup命令用于检测能否从网络DNS服务器中查询到域名与IP地址的解析记录,检测named服务的解析能否成功。
此为查询DNS服务器的信息:

[root@Centos named]# nslookup 
> www.music.com
Server:        192.168.0.85
Address:    192.168.0.85#53

Name:    www.music.com
Address: 192.168.0.85
> mail.music.com
Server:        192.168.0.85
Address:    192.168.0.85#53

Name:    mail.music.com
Address: 192.168.0.85
> bbs.music.com
Server:        192.168.0.85
Address:    192.168.0.85#53

Name:    bbs.music.com
Address: 192.168.0.95
> ns.music.com
Server:        192.168.0.85
Address:    192.168.0.85#53

Name:    ns.music.com
Address: 192.168.0.85

2.4 反向解析实验-可以不配置

第1步:配置区域数据信息。

  反向解析的作用是根据IP地址查找到对应的主机名(域名),在区域文件(named.rfc1912.zones)中默认已存在一些注释内容与区域信息,可不需要删除上面实验及默认区域信息,直接在下面追加即可。

[root@Centos named]# vim /etc/named.rfc1912.zones

zone "0.168.192.in-addr.arpa" IN {
        type master;
        file "192.168.0.arpa";
        allow-update { none; };
};

第2步:配置解析数据信息。

[root@Centos named]# vim /etc/named.rfc1912.zones 
[root@Centos named]# cp -a named.loopback 192.168.0.arpa

[root@Centos named]# vim 192.168.0.arpa 

$TTL 1D          
@       IN SOA  music.com. scottcho.qq.com. (
    #授权信息开始:#DNS区域的地址#域名管理员的邮箱(不要用@符号)
0       ; serial    #更新序列号
                                        1D      ; refresh   #更新时间
                                        1H      ; retry   #重试延时
                                        1W      ; expire   #失效时间
                                        3H )    ; minimum  #无效解析记录的缓存时间
        NS      ns.music.com.       #域名服务器记录    
ns      A       192.168.0.85        #地址记录
85      PTR     ns.music.com.      #PTR为指针记录,仅用于反向解析中
85      PTR     mail.music.com.
85      PTR     www.music.com
95      PTR     bbs.music.com

 

第3步:检验解析结果。

重启named服务程序,让配置文件立即生效:

[root@Centos named]# systemctl restart named

执行nslookup命令检查反向解析结果:

root@Centos named]# nslookup 
> 192.168.0.85
Server:        192.168.0.85
Address:    192.168.0.85#53

85.0.168.192.in-addr.arpa    name = mail.music.com.
85.0.168.192.in-addr.arpa    name = ns.music.com.
85.0.168.192.in-addr.arpa    name = www.music.com.0.168.192.in-addr.arpa.
> 192.168.0.95
Server:        192.168.0.85
Address:    192.168.0.85#53

95.0.168.192.in-addr.arpa    name = bbs.music.com.0.168.192.in-addr.arpa.

 

2.5 配置dns转发服务器

[root@Centos named]# vim /etc/named.conf   配置如下参数
        allow-query     { any; };
        forwarders { 114.114.114.114; 8.8.8.8; 223.5.5.5; 223.6.6.6; };  

如下所示:

options {
        listen-on port 53 { any; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
        allow-query     { any; };
        forwarders { 114.114.114.114; 8.8.8.8; 223.5.5.5; 223.6.6.6; };

        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.root.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

...省略...

 

3 主从复制配置

主DNS:192.168.15.98

从DNS:192.168.15.99

 

3.1 主DNS配置

3.1.1 主配置文件

只看“// 修改为”部分即可

[root@szxlkl01-dns-98 ~]# cat /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {
        listen-on port 53 { any; };                           // 修改为:any                           
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
        allow-query     { any; };                         // 修改为:any;允许查询
        forwarders { 114.114.114.114; 8.8.8.8; 223.5.5.5; 223.6.6.6; };  // 修改为:外网DNS服务器;转发配置

        /* 
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable 
           recursion. 
         - If your recursive DNS server has a public IP address, you MUST enable access 
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification 
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface 
        */
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.root.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

[root@szxlkl01-dns-98 ~]# 

3.1.2 配置域名区域

只看// lakala.com后面部分

以lakala.com为例:// lakala.com后面增加一个域名区域

[root@szxlkl01-dns-98 ~]# cat /etc/named.rfc1912.zones
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package 
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
// 
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

zone "localhost.localdomain" IN {
        type master;
        file "named.localhost";
        allow-update { none; };
};

zone "localhost" IN {
        type master;
        file "named.localhost";
        allow-update { none; };
};

zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
        type master;
        file "named.loopback";
        allow-update { none; };
};

zone "1.0.0.127.in-addr.arpa" IN {
        type master;
        file "named.loopback";
        allow-update { none; };
};

zone "0.in-addr.arpa" IN {
        type master;
        file "named.empty";
        allow-update { none; };
};

// lakala.com
zone "lakala.com" IN { type master; file "lakala.com.zone"; masterfile-format text; allow-update {none;}; allow-transfer {192.168.15.99;}; notify yes; also-notify {192.168.15.99;}; }; [root@szxlkl01-dns-98 ~]#

3.1.3 配置域名解析

[root@szxlkl01-dns-98 ~]# cat /var/named/lakala.com.zone 
$TTL 1D
$ORIGIN lakala.com.
@       IN SOA  ns.lalala.com. root.localhost. (
11       ; serial
1D      ; refresh
1H      ; retry
1W      ; expire
3H     ; minimum
)
@                       IN      NS              ns1.lakala.com.
@                       IN      NS              ns2.lakala.com.
ns1                     IN      A               192.168.15.98
ns2                     IN      A               192.168.15.99

; vuat environment
vuat.fintech    IN A    10.68.8.64
vuat.fintech    IN A    10.68.8.65

赋予普通账号named权限,主从都要赋予,否则无法主从自动同步,因为binddns是以普通账号named运行的。

[root@szxlkl01-dns-98 ~]# chown -R named.named /var/named/*

[root@szxlkl01-dns-98 ~]# ps -ef|grep named
named 30579 1 0 18:27 ? 00:00:05 /usr/sbin/named -u named -c /etc/named.conf
root 31195 28129 0 18:50 pts/0 00:00:00 grep --color=auto named
[root@szxlkl01-dns-98 ~]#

3.2 从DNS配置

3.2.1 主配置文件

和主DNS一样的

3.2.2 配置域名区域

以lakala.com为例:// lakala.com后面增加一个域名区域

[root@szxlkl02-dns-99 ~]# cat /etc/named.rfc1912.zones 
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package 
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
// 
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

zone "localhost.localdomain" IN {
        type master;
        file "named.localhost";
        allow-update { none; };
};

zone "localhost" IN {
        type master;
        file "named.localhost";
        allow-update { none; };
};

zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
        type master;
        file "named.loopback";
        allow-update { none; };
};

zone "1.0.0.127.in-addr.arpa" IN {
        type master;
        file "named.loopback";
        allow-update { none; };
};

zone "0.in-addr.arpa" IN {
        type master;
        file "named.empty";
        allow-update { none; };
};


// lakala.com

zone "lakala.com" IN {
        type slave;
        masters { 192.168.15.98; };
        file "lakala.com.zone";
        masterfile-format text;
};

[root@szxlkl02-dns-99 ~]# 

3.1.3 配置域名解析

从DNS不需要配置域名解析/var/named/lakala.com.zone 

因为主域名更新后,执行修改serial +1后,在执行命令: rndc reload  后

从DNS对应域名配置文件/var/named/lakala.com.zone就会自动同步。

3.3 验证主从复制

3.3.1 需求:增删解析

DNS加一条记录:10.68.8.65 vuat.fintech.lakala.com

3.3.2 主DNS编辑配置文件

vim /var/named/lakala.com.zone
1、serial 号+1

2、加记录:vuat.fintech IN A 10.68.8.65

详情如下所示:

[root@szxlkl01-dns-98 ~]# vim /var/named/lakala.com.zone

$TTL 1D
$ORIGIN lakala.com.
@ IN SOA ns.lakala.com. root.localhost. (
12 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ; minimum
)
@ IN NS ns1.lakala.com.
@ IN NS ns2.lakala.com.
ns1 IN A 192.168.15.98
ns2 IN A 192.168.15.99

; vuat environment
vuat.fintech IN A 10.68.8.64
vuat.fintech IN A 10.68.8.65

 

主DNS执行同步命令

[root@szxlkl01-dns-98 ~]# rndc reload
server reload successful
[root@szxlkl01-dns-98 ~]# 

3.3.3 从DNS上看已同步

[root@szxlkl02-dns-99 ~]# cat /var/named/lakala.com.zone
$ORIGIN . $TTL
86400 ; 1 day lakala.com IN SOA ns.lakala.com. root.localhost. ( 12 ; serial 86400 ; refresh (1 day) 3600 ; retry (1 hour) 604800 ; expire (1 week) 10800 ; minimum (3 hours) ) NS ns1.lakala.com. NS ns2.lakala.com. $ORIGIN lakala.com. vuat A 192.168.15.64 A 192.168.15.65

3.3.4 dig命令和nslookup查看

linux客户端配置DNS为192.168.15.98和192.168.15.99

[root@szxlkl01-dns-98 ~]# mkdir /var/named/logs/

logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};

修改为

logging {
file "/var/named/logs/bind_query.log" versions 3 10M;
severity dynamic;
print-category yes;
print-time yes; // 表示记录日志的时间
print-severity yes; // 表示记录日志级别
};
category queries { query_log; }; // 表示queries类型的DNS日志信息全部记录到query_log这个channel中
};

 

4 增加域名区域-举例:huawei.com

4.1 主DNS配置

4.1.1 配置域名区域

只看// huawei.com后面部分

以huawei.com为例:// huawei.com后面增加一个域名区域

[root@szxlkl01-dns-98 ~]# vim /etc/named.rfc1912.zones    
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package 
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
// 
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

zone "localhost.localdomain" IN {
        type master;
        file "named.localhost";
        allow-update { none; };
};

zone "localhost" IN {
        type master;
        file "named.localhost";
        allow-update { none; };
};

zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
        type master;
        file "named.loopback";
        allow-update { none; };
};

zone "1.0.0.127.in-addr.arpa" IN {
        type master;
        file "named.loopback";
        allow-update { none; };
};

zone "0.in-addr.arpa" IN {
        type master;
        file "named.empty";
        allow-update { none; };
};


// lakala.com
zone "lakala.com" IN {
        type master;
        file "lakala.com.zone";
        masterfile-format text;
        allow-update {none;};
        allow-transfer {192.168.15.99;};
        notify yes;
        also-notify {192.168.15.99;};
};

//huawei.com
zone "huawei.com" IN {
        type master;
        file "huawei.com.zone";
        masterfile-format text;
        allow-update {none;};
        allow-transfer {192.168.15.99;};
        notify yes;
        also-notify {192.168.15.99;};
};

 

 

4.1.2 配置域名解析

[root@szxlkl01-dns-98 ~]# cat /var/named/huawei.com.zone 
$TTL 1D
$ORIGIN huawei.com.
@       IN SOA  ns.lalala.com. root.localhost. (
11       ; serial
1D      ; refresh
1H      ; retry
1W      ; expire
3H     ; minimum
)
@                       IN      NS              ns1.lakala.com.
@                       IN      NS              ns2.lakala.com.
ns1                     IN      A               192.168.15.98
ns2                     IN      A               192.168.15.99

; vuat environment
test1    IN A    192.168.15.81

赋予普通账号named权限,主从都要赋予,否则无法主从自动同步,因为binddns是以普通账号named运行的。

[root@szxlkl01-dns-98 ~]# chown -R named.named /var/named/*

[root@szxlkl01-dns-98 ~]# ps -ef|grep named
named 30579 1 0 18:27 ? 00:00:05 /usr/sbin/named -u named -c /etc/named.conf
root 31195 28129 0 18:50 pts/0 00:00:00 grep --color=auto named
[root@szxlkl01-dns-98 ~]#

4.2 从DNS配置

4.2.1 配置域名区域

只看// huawei.com后面部分

以huawei.com为例:// huawei.com后面增加一个域名区域

[root@szxlkl02-dns-99 ~]# cat /etc/named.rfc1912.zones    
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package 
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
// 
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

zone "localhost.localdomain" IN {
        type master;
        file "named.localhost";
        allow-update { none; };
};

zone "localhost" IN {
        type master;
        file "named.localhost";
        allow-update { none; };
};

zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
        type master;
        file "named.loopback";
        allow-update { none; };
};

zone "1.0.0.127.in-addr.arpa" IN {
        type master;
        file "named.loopback";
        allow-update { none; };
};

zone "0.in-addr.arpa" IN {
        type master;
        file "named.empty";
        allow-update { none; };
};


// lakala.com
zone "lakala.com" IN {
        type slave;
        masters { 192.168.15.98; };
        file "lakala.com.zone";
        masterfile-format text;
};
// huawei.com
zone "huawei.com" IN {
        type slave;
        masters { 192.168.15.98; };
        file "huawei.com.zone";
        masterfile-format text;
};

4.2.2 配置域名解析

从dns不需要配置域名解析

只需要配置权限即可

[root@szxlkl02-dns-99 ~]# chown -R named.named /var/named/

 

4.3 触发主从同步

在主dns上重启named服务

[root@szxlkl01-dns-98 ~]# systemctl restart named

在从dns上重启dns服务

[root@szxlkl02-dns-99 ~]# systemctl restart named
此时自动同步到从dns了

[root@szxlkl02-dns-99 ~]# cat /var/named/huawei.com.zone
$ORIGIN .
$TTL 86400 ; 1 day
huawei.com IN SOA ns.lalala.com. root.localhost. (
11 ; serial
86400 ; refresh (1 day)
3600 ; retry (1 hour)
604800 ; expire (1 week)
10800 ; minimum (3 hours)
)
NS ns1.lakala.com.
NS ns2.lakala.com.
$ORIGIN huawei.com.
ns1 A 192.168.15.98
ns2 A 192.168.15.99
test1 A 192.168.15.81
[root@szxlkl02-dns-99 ~]#

备注:第一次主从同步必须重启各自named服务。

4.4 更新域名

在主dns上操作:

更新域名只需要在主dns上更新,更新时候serial数字要+1,更新完后rndc reload同步

更新增加:test2    IN A    192.168.15.81
[root@szxlkl01-dns-98 ~]# vim /var/named/huawei.com.zone 
$TTL 1D
$ORIGIN huawei.com.
@       IN SOA  ns.lalala.com. root.localhost. (
11       ; serial
1D      ; refresh
1H      ; retry
1W      ; expire
3H     ; minimum
)
@                       IN      NS              ns1.lakala.com.
@                       IN      NS              ns2.lakala.com.
ns1                     IN      A               192.168.15.98
ns2                     IN      A               192.168.15.99

; vuat environment
test1    IN A    192.168.15.81
test2    IN A    192.168.15.81

[root@szxlkl01-dns-98 ~]# rndc reload
server reload successful
[root@szxlkl01-dns-98 ~]#

此时在从dns查看已更新test2这条记录

[root@szxlkl02-dns-99 ~]# cat /var/named/huawei.com.zone 
$ORIGIN .
$TTL 86400      ; 1 day
huawei.com              IN SOA  ns.lalala.com. root.localhost. (
                                12         ; serial
                                86400      ; refresh (1 day)
                                3600       ; retry (1 hour)
                                604800     ; expire (1 week)
                                10800      ; minimum (3 hours)
                                )
                        NS      ns1.lakala.com.
                        NS      ns2.lakala.com.
$ORIGIN huawei.com.
ns1                     A       192.168.15.98
ns2                     A       192.168.15.99
test1                   A       192.168.15.81
test2                   A       192.168.15.81
[root@szxlkl02-dns-99 ~]# 

4.4 验证

 

参考:

https://blog.51cto.com/zhubo/1893954

https://www.cnblogs.com/long-cnblogs/p/10524808.html

https://blog.csdn.net/zhu_tianwei/article/details/45103455

 

 

 

 

 

 

参考:

https://www.cnblogs.com/zydev/p/6293745.html

https://www.cnblogs.com/zhangb8042/p/10978127.html

https://www.cnblogs.com/f-ck-need-u/p/7367503.html

 

posted @ 2019-10-14 20:14  老虎逛大街  阅读(1666)  评论(0)    收藏  举报
levels of contents