CentOS7.6域名服务器配置（一）使用Bind配置主从DNS服务器

CentOS7.6 使用Bind配置主从DNS服务器

一、环境信息说明

1.1 实现场景

• 配置实现在一个服务器上配置多域名解析（多区域文件）
• 配置域名反向解析（这个如果不配置邮件服务器，则不是很重要，可以不配置）
• 配置服务器使用该域名解析服务器进行域名解析
• 配置实现DNS服务器的主从数据同步

1.2 环境信息

主机名称	地址	版本	角色	备注
sysldap-shylf-1	10.116.72.6	CentOS7.6 min	DNS（主）
sysldap-shylf-2	10.116.72.7	CentOS7.6 min	DNS（从）
systerm-shylf-1	10.116.72.4	CentOS7.6 min	www服务器	业务主机示例

备注：这里便于配置关闭了防火墙firewalld，并且禁用了Selinux
这里配置的示例域名：example.com 和 demo.com

二、主域名服务器配置（也即单节点配置）

2.1 组件安装

yum -y install bind
rpm -aq |grep bind
	bind-license-9.9.4-73.el7_6.noarch
	bind-utils-9.9.4-73.el7_6.x86_64
	bind-9.9.4-73.el7_6.x86_64
	bind-libs-lite-9.9.4-73.el7_6.x86_64
	bind-libs-9.9.4-73.el7_6.x86_64

# 主配置文件：
/etc/named.conf

# 默认添加定义区域的配置文件： 
/etc/named.rfc1912.zones

# 自定义区域文件默认目录
/var/named/

# ll /var/named
drwxrwx--- 2 named named   23 Jul 16 16:39 data
drwxrwx--- 2 named named   31 Jul 16 16:41 dynamic
-rw-r----- 1 root  named 2281 May 22  2017 named.ca
-rw-r----- 1 root  named  152 Dec 15  2009 named.empty
-rw-r----- 1 root  named  152 Jun 21  2007 named.localhost
-rw-r----- 1 root  named  168 Dec 15  2009 named.loopback
drwxrwx--- 2 named named    6 Jan 30 01:23 slaves/

2.2 添加自定义区域配置

作为实验，我们这里配置2个域名区域 example.com.zone 和 demo.com.zone 以及一个反向解析区域 72.116.10.in-addr.arpa
[备注]：我这里实验需要解析的IP地址段为10.116.72.0/24

2.2.1 主配置文件修改

修改监听IP地址；修改允许查询地址列表：allow-query { 127.0.0.1; 10.0.0.0/8; };
其他先保持不变，配置从服务器的时候再变更

vi /etc/named.conf

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {
        listen-on port 53 { 10.116.72.6; };
        //我的环境里面没有配置ipv6，这里禁用掉
        //listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
        /* allow-query     { localhost; }; */
        allow-query     { 127.0.0.1; 10.0.0.0/8; };

        /*
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable
           recursion.
         - If your recursive DNS server has a public IP address, you MUST enable access
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface
        */
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

• 禁用namad服务启用使用ipv6

vi /etc/sysconfig/named
#将默认参数OPTIONS="whatever" 修改为如下
OPTIONS="-4"

如果不禁用ipv6可能会报如下错误

tail -f /var/log/messages
... ...
network unreachable resolving 'xx.xx.xx/DS/IN': 2001:503:ba3e::2:30#53
network unreachable resolving 'xx.xx.xx/DS/IN': 2001:500:84::b#53

2.2.2 添加自定义区域配置

vi /etc/named.rfc1912.zones
//这里省略默认配置
//（不要动这里默认的配置，因为默认bind需要配置3个区域：根，127.0.0.1, 127.0.0.1的反向解析）

zone "example.com" IN { 
        type master;
        file "example.com.zone";
        allow-update { none; };
};

zone "demo.com" IN { 
        type master;
        file "demo.com.zone";
        allow-update { none; };
}; 

zone "72.116.10.in-addr.arpa." IN {
        type master;
        file "72.116.10.in-addr.arpa";
        allow-update { none; };
};

[备注]
type：定义区域类型，具有4种参数值：hint（根），master（主），slave（从），forward（转发）
file：定义区域文件名称，默认父目录为/var/named/ 可以在/etc/named.conf配置文件中修改

2.2.3 添加自定义区域配置文件以及解析内容

cd /var/named/

# 1. 添加区域文件 example.com.zone  名称与/etc/named.rfc1912.zones里面配置一致
vi example.com.zone 
$TTL 600
@       IN SOA  dns.example.com admin.example.com (
                                        2019071601      ; serial
                                        2H              ; refresh
                                        5M              ; retry
                                        1D              ; expire
                                        2D )            ; minimum
@               IN      NS      dns.example.com.
dns             IN      A       10.116.72.6
www             IN      A       10.116.72.4
example.com     IN      A       10.116.72.4
ntp1            IN      A       10.116.72.9
ntp2            IN      A       10.116.72.10
ldaps1          IN      A       10.116.72.11
ldaps2          IN      A       10.116.72.12
relay           IN      A       10.116.72.13
terminal        IN      A       10.116.72.15

# 2. 添加区域文件 demo.com.zone  名称与/etc/named.rfc1912.zones里面配置一致
vi demo.com.zone
$TTL 600
@       IN SOA  dns.example.com admin.example.com (
                                        2019071601      ; serial
                                        2H              ; refresh
                                        5M              ; retry
                                        1D              ; expire
                                        2D )            ; minimum
@                       IN      NS      dns.example.com.
dns.example.com.        IN      A       10.116.72.6
www                     IN      A       10.116.72.4
demo.com                IN      A       10.116.72.4

# 3. 添加反向解析区域文件 72.116.10.in-addr.arpa  名称与/etc/named.rfc1912.zones里面配置一致
# 反向解析多个域名可以放置在同一个区域文件中，而正向解析不同域名需要放置在不同的区域文件
vi 72.116.10.in-addr.arpa
$TTL 600
@       IN SOA  dns.example.com admin.example.com (
                                        2019071601      ; serial
                                        2H              ; refresh
                                        5M              ; retry
                                        1D              ; expire
                                        2D )            ; minimum
@               IN      NS      dns.example.com.
6               IN      PTR     dns.example.com.
4               IN      PTR     www.example.com.
4               IN      PTR     example.com.
4               IN      PTR     www.demo.com.
4               IN      PTR     demo.com.
9               IN      PTR     ntp1.example.com.
10              IN      PTR     ntp2.example.com.
11              IN      PTR     ldaps1.example.com.
12              IN      PTR     ldaps2.example.com.
13              IN      PTR     relay.example.com.
15              IN      PTR     terminal.example.com.

# 修改配置文件权限
chown root:named /var/named/example.com.zone /var/named/demo.com.zone /var/named/72.116.10.in-addr.arpa 
chmod 0640 /var/named/example.com.zone /var/named/demo.com.zone /var/named/72.116.10.in-addr.arpa 

2.2.4 检查配置文件正确性

named-checkzone "example.com" /var/named/example.com.zone 
	zone example.com/IN: loaded serial 2019071601
	OK
named-checkzone "demo.com" /var/named/demo.com.zone 
	/var/named/demo.com.zone:9: ignoring out-of-zone data (dns.example.com)
	zone demo.com/IN: loaded serial 2019071601
	OK
named-checkzone "example.com.arpa" /var/named/72.116.10.in-addr.arpa 
	zone example.com.arpa/IN: loaded serial 2019071601
	OK
named-checkzone "demo.com.arpa" /var/named/72.116.10.in-addr.arpa 
	zone demo.com.arpa/IN: loaded serial 2019071601
	OK

2.3 启动bind服务named

systemctl start named.service
systemctl eanble named.service

systemctl status named.service
	● named.service - Berkeley Internet Name Domain (DNS)
	   Loaded: loaded (/usr/lib/systemd/system/named.service; disabled; vendor preset: disabled)
	   Active: active (running) since Tue 2019-07-16 16:41:59 CST; 32min ago
	  Process: 11499 ExecStop=/bin/sh -c /usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID (code=exited, status=0/SUCCESS)
	  Process: 11513 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} $OPTIONS (code=exited, status=0/SUCCESS)
	  Process: 11510 ExecStartPre=/bin/bash -c if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi (code=exited, status=0/SUCCESS)
	 Main PID: 11516 (named)
	   CGroup: /system.slice/named.service
	           └─11516 /usr/sbin/named -u named -c /etc/named.conf
	
	Jul 16 16:41:59 sysdns-shylf-1 named[11516]: zone demo.com/IN: loaded serial 2019071601
	Jul 16 16:41:59 sysdns-shylf-1 named[11516]: zone example.com/IN: loaded serial 2019071601
	Jul 16 16:41:59 sysdns-shylf-1 named[11516]: zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 0
	Jul 16 16:41:59 sysdns-shylf-1 named[11516]: zone localhost/IN: loaded serial 0
	Jul 16 16:41:59 sysdns-shylf-1 named[11516]: all zones loaded
	Jul 16 16:41:59 sysdns-shylf-1 named[11516]: running
	Jul 16 16:41:59 sysdns-shylf-1 named[11516]: zone demo.com/IN: sending notifies (serial 2019071601)
	Jul 16 16:41:59 sysdns-shylf-1 named[11516]: zone example.com/IN: sending notifies (serial 2019071601)
	Jul 16 16:41:59 sysdns-shylf-1 named[11516]: zone 72.116.10.in-addr.arpa/IN: sending notifies (serial 2019071601)
	Jul 16 16:41:59 sysdns-shylf-1 systemd[1]: Started Berkeley Internet Name Domain (DNS).


netstat -pltn |grep named
	tcp        0      0 10.116.72.6:53          0.0.0.0:*               LISTEN      11516/named         
	tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN      11516/named

2.4 业务主机配置使用域名解析服务器

2.4.1 配置主机域名解析

业务主机IP：10.116.72.4

ssh 10.116.72.4

vi /etc/resolv.conf
nameserver 10.116.72.6

2.4.2 解析测试

可以用来测试的指令有，dig,nslookup,host ,ping 等

dig [-t type] [-x addr] [name] [@server]

# 正向解析测试
dig -t A www.example.com
	; <<>> DiG 9.9.4-RedHat-9.9.4-73.el7_6 <<>> -t A www.example.com
	;; global options: +cmd
	;; Got answer:
	;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39410
	;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
	
	;; OPT PSEUDOSECTION:
	; EDNS: version: 0, flags:; udp: 4096
	;; QUESTION SECTION:
	;www.example.com.               IN      A
	
	;; ANSWER SECTION:
	www.example.com.        600     IN      A       10.116.72.4
	
	;; AUTHORITY SECTION:
	example.com.            600     IN      NS      dns.example.com.
	
	;; ADDITIONAL SECTION:
	dns.example.com.        600     IN      A       10.116.72.6
	
	;; Query time: 2 msec
	;; SERVER: 10.116.72.6#53(10.116.72.6)
	;; WHEN: Tue Jul 16 17:30:01 CST 2019
	;; MSG SIZE  rcvd: 94

# 2. 反向解析测试
dig -x 10.116.72.4
	; <<>> DiG 9.9.4-RedHat-9.9.4-73.el7_6 <<>> -x 10.116.72.4
	;; global options: +cmd
	;; Got answer:
	;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53226
	;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 1, ADDITIONAL: 2
	
	;; OPT PSEUDOSECTION:
	; EDNS: version: 0, flags:; udp: 4096
	;; QUESTION SECTION:
	;4.72.116.10.in-addr.arpa.      IN      PTR
	
	;; ANSWER SECTION:
	4.72.116.10.in-addr.arpa. 600   IN      PTR     demo.com.
	4.72.116.10.in-addr.arpa. 600   IN      PTR     www.example.com.
	4.72.116.10.in-addr.arpa. 600   IN      PTR     example.com.
	4.72.116.10.in-addr.arpa. 600   IN      PTR     www.demo.com.
	
	;; AUTHORITY SECTION:
	72.116.10.in-addr.arpa. 600     IN      NS      dns.example.com.
	
	;; ADDITIONAL SECTION:
	dns.example.com.        600     IN      A       10.116.72.6
	
	;; Query time: 1 msec
	;; SERVER: 10.116.72.6#53(10.116.72.6)
	;; WHEN: Tue Jul 16 17:34:37 CST 2019
	;; MSG SIZE  rcvd: 167

三、配置从域名解析服务器并数据同步

3.1 组件安装

yum -y install bind
rpm -aq |grep bind
	bind-license-9.9.4-73.el7_6.noarch
	bind-utils-9.9.4-73.el7_6.x86_64
	bind-9.9.4-73.el7_6.x86_64
	bind-libs-lite-9.9.4-73.el7_6.x86_64
	bind-libs-9.9.4-73.el7_6.x86_64

# 主配置文件：
/etc/named.conf

# 默认添加定义区域的配置文件： 
/etc/named.rfc1912.zones

# 自定义区域文件默认目录
/var/named/

# ll /var/named
drwxrwx--- 2 named named   23 Jul 16 16:39 data
drwxrwx--- 2 named named   31 Jul 16 16:41 dynamic
-rw-r----- 1 root  named 2281 May 22  2017 named.ca
-rw-r----- 1 root  named  152 Dec 15  2009 named.empty
-rw-r----- 1 root  named  152 Jun 21  2007 named.localhost
-rw-r----- 1 root  named  168 Dec 15  2009 named.loopback
drwxrwx--- 2 named named    6 Jan 30 01:23 slaves/

3.2 添加自定义区域信息

3.2.1 主配置文件修改

修改监听IP地址；修改允许查询地址列表：allow-query { 127.0.0.1; 10.0.0.0/8; };
其他先保持不变，配置从服务器的时候再变更

跟主服务器一致，只是将监听IP地址修改为本机IP地址

3.2.2 添加自定义区域信息

vi /etc/named.rfc1912.zones
//这里省略默认配置
//（不要动这里默认的配置，因为默认bind需要配置3个区域：根，127.0.0.1, 127.0.0.1的反向解析）

zone "example.com" IN { 
        type slave;
        master { 10.116.72.6; };
        masterfile-format text;
        file "slaves/example.com.zone";
};

zone "demo.com" IN { 
        type slave;
        master { 10.116.72.6; };
        masterfile-format text;
        file "slaves/demo.com.zone";
}; 

zone "72.116.10.in-addr.arpa." IN {
        type slave;
        master { 10.116.72.6; };
        masterfile-format text;
        file "slaves/72.116.10.in-addr.arpa";
};

[备注] 从服务器上不需要生成区域配置文件，数据同步自动生成

3.3 启动从服务器

systemctl start named.service
systemctl enable named.service
netstat -pltn |grep named

# 可以看到区域文件已经同步过来了。
ll /var/named/slaves
-rw-r--r-- 1 named named 818 Jul 16 17:51 72.116.10.in-addr.arpa
-rw-r--r-- 1 named named 264 Jul 16 17:51 demo.com.zone
-rw-r--r-- 1 named named 601 Jul 16 17:51 example.com.zone

3.4 修改主DNS服务器，将从服务器记录加入进去

vi /var/named/example.com.zone
vi /var/named/demo.com.zone
$TTL 600
@       IN SOA  dns.example.com admin.example.com (
                                        2019071602      ; serial
                                        2H              ; refresh
                                        5M              ; retry
                                        1D              ; expire
                                        2D )            ; minimum
@               IN      NS      dns.example.com.
@               IN      NS      ns2.example.com.
dns             IN      A       10.116.72.6
ns2             IN      A       10.116.72.7

# 重新加载主DNS服务器配置文件
systemctl restart named.service

# 验证
dig ns2.example.com @10.116.72.7
dig ns2.example.com @10.116.72.6

[备注] serial需要修改，也就是会通知从服务器自动更新数据文件

3.5 修改业务主机域名解析配置

业务主机：10.116.72.4

ssh 10.116.72.4

vi /etc/resolv.conf
nameserver 10.116.72.6
nameserver 10.116.72.7

# 测试
dig www.example.com

; <<>> DiG 9.9.4-RedHat-9.9.4-73.el7_6 <<>> www.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49816
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.example.com.               IN      A

;; ANSWER SECTION:
www.example.com.        600     IN      A       10.116.72.4

;; AUTHORITY SECTION:
example.com.            600     IN      NS      ns2.example.com.
example.com.            600     IN      NS      dns.example.com.

;; ADDITIONAL SECTION:
dns.example.com.        600     IN      A       10.116.72.6
ns2.example.com.        600     IN      A       10.116.72.7

;; Query time: 1 msec
;; SERVER: 10.116.72.6#53(10.116.72.6)
;; WHEN: Tue Jul 16 18:03:36 CST 2019
;; MSG SIZE  rcvd: 128

四、总结与延展

到这里DNS主从同步就配置完成了，在单独的10.116.72.0/24 内部网段可以完成解析。还需要进行配置或者使用的工具

1. 从业务主机上ping/dig其他公网域名，例如 baidu.com 会发现不通或者没有解析记录，是因为只配置了这2个域名而不能解析其他域名。完成这一步需要配置forward
2. 刚刚配置区域文件是直接编辑文件，然后重启服务生效。在实际使用中需要通过工具进行更新文件，并自动生效。
3. 可以开发API，与域名管理平台进行集成