linux下BIND DNS服務器的應用和部署(bind-dlz+智能dns+子域dns+緩存轉發dns)

本文轉載自查看原文 2013-01-10 19:29 2768 緩存轉發dns/ 智能dns/ bind-dlz/ 子域dns

BIND DNS服務器的應用和部署

安裝Bind及基本環境

編譯安裝MySQL

../configure --prefix=/usr/local/mysql

make

make install

2.增加用戶

adduser -s /bin/false mysql

3.初始化並設置目錄權限

/usr/local/mysql/bin/mysql_install_db

chown -R root /usr/local/mysql/

chown -R mysql /usr/local/mysql/var

chgrp -R mysql /usr/local/mysql/

4.加入庫

echo /usr/local/mysql/lib/mysql/lib >>/etc/ld.so.conf

ldconfig

5.使之啟動時自動運行

echo "/usr/local/mysql/bin/mysqld_safe &" >>/etc/rc.d/rc.local

6.啟動MySQL

/usr/local//mysql/bin/mysqld_safe &

7.安全性設定

修改MySQL的root密碼：

/usr/local/mysql/bin/mysqladmin -uroot password abcdefg

8.測試

[root@terry bin]# /usr/local/mysql/bin/mysql -u root -p

Enter password:

Welcome to the MySQL monitor. Commands end with ; or \g.

Your MySQL connection id is 3 to server version: 4.0.15

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> use mysql;

Reading table information for completion of table and column names

You can turn off this feature to get a quicker startup with -A

Database changed

mysql> delete from user where user=''; (刪除所有用戶名為空的用戶，可以提高安全性)

Query OK, 2 rows affected (0.00 sec)

mysql> quit

Bye

編譯安裝Bind

mkdir /usr/local/src/bind-dlz

cd /usr/local/src/bind-dlz

wget http://ftp.isc.org/isc/bind9/9.6.0-P1/bind-9.6.0-P1.tar.gz

tar zxvf bind-9.6.0-P1.tar.gz

cd bind-9.6.0-P1

./configure --with-dlz-mysql --enable-largefile --enable-threads=no --prefix=/usr/local/bind

--with-openssl=/usr/local/openssl/

注：禁掉線程;--with-openssl= 你的 openssl安裝的相關目錄有可能是/usr

make && make install

創建相關配置文件

cd /usr/local/bind/etc

../sbin/rndc-confgen >rndc.conf

tail -n10 rndc.conf | head -n9 | sed -e s/#\//g >named.conf

啟動bind 服務.

/usr/local/bind/sbin/named -uroot -g -d 9 // 調試狀態，如果沒有報錯說明環境配置正確。

做成啟動服務. Debug 的時候多用此模式啟動bind.

/usr/local/bind/sbin/rndc reload //重載named.conf 相關配置文件. /usr/local/bind/sbin/named -uroot -c /usr/local/bind/etc/named.conf //啟動bind 服務.

基於Bind-DLZ 的php管理程序

編譯安裝apache 2.4.3 (released 2012-08-21)

可到http://httpd.apache.org/下載安裝最新版本apache

mkdir /usr/local/src/httpd

cd /usr/local/src/httpd

wget http://mirrors.tuna.tsinghua.edu.cn/apache//httpd/httpd-2.4.3.tar.gz

tar zxvf httpd-2.4.3.tar.gz

cd httpd-2.4.3

./configure --prefix=/usr/local/httpd --enable-so

make && make install

出現依賴包的錯誤

configure: error: APR not found. Please read the documentation.

下載apr源碼包

./configure --prefix=/usr/local/APR

make && make install

configure: error: APR-util not found. Please read the documentation

下載APR-util源碼包

./configure --prefix=/usr/local/APR-util

make && make install

configure: error: pcre-config for libpcre not found. PCRE is required and available from http://pcre.org/

下載pcre源碼包

./configure --prefix=/usr/local/pcre

make && make install

./configure --prefix=/usr/local/ httpd --with-apr=/usr/local/apr --with-apr-util=/usr/local/apr-util --with-pcre=/usr/local/pcre

現在已經將Apache 2.0.47安裝到 /usr/local/httpd目錄中，安裝好的Apache支持可裝載模塊和標准的MPM prefork。如果安裝過程中沒有出現錯誤，便可以使用如下命令啟動Apache服務：

/usr/local/httpd/bin/apachectl start

如果啟動成功，將啟動命令加入rc.local，使之在系統啟動時自動運行：

echo "/usr/local/httpd/bin/apachectl start &" >>/etc/rc.d/rc.local

停止Apache服務，並繼續安裝PHP：

/usr/local/httpd/bin/apachectl stop

編譯安裝PHP

mkdir /usr/local/src/php

cd /usr/local/src/php

wget http://cn2.php.net/get/php-5.4.10.tar.gz/from/this/mirror

tar zxvf php-5.4.10.tar.gz

cd php-5.4.10

./configure --with-apxs2=/usr/local/httpd/bin/apxs --with-mysql=/usr/local/mysql

make && make install

cp php.ini-dist /usr/local/lib/php.ini

這種安裝方式是將PHP作為Apache的SAPI模塊來進行安裝，它僅是其中的一種安裝方式，更多的方法請參閱相關文檔。

PHP和Apache安裝后的基本配置

1.Apache的配置

Apache的配置文件是/usr/local/httpd/conf/httpd.conf，編輯httpd.conf 文件，在文件結尾加上以下兩行：

LoadModule php4_module modules/libphp4.so

AddType application/x-httpd-php .php .php3

同時修改DirectoryIndex為：

DirectoryIndex index.html index.php index.php3

ServerName 127.0.0.1

AddType application/x-httpd-php .php

AddType application/x-httpd-php-source .phps

Apache的配置內容比較豐富，其它Apache相關配置請參考Apache的相關文檔。

編輯/etc/hosts文件

127.0.0.1 localhost.localdomain TonyHost

2.PHP的配置

Apache的配置文件是/usr/local/lib/php.ini，編輯php.ini文件來配置PHP的選項。特別注意的是，安裝完成后register_globals變量默認設置為Off，需要將它改成On。否則會出現PHP讀不到post的數據的現象。

register_globals=On

其它PHP的選項請參考相關文檔。

3.測試

可以寫一個簡單的PHP文件來測試安裝，文件包含下列一行：

<? phpinfo();?>

將其保存為/usr/local/httpd/htdocs/info.php，啟動Apache，然后在瀏覽器中瀏覽。

bind dns的web管理界面dns_web

導入mysql數據腳本

DROP TABLE IF EXISTS `dns_records`;

CREATE TABLE `dns_records` (

`id` int(10) unsigned NOT NULL auto_increment,

`zone` varchar(255) NOT NULL,

`host` varchar(255) NOT NULL default '@',

`type` enum('MX','CNAME','NS','SOA','A','PTR') NOT NULL,

`data` varchar(255) default NULL,

`ttl` int(11) NOT NULL default '800',

`view` char(20) default 'DF',

`mx_priority` int(11) default NULL,

`refresh` int(11) NOT NULL default '3600',

`retry` int(11) NOT NULL default '3600',

`expire` int(11) NOT NULL default '86400',

`minimum` int(11) NOT NULL default '3600',

`serial` bigint(20) NOT NULL default '2008082700',

`resp_person` varchar(64) NOT NULL default 'root.domain.com.',

`primary_ns` varchar(64) NOT NULL default 'ns1.domain.com.',

`data_count` int(11) NOT NULL default '0',

`time` datetime default NULL,

`opuser` varchar(20) default NULL,

`status` tinyint(1) default '1',

PRIMARY KEY (`id`),

KEY `type` (`type`),

KEY `host` (`host`),

KEY `zone` (`zone`)

) ENGINE=MyISAM DEFAULT CHARSET=gbk;

DROP TABLE IF EXISTS `p_admin`;

CREATE TABLE `p_admin` (

`uid` int(3) NOT NULL auto_increment,

`m_id` int(2) NOT NULL,

`username` varchar(25) NOT NULL,

`password` varchar(50) NOT NULL,

`name` varchar(50) NOT NULL,

PRIMARY KEY (`uid`)

) ENGINE=MyISAM DEFAULT CHARSET=utf8;

LOCK TABLES `p_admin` WRITE;

INSERT INTO `p_admin` VALUES (22,1,'admin1','e00cf25ad42683b3df678c61f42c6bda','管理員');

UNLOCK TABLES;

放置dns_web到/usr/local/httpd/htdocs中，瀏覽器中瀏覽http://localhost/dns_web即可進入dns的web管理界面。

服務規划：

應用網絡拓撲圖

環境配置

192.168.10.100為主dns服務器，主機名ns1.google1.com,管理google1.com域。

192.168.10.110為從dns服務器，主機名ns1.google1.com,管理google1.com域。

192.168.10.101為google.com子域服務器,主機名ns1.play.google1.com,管理play.google1.com域。

192.168.10.102為google2.com域服務器，主機名ns1.google1.com。

192.168.10.103為轉發緩存服務器，指向互聯網或其它域的dns服務器。

Bind-acl規划


網通	CNC	include "/usr/local/bind/etc/view/cnc_acl.conf";
電信	TELECOM	include "/usr/local/bind/etc/view/tele_acl.conf";
教育	EDU	include "/usr/local/bind/etc/view/edu_acl.conf";
其他	ANY	include "/usr/local/bind/etc/view/any_acl.conf";

注：當一個網通用戶向本地DNS發www. google1.com的請求時，本地DNS會遞歸查詢，最后把請求發給ns1.google1.com這台DNS服務器上,ns1. google1.com會根據請求的用戶IP所屬的范圍來擇優選擇，將www. google1.com在網通的ip返回給本地DNS。

配置DNS TSIG

主dns服務器192.168.10.100

根據之前提供方法分別安裝mysql、bind、apache、php及整合dns_web管理系統。這里主dns配置智能dns，划分四個訪問來路：網通、電信、教育和其它。

使用dnssec-keygen function 產生加密密鑰，一個為public key, 另一個為private key

產生加密金鑰

cd /usr/local/bind/sbin

./dnssec-keygen -a hmac-md5 -b 128 -n HOST cnc

./dnssec-keygen -a hmac-md5 -b 128 -n HOST telecom

./dnssec-keygen -a hmac-md5 -b 128 -n HOST edu

./dnssec-keygen -a hmac-md5 -b 128 -n HOST any

查看生成的密鑰文件

cat Kcnc.+157+24406.private

Private-key-format: v1.2

Algorithm: 157 (HMAC_MD5)

Key: YTjTOw00PzeEaasA16/Rvw==

Bits: AAA=

配置named.conf

vim /usr/local/bind/etc/named.conf 注：vi或者vim編輯named配置文件

key "rndc-key" {

algorithm hmac-md5;

secret "srtEZG/uJHD2nGeb42Ir6g==";

};

controls {

inet 127.0.0.1 port 953

allow { 127.0.0.1; } keys { "rndc-key"; };

};

options {

directory "/usr/local/bind/etc";

pid-file "named.pid";

allow-query { any; };

forward only;

forwarders {

192.168.10.101;//子域服務器，沒有配置會找不到子域服務器

192.168.10.103;//緩存服務器

};

#TSIG-key

key "cnc" {

algorithm hmac-md5;

secret "LbIyflTY/N3EELqktaFSRw==";

};

key "telecom" {

algorithm hmac-md5;

secret "oLLqtgn2UF4hsW0YXug0sA==";

};

key "edu" {

algorithm hmac-md5;

secret "FeMlTjiGbqBlYG0TRlbokg==";

};

key "any" {

algorithm hmac-md5;

secret "sdEGmt20BBwcpSfqTn7P/Q==";

};

acl "dns-ip-list"{

192.168.10.100;

192.168.10.111;

};

acl "telecom-dns-ip-list"{

192.168.1.0/24;

};

include "/usr/local/bind/etc/cnc_acl.conf"; //

include "/usr/local/bind/etc/telecom_acl.conf"; //

include "/usr/local/bind/etc/edu_acl.conf"; //

include "/usr/local/bind/etc/view.conf";

include "/usr/local/bind/etc/forwardzone.conf";

acl.conf

以telecom_acl.conf為例

acl TELECOM{

192.168.1.162;//訪問ip字典，以我的電腦ip192.168.1.162為例，這個可判斷為電信網 //絡訪問dns服務器。ip字典越多，分析越准確。

};

forwardzone.conf

添加域名轉發，即定義某域名指定其他DNS服務器，這里以google2.com為例。

zone "google2.com" IN {

type forward;

forwarders {

192.168.10.102;//權威域為google2的dns服務器

};

配置Bind-view-DLZ-MySQL

vim /usr/local/bind/etc/ view.conf

view "cnc_view" {

match-clients {key cnc;dns-ip-list;CNC;};

allow-query-cache {none;};

allow-recursion {none;};

allow-transfer {192.168.10.111;};

recursion yes;

dlz "Mysql zone" {

database "mysql

{ host=127.0.0.1 dbname=cdn_view ssl=false port=3306 user=root pass= }

{select zone from dns_records where zone = '%zone%' and view='CNC' limit 1}

{select ttl, type, mx_priority, case when lower(type)='txt' then concat( '\"', data, '\"') when lower(type) = 'soa' then concat_ws(' ', data, resp_person, serial, refresh , retry, expire, minimum) else data end as mydata from dns_records where zone = '%zone%' and host = '%record%' and (view = 'CNC' or view = 'DF') and status='1'}

{select ttl, type, host, mx_priority, case when lower(type)='txt' then concat( '\"', data, '\"' ) else data end as mydata, resp_person, serial, refresh, retry, expire, minimum from dns_records where zone = '%zone%' and (view='CNC' or view='ALL' or view='DF') and status='1'}";

};

view "telecom_view" {

match-clients {key telecom;telecom-dns-ip-list;TELECOM;};

#allow-query-cache {none;};

#allow-recursion {none;};

allow-transfer {192.168.10.111;};

recursion yes;

dlz "Mysql zone" {

database "mysql

{ host=127.0.0.1 dbname=cdn_view ssl=false port=3306 user=root pass= }

{select zone from dns_records where zone = '%zone%' and view='TELCOM' limit 1}

};

include "/usr/local/bind/etc/transferzone.conf";

};

view "edu_view" {

match-clients {key edu;dns-ip-list;EDU;};

allow-query-cache {none;};

allow-recursion {none;};

allow-transfer {192.168.10.111;};

recursion yes;

dlz "Mysql zone" {

database "mysql

{ host=127.0.0.1 dbname=cdn_view ssl=false port=3306 user=root pass= }

{select zone from dns_records where zone = '%zone%' and view='EDU' limit 1}

{select ttl, type, host, mx_priority, case when lower(type)='txt' then concat( '\"', data, '\"' ) else data end as mydata, resp_person, serial, refresh, retry, expire, minimum from dns_records where zone = '%zone%' and ( view='EDU' or view = 'ALL' or view = 'DF') and status = '1'}";

};

view "any_view" {

match-clients {key any;dns-ip-list;ANY;};

allow-query-cache {none;};

allow-recursion {none;};

allow-transfer {192.168.10.111;};

recursion yes;

dlz "Mysql zone" {

database "mysql

{ host=127.0.0.1 dbname=cdn_view ssl=false port=3306 user=root pass= }

{select zone from dns_records where zone = '%zone%' and view='ANY' limit 1}

};

mysql腳本

LOCK TABLES `dns_records` WRITE;

INSERT INTO `dns_records` VALUES (15,'google1.com','@','SOA','dns',86400,'DF',NULL,4800,3600,604800,600,1357785600,'root','',0,'2012-12-28 01:10:53','22',1),(2,'google1.com','@','NS','ns1.google1.com.',800,'TELCOM',NULL,3600,3600,86400,3600,2008082700,'root.domain.com.','ns1.domain.com.',0,'2013-01-09 18:38:29','22',1),(4,'google1.com','ns1','A','192.168.10.100',800,'TELCOM',NULL,3600,3600,86400,3600,2008082700,'root.domain.com.','ns1.domain.com.',0,'2013-01-09 18:40:00','22',1),(9,'google1.com','www','A','192.168.1.107',3600,'TELCOM',NULL,3600,3600,86400,3600,2008082700,'root.domain.com.','ns1.domain.com.',0,'2013-01-04 00:42:04','22',1),(10,'google1.com','bbs','A','210.51.36.116',3600,'CNC',NULL,3600,3600,86400,3600,2008082700,'root.domain.com.','ns1.domain.com.',0,NULL,NULL,1),(11,'google1.com','bbs','A','221.238.249.178',3600,'TELCOM',NULL,3600,3600,86400,3600,2008082700,'root.domain.com.','ns1.domain.com.',0,'2013-01-04 00:39:23','22',1),(13,'google1.com','bbs','A','192.168.1.108',3600,'ALL',NULL,3600,3600,86400,3600,2008082700,'root.domain.com.','ns1.domain.com.',0,'2012-12-28 19:46:42','22',1),(20,'google1.com','play','NS','ns1.play.google1.com.',86400,'TELCOM',NULL,3600,3600,86400,3600,2008082700,'root.domain.com.','ns1.domain.com.',0,'2013-01-05 00:13:02','22',1),(21,'google1.com','ns1.play','A','192.168.10.102',86400,'TELCOM',NULL,3600,3600,86400,3600,2008082700,'root.domain.com.','ns1.domain.com.',0,'2013-01-05 00:13:29','22',1);

UNLOCK TABLES;

dns_web管理界面

從dns服務器192.168.10.110

主從dns之間實現mysql主從數據庫同步：

1、安裝mysql（略）

2、安裝bind配置和主的一樣，可以通過rsync同步過來。

3、Mysql主從復制：

1）Master 配置

創建同步用戶

mysql -u root

mysql>UNLOCK TABLES；

mysql>GRANT ALL PRIVILEGES ON *. TO 'larry'@'%' IDENTIFIED BY 'larrypasswd' WITH

GRANT OPTION;

mysql>exit

修改配置文件，並打包var文件到Slave 端

vim /etc/my.cnf

[mysqld] 在mysqld 里添加如下幾項

long_query_time = 5

expire_logs_days= 3

binlog-do-db=cdn_view ==>要同步的數據庫

binlog-ignore-db=mysql ==>不同步的數據庫

binlog_format=mixed

server-id = 12760 ==>同一個網絡唯一

mysqladmin -u root -S /tmp/mysql.sock shutdown 重啟mysql

/usr/local/mysql/bin/mysqld_safe --defaults-file=/etc/my.cnf &

2)Slave配置:

將my.cnf 中的server-id=1 改成12761

#log-bin=mysql-bin //注釋掉這兩行。

#binlog_format=mixed //修改成如下內容

server-id = 12761

replicate-do-db=cdn_view

replicate-ignore-db=mysql

log-slave-updates

slave-skip-errors=all

slave-net-timeout=60

mysqladmin -u root -S /tmp/mysql.sock shutdown //重啟Mysql

/usr/local/mysql/bin/mysqld_safe --defaults-file=/etc/my.cnf &

msql -u root

mysql>CHANGE MASTER TO

MASTER_HOST='192.168.10.100', //Master IP

MASTER_USER=root, //用戶

MASTER_PASSWORD=, //密碼

MASTER_LOG_FILE='mysql-bin.000002',

MASTER_LOG_POS=2272;

以上兩行必須按照Master 端的master 狀態寫show master status;

3)驗證：

dig @192.168.10.100 www.google1.com

dig @192.168.10.110 www. google1.com

在Master端修改A記錄的IP地址，看從是否有變化，如果變化一致說明mysql主從復制成功。

子域服務器192.168.10.101

根據之前提供方法分別安裝mysql、bind、apache、php及整合dns_web管理系統。

配置named.conf

key "rndc-key" {

algorithm hmac-md5;

secret "srtEZG/uJHD2nGeb42Ir6g==";

};

controls {

inet 127.0.0.1 port 953

allow { 127.0.0.1; } keys { "rndc-key"; };

};

options {

directory "/usr/local/bind/etc";

pid-file "named.pid";

allow-query { 192.168.10.100; };

};

include "/usr/local/bind/etc/view.conf";

配置Bind-view-DLZ-MySQL

view "any_view" {

match-clients {key rndc-key;any;};

allow-query-cache {none;};

allow-recursion {none;};

allow-transfer {none;};

recursion no;

dlz "Mysql zone" {

database "mysql

{ host=127.0.0.1 dbname=cdn_view ssl=false port=3306 user=root pass= }

{select zone from dns_records where zone = '%zone%' and (view = 'ALL' or view='DF') limit 1}

};

mysql腳本

LOCK TABLES `dns_records` WRITE;

INSERT INTO `dns_records` VALUES (36,'play.google1.com','@','NS','ns1.play.google1.com.',86400,'TELCOM',NULL,3600,3600,86400,3600,2008082700,'root.domain.com.','ns1.domain.com.',0,'2013-01-05 01:36:11','22',1),(38,'play.google1.com','www','A','192.168.1.108',86400,'TELCOM',NULL,3600,3600,86400,3600,2008082700,'root.domain.com.','ns1.domain.com.',0,'2013-01-09 18:55:12','22',1),(37,'play.google1.com','pic1','A','192.168.1.108',86400,'TELCOM',NULL,3600,3600,86400,3600,2008082700,'root.domain.com.','ns1.domain.com.',0,'2013-01-05 02:24:52','22',1),(35,'play.google1.com','@','SOA','dns',86400,'DF',NULL,4800,3600,604800,600,1357786512,'root','',0,'2013-01-05 01:35:06','22',1);

UNLOCK TABLES;

dns_web管理界面

google2.com區域dns服務器192.168.10.102

根據之前提供方法分別安裝mysql、bind、apache、php及整合dns_web管理系統。

配置named.conf

key "rndc-key" {

algorithm hmac-md5;

secret "srtEZG/uJHD2nGeb42Ir6g==";

};

controls {

inet 127.0.0.1 port 953

allow { 127.0.0.1; } keys { "rndc-key"; };

};

options {

directory "/usr/local/bind/etc";

pid-file "named.pid";

allow-query { 192.168.10.100; };

};

include "/usr/local/bind/etc/view.conf";

配置Bind-view-DLZ-MySQL

view "any_view" {

match-clients {key rndc-key;any;};

allow-query-cache {none;};

allow-recursion {none;};

allow-transfer {none;};

recursion no;

dlz "Mysql zone" {

database "mysql

{ host=127.0.0.1 dbname=cdn_view ssl=false port=3306 user=root pass= }

{select zone from dns_records where zone = '%zone%' and (view = 'ALL' or view='DF') limit 1}

};

mysql腳本

LOCK TABLES `dns_records` WRITE;

INSERT INTO `dns_records` VALUES (38,'google2.com','@','SOA','dns',86400,'DF',NULL,4800,3600,604800,600,1357802143,'root','',0,'2013-01-05 21:58:58','22',1),(39,'google2.com','@','NS','ns1.google2.com.',86400,'DF',NULL,3600,3600,86400,3600,2008082700,'root.domain.com.','ns1.domain.com.',0,'2013-01-09 23:15:43','22',1),(40,'google2.com','www','A','192.168.1.108',86400,'DF',NULL,3600,3600,86400,3600,2008082700,'root.domain.com.','ns1.domain.com.',0,'2013-01-09 23:15:37','22',1);

UNLOCK TABLES;

dns_web管理界面

dns緩存服務器192.168.10.103

而作為緩存dns服務器，需要連接外部互聯網或者其它網絡就不需要用到bind-dlz功能，這樣可以提高緩存dns服務器性能。

l 編譯安裝bind時就不需要帶-with-dlz-mysql;使用bind安裝包配置時方法。

l 首先我們來看下RHEL5預裝了哪些與bind相關的包。

rpm -qa|grep bind

ypbind-1.19-8.el5

bind-utils-9.3.3-10.el5

bind-libs-9.3.3-10.el5

安裝bind-9.3.3-10.el5（這里可以安裝最新的bind安裝包或者光盤自帶的bind安裝包）

rpm -ivh /bind安裝包所在目錄/bind-9.3.3-10.el5.i386.rpm

安裝CHROOT設置包，CHROOT技術，又叫虛擬根目錄技術，是對付黑客利用漏洞入侵BIND系統的一種手段。

rpm -ivh /bind安裝包所在目錄/bind-chroot-9.3.3-10.el5.i386.rpm

安裝唯高速緩存服務器設置包，有了這個包就可以構建DNS唯高速緩存服務器

rpm -ivh/caching-nameserver安裝包所在目錄/caching-nameserver-9.3.3-10.el5.i386.rpm

配置named.caching-nameserver.conf

vim /var/named/chroot/etc/named.caching-nameserver.conf

options {

listen-on port 53 { 127.0.0.1;192.168.10.103; };

listen-on-v6 port 53 { ::1; };

directory "/var/named";

dump-file "/var/named/data/cache_dump.db";

statistics-file "/var/named/data/named_stats.txt";

memstatistics-file "/var/named/data/named_mem_stats.txt";

query-source port 53;

query-source-v6 port 53;

allow-query { any; };

};

logging {

channel default_debug {

file "data/named.run";

severity dynamic;

};

view localhost_resolver {

match-clients { localhost; };

match-destinations { localhost; };

recursion yes;

include "/etc/named.rfc1912.zones";

};

view wan {

match-clients {any;};

forward first;

forwarders {

192.168.0.3;

8.8.8.8;

8.8.4.4;

};

recursion yes;

zone "." IN {

type hint;

file "named.ca";

};

zone "0.0.127.in-addr.arpa" {

type master;

file "named.broadcast";

};

查詢測試

l 模擬電信用戶請求www.google1.com，解析到電信主機，說明智能解析正確。

l 請求www.play.google1.com子域dns能夠返回正確主機地址，說明子域dns服務器配置解析正確。

l 請求www.google2.com,解析到正確主機地址，說明google2.com的dns配置解析正確。

l 請求www.baidu.com,解析到正確主機地址，說明緩存轉發的dns配置解析正確。

域名	作用	Dns	IP
google1.com	主DNS	ns1.google1.com	192.168.10.100
	從DNS	ns2. google1.com	192.168.10.110
	子域DNS	ns1.play.google1.com	192.168.10.101
google2.com	主DNS	ns1.google2.com	192.168.10.102
	緩存dns		192.168.10.103

訪問途徑	網址	WEB主機IP
cnc	www. google1.com	192.168.10.10
telecom	www. google1.com	192.168.10.11
edu	www. google1.com	192.168.10.12
其他	www. google1.com	192.168.10.11

linux下BIND DNS服務器的應用和部署(bind-dlz+智能dns+子域dns+緩存轉發dns)

BIND DNS服務器的應用和部署

相關術語簡介

智能DNS （Bind-view）：

Bind-DLZ

BIND遞歸查詢：

域名轉發

forward first| only;

forward zone

DNS子域授權

安裝Bind及基本環境

編譯安裝MySQL

編譯安裝Bind

基於Bind-DLZ 的php管理程序

編譯安裝apache 2.4.3 (released 2012-08-21)

編譯安裝PHP

bind dns的web管理界面dns_web

導入mysql數據腳本

服務規划：

應用網絡拓撲圖

環境配置

相關DNS規划

相關WEB服務器規划

Bind-acl規划

配置DNS TSIG

主dns服務器192.168.10.100

使用dnssec-keygen function 產生加密密鑰，一個為public key, 另一個為private key

配置named.conf

acl.conf

forwardzone.conf

配置Bind-view-DLZ-MySQL

mysql腳本

dns_web管理界面

從dns服務器192.168.10.110

子域服務器192.168.10.101

配置named.conf

配置Bind-view-DLZ-MySQL

mysql腳本

dns_web管理界面

google2.com區域dns服務器192.168.10.102

配置named.conf

配置Bind-view-DLZ-MySQL

mysql腳本

dns_web管理界面

dns緩存服務器192.168.10.103

查詢測試

推薦資料

免責聲明！