DNS服务及其管理

来源：互联网发布：js修改css样式编辑：程序博客网时间：2024/05/22 04:54

DNS

1.安装部署DNS
yum insatll bind.x86_64 -y
systemctl start named （敲键盘）
sytemctl enable named
systemctl stop firewalld
systemctl disable firewalld
主配置文件： /etc/named.conf
子配置文件： /etc/named.rfc1912.zones
数据目录： /var/named

2.高速缓存dns
vim /etc/named.conf

options {
11         listen-on port 53 { any; }; 53端口允许任何人访问这个dns（原本端口是只在内部开启） ss -anutple | grep named
12         listen-on-v6 port 53 { ::1; };
13         directory       "/var/named";
14         dump-file       "/var/named/data/cache_dump.db";
15         statistics-file "/var/named/data/named_stats.txt";
16         memstatistics-file "/var/named/data/named_mem_stats.txt"    ;
17         allow-query     { any; };              查询当前dns的客户群体

18 forwarders {172.25.254.68;}; 若本机不知道，去向68主机寻找

systemctl restart named

测试：ping www.baidu.com

第一次：此时用时72毫秒

第二次：用时8毫秒

因为已经搜索过百度，并且缓存，所以第二次时间大大缩短，这就是高速缓存的意义，在企业中

可以缓解用户网络的压力

3、权威dns的正象解析

删除/etc/named.conf文件中的172.25.254.250那行
vim /etc/named.rfc1912.zones
42 zone "westos.com" IN {
43         type master;
44         file "westos.com.zone";
45         allow-update { none; };

46 };

cd /var/named
cp -p named.localhost westos.com.zone 注意要加-p，复制文件的权限
vim westos.com.zone

systemctl restart named 重启named

测试：ping www.westos.com

4、反向解析
vim /etc/named.rfc1912.zones
38 zone "254.25.172.in-addr.arpa" IN {
39         type master;
40         file "westos.com.ptr";
41         allow-update { none; };
42 };

cd /var/named
cp -p named.localhost westos.com.ptr
vim westos.com.ptr

systemctl restart named 重启named
测试： dig -x 172.25.254.200

5、双向解析
vim /etc/named.conf
48 view localnet {
49         match-clients { 172.25.254.68; };   #内网能连接的人是172.25.254.68
50         zone "." IN {
51                 type hint;
52                 file "named.ca";
53 };
54
55 include "/etc/named.rfc1912.zones";         #内网访问的是/etc/named.rfc1912.zones这个文件
56 include "/etc/named.root.key";
57 };
58 view any {
59         match-clients { any; };            #其他人都能访问
60         zone "." IN {
61                 type hint;
62                 file "named.ca";
63 };
65 include "/etc/named.rfc1912.zones.inter";   #外网访问的是/etc/named.rfc1912.zones.inter
66 include "/etc/named.root.key";
67 };

cp -p /etc/named.rfc1912.zones /etc/named.rfc1912.zones.inter     #-p的意思是peimission
vim /etc/named.rfc1912.zones.inter
42 zone "westos.com" IN {
43         type master;
44         file "westos.com.inter";
45         allow-update { none; };
46 };

cp -p westos.com.zone westos.com.inter
vim westos.com.inter
1 $TTL 1D
2 @       IN SOA dns.westos.com. root.westos.com. (
3                                         0       ; serial
4                                         1D      ; refresh
5                                         1H      ; retry
6                                         1W      ; expire
7                                         3H )    ; minimum
8         NS      dns.westos.com.
9 dns     A       1.1.1.126
10 www     A       1.1.1.111
重启服务
测试：
172.25.254.68主机 dig www.westos.com (内网)

vim /etc/resolv.conf

nameserver 172.25.254.200

172.25.254.200主机,dig www.westos.com （外网）

vim /etc/resolv.conf

nameserver 172.25.254.200

6、从属dns

从属dns
yum install bind -y
systemctl stop firewalls
systemctl start named

vim /etc/named.conf

vim /etc/named.rfc1912.zones
zone "westos.com" IN {
        type slave;
        masters { 172.25.254.200; };
        file "slavec/westos.com.inter";
        allow-update { none; };
};

systemctl restart named
####注意westos.com.inter里面的serial值最大为10位
若/var/named/slaves中没有改有的文件，则是selinux没有关闭

主dns：
vim /etc/named.rfc1912.zones.inter
42 zone "westos.com" IN {
43         type master;
44         file "westos.com.inter";
45         allow-update { none; };
46         also-notify { 172.25.254.168; };
47 };

改变主dns上westos.com.inter

vim westos.com.inter

systemctl restart named

测试：从属机dig www.westos.com

7、dns的远程更新

做这个的时候把selinux改为disabled
主dns主机
vim /etc/named.rfc1912.zones.inter
42 zone "westos.com" IN {
43         type master;
44         file "westos.com.inter";
45         allow-update { 172.25.254.168; };    #允许168主机远程更新
46         also-notify { 172.25.254.168; };        #更新通知168主机
47 };

远程主机上作更新动作：
[root@dns-slave ~]# nsupdate
> server 172.25.254.200
> update add bbs.westos.com 86400 A 1.1.1.111    #添加
> send
>