Bind DNS服务——反向解析与区域传送
Linux基础服务——Bind DNS服务 Part2
DNS反向解析与区域传送
实验环境延续Part1的实验环境。
反向区域配置
正向解析是域名到IP地址的映射，反向解析则是IP地址到域名的解析，在区域名称方面有较大的的不同。
（下图为定义区域的基本样例）
且反向解析使用PTR记录表明反向解析记录，且所指向的域名必须是FQDN（SOA记录不需要改变，$ORIGIN变量的默认值也与正向解析相同）
定义完毕区域并编写完成区域文件后重新启动named服务即可生效
[root@localhost named]# systemctl restart named
反向解析测试
区域传送（zone transfer）
添加一台相同配置的虚拟机进入环境中，IP地址为192.168.100.60。（软件安装略）
如果我们想让第二台虚拟机提供备份的DNS服务，那么需要将第一台服务器的区域记录传送至第二台服务器，从服务器不能对记录进行修改，接下来进行区域传送的配置。
首先修改区域文件的记录，对第二台虚拟机进行解析，并指定第二台服务器的NS记录使其能够为区域进行解析。
然后在主服务器上进行传送权限的配置。我们需对区域定义的部分进行修改。
添加的allow-transfer指定了该区域可以被传送到那些主机。接下来配置第二台虚拟机。同样的，只需要在区域定义的部分修改部分即可。
type指定了区域类型为辅助区域，masters参数指定了它将向那台服务器进行区域传送，file指定文件保存位置（相对于/var/named/）
配置完毕后，确认防火墙配置是否正确（TCP与UDP53端口放行），重启服务即可。
[root@localhost named]# systemctl restart named
查看日志
Jun 07 07:25:10 localhost.localdomain named[1342]: zone test.com/IN: Transfer started.
Jun 07 07:25:10 localhost.localdomain named[1342]: transfer of 'test.com/IN' from 192.168.100.50#53: connected using 192.168.100.60#50187
Jun 07 07:25:10 localhost.localdomain named[1342]: zone test.com/IN: transferred serial 0
Jun 07 07:25:10 localhost.localdomain named[1342]: transfer of 'test.com/IN' from 192.168.100.50#53: Transfer status: success
Jun 07 07:25:10 localhost.localdomain named[1342]: transfer of 'test.com/IN' from 192.168.100.50#53: Transfer completed: 1 messages, 6 records, 178 bytes, 0.001 secs (178000 bytes/sec)
Jun 07 07:25:10 localhost.localdomain named[1342]: zone 100.168.192.in-addr.arpa/IN: Transfer started.
Jun 07 07:25:10 localhost.localdomain named[1342]: transfer of '100.168.192.in-addr.arpa/IN' from 192.168.100.50#53: connected using 192.168.100.60#40069
Jun 07 07:25:10 localhost.localdomain named[1342]: zone 100.168.192.in-addr.arpa/IN: transferred serial 0
Jun 07 07:25:10 localhost.localdomain named[1342]: transfer of '100.168.192.in-addr.arpa/IN' from 192.168.100.50#53: Transfer status: success
Jun 07 07:25:10 localhost.localdomain named[1342]: transfer of '100.168.192.in-addr.arpa/IN' from 192.168.100.50#53: Transfer completed: 1 messages, 6 records, 205 bytes, 0.001 secs (205000 bytes/sec)
可以看到区域传送已经传送完毕，到文件系统中查看。
[root@localhost slaves]# pwd
/var/named/slaves
[root@localhost slaves]# ls
test.com.ptr.zone test.com.zone
区域文件被传送到了服务器中。接下来测试主辅的DNS。
主从DNS测试
使用Linux客户机的dig命令进行测试（客户机的DNS服务器需配置为192.168.100.50和192.168.100.60）
[root@localhost ~]# dig www.test.com
; <<>> DiG 9.11.20-RedHat-9.11.20-5.el8 <<>> www.test.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 171
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 7682c1196c8fb2fe8ac2854b60be0629b89d5d1616f419f5 (good)
;; QUESTION SECTION:
;www.test.com. IN A
;; ANSWER SECTION:
www.test.com. 86400 IN A 192.168.100.20
;; AUTHORITY SECTION:
test.com. 86400 IN NS dns2.test.com.
test.com. 86400 IN NS dns.test.com.
;; ADDITIONAL SECTION:
dns.test.com. 86400 IN A 192.168.100.50
dns2.test.com. 86400 IN A 192.168.100.60
;; Query time: 0 msec
;; SERVER: 192.168.100.50#53(192.168.100.50)
;; WHEN: Mon Jun 07 15:42:34 EDT 2021
;; MSG SIZE rcvd: 154
以上可见相应的Server为192.168.100.50服务器，将主DNS关闭后再次进行测试。
[root@localhost ~]# dig www.test.com
; <<>> DiG 9.11.20-RedHat-9.11.20-5.el8 <<>> www.test.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44650
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 527a8826a09007e405815b9560be06449ec3acd3b38c6dee (good)
;; QUESTION SECTION:
;www.test.com. IN A
;; ANSWER SECTION:
www.test.com. 86400 IN A 192.168.100.20
;; AUTHORITY SECTION:
test.com. 86400 IN NS dns.test.com.
test.com. 86400 IN NS dns2.test.com.
;; ADDITIONAL SECTION:
dns.test.com. 86400 IN A 192.168.100.50
dns2.test.com. 86400 IN A 192.168.100.60
;; Query time: 0 msec
;; SERVER: 192.168.100.60#53(192.168.100.60)
;; WHEN: Mon Jun 07 15:43:00 EDT 2021
;; MSG SIZE rcvd: 154
可见Server转变成为了192.168.100.60，它们同时提供了服务。
区域文件的更新
当在区域文件内添加内容时，需要更新SOA记录中的Serial（序列号），对于区域传送来说，它通过Serial的大小来区分区域文件的新旧，Serial值越大则区域文件越新。例如我需要在100.168.192.in-addr.arpa区域文件中添加一条A记录，那么我就需要将Serial加一，如下。
Serial由0变为1，然后查看系统日志观察区域传送的更新（从服务器端日志）
Jun 07 08:02:00 localhost.localdomain named[1570]: client @0x7f12e80bf9f0 192.168.100.50#37234: received notify for zone '100.168.192.in-addr.arpa'
Jun 07 08:02:00 localhost.localdomain named[1570]: zone 100.168.192.in-addr.arpa/IN: notify from 192.168.100.50#37234: zone is up to date
Jun 07 08:03:21 localhost.localdomain named[1570]: client @0x7f12e80bf9f0 192.168.100.50#35630: received notify for zone 'test.com'
Jun 07 08:03:21 localhost.localdomain named[1570]: zone test.com/IN: notify from 192.168.100.50#35630: zone is up to date
Jun 07 08:03:21 localhost.localdomain named[1570]: client @0x7f12e80bf9f0 192.168.100.50#58424: received notify for zone '100.168.192.in-addr.arpa'
Jun 07 08:03:21 localhost.localdomain named[1570]: zone 100.168.192.in-addr.arpa/IN: notify from 192.168.100.50#58424: serial 1
Jun 07 08:03:21 localhost.localdomain named[1570]: zone 100.168.192.in-addr.arpa/IN: Transfer started.
Jun 07 08:03:21 localhost.localdomain named[1570]: transfer of '100.168.192.in-addr.arpa/IN' from 192.168.100.50#53: connected using 192.168.100.60#49353
Jun 07 08:03:21 localhost.localdomain named[1570]: zone 100.168.192.in-addr.arpa/IN: transferred serial 1
Jun 07 08:03:21 localhost.localdomain named[1570]: transfer of '100.168.192.in-addr.arpa/IN' from 192.168.100.50#53: Transfer status: success
Jun 07 08:03:21 localhost.localdomain named[1570]: transfer of '100.168.192.in-addr.arpa/IN' from 192.168.100.50#53: Transfer completed: 1 messages, 9 records, 262 bytes, >
Jun 07 08:03:21 localhost.localdomain named[1570]: zone 100.168.192.in-addr.arpa/IN: sending notifies (serial 1)
可以看到，主服务器发出了通知告诉从服务器，区域文件需要被升级，那么从服务器将会开启区域传送传送新的区域文件到本机，在日志中Serial将会被记录。
