BIND（Berkeley Internet Name Domain,伯克利因特网名称域）服务是全球使用最广泛、最安全且最高效的域名解析服务程序。
1、安装bind域名解析服务：
[root@PC1 ~]# yum install bind-chroot ## 使用chroot，俗称牢笼机制，更加安全 Loaded plugins: langpacks, product-id, subscription-manager This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register. Resolving Dependencies --> Running transaction check ---> Package bind-chroot.x86_64 32:9.9.4-14.el7 will be installed --> Finished Dependency Resolution Dependencies Resolved ================================================================================ Package Arch Version Repository Size ================================================================================ Installing: bind-chroot x86_64 32:9.9.4-14.el7 rhel7 81 k Transaction Summary ================================================================================ Install 1 Package Total download size: 81 k Installed size: 3.1 k Is this ok [y/d/N]: y Downloading packages: Running transaction check Running transaction test Transaction test succeeded Running transaction Installing : 32:bind-chroot-9.9.4-14.el7.x86_64 1/1 Verifying : 32:bind-chroot-9.9.4-14.el7.x86_64 1/1 Installed: bind-chroot.x86_64 32:9.9.4-14.el7 Complete!
2、三个重要配置文件：
主配置文件：/etc/named.conf，用来定义bind服务的运行
区域配置文件： /etc/named.rfc1912.zones，类似于图书馆的目录大纲，用来指定域名和IP地址对应关系文件所在位置
数据配置文件目录：/var/named/，该目录下具有域名和IP地址对应关系的文件
3、修改主配置文件，保证基本的服务
vim /etc/named.conf ## 修改第11行和第17行 1 // 2 // named.conf
3 // 4 // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
5 // server as a caching only nameserver (as a localhost DNS resolver only).
6 // 7 // See /usr/share/doc/bind*/sample/ for example named configuration files.
8 // 9
10 options { 11 listen-on port 53 { any; }; ## 此处修改为any，表示服务器上的所有IP地址均可提供DNS域名解析服务 12 listen-on-v6 port 53 { ::1; }; 13 directory "/var/named"; 14 dump-file "/var/named/data/cache_dump.db"; 15 statistics-file "/var/named/data/named_stats.txt"; 16 memstatistics-file "/var/named/data/named_mem_stats.txt"; 17 allow-query { any; }; ## 此处也修改为any，表示允许所有人对本服务器发送DNS查询请求 18
19 /* 20 - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. 21 - If you are building a RECURSIVE (caching) DNS server, you need to enable 22 recursion. 23 - If your recursive DNS server has a public IP address, you MUST enable access 24 control to limit queries to your legitimate users. Failing to do so will 25 cause your server to become part of large scale DNS amplification 26 attacks. Implementing BCP38 within your network would greatly 27 reduce such attack surface 28 */
29 recursion yes;
………………