发布时间:2022-08-19 14:04
dns:domain name service(域名解析服务)
提供域名解析,主要分为dns服务端的搭建和测试端测试两部分内容
指向文件:
/etc/resolv.conf
nameserver 172.25.254.72
用于测试的命令:
host www.baidu.com
#地址解析命令
dig www.baidu.com
#地址详细解析信息命令
A记录 ##ip地址叫域名的Address记录
SOA ##授权起始主机
dns顶级 .
.13次级 .com .org .net .edu 。。。
bind ##安装包
named ##服务名称
端口:53
主配置文件:
/etc/named.conf
数据目录:
/var/named
1 no servers could be reached ##服务器无法访问(服务i开启?火墙?网络?端口?)
2 服务启动失败 ##配置文件写错,journalctl -xe 查询错误
3 dig 查询状态
NOERROR ##查询成功
REFUSED ##服务拒绝访问
SERVFAIL ##查询记录失败,dns服务器无法到达上级,拒绝缓存
NXDOMAIN ##此域名A记录在dns中不存在
真机:
[root@westos_student72 Desktop]# firewall-cmd --add-masquerade
#能上网的真机设置为路由器
服务端:
[root@westoslinux ~]# ip route add default via 172.25.254.72
[root@westoslinux ~]# route -n
[root@westoslinux ~]# cat /etc/resolv.conf
# Generated by NetworkManager
search westos.org
nameserver 114.114.114.114
测试
[root@westoslinux ~]# dig www.baidu.com
在服务端安装
[root@westoslinux ~]# dnf search dns
bind.x86_64 : The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
[root@westoslinux ~]# dnf install bind.x86_64 -y
[root@westoslinux ~]# systemctl enable --now named
[root@westoslinux ~]# firewall-cmd --permanent --add-service=dns
[root@westoslinux ~]# firewall-cmd --reload
[root@westoslinux ~]# netstat -antlupe |grep named
[root@westoslinux ~]# vim /etc/named.conf
11 listen-on port 53 { any; }; #服务端所有ip都开启53端口
19 allow-query { any; }; #允许所有人访问
34 dnssec-validation no; #对dns安全性进行校验,这里不需要
[root@westoslinux ~]# systemctl restart named.service
[root@westoslinux ~]# netstat -antlupe |grep named
端口开到回环接口上了,并没有在服务端主机ip上开端口,所以这时当客户端指定
dns到服务端ip,dns服务并不能响应
[root@westoslinux ~]# vim /etc/resolv.conf
[root@westoslinux ~]# cat /etc/resolv.conf
# Generated by NetworkManager
search westos.org
nameserver 172.25.254.172
[root@westoslinux ~]# vim /etc/named.conf
20 forwarders { 114.114.114.114; }; 企业内部其他主机访问这台dns服务端时,设定它去哪里取数据
[root@westoslinux ~]# systemctl restart named
改成自己的serverfile后,dig www.baidu.com 发现用时变长,这台主机本身没有数据,就层层上报查询
在客户端测试:dns指定到服务端ip
两个不同的客户端主机分别访问www.jd.com
结果可见,第一次时间稍长,再第一次访问后数据被高速缓存
第二个主机再访问时,所需时间很短
构建一个企业内部的正向解析,不去访问别人的域了
在服务端
[root@westoslinux ~]# vim /etc/named.conf
# 20 forwarders { 114.114.114.114; };
57 include "/etc/named.rfc1912.zones"; 子配置文件
[root@westoslinux ~]# vim /etc/named.rfc1912.zones
29 zone "westos.org" IN {
30 type master;
31 file "westos.org.zone";
32 allow-update { none; };
33 };
#访问 westos.org域名时,向westos.org.zone文件查找解析信息
[root@westoslinux named]# ls
data dynamic named.ca named.empty named.localhost named.loopback slaves
[root@westoslinux named]# cp -p named.localhost westos.org.zone
# -p保证复制的文件权限不变
[root@westoslinux named]# ls
data dynamic named.ca named.empty named.localhost named.loopback slaves westos.org.zone
[root@westoslinux named]# vim westos.org.zone
$TTL 1D
@ IN SOA dns.westos.org. root.westos.org. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.westos.org.
dns A 172.25.254.172
www A 172.25.254.111
[root@westoslinux named]# systemctl restart named
测试
[root@westoslinux named]# dig www.westos.org
[root@westoslinux named]# vim westos.org.zone
$TTL 1D
@ IN SOA dns.westos.org. root.westos.org. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.westos.org.
dns A 172.25.254.172
www CNAME dyh.a #规范域名
dyh.a A 172.25.254.1 #正向解析记录
dyh.a A 172.25.254.2
westos.org. MX 1 172.25.254.172. #邮件解析记录,不是A记录的都要加.
测试:
[root@westoslinux named]# dig www.westos.org
[root@westoslinux named]# vim /etc/named.rfc1912.zones
52 zone "254.25.172.in-addr.arpa" IN { #反向解析ip倒着写
53 type master;
54 file "172.25.254.ptr";
55 allow-update { none; };
56 };
[root@westoslinux named]# ls
data dynamic named.ca named.empty named.localhost named.loopback slaves westos.org.zone
[root@westoslinux named]# cp -p named.loopback 172.25.254.ptr
[root@westoslinux named]# vim 172.25.254.ptr
$TTL 1D
@ IN SOA dns.westos.org. rname.invalid. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.westos.org.
dns A 172.25.254.172
172 PTR mail.westos.org.
[root@westoslinux named]# systemctl restart named
测试: 反向解析加-x
[root@westoslinux named]# dig -x 172.25.254.172
注:正反向解析主要用于邮件发送,发送端正向解析,把接收方域名解析为ip,接收端反向解析,把发送端的ip解析为域名
准备两套ip,172网段解析172网段,1网段解析1网段。
1)服务端设置
[root@westoslinux ~]# cat /etc/sysconfig/network-scripts/ifcfg-ens3
DEVICE=ens3
NAME=ens3
IPADDR0=172.25.254.172
NETMASK0=255.255.255.0
IPADDR1=1.1.1.100
NETMASK1=255.255.255.0
ONBOOT=yes
BOOTPROTO=none
[root@westoslinux ~]# nmcli connection reload
[root@westoslinux ~]# nmcli connection up ens3
#查询两个ip是否都设置好
[root@westoslinux named]# ip addr show ens3
2: ens3: mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 52:54:00:f2:18:1f brd ff:ff:ff:ff:ff:ff
inet 172.25.254.172/24 brd 172.25.254.255 scope global noprefixroute ens3
valid_lft forever preferred_lft forever
inet 1.1.1.100/24 brd 1.1.1.255 scope global noprefixroute ens3
valid_lft forever preferred_lft forever
inet6 fe80::5054:ff:fef2:181f/64 scope link
valid_lft forever preferred_lft forever
2)客户端设置
测试:
在1网段的客户端dig www.westos.org却看到的是172网段的解析,这不是我们想要的
[root@westoslinux named]# ls
172.25.254.ptr data dynamic named.ca named.empty named.localhost named.loopback slaves westos.org.zone
[root@westoslinux named]# cp -p westos.org.zone westos.org.inter
[root@westoslinux named]# vim westos.org.inter
#输入指令: %s/172.25.254/1.1.1/ 替换内容
$TTL 1D
@ IN SOA dns.westos.org. root.westos.org. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.westos.org.
dns A 1.1.1.172
www CNAME dyh.a
dyh.a A 1.1.1.1
dyh.a A 1.1.1.2
westos.org. MX 1 1.1.1.172
[root@westoslinux named]# cp -p /etc/named.rfc1912.zones /etc/named.rfc1912.inter
[root@westoslinux named]# vim /etc/named.rfc1912.inter
29 zone "westos.org" IN {
30 type master;
31 file "westos.org.inter";
32 allow-update { none; };
33 };
[root@westoslinux named]# vim /etc/named.conf
52 /* ##表示整段注释
53 zone "." IN {
54 type hint;
55 file "named.ca";
56 };
57
58 include "/etc/named.rfc1912.zones";
59 include "/etc/named.root.key";
60 */
61
62 view localnet {
63 match-clients{ 1.1.1.0/24; };
64 zone "." IN {
65 type hint;
66 file "named.ca";
67 };
68 include "/etc/named.rfc1912.inter";
69 };
70 view anyone {
71 match-clients{ any; };
72 zone "." IN {
73 type hint;
74 file "named.ca";
75 };
76 include "/etc/named.rfc1912.zones";
77 };
[root@westoslinux named]# systemctl restart named
分别得到了各自网段的解析
补:想要在westos.org域里有多向解析,就在主配置文件(/etc/named.conf)再加一块网段配置,之后再设置子配置文件(/etc/named.rfc1912.xxxx)和解析信息文件(/var/named/westos.org.xxx)
实验前设置:
之前的westosb虚拟机网卡配置,去掉DNS1,ip改为172.25.254.200
[root@westoslinux named]# vim /etc/named.rfc1912.zones
29 zone "westos.org" IN {
30 type master;
31 file "westos.org.zone";
32 allow-update { none; };
33 also-notify { 172.25.254.200; }; #在更改dns信息时主动通知辅助dns主机
34 };
[root@westos200 ~]# dnf install bind -y ##安装dns
[root@westos200 ~]# vim /etc/named.conf
10 options {
11 listen-on port 53 { any; };
12 listen-on-v6 port 53 { ::1; };
13 directory "/var/named";
14 dump-file "/var/named/data/cache_dump.db";
15 statistics-file "/var/named/data/named_stats.txt";
16 memstatistics-file "/var/named/data/named_mem_stats.txt";
17 secroots-file "/var/named/data/named.secroots";
18 recursing-file "/var/named/data/named.recursing";
19 allow-query { any; };
34 dnssec-validation no;
[root@westos200 ~]# vim /etc/named.rfc1912.zones
29 zone "westos.org" IN {
30 type slave; ##类似是辅助dns
31 masters { 172.25.254.172; }; ##主dns的ip
32 file "slaves/westos.org.zone";
33 };
[root@westos200 ~]# systemctl restart named
[root@westos200 ~]# vim /etc/resolv.conf 设定dns为自己
# Generated by NetworkManager
search westos.org
nameserver 172.25.254.200
为了防止火墙影响辅助dns获取主dns信息:
[root@westos200 ~]# firewall-cmd --add-service=dns
或者
[root@westos200 ~]# systemctl disable firewalld.service
测试:
[root@westos200 ~]# dig www.westos.org
在主dns修改解析文件信息
[root@westoslinux named]# vim /var/named/westos.org.zone
$TTL 1D
@ IN SOA dns.westos.org. root.westos.org. (
1 ; serial #改变serial值告诉系统文件修改了
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.westos.org.
dns A 172.25.254.172
www CNAME dyh.a
#dyh.a A 172.25.254.1 #原来的解析ip改为100
dyh.a A 172.25.254.100
#dyh.a A 172.25.254.2 #原来的解析ip改为200
dyh.a A 172.25.254.200
westos.org. MX 1 172.25.254.172
systemctl restart named
[root@westos200 ~]# dig www.westos.org
目的:对于dhcp分配ip的主机,随着它ip的改变,我们想对它域名的解析也能动态改变
在dns+dhcp服务端:
[root@westoslinux named]# dnf install dhcp-server -y
[root@westoslinux named]# cd /usr/share/doc/dhcp-server/
[root@westoslinux dhcp-server]# ls
dhcpd6.conf.example dhcpd.conf.example dhcp-lease-list.pl ldap
[root@westoslinux dhcp-server]# cp -p dhcpd.conf.example /etc/dhcp/dhcpd.conf
cp: overwrite '/etc/dhcp/dhcpd.conf'? y
[root@westoslinux dhcp-server]# cd /etc/dhcp/
[root@westoslinux dhcp]# vim dhcpd.conf
7 option domain-name "westos.org";
8 option domain-name-servers 172.25.254.172;
29 subnet 172.25.254.0 netmask 255.255.255.0 {
30 range 172.25.254.10 172.25.254.70;
31 option routers 172.25.254.172;
32 }
dd掉后面内容
[root@westoslinux dhcp]# systemctl restart dhcpd
[root@westos200 ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens3
[root@westos200 ~]# nmcli connection reload
[root@westos200 ~]# nmcli connection up ens3
在服务端:
[root@westoslinux dhcp]# cd /mnt/
[root@westoslinux mnt]# dnssec-keygen -a HMAC-SHA256 -b 128 -n HOST westoskey
(-a指定加密方式,选择默认加密方式;-b指定生成的密钥长度;
-n指定密钥的名称类型,这里是为本机HOST生成密钥)
[root@westoslinux mnt]# ls
Kwestoskey.+163+49100.key Kwestoskey.+163+49100.private
[root@westoslinux mnt]# cat Kwestoskey.+163+49100.key
westoskey. IN KEY 512 3 163 6TylP6B1GW1kPzNg2j3/7A==
[root@westoslinux mnt]# cat Kwestoskey.+163+49100.private
Private-key-format: v1.3
Algorithm: 163 (HMAC_SHA256)
Key: 6TylP6B1GW1kPzNg2j3/7A==
Bits: AAA=
Created: 20211201085358
Publish: 20211201085358
Activate: 20211201085358
[root@westoslinux mnt]# rpm -qc bind
[root@westoslinux mnt]# cp -p /etc/rndc.key /etc/westos.key
[root@westoslinux mnt]# vim /etc/westos.key
1 key "westoskey" {
2 algorithm hmac-sha256;
3 secret "6TylP6B1GW1kPzNg2j3/7A==";
4 };
[root@westoslinux mnt]# vim /etc/named.conf
61 include "/etc/westos.key"; #在没有括号的空白处添加这一行,让dns知道有这个密钥文件
[root@westoslinux mnt]# vim /etc/named.rfc1912.zones
29 zone "westos.org" IN {
30 type master;
31 file "westos.org.zone";
32 allow-update { key westoskey; }; #有这个密钥的可以更新dns解析信息
33 also-notify { 172.25.254.200; };
34 };
[root@westoslinux mnt]# systemctl restart named
[root@westoslinux mnt]# man 5 dncp.conf
[root@westoslinux dhcp]# vim /etc/dhcp/dhcpd.conf
14 ddns-update-style interim; #设置更新dns
34 key westoskey { #给dhcp密钥
35 algorithm hmac-sha256;
36 secret 6TylP6B1GW1kPzNg2j3/7A==; #还是生成的密钥
37 };
38
39 zone westos.org. {
40 primary 127.0.0.1; #因为dns和dhcp都由一台主机提供,这里设置回环接口就可
41 key westoskey;
42 }
[root@westoslinux dhcp]# systemctl restart dhcpd
用man 5 dhcpd.conf 查询DNS相关语句块例子
dhcp给westos200主机分配ip是172.25.254.10,dig westos200.westos.org查看解析也是10
服务端重新设置dhcp分配ip范围为15-70
客户端重新分配到15的ip,再解析自己域名可以看到解析地址为172.25.254.15