Centos7.2 下DNS+NamedManager高可用部署方案完整记录

Centos7.2 下DNS+NamedManager高可用部署方案完整记录

之前说到了NamedManager单机版的配置，下面说下DNS+NamedManager双机高可用的配置方案：

1）机器环境

主机名            ip地址

dns01.kevin.cn   172.22.51.65

dns02.kevin.cn   172.22.51.74

VIP地址：172.22.51.75

两台机器做好主机名及hosts绑定

[root@dns01 ~]# vim /etc/hosts

......

172.22.51.65   dns01.kevin.cn

172.22.51.74   dns02.kevin.cn

172.22.51.75   dns.kevin.cn

四台机器都是Centos7.2系统

[root@dns01 ~]# cat /etc/redhat-release

CentOS Linux release 7.2.1511 (Core)

关闭四台机器的iptables和selinux

[root@dns01 ~]# systemctl stop firewalld

[root@dns01 ~]# setenforce 0

[root@dns01 ~]# vim /etc/sysconfig/selinux

......

SELINUX=disabled

同步四台机器的系统时间

[root@dns01 ~]# yum install -y ntpdate

[root@dns01 ~]# ntpdate ntp1.aliyun.com

2）安装namedmanager（在172.22.51.65和172.22.51.74两台机器上同样操作）

[root@dns01 ~]# yum install perl perl-DBD-MySQL perl-DBI httpd mod_ssl php php-intl php-ldap php-mysql php-soap php-xml lsof wget lrzsz rsync

修改/etc/httpd/conf/httpd.conf

.......

ServerName dns.kevin.cn:80

使用MySQL Yum仓库时，默认选择安装最新的MySQL版本。如果需要使用低版本请按如下操作。

1.安装MySQL仓库源

[root@dns01 ~]# rpm -ivh https://dev.mysql.com/get/mysql80-community-release-el7-1.noarch.rpm

2.选择并启用适合当前平台的发行包

//列出所有MySQL发行版仓库

[root@dns01 ~]# yum repolist all|grep mysql

//禁用8.0发行版仓库, 启用5.7发行版仓库

[root@dns01 ~]# yum install yum-utils

[root@dns01 ~]# yum-config-manager --disable mysql80-community

[root@dns01 ~]# yum-config-manager --enable mysql57-community

注意
可以手动编辑/etc/yum.repos.d/mysql-community.repo
文件配置仓库

[mysql57-community]

name=MySQL 5.7 Community Server

baseurl=http://repo.mysql.com/yum/mysql-5.7-community/el/6/$basearch/

enabled=1

gpgcheck=1

gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-mysql

3.通过以下命令安装MySQL, 并启动MySQL

[root@dns01 ~]# yum install -y mysql-community-server

[root@dns01 ~]# systemctl start mysqld

[root@dns01 ~]# systemctl enable mysqld

MySQL服务器初始化（仅适用于MySQL 5.7）在服务器初始启动时，如果服务器的数据目录为空，则会发生以下情况：

• 服务器已初始化。
• 在数据目录中生成SSL证书和密钥文件。
• validate_password插件安装并启用。
• 超级用户帐户'root'@'localhost'已创建。

超级用户的密码被设置并存储在错误日志文件中。要显示它，请使用以下命令:

[root@dns01 ~]# grep "password" /var/log/mysqld.log 

2018-04-28T07:11:51.589629Z 1 [Note] A temporary password is generated for root@localhost: jHlRHucap3+7

通过使用生成的临时密码登录并尽快更改root密码并为超级用户帐户设置自定义密码

[root@dns01 ~]# mysql -uroot -pjHlRHucap3+7

mysql> ALTER USER 'root'@'localhost' IDENTIFIED BY 'Bgx123.com';

注意
MySQL的validate_password插件默认安装。将要求密码至少包含大写、小写、数字、特殊字符、并且总密码长度至少为8个字符。

[root@dns01 ~]# systemctl restart mysqld

[root@dns01 ~]# systemctl restart httpd

[root@dns01 ~]# lsof -i:3306

[root@dns01 ~]# lsof -i:80

[root@dns01 ~]#
systemctl enable httpd

[root@dns02 ~]# mysqladmin -u root -p

Password:Bgx123.com

#验证下是否能登录进去

下载并安装namedmanager

[root@dns01 ~]# cd /usr/local/src/

[root@dns01
src]# wget
https://repos.jethrocarr.com/pub/amberdms/linux/centos/7/jethrocarr-custom/x86_64/namedmanager-www-1.9.0-2.el7.centos.noarch.rpm

[root@dns01 src]# rpm -Uvh namedmanager-www-1.9.0-2.el7.centos.noarch.rpm

[root@dns01
src]# cd /usr/share/namedmanager/resources/

注意：

这里要注意，对于mysql5.7因为默认有强密码模块要求，导致生成数据库账号密码不安全从而登录不了数据库，所以在执行autoinstall.pl脚本前要先禁用数据库的强密码模块，再执行脚本就不会报错。

[root@dns01 resources]# ./autoinstall.pl

autoinstall.pl

This script setups the NamedManager database components:

* NamedManager
MySQL user

* NamedManager
database

* NamedManager
configuration files

THIS SCRIPT ONLY NEEDS TO BE RUN FOR THE VERY FIRST
INSTALL OF NAMEDMANAGER.

DO NOT RUN FOR ANY OTHER REASON

Please enter MySQL root password (if any):
Bgx123.com

Searching ../sql/ for latest install schema...

../sql//version_20131222_install.sql is the latest file
and will be used for the install.

Importing file ../sql//version_20131222_install.sql

Creating user...

DBD::mysql::db do failed: Your password does not
satisfy the current policy requirements at ./autoinstall.pl line 288,
<SQL> line 2.

DBD::mysql::db do failed: Your password does not
satisfy the current policy requirements at ./autoinstall.pl line 288,
<SQL> line 2.

Updating configuration file...

DB installation complete!

You can now login with the default username/password of
setup/setup123 at http://localhost/namedmanager

这里要注意，对于mysql5.7因为默认有强密码模块要求，导致生成数据库账号密码不安全从而登录不了数据库，所以在执行autoinstall.pl脚本前要先禁用数据库的强密码模块，再执行脚本就不会报错。

3）安装和配置bind9（在172.22.51.65和172.22.51.74两台机器上同样操作）

[root@dns01 ~]# cd /usr/local/src/

[root@dns01 src]# yum install bind php-process

[root@dns01 src]# wget https://repos.jethrocarr.com/pub/amberdms/linux/centos/7/jethrocarr-custom/x86_64/namedmanager-bind-1.9.0-2.el7.centos.noarch.rpm

[root@dns01 src]# rpm -Uvh namedmanager-bind-1.9.0-2.el7.centos.noarch.rpm

warning: namedmanager-bind-1.9.0-2.el7.centos.noarch.rpm: Header V4 DSA/SHA1 Signature, key ID 55e8661e: NOKEY

Preparing...                          ################################# [100%]

Updating / installing...

1:namedmanager-bind-1.9.0-2.el7.cen################################# [100%]

BIND/NAMED CONFIGURATION

NamedManager BIND components have been installed, you will need to install

and configure bind/named to use the configuration file by adding the

following to /etc/named.conf:

#

# Include NamedManager Configuration

#

include "/etc/named.namedmanager.conf";

NAMEDMANAGER BIND CONFIGURATION

You need to set the application configuration in /etc/namedmanager/config-bind.php

修改/etc/named.conf

[root@dns01 src]# cp /etc/named.conf /etc/named.conf.bak

[root@dns01 src]# vim /etc/named.conf

options {

listen-on port 53 { any; };

directory "/var/named";

dump-file       "/var/named/data/cache_dump.db";

statistics-file "/var/named/data/named_stats.txt";

memstatistics-file "/var/named/data/named_mem_stats.txt";

allow-query     { any; };

recursion yes;

forward first;

forwarders {

223.5.5.5;

223.6.6.6;

8.8.8.8;

8.8.4.4;

};

dnssec-enable yes;

dnssec-validation yes;

dnssec-lookaside auto;

bindkeys-file "/etc/named.iscdlv.key";

managed-keys-directory "/var/named/dynamic";

};

logging {

channel default_debug {

file "data/named.run";

severity dynamic;

};

};

zone "." {

type hint;

file "named.ca";

};

include "/etc/named.rfc1912.zones";

include "/etc/named.root.key";

include "/etc/named.namedmanager.conf";

==========================================================

如果要bind可以在chroot的模式下运行

[root@dns src]# yum install bind-chroot

建立“/etc/named.namedmanager.conf”文件的硬连接

[root@dns src]# ln /etc/named.namedmanager.conf /var/named/chroot/etc/named.namedmanager.conf

如果不建立硬连接named启动时，会提示找不到“/etc/named.namedmanager.conf”。

这是因为：

bind-chroot是bind的一个功能，使bind可以在一个chroot的模式下运行。也就是说,bind运行时的/(根)目录,并不是系统真正的/(根)目录，只是系统中的一个子目录而已。

这样做的目的是为了提高安全性。因为在chroot的模式下，bind可以访问的范围仅限于这个子目录的范围里，无法进一步提升,进入到系统的其他目录中。

chroot可以改变程序运行时所参考的根目录(/)位置，即将某个特定的子目录作为程序的虚拟根目录，并且对程序运行时可以使用的系统资源，用户权限和所在目录进行严格控制，程序只在这个虚拟的根目录下具有权限，一旦跳出该目录就无任何权限。例如在centos中，/var/name/chroot实际上是根目录(/)的虚拟目录，所以虚拟目录中的/etc目录实际上/var/named/chroot/etc目录，而/var/named目录实际上/var/named/chroot/var/named目录。chroot功能的优点是：如果有黑客通过Bind侵入系统，也只能被限定在chroot目录及其子目录中，其破坏力也仅局限在该虚拟目录中，不会威胁到整个服务器的安全

==========================================================

启动named服务

[root@dns01 src]# systemctl start named

cat /etc/rndc.key    #rndc.key已自动生成

--------------------------------------------------------------------------

添加域名记录（正向解析与反向解析）。设置开机启动服务，并重启服务器。

[root@dns01 src]# systemctl enable httpd

[root@dns01 src]# systemctl enable mysqld

[root@dns01 src]# systemctl enable named

查询是否设置开机自启成功命令：

[root@dns01 ~]# systemctl list-unit-files | grep named.service

named.service                                 enabled

systemd-hostnamed.service                     static

[root@dns01 src]# init 6         #重启机器

重启之后，登录机器验证下httpd、mysqld和named服务是否如实开机启动了

[root@dns01 ~]# ps -ef|grep mysqld

[root@dns01 ~]# ps -ef|grep httpd

[root@dns01 ~]# ps -ef|grep named

测试登录mysql

[root@dns01 ~]# mysql –uroot –p

Password:Bgx123.com         #这时就能顺利登录mysql数据库了

 

4）安装keepalived（172.22.51.65和172.22.51.74两台机器上同样操作）

[root@dns01 ~]# cd /usr/local/src/

[root@dns01 src]# wget http://www.keepalived.org/software/keepalived-2.0.10.tar.gz

[root@dns01 src]# tar -zvxf keepalived-2.0.10.tar.gz

[root@dns01 src]# cd keepalived-2.0.10

[root@dns01 keepalived-2.0.10]# ./configure && make && make install

缺少头文件，只需要安装openssl和openssl-devel即可

yum install –y openssl openssl-devel gcc gcc++

[root@dns01 keepalived-2.0.10]# cp /usr/local/src/keepalived-2.0.10/keepalived/etc/init.d/keepalived /etc/rc.d/init.d/

[root@dns01 keepalived-2.0.10]# cp /usr/local/etc/sysconfig/keepalived /etc/sysconfig/

[root@dns01 keepalived-2.0.10]# mkdir /etc/keepalived

[root@dns01 keepalived-2.0.10]# cp /usr/local/etc/keepalived/keepalived.conf /etc/keepalived/

[root@dns01 keepalived-2.0.10]# cp /usr/local/sbin/keepalived /usr/sbin/

[root@dns01 keepalived-2.0.10]# echo "/etc/init.d/keepalived start" >> /etc/rc.local

两台都要操作：

+++++++检查keepalived进程是否成功设置开机启动

1、cat /etc/rc.local #看启动命令是否成功插入到配置文件

2、ll /etc/rc.local  #查看该文件是否软链接

3、ll /etc/rc.d/rc.local #查看源文件是否有可执行权限

keepalived.conf配置

------------------------------------------

172.22.51.65机器的keepalived.conf配置

[root@dns01 ~]# cp /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf.bak

[root@dns01 ~]# vim /etc/keepalived/keepalived.conf

! Configuration File for keepalived     #全局定义

global_defs {

notification_email {

ops@kevin.cn

}

notification_email_from ops@kevin.cn

smtp_server 127.0.0.1

smtp_connect_timeout 30

router_id master-node

}

vrrp_script chk_http_port {

script "/opt/chk_http.sh"

interval 2

weight -5

fall 2

rise 1

}

vrrp_instance VI_1 {

state MASTER

interface eth0

mcast_src_ip 172.22.51.65

virtual_router_id 51

priority 101

advert_int 1

authentication {

auth_type PASS

auth_pass 1111

}

virtual_ipaddress {

172.22.51.75

}

track_script {

chk_http_port

}

}

编写httpd监控脚本

[root@dns01 ~]# vim /opt/chk_http.sh

#!/bin/bash

counter=$(netstat -na|grep "LISTEN"|grep "80"|wc -l)

if [ "${counter}" = "0" ]; then

systemctl start httpd >/dev/null 2>&1

sleep 2

counter=$(netstat -na|grep "LISTEN"|grep "80"|wc -l)

if [ "${counter}" = "0" ]; then

/etc/init.d/keepalived stop

fi

fi

必须要给此脚本授予执行权限

[root@dns01 ~]# chmod 755 /opt/chk_http.sh

-----------------------------------------

172.22.51.74机器的keepalived.conf配置

[root@dns02 ~]# cp /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf.bak

[root@dns02 ~]# vim /etc/keepalived/keepalived.conf

! Configuration File for keepalived

global_defs {

notification_email {

ops@kevin.cn

}

notification_email_from ops@kevin.cn

smtp_server 127.0.0.1

smtp_connect_timeout 30

router_id slave-node

}

vrrp_script chk_http_port {

script "/opt/chk_http.sh"

interval 2

weight -5

fall 2

rise 1

}

vrrp_instance VI_1 {

state BACKUP

interface eth0

mcast_src_ip 172.22.51.74

virtual_router_id 51

priority 99

advert_int 1

authentication {

auth_type PASS

auth_pass 1111

}

virtual_ipaddress {

172.22.51.75

}

track_script {

chk_http_port

}

}

编写httpd监控脚本

[root@dns02 ~]# vim /opt/chk_http.sh

#!/bin/bash

counter=$(netstat -na|grep "LISTEN"|grep "80"|wc -l)

if [ "${counter}" = "0" ]; then

systemctl start httpd >/dev/null 2>&1

sleep 2

counter=$(netstat -na|grep "LISTEN"|grep "80"|wc -l)

if [ "${counter}" = "0" ]; then

/etc/init.d/keepalived stop

fi

fi

必须要给此脚本授予执行权限

[root@dns02 ~]# chmod 755 /opt/chk_http.sh

-----------------------------------------------------

分别启动两台机器的keepalived服务

[root@dns01 ~]# /etc/init.d/keepalived start

[root@dns01 ~]# ps -ef|grep keep

[root@dns02 ~]# /etc/init.d/keepalived start

[root@dns02 ~]# ps -ef|grep keepalived

检查两台机器的ip，发现vip此时已经漂到172.22.51.65这台机器上

[root@dns01 ~]# ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

inet 127.0.0.1/8 scope host lo

inet6 ::1/128 scope host

valid_lft forever preferred_lft forever

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000

link/ether 52:54:00:6f:a5:e3 brd ff:ff:ff:ff:ff:ff

inet 172.22.51.65/24 brd 192.168.10.255 scope global eth0

inet 172.22.51.75/32 scope global eth0

inet6 fe80::5054:ff:fe6f:a5e3/64 scope link

valid_lft forever preferred_lft forever

[root@dns02 ~]# ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

inet 127.0.0.1/8 scope host lo

inet6 ::1/128 scope host

valid_lft forever preferred_lft forever

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000

link/ether 52:54:00:e2:01:9b brd ff:ff:ff:ff:ff:ff

inet 172.22.51.74/24 brd 192.168.10.255 scope global eth0

inet6 fe80::5054:ff:fee2:19b/64 scope link

valid_lft forever preferred_lft forever

-------------------------------------------------

测试下故障转移

先关闭172.22.51.65机器的httpd程序，发现关闭后会很快重启起来（最多2秒钟），这是因为keepalived程序里引用了/opt/chk_http.sh监控脚本。

同样关闭172.22.51.74机器的httpd程序，也是很快重启起来。

根据/opt/chk_httpd.sh脚本可知，httpd程序挂掉后会自动重启，只有当httpd程序重启失败后，才会强制kill掉keepalived服务，这时vip也会转移到另一台节点。

[root@dns01 keepalived]# killall -9 httpd

两台都要操作：

killall命令并不是Centos7自带的，需要安装，在centos下安装方法如下：

yum install psmisc -y

[root@dns01 keepalived]# ps -ef|grep http

root     23661 23660  0 21:30 ?        00:00:00 /bin/bash /opt/chk_http.sh

root     23682     1  1 21:30 ?        00:00:00 /usr/sbin/httpd

apache   23685 23682  0 21:30 ?        00:00:00 /usr/sbin/httpd

apache   23686 23682  0 21:30 ?        00:00:00 /usr/sbin/httpd

apache   23687 23682  0 21:30 ?        00:00:00 /usr/sbin/httpd

apache   23688 23682  0 21:30 ?        00:00:00 /usr/sbin/httpd

apache   23689 23682  0 21:30 ?        00:00:00 /usr/sbin/httpd

apache   23690 23682  0 21:30 ?        00:00:00 /usr/sbin/httpd

apache   23691 23682  0 21:30 ?        00:00:00 /usr/sbin/httpd

apache   23692 23682  0 21:30 ?        00:00:00 /usr/sbin/httpd

root     23694 21411  0 21:30 pts/1    00:00:00 grep http

在测试关闭172.22.51.65机器的keepalived服务，发现vip资源会自动漂移到172.22.51.74机器上。

当172.22.51.65机器的keepalived服务恢复后，vip资源会再次转移回来。

[root@dns01 ~]# /etc/init.d/keepalived stop

[root@dns01 ~]# ps -ef|grep keeplived

root     24854 21411  0 21:36 pts/1    00:00:00 grep keeplived

[root@dns01 ~]# ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

inet 127.0.0.1/8 scope host lo

inet6 ::1/128 scope host

valid_lft forever preferred_lft forever

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000

link/ether 52:54:00:6f:a5:e3 brd ff:ff:ff:ff:ff:ff

inet 172.22.51.65/24 brd 192.168.10.255 scope global eth0

inet6 fe80::5054:ff:fe6f:a5e3/64 scope link

valid_lft forever preferred_lft forever

[root@dns02 ~]# ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

inet 127.0.0.1/8 scope host lo

inet6 ::1/128 scope host

valid_lft forever preferred_lft forever

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000

link/ether 52:54:00:e2:01:9b brd ff:ff:ff:ff:ff:ff

inet 172.22.51.74/24 brd 192.168.10.255 scope global eth0

inet 172.22.51.75/32 scope global eth0

inet6 fe80::5054:ff:fee2:19b/64 scope link

valid_lft forever preferred_lft forever

可以查看两台机器的/var/log/messages日志，可以看到vip资源的转移过程。

[root@dns01 ~]# /etc/init.d/keepalived start

Starting keepalived:                                       [  OK  ]

[root@dns01 ~]# ps -ef|grep keepalived

root     24877     1  0 21:37 ?        00:00:00 keepalived -D

root     24878 24877  0 21:37 ?        00:00:00 keepalived -D

root     24879 24877  0 21:37 ?        00:00:00 keepalived -D

root     24939 21411  0 21:38 pts/1    00:00:00 grep keepalived

172.22.51.65机器的keepalived服务恢复后，vip资源会再次转移回来。

[root@dns01 ~]# /etc/init.d/keepalived start

Starting keepalived:                                       [  OK  ]

[root@dns01 ~]# ps -ef|grep keepalived

root     24877     1  0 21:37 ?        00:00:00 keepalived -D

root     24878 24877  0 21:37 ?        00:00:00 keepalived -D

root     24879 24877  0 21:37 ?        00:00:00 keepalived -D

root     24939 21411  0 21:38 pts/1    00:00:00 grep keepalived

[root@dns01 ~]# ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

inet 127.0.0.1/8 scope host lo

inet6 ::1/128 scope host

valid_lft forever preferred_lft forever

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000

link/ether 52:54:00:6f:a5:e3 brd ff:ff:ff:ff:ff:ff

inet 172.22.51.65/24 brd 192.168.10.255 scope global eth0

inet 172.22.51.75/32 scope global eth0

inet6 fe80::5054:ff:fe6f:a5e3/64 scope link

valid_lft forever preferred_lft forever

[root@dns02 ~]# ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

inet 127.0.0.1/8 scope host lo

inet6 ::1/128 scope host

valid_lft forever preferred_lft forever

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000

link/ether 52:54:00:e2:01:9b brd ff:ff:ff:ff:ff:ff

inet 172.22.51.74/24 brd 192.168.10.255 scope global eth0

inet6 fe80::5054:ff:fee2:19b/64 scope link

valid_lft forever preferred_lft forever

 

5）配置namedmanager（两台机器都要操作）

[root@dns01 ~]# cp /etc/namedmanager/config-bind.php /etc/namedmanager/config-bind.php.bak

[root@dns01 ~]# vim /etc/namedmanager/config-bind.php

......

$config["api_url"]      = "http://172.22.51.75/namedmanager";

$config["api_server_name"]  = "dns.kevin.cn";

$config["api_auth_key"]     = "DNS";

6）配置两台机器的mysql主主关系

++++++++++++172.22.51.65这台+++++++++++++++++++++

验证登录

[root@dns01 ~]# mysql -hlocalhost -unamedmanager -p

Password:查看配置文件vi /etc/namedmanager/config.php(上面安装namedmanager时，脚本自动生成数据库以及数据库账号密码以及权限的)

......

mysql>

++++++++++++172.22.51.74这台+++++++++++++++++++++

验证登录:因172.22.51.65和172.22.51.74做了mysql主-主，新创建的用户namedmanager的账号密码也同步到74这台，但namedmanager配置文件并没有自动修改，所以需要65上的namedmanage用户的数据库密码更新到74namedmanager的配置上面，保持一致，否则登录74 namedmanager页面会提示数据库连接失败。

[root@dns01 ~]# mysql -hlocalhost -unamedmanager -p

Password:查看配置文件vi /etc/namedmanager/config.php(上面安装namedmanager时，脚本自动生成数据库以及数据库账号密码以及权限的，因为和65是不一样的，所以需要更新成65一样才行)

......

mysql>

-------------------------------------------------------------

172.22.51.65机器上的mysql设置

[root@dns01 ~]# cp /etc/my.cnf /etc/my.cnf.bak

[root@dns01 ~]# vim /etc/my.cnf                  #在[mysqld]区域里添加下面几行内容

......

server-id = 1

log-bin = mysql-bin

sync_binlog = 1

binlog_format = mixed

auto-increment-increment = 2

auto-increment-offset = 1

slave-skip-errors = all

重启mysqld服务

[root@dns01 log]# systemctl restart mysqld

数据同步授权,这样I/O线程就可以以这个用户的身份连接到主服务器，并且读取它的二进制日志。

[root@dns01 log]# mysql -uroot -p

......

mysql> grant replication slave,replication client on *.* to kevin@'172.22.51.%' identified by "Kevin@123";

mysql> flush privileges;

最好将库锁住，仅仅允许读，以保证数据一致性；待主主同步环境部署后再解锁；

锁住后，就不能往表里写数据，但是重启mysql服务后就会自动解锁！

mysql> flush tables with read lock;

mysql> show master status;

+------------------+----------+--------------+------------------+

| File             | Position | Binlog_Do_DB | Binlog_Ignore_DB |

+------------------+----------+--------------+------------------+

| mysql-bin.000001 |      154 |              |                  |

+------------------+----------+--------------+------------------+

1 row in set (0.00 sec)

--------------------------------------------------------------------

172.22.51.74机器上的mysql设置

[root@dns02 ~]# cp /etc/my.cnf /etc/my.cnf.bak

[root@dns02 ~]# vim /etc/my.cnf

.......

server-id = 2

log-bin = mysql-bin

sync_binlog = 1

binlog_format = mixed

auto-increment-increment = 2

auto-increment-offset = 2

slave-skip-errors = all

[root@dns02 ~]# systemctl restart mysqld

[root@dns02 ~]# mysql –uroot -p

.......

mysql> grant replication slave,replication client on *.* to kevin@'172.22.51.%' identified by "Kevin@123";

mysql> flush privileges;

mysql> flush tables with read lock;

mysql> show master status;

+------------------+----------+--------------+------------------+

| File             | Position | Binlog_Do_DB | Binlog_Ignore_DB |

+------------------+----------+--------------+------------------+

| mysql-bin.000001 |      630 |              |                  |

+------------------+----------+--------------+------------------+

1 row in set (0.00 sec)

---------------172.22.51.65服务器做同步操作---------------

mysql> unlock tables;

Query OK, 0 rows affected (0.00 sec)

mysql> stop slave;

Query OK, 0 rows affected, 1 warning (0.00 sec)

mysql> change master to master_host='172.22.51.74',master_user='kevin',master_password='Kevin@123',master_log_file='mysql-bin.000001',master_log_pos=794;

Query OK, 0 rows affected (0.20 sec)

mysql> start slave;

Query OK, 0 rows affected (0.00 sec)

mysql> show slave status \G;

.......

*************************** 1. row ***************************

Slave_IO_State: Waiting for master to send event

Master_Host: 172.22.51.74

Master_User: kevin

Master_Port: 3306

Connect_Retry: 60

Master_Log_File: mysql-bin.000001

Read_Master_Log_Pos: 365

Relay_Log_File: mysqld-relay-bin.000002

Relay_Log_Pos: 251

Relay_Master_Log_File: mysql-bin.000001

Slave_IO_Running: Yes

Slave_SQL_Running: Yes

.......

.......

---------------172.22.51.74服务器做同步操作---------------

mysql> unlock tables;

Query OK, 0 rows affected (0.00 sec)

mysql> stop slave;

Query OK, 0 rows affected, 1 warning (0.00 sec)

mysql> change master to master_host='172.22.51.65',master_user='kevin',master_password='Kevin@123',master_log_file='mysql-bin.000001',master_log_pos=321;

Query OK, 0 rows affected (0.18 sec)

mysql> start slave;

Query OK, 0 rows affected (0.00 sec)

mysql> show slave status \G;

*************************** 1. row ***************************

Slave_IO_State: Waiting for master to send event

Master_Host: 172.22.51.65

Master_User: kevin

Master_Port: 3306

Connect_Retry: 60

Master_Log_File: mysql-bin.000001

Read_Master_Log_Pos: 365

Relay_Log_File: mysqld-relay-bin.000002

Relay_Log_Pos: 251

Relay_Master_Log_File: mysql-bin.000001

Slave_IO_Running: Yes

Slave_SQL_Running: Yes

.......

.......

到这里，172.22.51.65和172.22.51.74两台机器的mysql主主关系就配置成功了。下面测试下：

首先在172.22.51.65的mysql数据库上添加数据：

[root@dns01 log]# mysql –uroot -p

.....

mysql> show databases;

+--------------------+

| Database           |

+--------------------+

| information_schema |

| mysql              |

| namedmanager       |

| test               |

+--------------------+

4 rows in set (0.00 sec)

mysql> create database kevin;

Query OK, 1 row affected (0.04 sec)

然后到172.22.51.74机器的mysql数据库上验证并变更数据

[root@dns02 ~]# mysql –uroot -p

.......

mysql> show databases;

+--------------------+

| Database           |

+--------------------+

| information_schema |

| kevin              |

| mysql              |

| namedmanager       |

| test               |

+--------------------+

5 rows in set (0.00 sec)

mysql> drop database kevin;

Query OK, 0 rows affected (0.03 sec)

mysql> create database bobo;

Query OK, 1 row affected (0.08 sec)

再到172.22.51.65机器的mysql数据库上验证

[root@dns01 log]# mysql –uroot -p

......

mysql> show databases;

+--------------------+

| Database           |

+--------------------+

| information_schema |

| bobo               |

| mysql              |

| namedmanager       |

| test               |

+--------------------+

5 rows in set (0.00 sec)

mysql> drop database bobo;

Query OK, 0 rows affected (0.05 sec)

 

7）在172.22.51.65和172.22.51.74两台机器上配置相关数据的同步关系。 

先做好两台机器的ssh相互信任关系。

[root@dns01 ~]#ssh-keygen -t rsa

[root@dns02 ~]#ssh-keygen -t rsa

[root@dns01 ~]# ssh-copy-id -i /root/.ssh/id_rsa.pub –p 22 root@172.22.51.74

[root@dns02 ~]# ssh-copy-id -i /root/.ssh/id_rsa.pub –p 22 root@172.22.51.65

验证两机之间的ssh互信

[root@dns01 ~]# ssh -p22 root@172.22.51.74

[root@dns02 ~]#

[root@dns02 httpd]# ssh -p22 root@172.22.51.65

[root@dns01 ~]#

------------------------------------------------------------

现在172.22.51.65机器上做同步，判断VIP资源是否存在本机，如果存在就同步到另一台机器上。

[root@dns01 ~]# vim /opt/rsync_dns.sh

#!/bin/bash

while [ "1" = "1" ]

do

NUM=`ip addr|grep 172.22.51.75|wc -l`

if [ $NUM -eq 0 ];then

echo "vip is not at this server" >/dev/null 2>&1

fi

if [ $NUM -eq 1 ];then

/usr/bin/rsync -e "ssh -p22" -avpgolr /etc/named.conf root@172.22.51.74:/etc/

/usr/bin/rsync -e "ssh -p22" -avpgolr /var/named/*.zone root@172.22.51.74:/var/named/

fi

done

授予脚本执行权限，并启动脚本

[root@dns01 ~]# chmod 755 /opt/rsync_dns.sh

[root@dns01 ~]# nohup sh /opt/rsync_dns.sh &

[root@dns01 ~]# ps -ef|grep rsync_dns.sh

root      6310 21411  0 22:33 pts/1    00:00:00 sh /opt/rsync_dns.sh

root      6508 21411  0 22:33 pts/1    00:00:00 grep rsync_dns.sh

-----------------------------------------------------------------

然后在172.22.51.74机器上做同步：

[root@dns02 httpd]# vim /opt/rsync_dns.sh

#!/bin/bash

while [ "1" = "1" ]

do

NUM=`ip addr|grep 172.22.51.75|wc -l`

if [ $NUM -eq 0 ];then

echo "vip is not at this server" >/dev/null 2>&1

fi

if [ $NUM -eq 1 ];then

/usr/bin/rsync -e "ssh -p22" -avpgolr /etc/named.conf root@172.22.51.65:/etc/

/usr/bin/rsync -e "ssh -p22" -avpgolr /var/named/*.zone root@172.22.51.65:/var/named/

fi

done

授予脚本执行权限，并启动脚本

[root@dns02 httpd]# chmod 755 /opt/rsync_dns.sh

[root@dns02 httpd]# nohup sh /opt/rsync_dns.sh &

[root@dns02 httpd]# ps -ef|grep rsync_dns.sh

root     12578  5466  0 22:35 pts/1    00:00:00 grep rsync_dns.sh

root     32124  5466  8 22:35 pts/1    00:00:00 sh /opt/rsync_dns.sh

 

8）访问namedmanager（https://172.22.51.75/namedmanager）进行界面配置。（由于此时vip资源在172.22.51.65机器上，故配置信息从172.22.51.65机器同步到172.22.51.74机器）。默认用户名和密码（setup，setup123）。不要忘记在用户管理中修改用户名和密码。

解决办法：vi /etc/httpd/conf/httpd.conf,修改如下：

重置管理员用户名和密码（由于两台服务器的mysql做了主主关系，修改后的信息同样会同步到另一台机器的mysql数据库里，即修改后的管理员账号密码同样适用于另一台机器的namedmanager登录）

接着设置API key（如下图。设置邮箱地址和API key，这个key是在上面的/etc/namedmanager/config-bind.php文件中设置的）

添加服务器。Name Server FQDN的名称要和httpd中的ServerName一致。（如下添加部署机的主机名或者ip地址都可以）

确保下面的"Zonefile Status"和"Logging Status"的状态是绿色的。

添加正向域名解析

添加反向域名解析（如果有多个ip段的客户机，那么就如下图添加多个反向解析配置）

查看正反向解析域名添加情况

上面已经成功添加了正反向解析域名，现在尝试添加一些域名的A记录和PTR记录
先添加A正向解析记录

由于上面在添加A正向解析的时候，已经勾选了PTR反向解析（如果没有勾选，则需要手动添加PTR反向解析记录），故这时候已经有了上面那几个域名的反向解析记录了：

如上，已经添加了几个正反向解析记录，可以访问https://172.22.51.74/namedmanager，发现访问另一台机器的namedmanager（使用上面重置后的admin用户）也会看到上面设置的正反向解析配置信息。这就说明双机同步已经生效。

可以登录到两台机器本机上查看相关的正反向解析配置：

[root@dns01 ~]# cd /var/named/

[root@dns01 named]# ll

total 36

-rw-r--r--. 1 root  root   614 Jun  3 23:42 51.22.172.in-addr.arpa.zone

drwxrwx---. 2 named named 4096 Jun  3 03:21 data

drwxrwx---. 2 named named 4096 Jun  3 23:05 dynamic

-rw-r--r--. 1 root  root   575 Jun  3 23:42 kevin.cn.zone

-rw-r-----. 1 root  named 3289 Apr 11  2017 named.ca

-rw-r-----. 1 root  named  152 Dec 15  2009 named.empty

-rw-r-----. 1 root  named  152 Jun 21  2007 named.localhost

-rw-r-----. 1 root  named  168 Dec 15  2009 named.loopback

drwxrwx---. 2 named named 4096 Jan 22 20:57 slaves

[root@dns01 ~]# cat /etc/named.namedmanager.conf

//

// NamedManager Configuration

//

// This file is automatically generated any manual changes will be lost.

//

zone "kevin.cn" IN {

type master;

file "kevin.cn.zone";

allow-update { none; };

};

zone "51.22.172.in-addr.arpa" IN {

type master;

file "51.22.172.in-addr.arpa.zone";

allow-update { none; };

};

[root@dns01 named]# cat kevin.cn.zone

$ORIGIN kevin.cn.

$TTL 120

@       IN SOA dns.kevin.cn. wangshbo.veredholdings.com. (

2018060311 ; serial

21600 ; refresh

3600 ; retry

604800 ; expiry

120 ; minimum ttl

)

; Nameservers

kevin.cn.   86400 IN NS dns.kevin.cn.

; Mailservers

; Reverse DNS Records (PTR)

; CNAME

; HOST RECORDS

db01    120 IN A 192.168.10.239

db02    120 IN A 192.168.10.212

dns 120 IN A 172.22.51.75

dns01   120 IN A 172.22.51.65

dns02   120 IN A 172.22.51.74

ftp01   120 IN A 192.168.10.209

nc-app  120 IN A 192.168.10.210

web01   120 IN A 192.168.10.214

web02   120 IN A 192.168.10.215

[root@dns01 named]# cat 51.22.172.in-addr.arpa.zone

$ORIGIN 51.22.172.in-addr.arpa.

$TTL 120

@       IN SOA dns.kevin.cn. wangshbo.veredholdings.com. (

2018060310 ; serial

21600 ; refresh

3600 ; retry

604800 ; expiry

120 ; minimum ttl

)

; Nameservers

51.22.172.in-addr.arpa.    86400 IN NS dns.kevin.cn.

; Mailservers

; Reverse DNS Records (PTR)

190 120 IN PTR dns.kevin.cn.

202 120 IN PTR dns01.kevin.cn.

203 120 IN PTR dns02.kevin.cn.

209 120 IN PTR ftp01.kevin.cn.

210 120 IN PTR nc-app.kevin.cn.

212 120 IN PTR db02.kevin.cn.

214 120 IN PTR web01.kevin.cn.

215 120 IN PTR web02.kevin.cn.

239 120 IN PTR db01.kevin.cn.

; CNAME

; HOST RECORDS

9）客户机的DNS配置

root@localhost ~]# ifconfig|grep 192

inet addr:192.168.10.207  Bcast:192.168.10.255  Mask:255.255.255.0

[root@localhost ~]# vim /etc/resolv.conf

domain kevin.cn

search kevin.cn

nameserver 172.22.51.75

[root@localhost ~]# ping www.baidu.com

PING www.a.shifen.com (61.135.169.121) 56(84) bytes of data.

64 bytes from 61.135.169.121: icmp_seq=1 ttl=55 time=2.23 ms

64 bytes from 61.135.169.121: icmp_seq=2 ttl=55 time=2.71 ms

64 bytes from 61.135.169.121: icmp_seq=1 ttl=55 time=2.23 ms

64 bytes from 61.135.169.121: icmp_seq=2 ttl=55 time=2.71 ms

......

......

[root@localhost ~]# ping ftp01.kevin.cn

PING ftp01.kevin.cn (192.168.10.209) 56(84) bytes of data.

64 bytes from ftp01.kevin.cn (192.168.10.209): icmp_seq=1 ttl=64 time=1.25 ms

64 bytes from ftp01.kevin.cn (192.168.10.209): icmp_seq=2 ttl=64 time=0.121 ms

[root@localhost ~]# ping db02.kevin.cn

PING db02.kevin.cn (192.168.10.212) 56(84) bytes of data.

64 bytes from db02.kevin.cn (192.168.10.212): icmp_seq=1 ttl=64 time=0.408 ms

64 bytes from db02.kevin.cn (192.168.10.212): icmp_seq=2 ttl=64 time=0.199 ms

故障切换验证：

关闭172.22.51.65上的keepalived服务，当vip资源切换到172.22.51.74机器上后，

再次在客户机上测试

[root@dns01 ~]# /etc/init.d/keepalived stop

Stopping keepalived:                                       [  OK  ]

[root@dns01 ~]# ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

inet 127.0.0.1/8 scope host lo

inet6 ::1/128 scope host

valid_lft forever preferred_lft forever

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000

link/ether 52:54:00:6f:a5:e3 brd ff:ff:ff:ff:ff:ff

inet 172.22.51.65/24 brd 192.168.10.255 scope global eth0

inet6 fe80::5054:ff:fe6f:a5e3/64 scope link

valid_lft forever preferred_lft forever

[root@dns02 ~]# ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

inet 127.0.0.1/8 scope host lo

inet6 ::1/128 scope host

valid_lft forever preferred_lft forever

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000

link/ether 52:54:00:e2:01:9b brd ff:ff:ff:ff:ff:ff

inet 172.22.51.74/24 brd 192.168.10.255 scope global eth0

inet 172.22.51.75/32 scope global eth0

inet6 fe80::5054:ff:fee2:19b/64 scope link

valid_lft forever preferred_lft forever

当vip资源转移到另一台机器后，客户机上的DNS就会继续生效了。

[root@localhost ~]# ping www.qq.com

PING news.qq.com (125.39.52.26) 56(84) bytes of data.

64 bytes from no-data (125.39.52.26): icmp_seq=1 ttl=52 time=4.32 ms

64 bytes from no-data (125.39.52.26): icmp_seq=2 ttl=52 time=4.15 ms

[root@localhost ~]# ping web02.kevin.cn

PING web02.kevin.cn (192.168.10.215) 56(84) bytes of data.

64 bytes from web02.kevin.cn (192.168.10.215): icmp_seq=1 ttl=64 time=2.14 ms

64 bytes from web02.kevin.cn (192.168.10.215): icmp_seq=2 ttl=64 time=0.143 ms

如果上面不做两台机器的mysql主主以及那些dns相关同步配置，那么要想实现主机高可用（提供统一的vip访问地址），就需要将DNS的解析配置在172.22.51.65和172.22.51.74

两台机器的namedmanager界面里同样操作，即每次都要操作两遍。