DNS之六----一条龙DNS服务搭建
DNS一条龙服务搭建过程
1、DNS架构图：
搭建架构分析：首先，我们需要在192.168.7.100web服务的访问域名，方便我们可以通过客户端进行测试验证是否存在问题，在搭建的过程中，搭建一步，验证一步，否则搭建完排错比较困难。
2、环境准备：
3、在HTTP服务器上安装服务并启动
[root@web ~]# yum install httpd -y [root@web ~]# systemctl start httpd [root@web ~]# echo welcome to shanghai > /var/www/html/index.html
4、配置客户端DNS地址
1、在客户端配置DNS地址，指向LDNS的IP地址
[root@client network-scripts]# pwd /etc/sysconfig/network-scripts [root@client network-scripts]# cat ifcfg-eth0 DEVICE=eth0 BOOTPROTO=static IPADDR=192.168.7.107 PREFIX=24 GATEWAY=192.168.7.2 DNS1=192.168.7.106 # 写上LDNS服务器的IP地址 ONBOOT=yes [root@client network-scripts]# systemctl restart network
2、由于此时HTTP服务器还未域名解析，只能在客户端访问IP地址。
[root@client ~]# curl 192.168.7.100 welcome to shanghai
5、安装主DNS服务器并配置
1、安装DNS服务器并修改主配置文件
[root@dns-master~]#yum install bind -y
options {
// listen-on port 53 { 127.0.0.1; }; # 注释掉此行
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; }; # 注释掉此行
allow-transfer { 192.168.7.102; }; # 允许DNS从服务器复制
2、创建一级域名
[root@dns-master~]#vim /etc/named.rfc1912.zones
zone "magedu.org" IN { # 创建一个magedu.org域名
type master;
file "magedu.org.zone"; # 指定magedu.org域名文件
};
3、修改主DNS的域名解析配置文件
[root@dns-masternamed]#cd /var/named
[root@dns-masternamed]#cp -p named.localhost magedu.org.zone # 复制后修改的文件名要与上面/etc/named.rfc1912.zone里边的file文件名称一致
[root@dns-masternamed]#vim magedu.org.zone
$TTL 1D
@ IN SOA ns1 admin (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS ns1
NS ns2
ns1 A 192.168.7.101 # 指定本机，即主DNS主机的域名解析
ns2 A 192.168.7.102 # 指定从DNS域名解析
www A 192.168.7.100 # 指定http服务器的域名解析
4、重启主DNS服务器
[root@dns-masternamed]#systemctl restart named
6、在客户端进行验证此时的域名解析效果
[root@client network-scripts]# yum install bind-utils -y # 安装dig命令 [root@client network-scripts]# dig www.magedu.org @192.168.7.101 # 测试主DNS域名解析效果 ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> www.magedu.org @192.168.7.101 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46168 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;www.magedu.org. IN A ;; ANSWER SECTION: www.magedu.org. 86400 IN A 192.168.7.100 # 此时已经返回了http地址和域名的效果 ;; AUTHORITY SECTION: magedu.org. 86400 IN NS ns2.magedu.org. magedu.org. 86400 IN NS ns1.magedu.org. ;; ADDITIONAL SECTION: ns1.magedu.org. 86400 IN A 192.168.7.101 # 主DNS的域名解析 ns2.magedu.org. 86400 IN A 192.168.7.102 # 从DNS的域名解析 ;; Query time: 2 msec ;; SERVER: 192.168.7.101#53(192.168.7.101) ;; WHEN: Tue Jul 14 22:07:22 CST 2020 ;; MSG SIZE rcvd: 127
7、安装并配置从DNS服务器，实现主从复制
1、安装从DNS服务，并配置。
[root@dns-slave~]#yum install bind -y
[root@dns-slave~]#vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; }; # 注释掉此行
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; }; # 注释掉此行
allow-transfer { none;}; # 不允许其他主机访问
2、配置从DNS服务器，与主DNS服务器关联，实现主从复制
[root@dns-slave~]#vim /etc/named.rfc1912.zones
zone "magedu.org" IN { # 与主DNS域名一致
type slave;
masters { 192.168.7.101; }; # 指定主DNS的IP地址
file "slaves/magedu.org.zone"; # 指定一个文件名，默认会在/var/named/slaves目录下创建出来，如果有，说明主从复制成功
};
3、查看此时从DNS服务器上已经存在文件，说明主从复制没问题。
[root@dns-slave~]#ll /var/named/slaves/ total 4 -rw-r--r-- 1 named named 306 Jul 14 22:13 magedu.org.zone
8、在客户端验证主从复制效果
1、在客户端测试验证主从DNS服务器效果
[root@client ~]# dig www.magedu.org @192.168.7.101 # 客户端上验证主DNS，可以看出DNS能解析http服务器的域名 ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> www.magedu.org @192.168.7.101 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 65287 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;www.magedu.org. IN A ;; ANSWER SECTION: www.magedu.org. 86400 IN A 192.168.7.100 # 能解析http服务器域名 ;; AUTHORITY SECTION: magedu.org. 86400 IN NS ns1.magedu.org. magedu.org. 86400 IN NS ns2.magedu.org. ;; ADDITIONAL SECTION: ns1.magedu.org. 86400 IN A 192.168.7.101 ns2.magedu.org. 86400 IN A 192.168.7.102 ;; Query time: 1 msec ;; SERVER: 192.168.7.101#53(192.168.7.101) ;; WHEN: Tue Jul 14 22:24:34 CST 2020 ;; MSG SIZE rcvd: 127 [root@client ~]# dig www.magedu.org @192.168.7.102 # 在从DNS服务器上验证也能解析http服务域名 ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> www.magedu.org @192.168.7.102 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10275 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;www.magedu.org. IN A ;; ANSWER SECTION: www.magedu.org. 86400 IN A 192.168.7.100 # 解析http域名效果 ;; AUTHORITY SECTION: magedu.org. 86400 IN NS ns2.magedu.org. magedu.org. 86400 IN NS ns1.magedu.org. ;; ADDITIONAL SECTION: ns1.magedu.org. 86400 IN A 192.168.7.101 ns2.magedu.org. 86400 IN A 192.168.7.102 ;; Query time: 1 msec ;; SERVER: 192.168.7.102#53(192.168.7.102) ;; WHEN: Tue Jul 14 22:24:37 CST 2020 ;; MSG SIZE rcvd: 127
9、实现子域委派效果
1、安装DNS服务器，并修改主配置文件
[root@orgdnsnamed]#yum install bind -y
[root@orgdnsnamed]#vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; };
2、创建顶级域
[root@orgdnsnamed]#vim /etc/named.rfc1912.zones
zone "org" IN {
type master;
file "org.zone";
};
3、在/var/named目录下创建一个org.zone的配置文件，这里直接将主DNS服务器的配置文件复制过来，不再手动写了
[root@dns-masternamed]#scp -p magedu.org.zone 192.168.7.103:/var/named/org.zone # 一定要注意org.zone的属组权限，否则就会问题
[root@orgdnsnamed]#ll
total 20
drwxrwx--- 2 named named 23 Jul 14 22:40 data
drwxrwx--- 2 named named 60 Jul 14 22:44 dynamic
-rw-r----- 1 root named 2253 Apr 5 2018 named.ca
-rw-r----- 1 root named 152 Dec 15 2009 named.empty
-rw-r----- 1 root named 152 Jun 21 2007 named.localhost
-rw-r----- 1 root named 168 Dec 15 2009 named.loopback
-rw-r----- 1 root named 221 Jul 14 22:31 org.zone # 属组权限一定要是named
drwxrwx--- 2 named named 6 Jun 1 23:26 slaves
[root@orgdnsnamed]#vim org.zone # 创建一个org.zone文件
$TTL 1D
@ IN SOA ns1 admin (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS ns1 # 指向第一个ns1域名，也是本主机
magedu NS ns2 # 定义主DNS服务器的二级域，因为前面已经定义了magedu.org,因此magedu不能随意变化
magedu NS ns3 # 同理，定义了从DNS服务器
ns1 A 192.168.7.103 # 定义本主机为顶级域，并解析为IP地址
ns2 A 192.168.7.101 # 定义主DNS服务器为二级域，进行委派
ns3 A 192.168.7.102 # 定义从DNS服务器为二级域，进行委派
4、启动二级域的DNS服务器：systemctl start named
10、在客户端进行测试验证子域委派效果
1、验证此时的子域委派，如果orgdns服务器可以向下查询，说明此时子域委派正常。
[root@client ~]# dig www.magedu.org @192.168.7.103 # 测试子域委派的orgdns服务器 ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> www.magedu.org @192.168.7.103 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52563 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;www.magedu.org. IN A ;; ANSWER SECTION: www.magedu.org. 86036 IN A 192.168.7.100 # 此时可以看到http服务器还是可以解析 ;; AUTHORITY SECTION: magedu.org. 86400 IN NS ns3.org. magedu.org. 86400 IN NS ns2.org. ;; ADDITIONAL SECTION: ns2.org. 86400 IN A 192.168.7.101 ns3.org. 86400 IN A 192.168.7.102 ;; Query time: 1 msec ;; SERVER: 192.168.7.103#53(192.168.7.103) ;; WHEN: Tue Jul 14 22:50:31 CST 2020 ;; MSG SIZE rcvd: 127
11、在rootdns服务器上安装并配置
1、修改rootdns服务器的主配置文件
[root@rootdns ~]# vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; }; # 注释
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; }; # 注释
zone "." IN {
type master; # 在最下面定义根域名为master
file "root.zone"; # 自定义一个文件
};
2、在主DNS服务器上将magedu.org.zone复制到rootdns服务器上，修改关键部分即可
[root@dns-masternamed]#scp -p magedu.org.zone 192.168.7.104:/var/named/root.zone # 将主DNS服务器的配置文件复制到rootdns服务器上，并起名为root.zone
[root@rootdns named]# vim /var/named/root.zone # 修改rootdns配置文件
$TTL 1D
@ IN SOA ns1 admin (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS ns1
org NS ns2 # 将根域委派给org的顶级域
ns1 A 192.168.7.104 # 将根域，也就是本机的主机IP进行解析
ns2 A 192.168.7.103 # 将orgdns服务器的IP地址和域名进行解析
3、启动rootdns根域的DNS服务器
[root@rootdns named]# systemctl start named
12、在客户端测试根域委派效果
[root@client ~]# dig www.magedu.org @192.168.7.104 # @后面的IP地址就是根服务器 ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> www.magedu.org @192.168.7.104 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5853 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;www.magedu.org. IN A ;; ANSWER SECTION: www.magedu.org. 86400 IN A 192.168.7.100 # 此时查看到还是可以解析http服务器的域名 ;; AUTHORITY SECTION: magedu.org. 86400 IN NS ns3.org. magedu.org. 86400 IN NS ns2.org. ;; ADDITIONAL SECTION: ns3.org. 86400 IN A 192.168.7.102 ns2.org. 86400 IN A 192.168.7.101 ;; Query time: 6 msec ;; SERVER: 192.168.7.104#53(192.168.7.104) ;; WHEN: Tue Jul 14 23:29:51 CST 2020 ;; MSG SIZE rcvd: 127
13、实现DNS转发功能
1、安装DNS服务器，并修改主配置文件
[root@forward~]#vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; };
dnssec-enable no; # 将yes改为no
dnssec-validation no; #将yes改为no
2、修改/var/named/named.ca配置文件，实现转发到根域功能
[root@forward~]#vim /var/named/named.ca . 518400 IN NS a.root-servers.net. # 多余的全部删除 a.root名称要与下面一行的a.root一致 a.root-servers.net. 518400 IN A 192.168.7.104 # 指向根域服务器的地址
14、在客户端进行测试转发服务器效果
[root@client ~]# dig www.magedu.org @192.168.7.105 # 测试转发服务器效果 ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> www.magedu.org @192.168.7.105 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56960 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;www.magedu.org. IN A ;; ANSWER SECTION: www.magedu.org. 86280 IN A 192.168.7.100 # 可以看到此时服务器抓发成功，http服务器域名还是可以解析 ;; AUTHORITY SECTION: magedu.org. 86280 IN NS ns3.org. magedu.org. 86280 IN NS ns2.org. ;; ADDITIONAL SECTION: ns3.org. 86280 IN A 192.168.7.102 ns2.org. 86280 IN A 192.168.7.101 ;; Query time: 3 msec ;; SERVER: 192.168.7.105#53(192.168.7.105) ;; WHEN: Tue Jul 14 23:32:01 CST 2020 ;; MSG SIZE rcvd: 127
15、安装并配置本地DNS服务器
1、安装DNS服务器，并修改主配置文件
[root@localdns ~]# yum install bind -y
[root@localdns ~]# vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; };
forward only ; # 转发功能打开，选择only模式
forwarders {192.168.7.105;}; # 转发的IP地址指向上一级的转发DNS服务器上
dnssec-enable no; # 将此行yes改为no
dnssec-validation no; # 将此行yes改为no
2、启动DNS服务器：systemctl start named
16、开始在客户端最终的测试效果
1、测试本地的DNS解析效果
[root@client ~]# dig www.magedu.org @192.168.7.106 # 直接访问本地的DNS服务器可以解析 ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> www.magedu.org @192.168.7.106 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56578 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;www.magedu.org. IN A ;; ANSWER SECTION: www.magedu.org. 85844 IN A 192.168.7.100 # 访问本地的DNS服务器可以解析 ;; AUTHORITY SECTION: magedu.org. 85844 IN NS ns3.org. magedu.org. 85844 IN NS ns2.org. ;; ADDITIONAL SECTION: ns2.org. 85844 IN A 192.168.7.101 ns3.org. 85844 IN A 192.168.7.102 ;; Query time: 6 msec ;; SERVER: 192.168.7.106#53(192.168.7.106) ;; WHEN: Tue Jul 14 23:39:17 CST 2020 ;; MSG SIZE rcvd: 127
2、通过域名访问http服务，此时通过域名也可以访问到网页，所有的实验到此结束。
[root@client ~]# curl www.magedu.org welcome to shanghai
