bind9 安装过程

1，安装方式分为两种，

1）yum install bind*

2）直接下载包安装

本文章采取的安装yum 安装

安装完

编辑

named.conf

[root@ip-172-30-4-53 etc]# cat named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {
    listen-on port 53 { any; };  //由127.0.0.1;改为 any,目的是在所有IP上 //打开监听
    listen-on-v6 port 53 { ::1; };
    directory     "/var/named";
    dump-file     "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    recursing-file  "/var/named/data/named.recursing";
    secroots-file   "/var/named/data/named.secroots";
    allow-query     { any; };  //由localhost改为0.0.0.0/0;允许所有IP访问,不配置会报refused dns

    /* 
     - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
     - If you are building a RECURSIVE (caching) DNS server, you need to enable 
       recursion. 
     - If your recursive DNS server has a public IP address, you MUST enable access 
       control to limit queries to your legitimate users. Failing to do so will
       cause your server to become part of large scale DNS amplification 
       attacks. Implementing BCP38 within your network would greatly
       reduce such attack surface 
    */
    recursion yes;

    dnssec-enable no;
    dnssec-validation no;

    /* Path to ISC DLV key */
    bindkeys-file "/etc/named.root.key";

    managed-keys-directory "/var/named/dynamic";

    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";

};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
    type hint;
    file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

3，修改 /etc/named.rfc1912.zones

[root@ip-172-30-4-53 etc]# cat /etc/named.rfc1912.zones
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package 
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
// 
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

zone "localhost.localdomain" IN {
    type master;
    file "named.localhost";
    allow-update { none; };
};

zone "localhost" IN {
    type master;
    file "named.localhost";
    allow-update { none; };
};

zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
    type master;
    file "named.loopback";
    allow-update { none; };
};

zone "1.0.0.127.in-addr.arpa" IN {
    type master;
    file "named.loopback";
    allow-update { none; };
};

zone "0.in-addr.arpa" IN {
    type master;
    file "named.empty";
    allow-update { none; };
};
---新增如下域名配置
zone "bacic.com" IN {
        type master;
        file "bacic.com.zone";
        allow-update {none;};
};

3，在/var/named/ 增加bacic.com.zone文件

文件编辑如下

$TTL 1D
$ORIGIN bacic.com.
@   IN SOA  bacic.com. admin.bacic.com. (
                    20170526; serial
                    1D  ; refresh
                    1H  ; retry
                    1W  ; expire
                    3H )    ; minimum
bacic.com. IN  NS  ns1.bacic.com.

ns1        IN  A   12.3.10.4
slave      IN  A   12.3.10.155
harbor     IN  A   12.3.9.64
pinpoint   IN  A   12.3.9.53
grafana    IN  A   12.3.9.42

4，systemctl restart named

5, systemctl status named

报如下错误

[root@kube data]# tail -f named.run
network unreachable resolving './DNSKEY/IN': 2001:500:200::b#53
network unreachable resolving './DNSKEY/IN': 2001:500:2d::d#53
network unreachable resolving './DNSKEY/IN': 2001:500:12::d0d#53
network unreachable resolving './DNSKEY/IN': 2001:503:c27::2:30#53
network unreachable resolving './DNSKEY/IN': 2001:500:2f::f#53
network unreachable resolving './DNSKEY/IN': 2001:7fe::53#53
network unreachable resolving './DNSKEY/IN': 2001:dc3::35#53
network unreachable resolving './DNSKEY/IN': 2001:7fd::1#53
network unreachable resolving './DNSKEY/IN': 2001:500:2::c#53
managed-keys-zone: Key 20326 for zone . acceptance timer complete: key now trusted

6，原因是bind9 默认解析ipv6了，需要修改文件，/etc/sysconfig/named

[root@kube ~]# cat /etc/sysconfig/named 
OPTIONS="-4"//增加这句话
# BIND named process options
# ~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# OPTIONS="whatever"     --  These additional options will be passed to named
#                            at startup. Don't add -t here, enable proper
#                            -chroot.service unit file.
#                            Use of parameter -c is not supported here. Extend
#                            systemd named*.service instead. For more
#                            information please read the following KB article:
#                            https://access.redhat.com/articles/2986001
#
# DISABLE_ZONE_CHECKING  --  By default, service file calls named-checkzone
#                            utility for every zone to ensure all zones are
#                            valid before named starts. If you set this option
#                            to 'yes' then service file doesn't perform those
#                            checks.

7，systemctl restart named

8 ，查看日志，/var/named/data/named.run 文件

9，使用nslookup验证

指定server验证

 

 验证成功！！！

10，如果想用dns实现上网功能  namd.conf option中配置如下配置

forward first; //下面这两行配置很重要，这个配置后，当客户端采用我们自己配置的内网DNS的NS服务器后，当访问别的网站，内网NS解析不了的就转发给8.8.8.8的DS服务器解析，保证能正常上网。
forwarders {
    223.5.5.5; //阿里云的DNS服务器
    223.6.6.6;
    8.8.8.8;
    8.8.4.4;
};

验证下