某种情况下如openstack或者openshift/kubernetes软件部署过程由于需要标准的 域名系统(DNS UPDATE)RFC 2136中的动态更新功能, 但是现有的阿里云/华为云均不提供该规范,大多理由为安全问题.
此时需要自建DDNS解决此问题.
前提条件
需要配置自有DNS服务器,参考配置DNS服务器脚本. 操作系统基于centos 7.5
在阿里云万网的DNS服务器新建2条记录:
ns.ddns.xxxxx.com -- A记录 --IPV4指向需要安装的DNS服务器IP
ddns.xxxxx.com – NS记录 – http://ns.ddns.xxxxx.com
此时ddns子域名下的所有解析全部转移到这台DNS服务器进行解析服务.
配置已有的named服务
创建一个安全key
首先,我们需要生成一个Key,用于更新记录的授权。这里使用了HMAC-MD5算法来生成Key。运行:
dnssec-keygen -a HMAC-MD5 -b 128 -n HOST ddnsxxxxx |
执行完成后会在当前目录生成2个文件,
文件名大概如下:
Kddnsxxxxx.+157+43433.key Kddnsxxxxx.+157+43433.private
打开其中的private,复制key出来.
more Kddnsxxxxx.+ 157 + 43433 . private Private-key-format: v1. 3 Algorithm: 157 (HMAC_MD5) Key: MjR1T1Bdwi9NaxiT+5yIYA== Bits: AAA= Created: 20181207022257 Publish: 20181207022257 Activate: 20181207022257 |
修改已有named配置
在/etc/named.conf中,zone “ddns.xxxxxx.com”之前加上:secret内容就是刚才复制出来的key值.
key "ddnskey" { algorithm hmac-md5; secret "MjR1T1Bdwi9NaxiT+5yIYA==" ; }; |
然后继续修改文件末尾zone的定义:
zone "ddns.xxxxx.com" IN { type master; file "ddns.xxxxx.com.zone" ; allow-update { key ddnskey; }; }; |
同时,selinux也有可能限制named写入文件,需要关闭:
setsebool named_write_master_zones true |
设置完成后。重启named:
systemctl restart named |
尝试dnsupdate功能
使用nsupdate命令对DNS进行更新:
# nsupdate > server 127.0 . 0.1 53 > zone ddns.xxxxx.com > key ddnskey MjR1T1Bdwi9NaxiT+5yIYA== > update add abcdefg.ddns.xxxxx.com 200 A 2.2 . 2.2 > send |
测试update结果
# dig abcdefg.ddns.xxxxx.com @localhost ; <<>> DiG 9.9 . 4 -RedHat- 9.9 . 4 - 72 .el7 <<>> vpn.ddns.xxxxx.com @localhost ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28156 ;; flags: qr aa rd ra; QUERY: 1 , ANSWER: 1 , AUTHORITY: 1 , ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0 , flags:; udp: 4096 ;; QUESTION SECTION: ;abcdefg.ddns.xxxxx.com. IN A ;; ANSWER SECTION: abcdefg.ddns.xxxxx.com. 200 IN A 13.37 . 27.291 ;; AUTHORITY SECTION: ddns.xxxxx.com. 120 IN NS ns.ddns.xxxxx.com. ;; ADDITIONAL SECTION: ns.ddns.xxxxx.com. 120 IN A 39.106 . 92.7 ;; Query time: 0 msec ;; SERVER: 127.0 . 0.1 # 53 ( 127.0 . 0.1 ) ;; WHEN: Fri Dec 07 10 : 41 : 49 CST 2018 ;; MSG SIZE rcvd: 97 |
最后收尾
别忘记开通防火墙,包括主机的 53 udp/tcp,还有云主机的upd/tcp 53都开通.
同时做一次异地机器测试,检查DNS是否在其他dns服务器有复制.通过nslookup 检查TTL值,检查ns名称是否正确.
补充在routerOS的脚本参考
/tool dns-update dns-server= 39.108 . 90.77 key-name= "ddnskey" key= "MjR1T1Bdwi9NaxiT+5yIYA==" name=abcdefg address= "3.4.5.6" zone= "ddns.xxxxx.com" ttl= 200 |
更详细routerOS脚本在这里ddnsscript.txt,
# :log info "DDNS: Begin":local ddnsuser "ddns-key":local ddnspass "q1B3kUxxWioLEVh74h8g==":local ddnshost "vpn":local ddnszone "ddns.iqyuan.com":local ddnsinterface "pppoe-2F":local ddnns "vpn.ddns.iqyuan.com":global ddnslastip# :global ddnslastip [:resolve $ddnns]:global ddnsip [ /ip address get [/ip address find interface=$ddnsinterface] address ]# log info $ddnslastip# log info ( [:pick $ddnsip 0 [:find $ddnsip "/"]]):if ([:typeof [:global ddnslastip]] = nil ) do={ :global ddnslastip 0.0.0.0/0 } else={ :set ddnslastip $ddnslastip }:if ([:typeof [:global ddnsip]] = nil ) do={:log info (" DDNS: No ip address present on $ddnsinterface , please check ")} else={:if ($ddnsip != $ddnslastip) do={# :log info "DDNS: DDNS!"/tool dns-update dns-server=39.108.90.77 key-name=$ddnsuser key=$ddnspass name=$ddnshost address=[:pick $ddnsip 0 [:find $ddnsip "/"] ] ttl=200 zone=$ddnszone:log info ( "shuaxin DDNS" . $ddnsip):global ddnslastip $ddnsip} else={# :log info "DDNS: IP"}}#:log info "DDNS: End"