關於在Linux下如何搭建DNS伺服器

2023-09-06 06:29:00

環境

作業系統：CentOS 7

IP地址：10.27.106.201

測試域名：aec.testuc.com

作用：主要提供解析aec.testuc.com域名的服務

安裝

yum -y install bind

修改組態檔

主組態檔

vim /etc/named.conf

主要修改以下兩個地方

listen-on port 53 { any; };

allow-query { any; };

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {
        listen-on port 53 { any; };
        # listen-on port 53 { 127.0.0.1; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
        allow-query     { any; };
        # allow-query     { localhost; };

        /* 
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable 
           recursion. 
         - If your recursive DNS server has a public IP address, you MUST enable access 
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification 
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface 
        */
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.root.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

區域組態檔，新增正向解析設定

vim /etc/named.rfc1912.zones

末尾新增如下設定：

zone "aec.starnetuc.com" IN {             #正向解析為"aec.starnetuc.com"
        type master;                      #型別：主快取為master
        file "aec.starnetuc.com.zone";    #指定區域資料檔案為aec.starnetuc.com.zone
        allow-update { none; };
};

正向區域資料檔案

拷貝其他區域資料檔案，保留原始檔的許可權和屬主的屬性複製

cp -a /var/named/named.localhost /var/named/aec.starnetuc.com.zone

修改該檔案，結果如下：

$TTL 1D  	#有效解析記錄的生成周期
@       IN SOA  aec.starnetuc.com. root.aec.starnetuc.com. (
#@表示當前的DNS區域名錶示這個域名  
#SOA表示授權資訊開啟 
# 後面表示郵件地址因為@有特殊含義 所以使用.代替 
                                        0       ; serial  #更新序列號，可以是10以內的整數
                                        1D      ; refresh #重新整理時間，重新下載地址資料的間隔
                                        1H      ; retry   #重試延遲，下載失敗後的重試延遲
                                        1W      ; expire  #失效時間，超過該時間仍無法下載則放棄
                                        3H )    ; minimum #無效解析記錄的生存週期
        IN      NS      aec.starnetuc.com. #記錄當前區域DNS伺服器的名稱
        IN      MX 10   aec.starnetuc.com. #MX為郵件伺服器 10表示優先順序 數位越大優先順序越低
        IN      A       10.27.106.214      #記錄正向解析域名對應的IP，即將域名與IP綁捆

檢查設定是否正確

named-checkconf -z /etc/named.conf

僅檢查語法不檢查邏輯關係。當顯示的全為0時表示沒有語法錯誤

zone localhost.localdomain/IN: loaded serial 0
zone localhost/IN: loaded serial 0
zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 0
zone 1.0.0.127.in-addr.arpa/IN: loaded serial 0
zone 0.in-addr.arpa/IN: loaded serial 0
zone aec.starnetuc.com/IN: loaded serial 0

啟動DNS服務

啟動前，檢查防火牆、SELINUX安全模式是否是關閉或允許狀態

啟動

systemctl start named
systemctl enable named

檢視53號監聽埠是否開啟

測試

將測試系統的DNS改為10.27.106.201，然後去

ping aec.starnetuc.com

PING aec.starnetuc.com (10.27.106.214) 56(84) bytes of data.
64 bytes from 10.27.106.214 (10.27.106.214): icmp_seq=1 ttl=64 time=1024 ms
64 bytes from 10.27.106.214 (10.27.106.214): icmp_seq=2 ttl=64 time=4.31 ms
64 bytes from 10.27.106.214 (10.27.106.214): icmp_seq=3 ttl=64 time=5.53 ms

表明設定成功。

到此這篇關於關於在Linux下如何搭建DNS伺服器的文章就介紹到這了,更多相關Linux搭建DNS伺服器內容請搜尋it145.com以前的文章或繼續瀏覽下面的相關文章希望大家以後多多支援it145.com！