码迷,mamicode.com
首页 > 其他好文 > 详细

架设DNS服务器(DNS主从服务器架设)

时间:2016-10-15 00:08:33      阅读:236      评论:0      收藏:0      [点我收藏+]

标签:dns服务器   主从服务器   

  1. 搭建DNS服务器

    试验要求:以workstation(92.168.1.105)作为服务器,(可以做正向解析和反向解析),以server1(192.168.1.103)作为客户机验证

#安装bind服务

yum install bind-chroot bind-utils -y

bind安装好之后会产生若干程序和配置文件;常见的如下:

主程序:/usr/sbin/named 

主配置文件:/etc/named.conf

区域配置文件:/etc/named.rfc.1912.zones

#配置bind

vim /etc/named.conf

11         listen-on port 53 { any; };

17         allow-query     { any; };

vim /etc/named.rfc1912.zones添加

zone "example.com" IN {

        type master;

        file "example.com.zone";

        allow-update { none; };

};

添加正向解析:

cd /var/named/

cp -a named.localhost example.com.zone //复制模板文件

vim example.com.zone 

$TTL 1D

@       IN SOA example.com.     root.example.com. (

                                        0       ; serial

                                        1D      ; refresh

                                        1H      ; retry

                                        1W      ; expire

                                        3H )    ; minimum

                NS      ns.example.com.

ns              IN A    192.168.1.105

workstation     IN A    192.168.1.105

server1         IN A    192.168.1.103

#检查配置文件及添加的zone是否正确

named-checkconf /etc/named.conf 

named-checkzone example.com /var/named/example.com.zone

重启服务

systemctl restart named;systemctl enable named

在server1上用nslookup /dig /host+域名验证

yum -y install bind-chroot bind-utils

nslookup server1.example.com

Server: 192.168.1.105

Address: 192.168.1.105#53


Name: server1.example.com

Address: 192.168.1.103

 添加反向解析:

vim /etc/named.rfc1912.zones

添加

zone "1.168.192.in-addr.arpa" IN {

        type master;

        file "192.168.1.arpa";

        allow-update { none; };

};

vim 192.168.1.arpa 

$TTL 1D

@       IN SOA  example.com.    root.example.com. (

                                        0       ; serial

                                        1D      ; refresh

                                        1H      ; retry

                                        1W      ; expire

                                        3H )    ; minimum

        NS      ns.example.com.

ns      A       192.168.1.105

105     PTR     ns.example.com.

105     PTR     workstation.example.com.

103     PTR     server1.example.com.

部署从服务器:

workstation :vim /etc/named.rfc1912.zones

allow-update { server1的IP;};//正反向zone中都需要添加从服务器的IP

重启服务

systemctl restart named

server1:vim /etc/named.conf 

options {

        listen-on port 53 { any; };

        listen-on-v6 port 53 { ::1; };

        directory       "/var/named";

        dump-file       "/var/named/data/cache_dump.db";

        statistics-file "/var/named/data/named_stats.txt";

        memstatistics-file "/var/named/data/named_mem_stats.txt";

        allow-query     { any; };

在区域配置文件中添加如下:

vim /etc/named.rfc1912.zones

zone "example.com" IN {

        type slave;

        masters { 192.168.1.105; };

        file "slaves/example.com.zone";

};

zone "1.168.192.in-addr.arpa" IN {

        type slave;

        masters { 192.168.1.105; };

        file "slaves/192.168.1.arpa";

};

systemctl restart named

验证:

cd /var/named/slaves

[root@server1 slaves]# ls

192.168.1.arpa  example.com.zone

主从服务器上启用密钥加密传输

workstation:

dnssec-keygen -a HMAC-MD5 -b 128 -n HOST student//生成DNS服务密钥

cat Kstudent.+157+61155.private //查看私钥,记住key的内容,待会会用到

Private-key-format: v1.3

Algorithm: 157 (HMAC_MD5)

Key: 5GzHt48CGo+pMEGrg7ck/Q==

Bits: AAA=

Created: 20161014154442

Publish: 20161014154442

Activate: 20161014154442

vim /var/named/chroot/etc/transfer.key//新建并编辑:

添加:

key "student" {

algorithm hmac-md5;

secret "5GzHt48CGo+pMEGrg7ck/Q==";

};

chown root.named /var/named/chroot/etc/transfer.key//更改权限

ln /var/named/chroot/etc/transfer.key /etc/transfer.key//创建硬链接

vim /etc/named.conf//编辑配置文件,新增红色部分

include "/etc/transfer.key";

options {

        listen-on port 53 { any; };

        listen-on-v6 port 53 { ::1; };

        directory       "/var/named";

        dump-file       "/var/named/data/cache_dump.db";

        statistics-file "/var/named/data/named_stats.txt";

        memstatistics-file "/var/named/data/named_mem_stats.txt";

        allow-query     { any; };

        allow-transfer { key student; };

systemctl restart named//保存重启服务

在server1上验证:

rm -rf /var/named/slaves/*

systemctl restart named //首先删除未加密前产生的文件

结果如下:

[root@server1 ~]# nslookup workstation.example.com

;; Got SERVFAIL reply from 127.0.0.1, trying next server

;; Got SERVFAIL reply from 127.0.0.1, trying next server

Server: ::1

Address: ::1#53

** server can‘t find workstation.example.com.example.com: SERVFAIL//解析失败

workstation:

scp /var/named/chroot/etc/transfer.key root@192.168.1.103:/var/named/chroot/etc///把密钥发给从服务器

server1

cd /var/named/chroot/etc/

chown root:named transfer.key //更改所属组

ln transfer.key /etc/transfer.key//建立硬链接

vim /etc/named.conf

include "/etc/transfer.key";//在文件头部添加

server 192.168.1.105 {

        keys    { ruiyung; };

};//在loggin前添加

systemctl restart named

验证:从服务器是否同步到

[root@server1 slaves]# ls -al

total 12

drwxrwx---. 2 named named   50 Oct 14 17:22 .

drwxr-x---. 6 root  named 4096 Oct 14 14:38 ..

-rw-r-----. 1 named named  262 Oct 14 17:22 192.168.1.arpa

-rw-r-----. 1 named named  240 Oct 14 17:22 example.com.zone


注意:关闭防火墙,seinux

本文出自 “12146768” 博客,请务必保留此出处http://12156768.blog.51cto.com/12146768/1862001

架设DNS服务器(DNS主从服务器架设)

标签:dns服务器   主从服务器   

原文地址:http://12156768.blog.51cto.com/12146768/1862001

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!