DNS实战--1
DNS(Domain Name System,域名系统)
因特网上作为域名和IP地址相互映射的一个分布式数据库,能够使用户方便的访问互联网,而不用去记住能够被机器读取的IP数串。
通过主机名,最终得到该主机名对应的IP地址的过程叫做域名解析(或主机名解析),DNS协议运行在UDP协议之上,使用端口号53
DNS的分布式数据库是以域名为索引的,每个域名实际上就是一颗很大的逆向数中路径,这棵逆向树成为域名空间(domain name space)
树的最大深度不超过127层,树种每个节点都有一个可以长达63个字符的文本符号。
简单地说就是一个IP地址和域名之间的转换系统,方便用户通过域名访问正确的服务地址,而不用记住不易区分的具体IP。DNS协议运行在UDP协议之上,使用端口53。
DNS的分类
主DNS服务器:就是一台存储着原始资料的DNS服务器
从DNS服务器:使用自动更新方式从主DNS服务器同步数据的DNS服务器,也称辅助DNS服务器
缓存服务器:不负责本地解析,采用递归方式转发客户机查询请求,并返回结果给客户机的DNS服务器,同时缓存查询回来的结果,也叫递归服务器。
转发器:这台DNS发现非本机负责的请求后,不再向根发起请求,而是直接转发给指定的一台或多台服务器,自身并不保存查询结果
10.0.1.161 m01 主DNS(Master DNS)
10.0.1.162 m02 从DNS(Slave DNS)
系统版本号
[root@linux-node1 ~]# cat /etc/redhat-release
CentOS release 6.6 (Final)
[root@linux-node1 ~]# uname -rm
2.6.32-504.el6.x86_64 x86_64
[root@linux-node1 ~]# [root@linux-node1 ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
10.0.1.161 linux-node1.example.com linux-node1
10.0.1.162 linux-node2.example.com linux-node2
[root@linux-node1 ~]#
[root@linux-node1 ~]# host baidu.com
baidu.com has address 180.149.132.47
baidu.com has address 220.181.57.217
baidu.com has address 111.13.101.208
baidu.com has address 123.125.114.144
baidu.com mail is handled by 20 jpmx.baidu.com.
baidu.com mail is handled by 20 mx50.baidu.com.
baidu.com mail is handled by 10 mx.n.shifen.com.
baidu.com mail is handled by 20 mx1.baidu.com.
[root@linux-node1 ~]#
nslookup显示的更多,会把nameserver也显示出来
[root@linux-node1 ~]# nslookup baidu.com
Server: 10.0.2.15
Address: 10.0.2.15#53 Non-authoritative answer:
Name: baidu.com
Address: 111.13.101.208
Name: baidu.com
Address: 123.125.114.144
Name: baidu.com
Address: 180.149.132.47
Name: baidu.com
Address: 220.181.57.217 [root@linux-node1 ~]#
dig命令
[root@linux-node1 ~]# dig baidu.com ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6 <<>> baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22215
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION:
;baidu.com. IN A ;; ANSWER SECTION:
baidu.com. 59 IN A 123.125.114.144
baidu.com. 59 IN A 180.149.132.47
baidu.com. 59 IN A 220.181.57.217
baidu.com. 59 IN A 111.13.101.208 ;; Query time: 1 msec
;; SERVER: 10.0.2.15#53(10.0.2.15)
;; WHEN: Sat May 13 21:41:26 2017
;; MSG SIZE rcvd: 91 [root@linux-node1 ~]#
主dns上安装bind
[root@linux-node1 yum.repos.d]# yum install -y bind-utils bind bind-devel bind-chroot
Loaded plugins: fastestmirror, refresh-packagekit, security
Setting up Install Process
Loading mirror speeds from cached hostfile
* base: mirrors.163.com
* epel: mirrors.tuna.tsinghua.edu.cn
* extras: mirrors.163.com
* updates: mirrors.aliyun.com
Package 32:bind-utils-9.8.2-0.62.rc1.el6_9.2.x86_64 already installed and latest version
Package 32:bind-9.8.2-0.62.rc1.el6_9.2.x86_64 already installed and latest version
Package 32:bind-devel-9.8.2-0.62.rc1.el6_9.2.x86_64 already installed and latest version
Package 32:bind-chroot-9.8.2-0.62.rc1.el6_9.2.x86_64 already installed and latest version
Nothing to do
[root@linux-node1 yum.repos.d]#
[root@linux-node1 yum.repos.d]# rpm -qa | grep "^bind"
bind-chroot-9.8.2-0.62.rc1.el6_9.2.x86_64
bind-9.8.2-0.62.rc1.el6_9.2.x86_64
bind-libs-9.8.2-0.62.rc1.el6_9.2.x86_64
bind-devel-9.8.2-0.62.rc1.el6_9.2.x86_64
bind-utils-9.8.2-0.62.rc1.el6_9.2.x86_64
[root@linux-node1 yum.repos.d]#
编辑dns主配置文件,清空原先的内容。新的内容写如下
[root@linux-node1 ~]# vim /etc/named.conf
[root@linux-node1 ~]# cat /etc/named.conf
options {
version "1.1.1";
listen-on port 53 {any;};
directory "/var/named/chroot/etc/";
pid-file "/var/named/chroot/var/run/named/named.pid";
allow-query { any; };
Dump-file "/var/named/chroot/var/log/binddump.db";
Statistics-file "/var/named/chroot/var/log/named_stats";
zone-statistics yes;
memstatistics-file "log/mem_stats";
empty-zones-enable no;
forwarders {202.106.196.115;8.8.8.8; };
};
key "rndc-key" {
algorithm hmac-md5;
secret "Eqw4hClGExUWeDkKBX/pBg==";
};
controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { "rndc-key"; };
};
logging {
channel warning {
file "/var/named/chroot/var/log/dns_warning" versions 10 size 10m;
severity warning;
print-category yes;
print-severity yes;
print-time yes;
};
channel general_dns {
file "/var/named/chroot/var/log/dns_log" versions 10 size 100m;
severity info;
print-category yes;
print-severity yes;
print-time yes;
};
category default {
warning;
};
category queries {
general_dns;
};
};
include "/var/named/chroot/etc/view.conf";
[root@linux-node1 ~]#
上面主配置文件详解
options {
version "1.1.1";
listen-on port 53 {any;}; #监控端口
directory "/var/named/chroot/etc/"; #A记录等配置文件所在的目录
pid-file "/var/named/chroot/var/run/named/named.pid"; 服务器来的进程号
allow-query { any; }; #允许谁访问{}可以写IP
Dump-file "/var/named/chroot/var/log/binddump.db";
Statistics-file "/var/named/chroot/var/log/named_stats"; #可以看到DNS解析记录的数量,成功率有多少域(可以做监控)DNS状态等
zone-statistics yes; #配成yes之后上面才会写入
memstatistics-file "log/mem_stats"; #内存状态
empty-zones-enable no;
forwarders {202.106.196.115;8.8.8.8; }; 转发(如果我这没有域名就转发)
};
key "rndc-key" { 认证的密钥
algorithm hmac-md5;
secret "Eqw4hClGExUWeDkKBX/pBg==";
};
controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { "rndc-key"; };
};
logging { 日志 警告路径 (日志分2种)
channel warning { 日志的相关信息
file "/var/named/chroot/var/log/dns_warning" versions 10 size 10m;
severity warning;
print-category yes;
print-severity yes;
print-time yes;
};
channel general_dns { 访问日志相关信息
file "/var/named/chroot/var/log/dns_log" versions 10 size 100m;
severity info;
print-category yes;
print-severity yes;
print-time yes;
};
category default { #默认日志警告级别
warning;
};
category queries { #访问日志级别
general_dns;
};
};
include "/var/named/chroot/etc/view.conf"; 其他域的配置文件目录(view.conf可以实现简单的只能DNS的功能,为以后的只能DNS做准备)
除了这个文件的配置,dns的一些其他的配置,比如zone的配置。你可以使用rndc reload生效,这个就是rndc的作用
channel warning {
file "/var/named/chroot/var/log/dns_warning" versions 10 size 10m;
severity warning;
print-category yes;
print-severity yes;
print-time yes;
};
channel general_dns {
file "/var/named/chroot/var/log/dns_log" versions 10 size 10m;
severity info;
print-category yes;
print-severity yes;
print-time yes;
};
category default {
warning;
};
category queries {
general_dns;
};
Statistics-file "/var/named/chroot/var/log/named_stats";
创建rndc.key和rndc.conf文件
[root@linux-node1 ~]# cat /etc/rndc.key
key "rndc-key" {
algorithm hmac-md5;
secret "Eqw4hClGExUWeDkKBX/pBg==";
};
[root@linux-node1 ~]# [root@linux-node1 ~]# cat /etc/rndc.conf
key "rndc-key" {
algorithm hmac-md5;
secret "Eqw4hClGExUWeDkKBX/pBg==";
};
options {
default-key "rndc-key";
default-server 127.0.0.1;
default-port 953;
};
[root@linux-node1 ~]#
编辑view.conf文件
下面的allow-transfer表示允许下面主机来取数据,注意不是请求dns解析,而是用于从dns请求配置文件里的数据
also-notify表示文件更新时,执行rndc reload时通知哪个从dns来取数据。这样就达到了主从同步的效果
[root@linux-node1 ~]# cat /var/named/chroot/etc/view.conf
view "View" {
zone "lnh.com" {
type master;
file "lnh.com.zone";
allow-transfer {
10.0.1.162;
};
notify yes;
also-notify {
10.0.1.162;
};
};
};
[root@linux-node1 ~]#
[root@linux-node1 ~]# vim /var/named/chroot/etc/lnh.com.zone
[root@linux-node1 ~]# cat /var/named/chroot/etc/lnh.com.zone
$ORIGIN .
$TTL 3600 ; 1 hour
lnh.com IN SOA op.lnh.com. dns.lnh.com. (
2003 ; serial
900 ; refresh (15 minutes)
600 ; retry (10 minutes)
86400 ; expire (1 day)
3600 ; minimum (1 hour)
)
NS op.lnh.com.
$ORIGIN lnh.com.
shanks A 1.2.3.4
op A 1.2.3.4
a A 1.2.3.4
a A 192.168.122.101
[root@linux-node1 ~]#
上面关于zone文件解释说明
1、Serial:只是一个序号,但这个序号可被用来作为slave与master更新的依据。举例来说。
master序号100 但salve序号为90时,那么这个zonefile的资料就会被传送到slave来更新了
由于序号代表新旧资料,通常我们建议可以利用日期来设定!举例来说,在2006/10/20
所更新文件,可以用2006102001作为序号代表!(yyyymmddnn,nn代表这一天第几次修改)
2、Refresh:除了根据Serial来判断新旧之外,我们可以利用这个refresh(更新)命令,slave多久进行一次主动更新。
3、Retry:如果到了Refresh的时间,但是slave却无法连接到master时,那么在多久之后,slave会再次的主动尝试与主机连线
4、Expire:如果slave一直无法与master连接上,那么经过多久的时间之后,则命令slave不要再连接master了!也就是说,此时我们假设master DNS
可能遇到重大问题而无法上线,则等待系统管理员处理完毕后,再重新来到slave DNS重新启动bind吧
5、Minimun:这个就有点像是TTL!
区域解析库文件的简要说明:
常见的正解文件 RR 相关信息
[domain] IN [[RR type] [RR data]]
主机名. IN A IPv4 的 IP 地址
主机名. IN AAAA IPv6 的 IP 地址
区域名. IN NS 管理这个领域名的服务器主机名字.
区域名. IN SOA 管理这个领域名的七个重要参数(如上说明)
区域名. IN MX 顺序数字 接收邮件的服务器主机名字
主机别名. IN CNAME 实际代表这个主机别名的主机名字.
单位:W=周、D=日、H=小时、M=分钟。 $TTL 86400 宏定义全局TTL时间
@ IN SOA ns.chinasoft.com. root ( # ns.chinasoft.com. 是DNS服务器的名称
0 ; serial (d. adams) 仅作为序列号而已
1D ;refresh 服务器的更新时间
15M ; retry 重新更新时间间隔
1W ; expiry 多久之后宣布失败
1H ) ;minimum 相当于缓存记忆时间
@ IN NS ns.chinasoft.com.
@ IN MX 5 mail.chinasoft.com.(5为优先级别)
ns IN A 1.2.3.4
www IN A 1.2.3.4
www IN A 1.2.3.4
mail IN A 1.2.3.4
[root@linux-node1 var]# cd /var && chown -R named.named named/
[root@linux-node1 var]# /etc/init.d/named start
Starting named: [ OK ]
[root@linux-node1 var]# chkconfig named on
[root@linux-node1 var]#
检查端口
[root@linux-node1 var]# netstat -lntup | grep 53
tcp 0 0 10.0.1.161:53 0.0.0.0:* LISTEN 7060/named
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 7060/named
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 7060/named
udp 0 0 10.0.1.161:53 0.0.0.0:* 7060/named
udp 0 0 127.0.0.1:53 0.0.0.0:* 7060/named
[root@linux-node1 var]#
如果对zone文件更改,可以使用rndc reload让其生效
[root@linux-node1 var]# rndc reload
WARNING: key file (/etc/rndc.key) exists, but using default configuration file (/etc/rndc.conf)
server reload successful
[root@linux-node1 var]#
使用dig命令测试
[root@linux-node1 var]# dig @127.0.0.1 a.lnh.com ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6_9.2 <<>> @127.0.0.1 a.lnh.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57403
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 1 ;; QUESTION SECTION:
;a.lnh.com. IN A ;; ANSWER SECTION:
a.lnh.com. 3600 IN A 192.168.122.101
a.lnh.com. 3600 IN A 1.2.3.4 ;; AUTHORITY SECTION:
lnh.com. 3600 IN NS op.lnh.com. ;; ADDITIONAL SECTION:
op.lnh.com. 3600 IN A 1.2.3.4 ;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon May 15 22:20:39 2017
;; MSG SIZE rcvd: 92 [root@linux-node1 var]#
[root@linux-node2 yum.repos.d]# yum install bind-utils bind bind-devel bind-chroot -y
Loaded plugins: fastestmirror, refresh-packagekit, security
Setting up Install Process
Loading mirror speeds from cached hostfile
* base: mirrors.aliyun.com
* epel: mirrors.ustc.edu.cn
* extras: mirrors.zju.edu.cn
* updates: mirrors.aliyun.com
Package 32:bind-utils-9.8.2-0.62.rc1.el6_9.2.x86_64 already installed and latest version
Package 32:bind-9.8.2-0.62.rc1.el6_9.2.x86_64 already installed and latest version
Package 32:bind-devel-9.8.2-0.62.rc1.el6_9.2.x86_64 already installed and latest version
Package 32:bind-chroot-9.8.2-0.62.rc1.el6_9.2.x86_64 already installed and latest version
Nothing to do
[root@linux-node2 yum.repos.d]#
[root@linux-node1 var]# scp /etc/named.conf 10.0.1.162:/etc/
root@10.0.1.162's password:
named.conf 100% 1121 1.1KB/s 00:00
[root@linux-node1 var]# scp /etc/rndc.key 10.0.1.162:/etc/
root@10.0.1.162's password:
rndc.key 100% 91 0.1KB/s 00:00
[root@linux-node1 var]# scp /etc/rndc.conf 10.0.1.162:/etc/
root@10.0.1.162's password:
rndc.conf 100% 181 0.2KB/s 00:00
[root@linux-node1 var]#
[root@linux-node2 ~]# vim /var/named/chroot/etc/view.conf
[root@linux-node2 ~]# cat /var/named/chroot/etc/view.conf
view "SlaveView" {
zone "lnh.com" {
type slave;
masters {10.0.1.161;};
file "slave.lnh.com.zone";
};
};
[root@linux-node2 ~]#
[root@linux-node2 ~]# cd /var && chown -R named.named named/
[root@linux-node2 var]# /etc/init.d/named start
Starting named: [ OK ]
[root@linux-node2 var]#
[root@linux-node2 var]# chkconfig named on
[root@linux-node2 var]#
它自动生成从的zone文件
[root@linux-node2 var]# ll /var/named/chroot/etc/
total 676
-rw-r--r-- 1 root root 388 Sep 17 2014 localtime
drwxr-x--- 2 root named 4096 May 9 21:43 named
-rw-r----- 1 root named 1891 May 14 19:05 named.conf
-rw-r--r-- 1 root named 2389 May 9 21:43 named.iscdlv.key
-rw-r----- 1 root named 931 Jun 21 2007 named.rfc1912.zones
-rw-r--r-- 1 root named 487 Jul 19 2010 named.root.key
drwxr-x--- 3 named named 4096 May 14 19:03 pki
-rw-r--r--. 1 root root 6455 Jan 12 2010 protocols
-rw-r--r-- 1 root root 90 May 14 19:06 rndc.conf
-rw-r--r--. 1 root root 641020 Oct 2 2013 services
-rw-r--r-- 1 named named 326 May 14 20:00 slave.lnh.com.zone
-rw-r--r-- 1 named named 129 May 14 20:00 view.conf
[root@linux-node2 var]# cat /var/named/chroot/etc/slave.lnh.com.zone
$ORIGIN .
$TTL 3600 ; 1 hour
lnh.com IN SOA op.lnh.com. dns.lnh.com. (
2000 ; serial
900 ; refresh (15 minutes)
600 ; retry (10 minutes)
86400 ; expire (1 day)
3600 ; minimum (1 hour)
)
NS op.lnh.com.
$ORIGIN lnh.com.
a A 1.2.3.4
op A 1.2.3.4
shanks A 1.2.3.4
[root@linux-node2 var]#
测试主从
主dns服务器把zone文件序号改成2004
[root@linux-node1 var]# cd /var/named/chroot/etc/
[root@linux-node1 etc]# vim lnh.com.zone
[root@linux-node1 etc]# cat lnh.com.zone
$ORIGIN .
$TTL 3600 ; 1 hour
lnh.com IN SOA op.lnh.com. dns.lnh.com. (
2004 ; serial
900 ; refresh (15 minutes)
600 ; retry (10 minutes)
86400 ; expire (1 day)
3600 ; minimum (1 hour)
)
NS op.lnh.com.
$ORIGIN lnh.com.
shanks A 1.2.3.4
op A 1.2.3.4
a A 1.2.3.4
a A 192.168.122.101
[root@linux-node1 etc]#
[root@linux-node1 etc]# rndc reload
WARNING: key file (/etc/rndc.key) exists, but using default configuration file (/etc/rndc.conf)
server reload successful
[root@linux-node1 etc]#
[root@linux-node2 etc]# cat slave.lnh.com.zone
$ORIGIN .
$TTL 3600 ; 1 hour
lnh.com IN SOA op.lnh.com. dns.lnh.com. (
2004 ; serial
900 ; refresh (15 minutes)
600 ; retry (10 minutes)
86400 ; expire (1 day)
3600 ; minimum (1 hour)
)
NS op.lnh.com.
$ORIGIN lnh.com.
a A 1.2.3.4
A 192.168.122.101
op A 1.2.3.4
shanks A 1.2.3.4
[root@linux-node2 etc]#
[root@linux-node1 etc]# vim lnh.com.zone
[root@linux-node1 etc]# cat lnh.com.zone
$ORIGIN .
$TTL 3600 ; 1 hour
lnh.com IN SOA op.lnh.com. dns.lnh.com. (
2004 ; serial
900 ; refresh (15 minutes)
600 ; retry (10 minutes)
86400 ; expire (1 day)
3600 ; minimum (1 hour)
)
NS op.lnh.com.
$ORIGIN lnh.com.
shanks A 1.2.3.4
op A 1.2.3.4
a A 1.2.3.4
a A 192.168.122.101
[root@linux-node1 etc]# rndc reload
WARNING: key file (/etc/rndc.key) exists, but using default configuration file (/etc/rndc.conf)
server reload successful
[root@linux-node1 etc]#
主dns上执行rndc reload
[root@linux-node2 etc]# cat slave.lnh.com.zone
$ORIGIN .
$TTL 3600 ; 1 hour
lnh.com IN SOA op.lnh.com. dns.lnh.com. (
2004 ; serial
900 ; refresh (15 minutes)
600 ; retry (10 minutes)
86400 ; expire (1 day)
3600 ; minimum (1 hour)
)
NS op.lnh.com.
$ORIGIN lnh.com.
a A 1.2.3.4
A 192.168.122.101
op A 1.2.3.4
shanks A 1.2.3.4
[root@linux-node2 etc]#
[root@linux-node1 etc]# cat lnh.com.zone
$ORIGIN .
$TTL 3600 ; 1 hour
lnh.com IN SOA op.lnh.com. dns.lnh.com. (
2005 ; serial
900 ; refresh (15 minutes)
600 ; retry (10 minutes)
86400 ; expire (1 day)
3600 ; minimum (1 hour)
)
NS op.lnh.com.
$ORIGIN lnh.com.
shanks A 1.2.3.4
op A 1.2.3.4
a A 1.2.3.4
a A 192.168.122.101
cname CNAME a.lnh.com.
[root@linux-node1 etc]#
[root@linux-node1 etc]# rndc reload
WARNING: key file (/etc/rndc.key) exists, but using default configuration file (/etc/rndc.conf)
server reload successful
[root@linux-node1 etc]#
[root@linux-node2 etc]# cat slave.lnh.com.zone
$ORIGIN .
$TTL 3600 ; 1 hour
lnh.com IN SOA op.lnh.com. dns.lnh.com. (
2005 ; serial
900 ; refresh (15 minutes)
600 ; retry (10 minutes)
86400 ; expire (1 day)
3600 ; minimum (1 hour)
)
NS op.lnh.com.
$ORIGIN lnh.com.
a A 1.2.3.4
A 192.168.122.101
cname CNAME a
op A 1.2.3.4
shanks A 1.2.3.4
[root@linux-node2 etc]#
[root@linux-node1 etc]# dig @10.0.1.161 cname.lnh.com ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6_9.2 <<>> @10.0.1.161 cname.lnh.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53265
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 1 ;; QUESTION SECTION:
;cname.lnh.com. IN A ;; ANSWER SECTION:
cname.lnh.com. 3600 IN CNAME a.lnh.com.
a.lnh.com. 3600 IN A 192.168.122.101
a.lnh.com. 3600 IN A 1.2.3.4 ;; AUTHORITY SECTION:
lnh.com. 3600 IN NS op.lnh.com. ;; ADDITIONAL SECTION:
op.lnh.com. 3600 IN A 1.2.3.4 ;; Query time: 1 msec
;; SERVER: 10.0.1.161#53(10.0.1.161)
;; WHEN: Mon May 15 23:09:22 2017
;; MSG SIZE rcvd: 112 [root@linux-node1 etc]#
[root@linux-node1 etc]# dig @10.0.1.162 cname.lnh.com ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6_9.2 <<>> @10.0.1.162 cname.lnh.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6767
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 1 ;; QUESTION SECTION:
;cname.lnh.com. IN A ;; ANSWER SECTION:
cname.lnh.com. 3600 IN CNAME a.lnh.com.
a.lnh.com. 3600 IN A 192.168.122.101
a.lnh.com. 3600 IN A 1.2.3.4 ;; AUTHORITY SECTION:
lnh.com. 3600 IN NS op.lnh.com. ;; ADDITIONAL SECTION:
op.lnh.com. 3600 IN A 1.2.3.4 ;; Query time: 2 msec
;; SERVER: 10.0.1.162#53(10.0.1.162)
;; WHEN: Mon May 15 23:10:43 2017
;; MSG SIZE rcvd: 112 [root@linux-node1 etc]#
MX记录学习
MX记录和A记录差不多,MX是关于邮件服务的解析的
[root@linux-node1 etc]# vim lnh.com.zone
[root@linux-node1 etc]# cat lnh.com.zone
$ORIGIN .
$TTL 3600 ; 1 hour
lnh.com IN SOA op.lnh.com. dns.lnh.com. (
2006 ; serial
900 ; refresh (15 minutes)
600 ; retry (10 minutes)
86400 ; expire (1 day)
3600 ; minimum (1 hour)
)
NS op.lnh.com.
$ORIGIN lnh.com.
shanks A 1.2.3.4
op A 1.2.3.4
a A 1.2.3.4
a A 192.168.122.101
cname CNAME a.lnh.com.
mx MX 5 192.168.122.101
[root@linux-node1 etc]#
记得序列号更新下,可以+1
[root@linux-node1 etc]# rndc reload
WARNING: key file (/etc/rndc.key) exists, but using default configuration file (/etc/rndc.conf)
server reload successful
[root@linux-node1 etc]#
[root@linux-node2 etc]# cat slave.lnh.com.zone
$ORIGIN .
$TTL 3600 ; 1 hour
lnh.com IN SOA op.lnh.com. dns.lnh.com. (
2006 ; serial
900 ; refresh (15 minutes)
600 ; retry (10 minutes)
86400 ; expire (1 day)
3600 ; minimum (1 hour)
)
NS op.lnh.com.
$ORIGIN lnh.com.
a A 1.2.3.4
A 192.168.122.101
cname CNAME a
mx MX 5 192.168.122.101
op A 1.2.3.4
shanks A 1.2.3.4
[root@linux-node2 etc]#
[root@linux-node1 etc]# dig @10.0.1.162 mx.lnh.com ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6_9.2 <<>> @10.0.1.162 mx.lnh.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31263
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION:
;mx.lnh.com. IN A ;; AUTHORITY SECTION:
lnh.com. 3600 IN SOA op.lnh.com. dns.lnh.com. 2006 900 600 86400 3600 ;; Query time: 1 msec
;; SERVER: 10.0.1.162#53(10.0.1.162)
;; WHEN: Mon May 15 23:17:57 2017
;; MSG SIZE rcvd: 71 [root@linux-node1 etc]#
[root@linux-node1 etc]# host mx.lnh.com 127.0.0.1
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases: mx.lnh.com mail is handled by 5 192.168.122.101.lnh.com.
[root@linux-node1 etc]# [root@linux-node1 etc]# host mx.lnh.com 10.0.1.162
Using domain server:
Name: 10.0.1.162
Address: 10.0.1.162#53
Aliases: mx.lnh.com mail is handled by 5 192.168.122.101.lnh.com.
[root@linux-node1 etc]#
添加RTP记录(反向解析)
作用:可以让人根据IP获取到主机名,从而判断主机用途
编辑maste节点/var/named/chroot/etc/view.conf,加入ptr的zone配置
in-addr.arpa已经成为业界共识了,作为ptr用的
168.192是IP地址反过来
主dns服务器上如下编辑view文件,添加新的zone
[root@linux-node1 ~]# vim /var/named/chroot/etc/view.conf
[root@linux-node1 ~]# cat /var/named/chroot/etc/view.conf
view "View" {
zone "lnh.com" {
type master;
file "lnh.com.zone";
allow-transfer {
10.0.1.162;
};
notify yes;
also-notify {
10.0.1.162;
};
};
zone "168.192.in-addr.arpa" {
type master;
file "168.192.zone";
allow-transfer {
10.0.1.162;
};
notify yes;
also-notify {
10.0.1.162;
};
};
};
[root@linux-node1 ~]#
[root@linux-node1 ~]# vim /var/named/chroot/etc/168.192.zone
[root@linux-node1 ~]# cat /var/named/chroot/etc/168.192.zone
$TTL 3600 ; 1 hour
@ IN SOA op.lnh.com. dns.lnh.com. (
2004 ; serial
900 ; refresh (15 minutes)
600 ; retry (10 minutes)
86400 ; expire (1 day)
3600 ; minimum (1 hour)
)
NS op.lnh.com.
102.122 IN PTR a.lnh.com.
[root@linux-node1 ~]#
@ 表示继承 zone "168.192.in-addr.arpa"
没有@的话,前面就得用
$ORIGIN .
了
文件授权,并重新加载
[root@linux-node1 ~]# cd /var/named/chroot/etc/
[root@linux-node1 etc]# ll
total 684
-rw-r--r-- 1 root root 503 May 15 23:43 168.192.zone
-rw-r--r-- 1 named named 536 May 15 23:14 lnh.com.zone
-rw-r--r-- 1 root root 388 Sep 17 2014 localtime
drwxr-x--- 2 named named 4096 May 9 21:43 named
-rw-r--r-- 1 named named 1121 May 14 21:16 named.conf
-rw-r--r-- 1 named named 2389 May 9 21:43 named.iscdlv.key
-rw-r----- 1 named named 931 Jun 21 2007 named.rfc1912.zones
-rw-r--r-- 1 named named 487 Jul 19 2010 named.root.key
drwxr-x--- 3 named named 4096 May 13 21:53 pki
-rw-r--r--. 1 named named 6455 Jan 12 2010 protocols
-rw-r--r-- 1 named named 181 May 14 20:45 rndc.conf
-rw-r--r-- 1 named named 91 May 14 20:53 rndc.key
-rw-r--r--. 1 named named 641020 Oct 2 2013 services
-rw-r--r-- 1 named named 434 May 15 23:39 view.conf
[root@linux-node1 etc]# chown named:named 168.192.zone
[root@linux-node1 etc]# rndc reload
WARNING: key file (/etc/rndc.key) exists, but using default configuration file (/etc/rndc.conf)
server reload successful
[root@linux-node1 etc]#
[root@linux-node2 etc]# vim /var/named/chroot/etc/view.conf
[root@linux-node2 etc]# cat /var/named/chroot/etc/view.conf
view "SlaveView" {
zone "lnh.com" {
type slave;
masters {10.0.1.161;};
file "slave.lnh.com.zone";
};
zone "168.192.in-addr.arpa" {
type slave;
masters {10.0.1.161; };
file "slave.168.192.zone";
};
};
[root@linux-node2 etc]#
从上更改权限并重新加载配置
[root@linux-node2 etc]# rndc reload
WARNING: key file (/etc/rndc.key) exists, but using default configuration file (/etc/rndc.conf)
server reload successful
[root@linux-node2 etc]# [root@linux-node2 etc]# cd /var/named/chroot/etc/
[root@linux-node2 etc]# ll
total 684
-rw-r--r-- 1 root root 388 Sep 17 2014 localtime
drwxr-x--- 2 root named 4096 May 9 21:43 named
-rw-r----- 1 root named 1121 May 15 22:36 named.conf
-rw-r--r-- 1 root named 2389 May 9 21:43 named.iscdlv.key
-rw-r----- 1 root named 931 Jun 21 2007 named.rfc1912.zones
-rw-r--r-- 1 root named 487 Jul 19 2010 named.root.key
drwxr-x--- 3 named named 4096 May 14 19:03 pki
-rw-r--r--. 1 root root 6455 Jan 12 2010 protocols
-rw-r--r-- 1 root root 181 May 15 22:37 rndc.conf
-rw-r--r-- 1 root root 91 May 15 22:37 rndc.key
-rw-r--r--. 1 root root 641020 Oct 2 2013 services
-rw-r--r-- 1 named named 327 May 15 23:58 slave.168.192.zone
-rw-r--r-- 1 named named 389 May 15 23:54 slave.lnh.com.zone
-rw-r--r-- 1 named named 251 May 15 23:50 view.conf
[root@linux-node2 etc]#
[root@linux-node2 etc]# cat slave.168.192.zone
$ORIGIN .
$TTL 3600 ; 1 hour
168.192.in-addr.arpa IN SOA op.lnh.com. dns.lnh.com. (
2004 ; serial
900 ; refresh (15 minutes)
600 ; retry (10 minutes)
86400 ; expire (1 day)
3600 ; minimum (1 hour)
)
NS op.lnh.com.
$ORIGIN 168.192.in-addr.arpa.
102.122 PTR a.lnh.com.
[root@linux-node2 etc]#
[root@linux-node1 etc]# host 192.168.122.102 127.0.0.1
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases: 102.122.168.192.in-addr.arpa domain name pointer a.lnh.com.
[root@linux-node1 etc]# host 192.168.122.102 10.0.1.162
Using domain server:
Name: 10.0.1.162
Address: 10.0.1.162#53
Aliases: 102.122.168.192.in-addr.arpa domain name pointer a.lnh.com.
[root@linux-node1 etc]#
测试dns解析的轮询功能
冲新加载服务
[root@linux-node1 etc]# rndc reload
WARNING: key file (/etc/rndc.key) exists, but using default configuration file (/etc/rndc.conf)
server reload successful
[root@linux-node1 etc]#
[root@linux-node1 etc]# nslookup a.lnh.com 127.0.0.1
Server: 127.0.0.1
Address: 127.0.0.1#53 Name: a.lnh.com
Address: 192.168.122.101
Name: a.lnh.com
Address: 192.168.122.102
Name: a.lnh.com
Address: 1.2.3.4 [root@linux-node1 etc]# nslookup a.lnh.com 127.0.0.1
Server: 127.0.0.1
Address: 127.0.0.1#53 Name: a.lnh.com
Address: 192.168.122.102
Name: a.lnh.com
Address: 1.2.3.4
Name: a.lnh.com
Address: 192.168.122.101 [root@linux-node1 etc]# nslookup a.lnh.com 127.0.0.1
Server: 127.0.0.1
Address: 127.0.0.1#53 Name: a.lnh.com
Address: 1.2.3.4
Name: a.lnh.com
Address: 192.168.122.101
Name: a.lnh.com
Address: 192.168.122.102 [root@linux-node1 etc]#
测试智能dns,根据源IP不同解析到对应的IP
[root@linux-node1 etc]# vim /var/named/chroot/etc/view.conf
[root@linux-node1 etc]# cat /var/named/chroot/etc/view.conf
view "GROUP1" {
match-clients { group1; };
zone "viewlnh.com" {
type master;
file "group1.viewlnh.com.zone";
};
}; view "GROUP2" {
match-clients { group2; };
zone "viewlnh.com" {
type master;
file "group2.viewlnh.com.zone";
};
};
[root@linux-node1 etc]#
[root@linux-node1 etc]# vim group1.viewlnh.com.zone
[root@linux-node1 etc]# cat /var/named/chroot/etc/group1.viewlnh.com.zone
$ORIGIN .
$TTL 3600 ; 1 hour
viewlnh.com IN SOA op.viewlnh.com. dns.viewlnh.com. (
2009 ; serial
900 ; refresh (15 minutes)
600 ; retry (10 minutes)
86400 ; expire (1 day)
3600 ; minimum (1 hour)
)
NS op.viewlnh.com.
$ORIGIN viewlnh.com.
op A 192.168.122.1
view A 192.168.122.1
[root@linux-node1 etc]#
[root@linux-node1 etc]# vim /var/named/chroot/etc/group2.viewlnh.com.zone
[root@linux-node1 etc]# cat /var/named/chroot/etc/group2.viewlnh.com.zone
$ORIGIN .
$TTL 3600 ; 1 hour
viewlnh.com IN SOA op.viewlnh.com. dns.viewlnh.com. (
2009 ; serial
900 ; refresh (15 minutes)
600 ; retry (10 minutes)
86400 ; expire (1 day)
3600 ; minimum (1 hour)
)
NS op.viewlnh.com.
$ORIGIN viewlnh.com.
op A 192.168.122.2
view A 192.168.122.2
[root@linux-node1 etc]# [root@linux-node1 etc]# chown named.named group*
[root@linux-node1 etc]# rndc reload
WARNING: key file (/etc/rndc.key) exists, but using default configuration file (/etc/rndc.conf)
server reload successful
[root@linux-node1 etc]#
[root@linux-node1 etc]# host view.viewlnh.com 10.0.1.161
Using domain server:
Name: 10.0.1.161
Address: 10.0.1.161#53
Aliases: view.viewlnh.com has address 192.168.122.1
[root@linux-node1 etc]#
[root@linux-node2 etc]# host view.viewlnh.com 10.0.1.161
Using domain server:
Name: 10.0.1.161
Address: 10.0.1.161#53
Aliases: view.viewlnh.com has address 192.168.122.2
[root@linux-node2 etc]#
[root@linux-node1 etc]# vim /etc/named.conf
[root@linux-node1 etc]# cat /etc/named.conf
options {
version "1.1.1";
listen-on port 53 {any;};
directory "/var/named/chroot/etc/";
pid-file "/var/named/chroot/var/run/named/named.pid";
allow-query { any; };
Dump-file "/var/named/chroot/var/log/binddump.db";
Statistics-file "/var/named/chroot/var/log/named_stats";
zone-statistics yes;
memstatistics-file "log/mem_stats";
empty-zones-enable no;
forwarders {202.106.196.115;8.8.8.8; };
};
key "rndc-key" {
algorithm hmac-md5;
secret "Eqw4hClGExUWeDkKBX/pBg==";
};
controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { "rndc-key"; };
};
logging {
channel warning {
file "/var/named/chroot/var/log/dns_warning" versions 10 size 10m;
severity warning;
print-category yes;
print-severity yes;
print-time yes;
};
channel general_dns {
file "/var/named/chroot/var/log/dns_log" versions 10 size 100m;
severity info;
print-category yes;
print-severity yes;
print-time yes;
};
category default {
warning;
};
category queries {
general_dns;
};
};
acl group1 {
10.0.1.161;
};
acl group2 {
10.0.1.162;
};
acl groupall {
*;
}; include "/var/named/chroot/etc/view.conf";
[root@linux-node1 etc]#
DNS实战--1的更多相关文章
- DNS实战--2
构建企业级DNS服务压测,服务的功能测试,这些在生产中都要考虑到 1.硬件选型dns对网卡和cpu消耗大下面配置可以达到单台服务器每秒3万请求,0延时CPU:12c以上配置内存:16GB网络:千兆 2 ...
- (转)架构师之DNS实战CentOS7VSCentOS6
原文:https://www.abcdocker.com/abcdocker/1298 CentOS7上使用bind9搭建DNS主从服务器-----http://blog.51cto.com/yich ...
- 面试官,别问我DNS了,也就这些!
提到网络,基本上都能把DNS给扯上去.为啥呢,今天我们来一探究竟. 1 Chrome浏览器原理 还记得面试过程中被问了千百遍的"输入URL后发生了什么"这个经典问题吗,因为这个问题 ...
- abcdocker 的博客
技术参考总结 abcdocker 的博客 09月 3 篇 20日 Centos7 图形化创建KVM 10日 Nginx 代理Google 进行*** 10日 mac 安装装逼神器cmatrix 08月 ...
- 最新linux运维高级架构课13期 架构师课程
有会员购买的,分享给大家.完整一套,可以学习一下. ├─L001-2017linux运维高级架构师13期-运维与自动化运维发展-10节 │ 1-1运维职业发展.avi │ ...
- SQL Server ->> 高可用与灾难恢复(HADR)技术 -- AlwaysOn(实战篇)之建立活动目录域、DNS服务器和Windows故障转移群集(准备工作)
因为篇幅原因,AlwaysOn可用性组被拆成了两部分:理论部分和实战部分.而实战部分又被拆成了准备工作和AlwaysOn可用性组搭建. 三篇文章各自的链接: SQL Server ->> ...
- DNS tunnel的原理及实战
DNS tunnel的原理及实战 摘自:http://netsec.ccert.edu.cn/zhengming/2011/11/01/%E8%BD%AC%E8%BD%BD%EF%BC%9Adns-t ...
- DNS原理及实战配置指南
目录 DNS简介 DNS域名结构介绍 顶级域名 DNS工作原理 工作模式和端口 资源记录 安装bind(详细) 实战:配置一个正反向解析 实战:配置DNS转发 实战:配置DNS主从 实战:子域授权 实 ...
- Kali Linux渗透测试实战 2.1 DNS信息收集
目录 2.1 DNS信息收集1 2.1.1 whois查询3 2.1.2 域名基本信息查询4 Dns服务器查询4 a记录查询4 mx记录查询5 2.1.3 域名枚举5 fierse 5 dnsdict ...
随机推荐
- 二、Memcached缓存穿透、缓存雪崩
二.Memcached缓存穿透.缓存雪崩 1. 缓存雪崩 可能是数据魏加载到缓存中,或者缓存同一时间大面积失效,导致大量请求去数据库查询的过程,数据库过载,崩溃. 解决方法: 1 采用加锁计数,使用合 ...
- chrome恢复默认搜索引擎为Google
管理员身份运行cmd RD /S /Q "%WinDir%\System32\GroupPolicyUsers" RD /S /Q "%WinDir%\System32\ ...
- css设置垂直居中方式总结
方式1:flex布局,display:flex;align-items:center <!DOCTYPE html> <html lang="en"> &l ...
- 使用 <embed> 标签显示 flash文件(swf)格式 ,如何设置 width 和 height 宽度,高度.
1. embed 标签 支持 .swf 格式. .flv 的不支持. 2. 通常情况下, 网站中上传 多个 flash文件. 它的默认大小是不一样的. 而且 可以 宽度 大于 高度(横向的) ...
- Java技术 第一次作业
(一)学习总结 1.在java中通过Scanner类完成控制台的输入,查阅JDK帮助文档,Scanner类实现基本数据输入的方法是什么? 代码开头加一句 Import java.util; 构建Sca ...
- day14 生成器迭代器
迭代器(iterator) 可迭代对象: 可以使用迭代器取出数据的对象 判断一个对象是否是可迭代对象,就看这个对象有没有实现__iter__方法 所有的容器类型(包括字符串)都是可迭代的 迭代器的使用 ...
- epoll+socket实现 socket并发 linux服务器
/* 实现功能:通过epoll, 处理多个socket * 监听一个端口,监听到有链接时,添加到epoll_event * xs */ #include <stdio.h> #includ ...
- swiper遇到的问题
<!DOCTYPE html> <html> <head> <meta name="viewport" content="wid ...
- Java中语法与C/CPP的区别
static不能在成员方法中定义,只能作为类变量定义.
- 利用JQuery 解析MVC控制器传到前台的Json数据
<script type="text/javascript"> function Getweb() { var name = $("#CityName&quo ...