|
安装BIND
|
[root@linux ~]# yum -y install bind ← 安装bind
Gathering header information file(s) from server(s)
Server: CentOS Core 2 - i386 - Base
Server: CentOS Core 2 - i386 - Released Updates
Finding updated packages
Downloading needed headers
Resolving dependencies
Dependencies resolved
I will do the following:
[install: bind 9.2.3-13.i386]
Downloading Packages
Getting bind-9.2.3-13.i386.rpm
bind-9.2.3-13.i386.rpm 100% |=========================| 1.9 MB 00:02
Running test transaction:
Test transaction complete, Success!
bind 100 % done 1/1
Installed: bind 9.2.3-13.i386
Transaction(s) Complete
[root@linux ~]# yum -y install caching-nameserver ← 安装caching-nameserver
Gathering header information file(s) from server(s)
Server: CentOS Core 2 - i386 - Base
Server: CentOS Core 2 - i386 - Released Updates
Finding updated packages
Downloading needed headers
Resolving dependencies
Dependencies resolved
I will do the following:
[install: caching-nameserver 7.2-12.noarch]
Downloading Packages
Getting caching-nameserver-7.2-12.noarch.rpm
caching-nameserver-7.2-12 100% |=========================| 8.0 kB 00:00
Running test transaction:
Test transaction complete, Success!
caching-nameserver 100 % done 1/1
Installed: caching-nameserver 7.2-12.noarch
Transaction(s) Complete
[root@linux ~]# yum -y install bind-chroot ← 安装bind-chroot
Gathering header information file(s) from server(s)
Server: CentOS Core 2 - i386 - Base
Server: CentOS Core 2 - i386 - Released Updates
Finding updated packages
Downloading needed headers
Resolving dependencies
Dependencies resolved
I will do the following:
[install: bind-chroot 9.2.3-13.i386]
Downloading Packages
Getting bind-chroot-9.2.3-13.i386.rpm
bind-chroot-9.2.3-13.i386 100% |=========================| 22 kB 00:00
Running test transaction:
Test transaction complete, Success!
bind-chroot 100 % done 1/1
Installed: bind-chroot 9.2.3-13.i386
Transaction(s) Complete
|
|
|
|
设定BIND
|
[root@linux ~]# vi /var/named/chroot/etc/named.conf ← 编辑bind设定文件
//
// named.conf for Red Hat caching-nameserver
//
//追加
// 定义内网
acl localnet{
192.168.1.0/24; ← 指定IP ※请根据自己的情况和要求填写
127.0.0.1;
};
//追加完了
options {
directory "/var/named";
version "unknown"; ← 不表示bind的版本信息
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
/*
* If there is a firewall between you and nameservers you want
* to talk to, you might need to uncomment the query-source
* directive below. Previous versions of BIND always asked
* questions using port 53, but BIND 8.1 uses an unprivileged
* port by default.
*/
// query-source address * port 53;
//追加
allow-query{ localnet; }; ← 仅向内部开放DNS(外部开放另外设置)
allow-recursion{ localnet; }; ← ””” 缓冲
allow-transfer{ localnet; }; ← ””” ZONE
forwarders{
192.168.1.1; ← 指定路由器的IP(如果通过路由器)
XXX.XXX.XXX.XXX; ← ISP提供的DNS IP (如果是PPPoE直接连接猫)
XXX.XXX.XXX.XXX; ← ISP提供的DNS IP (如果是PPPoE直接连接猫)
};
//追加完了
};
//
// a caching only nameserver config
//
controls {
inet 127.0.0.1 allow { localhost; } keys { rndckey; };
};
//追加
logging {
category lame-servers { null; };
↑ /var/log/messages里不记录「lame server resolving …」错误信息
};
// 面向内网
view "lan" {
match-clients {
localnet;
};
//追加完了
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/rndc.key";
//追加
// aoiday.com 正向索引信息
zone "aoiday.com" IN {
type master;
file "aoiday.com.db.lan";
allow-update { none; };
};
};
// 面向外部
view "wan" {
match-clients {
any;
};
// aoiday.com 正向索引信息
zone "aoiday.com" IN {
type master;
file "aoiday.com.db";
allow-query { any; }; ← 允许外部访问DNS主机
};
};
//追加完了
|
|
|
|
面向内网aoiday.com正向索引数据库
|
[root@linux ~]# vi /var/named/chroot/var/named/aoiday.com.db.lan
↑ 面向内网aoiday.com的正向索引数据库
$TTL 86400
@ IN SOA aoiday.com. root.aoiday.com.(
2006071201 ; Serial
28800 ; Refresh
14400 ; Retry
3600000 ; Expire
86400 ) ; Minimum
IN NS aoiday.com.
IN MX 10 aoiday.com.
@ IN A 192.168.1.1 ← A 设定(aoiday.com用)
www IN A 192.168.1.1 ← A 设定(www.aoiday.com用)
ftp IN A 192.168.1.1 ← A 设定(ftp.aoiday.com用)
mail IN A 192.168.1.1 ← A 设定(mail.aoiday.com用)
|
|
|
|
面向外部aoiday.com正向索引数据库
|
[root@linux ~]# vi /var/named/chroot/var/named/aoiday.com.db
↑ 面向外部aoiday.com的正向索引数据库
$TTL 86400
@ IN SOA ns1.aoiday.com. root.aoiday.com.(
2006071201 ; Serial
7200 ; Refresh
7200 ; Retry
2419200 ; Expire
86400 ) ; Minimum
IN NS ns1.aoiday.com.
IN MX 10 aoiday.com.
@ IN A XXX.XXX.XXX.XXX ← A 设定(aoiday.com用)
www IN A XXX.XXX.XXX.XXX ← A 设定(www.aoiday.com用)
ftp IN A XXX.XXX.XXX.XXX ← A 设定(ftp.aoiday.com用)
mail IN A XXX.XXX.XXX.XXX ← A 设定(mail.aoiday.com用)
aoiday.com. IN TXT "v=spf1 a mx ~all"
|
|
|
|
更新named.ca
|
[root@linux ~]# dig @a.root-servers.net . ns > /var/named/chroot/var/named/named.ca
↑ 更新named.ca
※全世界顶级DNS主机只有13个
|
|
|
|
自动更新
|
[root@linux ~]# vi /etc/cron.monthly/named.root_update ← 编辑
#!/bin/sh
new=`mktemp`
errors=`mktemp`
dig @a.root-servers.net . ns > $new 2> $errors
if [ $? -eq 0 ]; then
sort_new=`mktemp`
sort_old=`mktemp`
diff_out=`mktemp`
sort $new > $sort_new
sort /var/named/chroot/var/named/named.ca > $sort_old
diff --ignore-matching-lines=^; $sort_new $sort_old > $diff_out
if [ $? -ne 0 ]; then
(
echo '-------------------- old named.root --------------------'
cat /var/named/chroot/var/named/named.ca
echo
echo '-------------------- new named.root --------------------'
cat $new
echo '---------------------- difference ----------------------'
cat $diff_out
) | mail -s 'named.root updated' root
cp -f $new /var/named/chroot/var/named/named.ca
chown named. /var/named/chroot/var/named/named.ca
chmod 644 /var/named/chroot/var/named/named.ca
/etc/rc.d/init.d/named restart > /dev/null
fi
rm -f $sort_new $sort_old $diff_out
else
cat $errors | mail -s 'named.root update check error' root
fi
rm -f $new $errors
[root@linux ~]# chmod 700 /etc/cron.monthly/named.root_update ← 权限变更
|
|
|
|
启动
|
[root@linux ~]# /etc/rc.d/init.d/named start ← 启动BIND
named startting: [ OK ]
[root@linux ~]# chkconfig named on ← 开启自动启动BIND
[root@linux ~]# chkconfig --list named ← 确认
named 0:off 1:off 2:on 3:on 4:on 5:on 6:off ← 确认2～5为on
※注意开放53端口
|
|
|
