Linux Cache

查看当前系统版本

[root@iZj6cehstgjoj3qav88fidZ ~]# cat /etc/redhat-release 
CentOS Linux release 7.6.1810 (Core) 
[root@iZj6cehstgjoj3qav88fidZ ~]#

查看bind软件包信息

[root@iZj6cehstgjoj3qav88fidZ ~]# yum info bind
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
Available Packages
Name : bind
Arch : x86_64
Epoch : 32
Version : 9.9.4
Release : 73.el7_6
Size : 1.8 M
Repo : updates/7/x86_64
Summary : The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
URL : http://www.isc.org/products/BIND/
License : ISC
Description : BIND (Berkeley Internet Name Domain) is an implementation of the DNS
: (Domain Name System) protocols. BIND includes a DNS server (named),
: which resolves host names to IP addresses; a resolver library
: (routines for applications to use when interfacing with DNS); and
: tools for verifying that the DNS server is operating properly.

[root@iZj6cehstgjoj3qav88fidZ ~]#

使用yum安装bind及依赖包

[root@iZj6cehstgjoj3qav88fidZ ~]# yum install bind

安装清单

Installed:
bind.x86_64 32:9.9.4-73.el7_6

Dependency Installed:
audit-libs-python.x86_64 0:2.8.4-4.el7 bind-libs.x86_64 32:9.9.4-73.el7_6 checkpolicy.x86_64 0:2.5-8.el7 libcgroup.x86_64 0:0.41-20.el7 libsemanage-python.x86_64 0:2.5-14.el7 
policycoreutils-python.x86_64 0:2.5-29.el7_6.1 python-IPy.noarch 0:0.75-6.el7 python-ply.noarch 0:3.4-11.el7 setools-libs.x86_64 0:3.3.8-4.el7

注册服务及启动服务

[root@iZj6cehstgjoj3qav88fidZ ~]# systemctl enable named
Created symlink from /etc/systemd/system/multi-user.target.wants/named.service to /usr/lib/systemd/system/named.service.
[root@iZj6cehstgjoj3qav88fidZ ~]# systemctl start named
[root@iZj6cehstgjoj3qav88fidZ ~]#

查看端口监听

查看主配置文件

[root@iZj6cehstgjoj3qav88fidZ ~]# vi /etc/named.conf 
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {
listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
allow-query { localhost; };

/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;

dnssec-enable yes;
dnssec-validation yes;

/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";

managed-keys-directory "/var/named/dynamic";

pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
};

logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};

zone "." IN {
type hint;
file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

查看当前主机DNS配置

[root@iZj6cehstgjoj3qav88fidZ ~]# cat /etc/resolv.conf 
options timeout:2 attempts:3 rotate single-request-reopen
; generated by /usr/sbin/dhclient-script
nameserver 100.100.2.136
nameserver 100.100.2.138
search localdomain
[root@iZj6cehstgjoj3qav88fidZ ~]#

安装域名解析提示工具包

[root@iZj6cehstgjoj3qav88fidZ ~]# yum install bind-utils

查看软件版路径及文件

[root@iZj6cehstgjoj3qav88fidZ ~]# rpm -lq bind-utils
/etc/trusted-key.key
/usr/bin/dig
/usr/bin/host
/usr/bin/nslookup
/usr/bin/nsupdate
/usr/share/man/man1/dig.1.gz
/usr/share/man/man1/host.1.gz
/usr/share/man/man1/nslookup.1.gz
/usr/share/man/man1/nsupdate.1.gz
[root@iZj6cehstgjoj3qav88fidZ ~]#

修改本机DNS为当前DNS服务器并尝试域名解析操作

[root@iZj6cehstgjoj3qav88fidZ ~]# vi /etc/resolv.conf 
options timeout:2 attempts:3 rotate single-request-reopen
; generated by /usr/sbin/dhclient-script
#nameserver 100.100.2.136
#nameserver 100.100.2.138
nameserver 127.0.0.1
search localdomain

使用nslookup命令及ping命令检查域名递归（缓存）DNS配置生效情况

为内网主机配置正向解析和反向解析

查看默认的区域配置文件

// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

zone "localhost.localdomain" IN {
type master;
file "named.localhost";
allow-update { none; };
};

zone "localhost" IN {
type master;
file "named.localhost";
allow-update { none; };
};

zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
};

zone "1.0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
};

zone "0.in-addr.arpa" IN {
type master;
file "named.empty";
allow-update { none; };
};

添加自定义区域配置

[root@iZj6cehstgjoj3qav88fidZ ~]# vi /etc/named.rfc1912.zones
zone "ns-zone.com" IN {
type master;
file "ns-zone.com.zone";
allow-update { none; };
};

创建自定义区域配置文件

[root@iZj6cehstgjoj3qav88fidZ ~]# vi /var/named/ns-zone.com.zone
$TTL 600 ; 10 minutes
@ IN SOA ns1.ns-zone.com. hostmaster.ns-zone.com. (
20190001 ; serial number
10800 ; refresh time (3 hours)
900 ; retry time (15 minutes)
604800 ; expire time (1 week)
86400 ; minimum (1 day)
)
NS ns1.ns-zone.com.
$ORIGIN ns-zone.com.
$TTL 60 ; 1 minute
ns1 A 10.22.105.60
www A 10.22.105.60

修改区域配置文件属性

检查主配置文件和自定义区域配置文件

[root@iZj6cehstgjoj3qav88fidZ ~]# named-checkconf 
[root@iZj6cehstgjoj3qav88fidZ ~]#

[root@iZj6cehstgjoj3qav88fidZ ~]# vi /var/named/ns-zone.com.zone 
[root@iZj6cehstgjoj3qav88fidZ ~]# named-checkzone ns-zone.com. /var/named/ns-zone.com.zone 
zone ns-zone.com/IN: loaded serial 20190001
OK
[root@iZj6cehstgjoj3qav88fidZ ~]#

重启bind服务并验证新增加的正向解析

[root@iZj6cehstgjoj3qav88fidZ ~]# systemctl restart named
[root@iZj6cehstgjoj3qav88fidZ ~]# nslookup ns1.ns-zone.com
Server: 127.0.0.1
Address: 127.0.0.1#53

Name: ns1.ns-zone.com
Address: 10.22.105.60

[root@iZj6cehstgjoj3qav88fidZ ~]# nslookup www.ns-zone.com 
Server: 127.0.0.1
Address: 127.0.0.1#53

Name: www.ns-zone.com
Address: 10.22.105.60

[root@iZj6cehstgjoj3qav88fidZ ~]#

使用dig命令查看NS记录

反向解析
增加区域配置

[root@iZj6cehstgjoj3qav88fidZ ~]# vi /etc/named.rfc1912.zones 
zone "105.22.10.in-addr.arpa" IN {
type master;
file "105.22.10.in-addr.arpa.zone";
allow-update { none; };
};

增加自定义区域配置文件

[root@iZj6cehstgjoj3qav88fidZ ~]# vi /var/named/105.22.10.in-addr.arpa.zone
$TTL 600 ; 10 minutes
@ IN SOA ns1.ns-zone.com. hostmaster.ns-zone.com. (
20190001 ; serial number
10800 ; refresh time (3 hours)
900 ; retry time (15 minutes)
604800 ; expire time (1 week)
86400 ; minimum (1 day)
)
NS ns1.ns-zone.com.
$ORIGIN 105.22.10.in-addr.arpa.
$TTL 60 ; 1 minute
60 PTR ns1.ns-zone.com.

检查主配置文件和自定义区域配置文件

[root@iZj6cehstgjoj3qav88fidZ ~]# named-checkconf 
[root@iZj6cehstgjoj3qav88fidZ ~]# 

[root@iZj6cehstgjoj3qav88fidZ ~]# named-checkzone 105.22.10.in-addr.arpa. /var/named/105.22.10.in-addr.arpa.zone 
zone 105.22.10.in-addr.arpa/IN: loaded serial 20190001
OK
[root@iZj6cehstgjoj3qav88fidZ ~]#

验证反向解析