DNS之六----一条龙DNS服务搭建
DNS一条龙服务搭建过程
1、DNS架构图:
搭建架构分析:首先,我们需要在192.168.7.100web服务的访问域名,方便我们可以通过客户端进行测试验证是否存在问题,在搭建的过程中,搭建一步,验证一步,否则搭建完排错比较困难。
2、环境准备:
3、在HTTP服务器上安装服务并启动
[root@web ~]# yum install httpd -y
[root@web ~]# systemctl start httpd
[root@web ~]# echo welcome to shanghai > /var/www/html/index.html
4、配置客户端DNS地址
1、在客户端配置DNS地址,指向LDNS的IP地址
[root@client network-scripts]# pwd
/etc/sysconfig/network-scripts
[root@client network-scripts]# cat ifcfg-eth0
DEVICE=eth0
BOOTPROTO=static
IPADDR=192.168.7.107
PREFIX=24
GATEWAY=192.168.7.2
DNS1=192.168.7.106 # 写上LDNS服务器的IP地址
ONBOOT=yes
[root@client network-scripts]# systemctl restart network
2、由于此时HTTP服务器还未域名解析,只能在客户端访问IP地址。
[root@client ~]# curl 192.168.7.100
welcome to shanghai
5、安装主DNS服务器并配置
1、安装DNS服务器并修改主配置文件
[root@dns-master~]#yum install bind -y
options {
// listen-on port 53 { 127.0.0.1; }; # 注释掉此行
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; }; # 注释掉此行
allow-transfer { 192.168.7.102; }; # 允许DNS从服务器复制
2、创建一级域名
[root@dns-master~]#vim /etc/named.rfc1912.zones
zone "magedu.org" IN { # 创建一个magedu.org域名
type master;
file "magedu.org.zone"; # 指定magedu.org域名文件
};
3、修改主DNS的域名解析配置文件
[root@dns-masternamed]#cd /var/named
[root@dns-masternamed]#cp -p named.localhost magedu.org.zone # 复制后修改的文件名要与上面/etc/named.rfc1912.zone里边的file文件名称一致
[root@dns-masternamed]#vim magedu.org.zone
$TTL 1D
@ IN SOA ns1 admin (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS ns1
NS ns2
ns1 A 192.168.7.101 # 指定本机,即主DNS主机的域名解析
ns2 A 192.168.7.102 # 指定从DNS域名解析
www A 192.168.7.100 # 指定http服务器的域名解析
4、重启主DNS服务器
[root@dns-masternamed]#systemctl restart named
6、在客户端进行验证此时的域名解析效果
[root@client network-scripts]# yum install bind-utils -y # 安装dig命令
[root@client network-scripts]# dig www.magedu.org @192.168.7.101 # 测试主DNS域名解析效果
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> www.magedu.org @192.168.7.101
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46168
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.magedu.org. IN A
;; ANSWER SECTION:
www.magedu.org. 86400 IN A 192.168.7.100 # 此时已经返回了http地址和域名的效果
;; AUTHORITY SECTION:
magedu.org. 86400 IN NS ns2.magedu.org.
magedu.org. 86400 IN NS ns1.magedu.org.
;; ADDITIONAL SECTION:
ns1.magedu.org. 86400 IN A 192.168.7.101 # 主DNS的域名解析
ns2.magedu.org. 86400 IN A 192.168.7.102 # 从DNS的域名解析
;; Query time: 2 msec
;; SERVER: 192.168.7.101#53(192.168.7.101)
;; WHEN: Tue Jul 14 22:07:22 CST 2020
;; MSG SIZE rcvd: 127
7、安装并配置从DNS服务器,实现主从复制
1、安装从DNS服务,并配置。
[root@dns-slave~]#yum install bind -y
[root@dns-slave~]#vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; }; # 注释掉此行
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; }; # 注释掉此行
allow-transfer { none;}; # 不允许其他主机访问
2、配置从DNS服务器,与主DNS服务器关联,实现主从复制
[root@dns-slave~]#vim /etc/named.rfc1912.zones
zone "magedu.org" IN { # 与主DNS域名一致
type slave;
masters { 192.168.7.101; }; # 指定主DNS的IP地址
file "slaves/magedu.org.zone"; # 指定一个文件名,默认会在/var/named/slaves目录下创建出来,如果有,说明主从复制成功
};
3、查看此时从DNS服务器上已经存在文件,说明主从复制没问题。
[root@dns-slave~]#ll /var/named/slaves/
total 4
-rw-r--r-- 1 named named 306 Jul 14 22:13 magedu.org.zone
8、在客户端验证主从复制效果
1、在客户端测试验证主从DNS服务器效果
[root@client ~]# dig www.magedu.org @192.168.7.101 # 客户端上验证主DNS,可以看出DNS能解析http服务器的域名
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> www.magedu.org @192.168.7.101
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 65287
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.magedu.org. IN A
;; ANSWER SECTION:
www.magedu.org. 86400 IN A 192.168.7.100 # 能解析http服务器域名
;; AUTHORITY SECTION:
magedu.org. 86400 IN NS ns1.magedu.org.
magedu.org. 86400 IN NS ns2.magedu.org.
;; ADDITIONAL SECTION:
ns1.magedu.org. 86400 IN A 192.168.7.101
ns2.magedu.org. 86400 IN A 192.168.7.102
;; Query time: 1 msec
;; SERVER: 192.168.7.101#53(192.168.7.101)
;; WHEN: Tue Jul 14 22:24:34 CST 2020
;; MSG SIZE rcvd: 127
[root@client ~]# dig www.magedu.org @192.168.7.102 # 在从DNS服务器上验证也能解析http服务域名
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> www.magedu.org @192.168.7.102
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10275
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.magedu.org. IN A
;; ANSWER SECTION:
www.magedu.org. 86400 IN A 192.168.7.100 # 解析http域名效果
;; AUTHORITY SECTION:
magedu.org. 86400 IN NS ns2.magedu.org.
magedu.org. 86400 IN NS ns1.magedu.org.
;; ADDITIONAL SECTION:
ns1.magedu.org. 86400 IN A 192.168.7.101
ns2.magedu.org. 86400 IN A 192.168.7.102
;; Query time: 1 msec
;; SERVER: 192.168.7.102#53(192.168.7.102)
;; WHEN: Tue Jul 14 22:24:37 CST 2020
;; MSG SIZE rcvd: 127
9、实现子域委派效果
1、安装DNS服务器,并修改主配置文件
[root@orgdnsnamed]#yum install bind -y
[root@orgdnsnamed]#vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; };
2、创建顶级域
[root@orgdnsnamed]#vim /etc/named.rfc1912.zones
zone "org" IN {
type master;
file "org.zone";
};
3、在/var/named目录下创建一个org.zone的配置文件,这里直接将主DNS服务器的配置文件复制过来,不再手动写了
[root@dns-masternamed]#scp -p magedu.org.zone 192.168.7.103:/var/named/org.zone # 一定要注意org.zone的属组权限,否则就会问题
[root@orgdnsnamed]#ll
total 20
drwxrwx--- 2 named named 23 Jul 14 22:40 data
drwxrwx--- 2 named named 60 Jul 14 22:44 dynamic
-rw-r----- 1 root named 2253 Apr 5 2018 named.ca
-rw-r----- 1 root named 152 Dec 15 2009 named.empty
-rw-r----- 1 root named 152 Jun 21 2007 named.localhost
-rw-r----- 1 root named 168 Dec 15 2009 named.loopback
-rw-r----- 1 root named 221 Jul 14 22:31 org.zone # 属组权限一定要是named
drwxrwx--- 2 named named 6 Jun 1 23:26 slaves
[root@orgdnsnamed]#vim org.zone # 创建一个org.zone文件
$TTL 1D
@ IN SOA ns1 admin (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS ns1 # 指向第一个ns1域名,也是本主机
magedu NS ns2 # 定义主DNS服务器的二级域,因为前面已经定义了magedu.org,因此magedu不能随意变化
magedu NS ns3 # 同理,定义了从DNS服务器
ns1 A 192.168.7.103 # 定义本主机为顶级域,并解析为IP地址
ns2 A 192.168.7.101 # 定义主DNS服务器为二级域,进行委派
ns3 A 192.168.7.102 # 定义从DNS服务器为二级域,进行委派
4、启动二级域的DNS服务器:systemctl start named
10、在客户端进行测试验证子域委派效果
1、验证此时的子域委派,如果orgdns服务器可以向下查询,说明此时子域委派正常。
[root@client ~]# dig www.magedu.org @192.168.7.103 # 测试子域委派的orgdns服务器
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> www.magedu.org @192.168.7.103
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52563
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.magedu.org. IN A
;; ANSWER SECTION:
www.magedu.org. 86036 IN A 192.168.7.100 # 此时可以看到http服务器还是可以解析
;; AUTHORITY SECTION:
magedu.org. 86400 IN NS ns3.org.
magedu.org. 86400 IN NS ns2.org.
;; ADDITIONAL SECTION:
ns2.org. 86400 IN A 192.168.7.101
ns3.org. 86400 IN A 192.168.7.102
;; Query time: 1 msec
;; SERVER: 192.168.7.103#53(192.168.7.103)
;; WHEN: Tue Jul 14 22:50:31 CST 2020
;; MSG SIZE rcvd: 127
11、在rootdns服务器上安装并配置
1、修改rootdns服务器的主配置文件
[root@rootdns ~]# vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; }; # 注释
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; }; # 注释
zone "." IN {
type master; # 在最下面定义根域名为master
file "root.zone"; # 自定义一个文件
};
2、在主DNS服务器上将magedu.org.zone复制到rootdns服务器上,修改关键部分即可
[root@dns-masternamed]#scp -p magedu.org.zone 192.168.7.104:/var/named/root.zone # 将主DNS服务器的配置文件复制到rootdns服务器上,并起名为root.zone
[root@rootdns named]# vim /var/named/root.zone # 修改rootdns配置文件
$TTL 1D
@ IN SOA ns1 admin (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS ns1
org NS ns2 # 将根域委派给org的顶级域
ns1 A 192.168.7.104 # 将根域,也就是本机的主机IP进行解析
ns2 A 192.168.7.103 # 将orgdns服务器的IP地址和域名进行解析
3、启动rootdns根域的DNS服务器
[root@rootdns named]# systemctl start named
12、在客户端测试根域委派效果
[root@client ~]# dig www.magedu.org @192.168.7.104 # @后面的IP地址就是根服务器
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> www.magedu.org @192.168.7.104
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5853
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.magedu.org. IN A
;; ANSWER SECTION:
www.magedu.org. 86400 IN A 192.168.7.100 # 此时查看到还是可以解析http服务器的域名
;; AUTHORITY SECTION:
magedu.org. 86400 IN NS ns3.org.
magedu.org. 86400 IN NS ns2.org.
;; ADDITIONAL SECTION:
ns3.org. 86400 IN A 192.168.7.102
ns2.org. 86400 IN A 192.168.7.101
;; Query time: 6 msec
;; SERVER: 192.168.7.104#53(192.168.7.104)
;; WHEN: Tue Jul 14 23:29:51 CST 2020
;; MSG SIZE rcvd: 127
13、实现DNS转发功能
1、安装DNS服务器,并修改主配置文件
[root@forward~]#vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; };
dnssec-enable no; # 将yes改为no
dnssec-validation no; #将yes改为no
2、修改/var/named/named.ca配置文件,实现转发到根域功能
[root@forward~]#vim /var/named/named.ca
. 518400 IN NS a.root-servers.net. # 多余的全部删除 a.root名称要与下面一行的a.root一致
a.root-servers.net. 518400 IN A 192.168.7.104 # 指向根域服务器的地址
14、在客户端进行测试转发服务器效果
[root@client ~]# dig www.magedu.org @192.168.7.105 # 测试转发服务器效果
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> www.magedu.org @192.168.7.105
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56960
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.magedu.org. IN A
;; ANSWER SECTION:
www.magedu.org. 86280 IN A 192.168.7.100 # 可以看到此时服务器抓发成功,http服务器域名还是可以解析
;; AUTHORITY SECTION:
magedu.org. 86280 IN NS ns3.org.
magedu.org. 86280 IN NS ns2.org.
;; ADDITIONAL SECTION:
ns3.org. 86280 IN A 192.168.7.102
ns2.org. 86280 IN A 192.168.7.101
;; Query time: 3 msec
;; SERVER: 192.168.7.105#53(192.168.7.105)
;; WHEN: Tue Jul 14 23:32:01 CST 2020
;; MSG SIZE rcvd: 127
15、安装并配置本地DNS服务器
1、安装DNS服务器,并修改主配置文件
[root@localdns ~]# yum install bind -y
[root@localdns ~]# vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; };
forward only ; # 转发功能打开,选择only模式
forwarders {192.168.7.105;}; # 转发的IP地址指向上一级的转发DNS服务器上
dnssec-enable no; # 将此行yes改为no
dnssec-validation no; # 将此行yes改为no
2、启动DNS服务器:systemctl start named
16、开始在客户端最终的测试效果
1、测试本地的DNS解析效果
[root@client ~]# dig www.magedu.org @192.168.7.106 # 直接访问本地的DNS服务器可以解析
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> www.magedu.org @192.168.7.106
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56578
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.magedu.org. IN A
;; ANSWER SECTION:
www.magedu.org. 85844 IN A 192.168.7.100 # 访问本地的DNS服务器可以解析
;; AUTHORITY SECTION:
magedu.org. 85844 IN NS ns3.org.
magedu.org. 85844 IN NS ns2.org.
;; ADDITIONAL SECTION:
ns2.org. 85844 IN A 192.168.7.101
ns3.org. 85844 IN A 192.168.7.102
;; Query time: 6 msec
;; SERVER: 192.168.7.106#53(192.168.7.106)
;; WHEN: Tue Jul 14 23:39:17 CST 2020
;; MSG SIZE rcvd: 127
2、通过域名访问http服务,此时通过域名也可以访问到网页,所有的实验到此结束。
[root@client ~]# curl www.magedu.org
welcome to shanghai
转载至https://www.cnblogs.com/struggle-1216/p/13303159.html