上一篇讲了DNS的基础相关以及一个简单的DNS搭建过程，今天更加深入的讲一讲DNS的主从复制、子域授权以及视图功能。
大纲
一、DNS主从复制
二、DNS子域授权
三、DNS视图
一、DNS主从复制
环境准备
主DNS 172.16.1.111 soysauce
从DNS 172.16.1.110 CentOS5
1、首先建立主DNS
[[email protected] ~]# yum install -y "bind" "bind-utils" # 安装bind和bind-utils
[[email protected] ~]# mv /etc/named.conf{,.back} # 备份系统自带的配置文件
[[email protected] ~]# vim /etc/named.conf # 编辑主配置文件
[[email protected] named]# cat /etc/named.conf
options {
directory "/var/named";
allow-recursion { 172.16.0.0/16; }; # 定义允许递归的网段
notify yes; # 开启通知功能
};
zone "." IN {
type hint;
file "named.ca";
};
zone "localhost" IN {
type master;
file "named.localhost";
allow-transfer { none; }; # 不允许区域传送
};
zone "0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-transfer { none; }; # 不允许区域传送
};
zone "soysauce.com" IN {
type master;
file "soysauce.com.zone";
allow-transfer { 172.16.1.110; }; # 定义只允许从DNS区域传送
};
zone "1.16.172.in-addr.arpa" {
type master;
file "172.16.1.zone";
allow-transfer { 172.16.1.110; }; # 定义只允许从DNS区域传送
};
[[email protected] ~]# cd /var/named/
[[email protected] named]# vim soysauce.com.zone
[[email protected] named]# cat soysauce.com.zone # 定义soysauce.com.正向解析
$TTL 86400
@ IN SOA ns1.soysauce.com. admin.soysauce.com. (
2015121001
3H
10M
1D
2D )
IN NS ns1
IN NS ns2
IN MX 10 mail
ns1 IN A 172.16.1.111
ns2 IN A 172.16.1.110
mail IN A 172.16.1.115
www IN A 172.16.1.112
www IN A 172.16.1.113
ftp IN CNAME www
[[email protected] named]# vim 172.16.1.zone
[[email protected] named]# cat 172.16.1.zone # 定义1.16.172.in-addr.arpa反向解析
$TTL 86400
@ IN SOA ns1.soysauce.com. admin.soysauce.com. (
2015121001
3H
10M
1D
2D )
IN NS ns1.soysauce.com.
IN NS ns2.soysauce.com.
111 IN PTR ns1.soysauce.com.
110 IN PTR ns2.soysauce.com.
115 IN PTR mail.soysauce.com.
112 IN PTR www.soysauce.com.
113 IN PTR www.soysauce.com.
[[email protected] ~]# chmod 640 /etc/named.conf
[[email protected] ~]# chown root.named /etc/named.conf
[[email protected] ~]# ll /etc/named.conf
-rw-r----- 1 root named 529 Dec 3 14:13 /etc/named.conf
[[email protected] ~]# named-checkconf # 检查配置文件是否有语法错误
[[email protected] ~]# named-checkzone "soysauce.com." /var/named/soysauce.com.zone
zone soysauce.com/IN: loaded serial 2015121001
OK
[[email protected] ~]# named-checkzone "1.16.172.in-addr-arpa" /var/named/172.16.1.zone
zone 1.16.172.in-addr-arpa/IN: loaded serial 2015121001
OK
[[email protected] ~]# service named start # 启动主DNS
Starting named: [ OK ]
[[email protected] ~]# tail /var/log/messages
[[email protected] named]# tail /var/log/messages
Dec 11 14:07:32 CentOS6 named[9278]: command channel listening on 127.0.0.1#953
Dec 11 14:07:32 CentOS6 named[9278]: command channel listening on ::1#953
Dec 11 14:07:32 CentOS6 named[9278]: zone 0.0.127.in-addr.arpa/IN: loaded serial 0
Dec 11 14:07:32 CentOS6 named[9278]: zone 1.16.172.in-addr.arpa/IN: loaded serial 2015121001
Dec 11 14:07:32 CentOS6 named[9278]: zone soysauce.com/IN: loaded serial 2015121001
Dec 11 14:07:32 CentOS6 named[9278]: zone localhost/IN: loaded serial 0
Dec 11 14:07:32 CentOS6 named[9278]: managed-keys-zone ./IN: loaded serial 0
Dec 11 14:07:32 CentOS6 named[9278]: running
Dec 11 14:07:32 CentOS6 named[9278]: zone soysauce.com/IN: sending notifies (serial 2015121001)
Dec 11 14:07:32 CentOS6 named[9278]: zone 1.16.172.in-addr.arpa/IN: sending notifies (serial 2015121001)
[[email protected] ~]# netstat -tunlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 172.16.1.111:53 0.0.0.0:* LISTEN 8800/named
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 8800/named
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1631/sshd
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 8800/named
tcp 0 0 :::80 :::* LISTEN 8414/httpd
tcp 0 0 :::22 :::* LISTEN 1631/sshd
tcp 0 0 ::1:953 :::* LISTEN 8800/named
udp 0 0 172.16.1.111:53 0.0.0.0:* 8800/named
udp 0 0 127.0.0.1:53 0.0.0.0:* 8800/named
2、建立从DNS
[[email protected] ~]# yum install -y "bind97" "bind97-utils" # 此从DNS为CentOS5.8，所以bind为9.7版本
[[email protected] ~]# mv /etc/named.conf{,.back}
[[email protected] ~]# scp 172.16.1.111:/etc/named.conf /etc/named.conf
The authenticity of host ‘172.16.1.111 (172.16.1.111)‘ can‘t be established.
RSA key fingerprint is 1e:87:cd:f0:95:ff:a8:ef:19:bc:c6:e7:0a:87:6b:fa.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added ‘172.16.1.111‘ (RSA) to the list of known hosts.
[email protected]‘s password:
named.conf 100% 529 0.5KB/s 00:00
[[email protected] ~]# vim /etc/named.conf
[[email protected] ~]# cat /etc/named.conf
options {
directory "/var/named";
allow-recursion { 172.16.0.0/16; };
};
zone "." IN {
type hint;
file "named.ca";
};
zone "localhost" IN {
type master;
file "named.localhost";
allow-transfer { none; };
};
zone "0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-transfer { none; };
};
zone "soysauce.com" IN {
type slave; # 类型为从DNS
file "slaves/soysauce.com.zone"; # 保存区域数据文件到/var/named/slaves目录下
masters { 172.16.1.111; }; # 指明主DNS的地址
allow-transfer { none; }; # 为了安全，不允许任何人传送
};
zone "1.16.172.in-addr.arpa" {
type slave;
file "slaves/172.16.1.zone"; # 此反向区域定义同上
masters { 172.16.1.111; };
allow-transfer { none; };
};
[[email protected] ~]# ll /etc/named.conf
-rw-r----- 1 root root 574 Aug 29 05:59 /etc/named.conf
[[email protected] ~]# chown .named /etc/named.conf
[[email protected] ~]# named-checkconf
[[email protected] named]# service named start
Starting named: [ OK ]
[[email protected] named]# tail /var/log/messages # 查看区域传送日志
Dec 11 14:09:55 CentOS5 named[11183]: zone soysauce.com/IN: Transfer started.
Dec 11 14:09:55 CentOS5 named[11183]: transfer of ‘soysauce.com/IN‘ from 172.16.1.111#53: connected using 172.16.1.110#52835
Dec 11 14:09:55 CentOS5 named[11183]: zone soysauce.com/IN: transferred serial 2015121001
Dec 11 14:09:55 CentOS5 named[11183]: transfer of ‘soysauce.com/IN‘ from 172.16.1.111#53: Transfer completed: 1 messages, 11 records, 267 bytes, 0.006 secs (44500 bytes/sec)
Dec 11 14:09:55 CentOS5 named[11183]: zone soysauce.com/IN: sending notifies (serial 2015121001)
Dec 11 14:09:56 CentOS5 named[11183]: zone 1.16.172.in-addr.arpa/IN: Transfer started.
Dec 11 14:09:56 CentOS5 named[11183]: transfer of ‘1.16.172.in-addr.arpa/IN‘ from 172.16.1.111#53: connected using 172.16.1.110#46898
Dec 11 14:09:56 CentOS5 named[11183]: zone 1.16.172.in-addr.arpa/IN: transferred serial 2015121001
Dec 11 14:09:56 CentOS5 named[11183]: transfer of ‘1.16.172.in-addr.arpa/IN‘ from 172.16.1.111#53: Transfer completed: 1 messages, 9 records, 264 bytes, 0.008 secs (33000 bytes/sec)
Dec 11 14:09:56 CentOS5 named[11183]: zone 1.16.172.in-addr.arpa/IN: sending notifies (serial 2015121001)
[[email protected] ~]# cd /var/named/slaves
[[email protected] slaves]# ls # 可以看到数据文件已经同步过来了
172.16.1.zone soysauce.com.zone
[[email protected] slaves]# cat soysauce.com.zone # 同步过来的正向区域数据文件
$ORIGIN .
$TTL 86400 ; 1 day
soysauce.com IN SOA ns1.soysauce.com. admin.soysauce.com. (
2015121001 ; serial
10800 ; refresh (3 hours)
600 ; retry (10 minutes)
86400 ; expire (1 day)
172800 ; minimum (2 days)
)
NS ns1.soysauce.com.
NS ns2.soysauce.com.
MX 10 mail.soysauce.com.
$ORIGIN soysauce.com.
ftp CNAME www
mail A 172.16.1.115
ns1 A 172.16.1.111
ns2 A 172.16.1.110
www A 172.16.1.112
A 172.16.1.113
[[email protected] slaves]# cat 172.16.1.zone # 同步过来的反向区域数据文件
$ORIGIN .
$TTL 86400 ; 1 day
1.16.172.in-addr.arpa IN SOA ns1.soysauce.com. admin.soysauce.com. (
2015121001 ; serial
10800 ; refresh (3 hours)
600 ; retry (10 minutes)
86400 ; expire (1 day)
172800 ; minimum (2 days)
)
NS ns1.soysauce.com.
NS ns2.soysauce.com.
$ORIGIN 1.16.172.in-addr.arpa.
110 PTR ns2.soysauce.com.
111 PTR ns1.soysauce.com.
112 PTR www.soysauce.com.
113 PTR www.soysauce.com.
115 PTR mail.soysauce.com.
3、增加主DNS正向解析记录，测试是否能通知从DNS
[[email protected] named]# vim soysauce.com.zone [[email protected] named]# tail -1 soysauce.com.zone # 新增一条A记录 bbs IN A 172.16.1.114 [[email protected] named]# service named reload Reloading named: [ OK ] [[email protected] named]# tail /var/log/messages Dec 11 14:15:34 CentOS6 named[9278]: using default UDP/IPv4 port range: [1024, 65535] Dec 11 14:15:34 CentOS6 named[9278]: using default UDP/IPv6 port range: [1024, 65535] Dec 11 14:15:34 CentOS6 named[9278]: sizing zone task pool based on 5 zones Dec 11 14:15:34 CentOS6 named[9278]: Warning: ‘empty-zones-enable/disable-empty-zone‘ not set: disabling RFC 1918 empty zones Dec 11 14:15:34 CentOS6 named[9278]: reloading configuration succeeded Dec 11 14:15:34 CentOS6 named[9278]: reloading zones succeeded Dec 11 14:15:34 CentOS6 named[9278]: zone soysauce.com/IN: loaded serial 2015121002 Dec 11 14:15:34 CentOS6 named[9278]: zone soysauce.com/IN: sending notifies (serial 2015121002) Dec 11 14:15:34 CentOS6 named[9278]: client 172.16.1.110#48166: transfer of ‘soysauce.com/IN‘: AXFR-style IXFR started Dec 11 14:15:34 CentOS6 named[9278]: client 172.16.1.110#48166: transfer of ‘soysauce.com/IN‘: AXFR-style IXFR ended # 可以看到已然传送 [[email protected] slaves]# cat soysauce.com.zone # 再来看从DNS $ORIGIN . $TTL 86400 ; 1 day soysauce.com IN SOA ns1.soysauce.com. admin.soysauce.com. ( 2015121002 ; serial # 序列号已然发生改 10800 ; refresh (3 hours) 600 ; retry (10 minutes) 86400 ; expire (1 day) 172800 ; minimum (2 days) ) NS ns1.soysauce.com. NS ns2.soysauce.com. MX 10 mail.soysauce.com. $ORIGIN soysauce.com. bbs A 172.16.1.114 # 可以看到已然同步过来了 ftp CNAME www mail A 172.16.1.115 ns1 A 172.16.1.111 ns2 A 172.16.1.110 www A 172.16.1.112 A 172.16.1.113
4、增加主DNS反向解析记录，测试是否能通知从DNS
[[email protected] named]# vim 172.16.1.zone [[email protected] named]# tail -1 172.16.1.zone 114 IN PTR bbs.soysauce.com. # 新增一条A记录 [[email protected] named]# service named reload Reloading named: [ OK ] [[email protected] named]# tail /var/log/messages Dec 11 14:22:15 CentOS6 named[9278]: using default UDP/IPv4 port range: [1024, 65535] Dec 11 14:22:15 CentOS6 named[9278]: using default UDP/IPv6 port range: [1024, 65535] Dec 11 14:22:15 CentOS6 named[9278]: sizing zone task pool based on 5 zones Dec 11 14:22:15 CentOS6 named[9278]: Warning: ‘empty-zones-enable/disable-empty-zone‘ not set: disabling RFC 1918 empty zones Dec 11 14:22:15 CentOS6 named[9278]: reloading configuration succeeded Dec 11 14:22:15 CentOS6 named[9278]: reloading zones succeeded Dec 11 14:22:15 CentOS6 named[9278]: zone 1.16.172.in-addr.arpa/IN: loaded serial 2015121002 Dec 11 14:22:15 CentOS6 named[9278]: zone 1.16.172.in-addr.arpa/IN: sending notifies (serial 2015121002) Dec 11 14:22:15 CentOS6 named[9278]: client 172.16.1.110#41576: transfer of ‘1.16.172.in-addr.arpa/IN‘: AXFR-style IXFR started Dec 11 14:22:15 CentOS6 named[9278]: client 172.16.1.110#41576: transfer of ‘1.16.172.in-addr.arpa/IN‘: AXFR-style IXFR ended # 可以看到已然传送 [[email protected] slaves]# cat 172.16.1.zone # 再来看从DNS $ORIGIN . $TTL 86400 ; 1 day 1.16.172.in-addr.arpa IN SOA ns1.soysauce.com. admin.soysauce.com. ( 2015121002 ; serial # 序列号已然发生改变 10800 ; refresh (3 hours) 600 ; retry (10 minutes) 86400 ; expire (1 day) 172800 ; minimum (2 days) ) NS ns1.soysauce.com. NS ns2.soysauce.com. $ORIGIN 1.16.172.in-addr.arpa. 110 PTR ns2.soysauce.com. 111 PTR ns1.soysauce.com. 112 PTR www.soysauce.com. 113 PTR www.soysauce.com. 114 PTR bbs.soysauce.com. # 这一条A记录已然同步过来 115 PTR mail.soysauce.com.
注意：得配置iptables和selinux以及区域数据文件中从DNS的定义，不然可能导致无法实现主从复制。
5、增加本地rndc控制
[[email protected] ~]# rndc-confgen > /etc/rndc.conf # 生成rndc配置文件
[[email protected] ~]# vim /etc/rndc.conf # 将后半段注释部分追加至/etc/named.conf文件中
[[email protected] ~]# tail /etc/named.conf # 可以看到已然追加成功
# key "rndc-key" {
# algorithm hmac-md5;
# secret "zcuT2H5UyUdG/1maGgMTYg==";
# };
#
# controls {
# inet 127.0.0.1 port 953
# allow { 127.0.0.1; } keys { "rndc-key"; };
# };
# End of named.conf
[[email protected] ~]# vim /etc/named.conf # 去掉至倒数第二行的开头注释#号及空白
[[email protected] ~]# tail /etc/named.conf
key "rndc-key" {
algorithm hmac-md5;
secret "zcuT2H5UyUdG/1maGgMTYg==";
};
controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { "rndc-key"; };
};
#End of named.conf
[[email protected] ~]# rm /etc/rndc.key # 删除系统自带的key
[[email protected] ~]# service named restart
Stopping named: [ OK ]
Starting named: [ OK ]
[[email protected] ~]# rndc status # 查看统计信息
version: 9.8.2rc1-RedHat-9.8.2-0.37.rc1.el6_7.4
CPUs found: 1
worker threads: 1
number of zones: 20
debug level: 0
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is OFF
recursive clients: 0/0/1000
tcp clients: 0/100
server is up and running
[[email protected] ~]# rndc flush # 清空缓存
[[email protected] ~]# rndc notify "soysauce.com." # 手动通知区域
zone notify queued
[[email protected] ~]# tail /var/log/messages
Dec 11 15:26:49 CentOS6 named[9840]: managed-keys-zone ./IN: loaded serial 0
Dec 11 15:26:49 CentOS6 named[9840]: running
Dec 11 15:26:49 CentOS6 named[9840]: zone 1.16.172.in-addr.arpa/IN: sending notifies (serial 2015121002)
Dec 11 15:26:49 CentOS6 named[9840]: zone soysauce.com/IN: sending notifies (serial 2015121002)
Dec 11 15:28:30 CentOS6 named[9840]: received control channel command ‘flush‘
Dec 11 15:28:30 CentOS6 named[9840]: flushing caches in all views succeeded
Dec 11 15:28:46 CentOS6 named[9840]: received control channel command ‘flush‘
Dec 11 15:28:46 CentOS6 named[9840]: flushing caches in all views succeeded
Dec 11 15:29:28 CentOS6 named[9840]: received control channel command ‘notify soysauce.com.‘
Dec 11 15:29:28 CentOS6 named[9840]: zone soysauce.com/IN: sending notifies (serial 2015121002)
[[email protected] ~]# rndc stop # 关闭named服务
[[email protected] ~]# netstat -tunlp # 可以看到named服务已然关闭
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1631/sshd
tcp 0 0 :::80 :::* LISTEN 8414/httpd
tcp 0 0 :::22 :::* LISTEN 1631/sshd
[[email protected] ~]# service named start
Starting named: [ OK ]
[[email protected] ~]# netstat -tunlp # 可以看到named服务又重新启动了
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 172.16.1.111:53 0.0.0.0:* LISTEN 9909/named
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 9909/named
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1631/sshd
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 9909/named
tcp 0 0 :::80 :::* LISTEN 8414/httpd
tcp 0 0 :::22 :::* LISTEN 1631/sshd
udp 0 0 172.16.1.111:53 0.0.0.0:* 9909/named
udp 0 0 127.0.0.1:53 0.0.0.0:* 9909/named
二、DNS子域授权
1、首先在上面那个主DNS中添加子域one.soysauce.com.和two.soysauce.com.
[[email protected] named]# vim soysauce.com.zone [[email protected] named]# cat soysauce.com.zone $TTL 86400 @ IN SOA ns1.soysauce.com. admin.soysauce.com. ( 2015121003 # 此处应该改变，+1 3H 10M 1D 2D ) IN NS ns1 IN NS ns2 IN MX 10 mail ns1 IN A 172.16.1.111 ns2 IN A 172.16.1.110 mail IN A 172.16.1.115 www IN A 172.16.1.112 www IN A 172.16.1.113 ftp IN CNAME www bbs IN A 172.16.1.114 one IN NS ns1.one # 添加子域的NS记录和对应的A记录 ns1.one IN A 172.16.1.102 two IN NS ns1.two ns2.two IN A 172.16.1.103 [[email protected] named]# service named reload # 重读配置文件及区域数据文件 Reloading named: [ OK ] [[email protected] named]# tail /var/log/messages Dec 11 16:38:14 CentOS6 named[9909]: using default UDP/IPv6 port range: [1024, 65535] Dec 11 16:38:14 CentOS6 named[9909]: sizing zone task pool based on 5 zones Dec 11 16:38:14 CentOS6 named[9909]: Warning: ‘empty-zones-enable/disable-empty-zone‘ not set: disabling RFC 1918 empty zones Dec 11 16:38:14 CentOS6 named[9909]: reloading configuration succeeded Dec 11 16:38:14 CentOS6 named[9909]: reloading zones succeeded Dec 11 16:38:14 CentOS6 named[9909]: zone soysauce.com/IN: two.soysauce.com/NS ‘ns1.two.soysauce.com‘ has no REQUIRED GLUE address records (A or AAAA) Dec 11 16:38:14 CentOS6 named[9909]: zone soysauce.com/IN: loaded serial 2015121003 Dec 11 16:38:14 CentOS6 named[9909]: zone soysauce.com/IN: sending notifies (serial 2015121003) Dec 11 16:38:14 CentOS6 named[9909]: client 172.16.1.110#48797: transfer of ‘soysauce.com/IN‘: AXFR-style IXFR started Dec 11 16:38:14 CentOS6 named[9909]: client 172.16.1.110#48797: transfer of ‘soysauce.com/IN‘: AXFR-style IXFR ended # 已通知从DNS完成区域传送
2、查看从DNS上soysauce.com.区域数据文件是否同步
[[email protected] slaves]# cat soysauce.com.zone $ORIGIN . $TTL 86400 ; 1 day soysauce.com IN SOA ns1.soysauce.com. admin.soysauce.com. ( 2015121003 ; serial # 序列号发生改变 10800 ; refresh (3 hours) 600 ; retry (10 minutes) 86400 ; expire (1 day) 172800 ; minimum (2 days) ) NS ns1.soysauce.com. NS ns2.soysauce.com. $ORIGIN soysauce.com. bbs A 172.16.1.114 ftp CNAME www mail A 172.16.1.115 ns1 A 172.16.1.111 ns2 A 172.16.1.110 one NS ns1.one $ORIGIN one.soysauce.com. ns1 A 172.16.1.102 # 可以看到one和two两个子域都已然同步 $ORIGIN soysauce.com. two NS ns1.two MX 10 mail $ORIGIN two.soysauce.com. ns2 A 172.16.1.103 $ORIGIN soysauce.com. www A 172.16.1.112 A 172.16.1.113
3、配置子域one.soysauce.com.的DNS服务器
[[email protected] ~]# ifconfig eth0 Link encap:Ethernet HWaddr 00:0C:29:5C:4E:8F inet addr:172.16.1.102 Bcast:172.16.255.255 Mask:255.255.0.0 inet6 addr: fe80::20c:29ff:fe5c:4e8f/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:1590808 errors:0 dropped:0 overruns:0 frame:0 TX packets:783802 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:735399777 (701.3 MiB) TX bytes:284864150 (271.6 MiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:629537 errors:0 dropped:0 overruns:0 frame:0 TX packets:629537 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:61711838 (58.8 MiB) TX bytes:61711838 (58.8 MiB) [[email protected] ~]# yum install -y "bind" "bind-utils"
三、DNS视图
时间： 2024-12-15 01:45:12