centos7搭建DNS服务器

╰半橙微兮° 2022-12-10 08:58 235阅读 0赞

# 1. 安装 BIND 服务器软件并启动 #

yum -y install bind bind-utils
    systemctl start named.service  // 启动服务
    systemctl enable named  // 设为开机启动

## 1.1. 查看named进程是否正常启动 ##

ps -eaf|grep named // 检查进程
    ss -nult|grep :53 // 检查监听端口

## 1.2. 开放 TCP 和 UDP 的 53 端口 ##

firewall-cmd --permanent --add-port=53/tcp
    firewall-cmd --permanent --add-port=53/udp
    firewall-cmd --reload  // 重新加载防火墙配置，让配置生效

# 2. DNS 服务的相关配置文件 #

## 2.1. 修改主要文件 /etc/named.conf ##

修改前先备份： cp -p /etc/named.conf /etc/named.conf.bak // 参数-p表示备份文件与源文件的属性一致。  
修改配置：vi /etc/named.conf ， 配置内容如下：

options {
            listen-on port 53 { any; };
            listen-on-v6 port 53 { any; };
            directory       "/var/named";
            dump-file       "/var/named/data/cache_dump.db";
            statistics-file "/var/named/data/named_stats.txt";
            memstatistics-file "/var/named/data/named_mem_stats.txt";
            recursing-file  "/var/named/data/named.recursing";
            secroots-file   "/var/named/data/named.secroots";
            allow-query     { any; };
    
            /*
             - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
             - If you are building a RECURSIVE (caching) DNS server, you need to enable
               recursion.
             - If your recursive DNS server has a public IP address, you MUST enable access
               control to limit queries to your legitimate users. Failing to do so will
               cause your server to become part of large scale DNS amplification
               attacks. Implementing BCP38 within your network would greatly
               reduce such attack surface
            */
            recursion yes;
    
            dnssec-enable yes;
            dnssec-validation yes;
    
            /* Path to ISC DLV key */
            bindkeys-file "/etc/named.root.key";
    
            managed-keys-directory "/var/named/dynamic";
    
            pid-file "/run/named/named.pid";
            session-keyfile "/run/named/session.key";
    };
    
    logging {
            channel default_debug {
                    file "data/named.run";
                    severity dynamic;
            };
    };
    
    //zone "." IN {
    //      type hint;
    //      file "named.ca";
    //};
    
    include "/etc/named.rfc1912.zones";
    include "/etc/named.root.key";

检查一下

named-checkconf  // 检查named.conf是否有语法问题

## 2.2. 配置正向解析和反向解析 ##

### 2.2.1. 修改/etc/named.rfc1912.zones ###

添加配置： vi /etc/named.rfc1912.zones ， 配置内容如下：

zone "reading.zt" IN {
            type master;
            file "named.reading.zt";
            allow-update { none; };
    };
    
    zone "0.168.192.in-addr.arpa" {
            type master;
            file "named.192.168.0";
            allow-update { none; };
    };

### 2.2.2. 添加正向解析域 ###

基于 name.localhost 模板，创建配置文件：cp -p /var/named/named.localhost /var/named/named.reading.zt  
配置正向域名解析文件 named.reading.zt ： vi /var/named/named.reading.zt ，配置内容如下：

$TTL 1D
    @   IN SOA  @ rname.invalid. (
                        0   ; serial
                        1D  ; refresh
                        1H  ; retry
                        1W  ; expire
                        3H )    ; minimum
        NS  @
        A   127.0.0.1
        AAAA    ::1
    mirror  A   192.168.0.233
    test    A   192.168.0.232

说明：  
http://mirror.reading.zt/ 将会解析为 http://192.168.0.233/  
授权 named 用户 chown :named /var/named/named.reading.zt  
检查区域文件是否正确 named-checkzone “reading.zt” “/var/named/named.reading.zt”

### 2.2.3. 添加反向解析域 ###

基于 name.localhost 模板，创建配置文件： cp -p /var/named/named.localhost /var/named/named.192.168.0  
配置反向域名解析文件 named.192.168.0 ： vi /var/named/named.192.168.0

$TTL 1D
    @   IN SOA  @ rname.invalid. (
                        0   ; serial
                        1D  ; refresh
                        1H  ; retry
                        1W  ; expire
                        3H )    ; minimum
        NS  @
        A   127.0.0.1
        AAAA    ::1
    233 PTR mirror.reading.zt
    232 PTR test.reading.zt

授权 named 用户 chown :named /var/named/named.192.168.0  
检查区域文件是否正确 named-checkzone “0.168.192.in-addr.arpa” “/var/named/named.192.168.0” ，如图：

### 2.2.4. 重启 named 服务，让配置生效 ###

重启 named 服务，让配置生效 systemctl restart named

# 3. 使用nslookup测试 #

nslookup test.reading.zt
    nslookup 192.168.0.232