标签：linux
已经有3年多没有用linux的bind了，最近因为工作需要，又开始搭建一个bind来工作。Centos7的bind一般是没有问题的，但是，如果要加入chroot就会有一些改动。这个改动也让我研究了几天。呵呵。
环境CenOS7.2 本机IP:172.31.21.245
直接上代码：
yum安装bind bind-utils bind-chroot
| [root@localhost ~]# yum -y install bind bind-utils bind-chroot |
bind bind主程序
bind-utils bind的一些工具，如：nslookup
bind-chroot bind的安全性软件
2.将named.conf复制到/var/named/choot/etc里面
| [root@localhost ~]# cp -p /etc/named.conf /var/named/chroot/etc/ |
3.修改named.conf
[root@localhost ~]# vi /var/named/chroot/etc/named.conf // // named.conf // // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS // server as a caching only nameserver (as a localhost DNS resolver only). // // See /usr/share/doc/bind*/sample/ for example named configuration files. // options { listen-on port 53 { any; }; //监听端口 listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; allow-query { any; }; //查询 /* - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. - If you are building a RECURSIVE (caching) DNS server, you need to enable recursion. - If your recursive DNS server has a public IP address, you MUST enable access control to limit queries to your legitimate users. Failing to do so will cause your server to become part of large scale DNS amplification attacks. Implementing BCP38 within your network would greatly reduce such attack surface */ recursion yes; dnssec-enable yes; dnssec-validation yes; /* Path to ISC DLV key */ bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic"; pid-file "/run/named/named.pid"; session-keyfile "/run/named/session.key"; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "." IN { type hint; file "named.ca"; }; //添加正向解析 zone "zy.com" IN { type master; file "zy.com.zone"; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key"; |
4.复制解析配置文件，并复制一个修改
[root@localhost ~]# cp -R /usr/share/doc/bind-9.9.4/sample/var/named/* /var/named/chroot/var/named/ [root@localhost ~]# cd /var/named/chroot/var/named/ [root@localhost named]# cp -p named.localhost zy.com.zone |
5.修改正向解析文件
[root@localhost named]# vi zy.com.zone $TTL 1D @ IN SOA ns1.zy.com. admin.zy.com. ( 0 ; serial 1D ; refresh 1H ; retry 1W ; expire 3H ) ; minimum NS ns1.zy.com. ns1 A 172.31.21.245 @ A 172.31.21.245 www A 172.31.21.245 |
6.启动服务并修改DNS服务器
[root@localhost named]# service named restart Redirecting to /bin/systemctl restart named.service [root@localhost named]# vi /etc/resolv.conf # Generated by NetworkManager nameserver 172.31.21.245 |
7.测试解析
本文出自 “6975456” 博客，转载请与作者联系！
标签：linux
原文地址：http://6985456.blog.51cto.com/6975456/1837335
