源自《Linux 运维之道》丁一明编著 一书的总结

DNS是Domain Name System（域名系统）的简称，DNS可以为计算机、服务以及接入互联网或局域网的任何资源提供分层的名称解析功能。

域名是分级的，一般为：主机名.三级域名.二级域名.定级域名.。一般最后一个点是不用输入的。一般顶级域名代表国家或组织形式。

域名查询分为递归查询和迭代查询，从客户端到本地DNS服务器是属于递归查询，而DNS服务器之间就是的交互查询就是迭代查询。

安装：

[root@localhost /]# yum -y install bind

[root@localhost /]# yum -y install bind-chroot

[root@localhost /]# yum -y install bind-utils

对于bind而言，/var/named/chroot/目录就是根路径。bind-utils提供了一些DNS查询工具，如：dig、host、nslookup等。

配置文件解析，主配置文件一般为/etc/named.conf文件，但是当安装bind-chroot软件包后，在后面的内容提到的一些路径默认指的是一个虚拟路径，都是相对虚拟根路径而言的，虚拟根路径默认为/var/named/chroot/目录。也就是主配置文件的绝对路径变为/var/named/chroot/etc/named.conf。

//

// named.conf

//

// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS

// server as a caching only nameserver (as a localhost DNS resolver only).

//

// See /usr/share/doc/bind*/sample/ for example named configuration files.

//

options {

listen-on port 53 { 127.0.0.1; };

listen-on-v6 port 53 { ::1; };

directory "/var/named";

dump-file "/var/named/data/cache_dump.db";

statistics-file "/var/named/data/named_stats.txt";

memstatistics-file "/var/named/data/named_mem_stats.txt";

allow-query { localhost; };

recursion yes;

dnssec-enable yes;

dnssec-validation yes;

dnssec-lookaside auto;

/* Path to ISC DLV key */

bindkeys-file "/etc/named.iscdlv.key";

managed-keys-directory "/var/named/dynamic";

};

//自定义一些主机访问控制列表

acl black{

172.16.0.0/16;

};

acl white{

10.0.0.0/8;

}

//options语句用来定义全局配置选项，在全局配置中至少需要定义一个工作路径，默认的工作路径为/var/named/，具体的常见参数见表8.1

Options{

allow-query {white;};

blackhole{black;};

};

logging {

channel default_debug {

file "data/named.run";

severity dynamic;

};

};

//zone语句用来定义域以及相关选项，该语句的重点有type和file，表8.2为zone语句内常用的选项和描述

zone "." IN {

type hint;

file "named.ca";

};

include "/etc/named.rfc1912.zones";

include "/etc/named.root.key";

表8.1

表8.2

在BIND软件的主配置中，如果定义了zone语句，还需要额外创建于数据文件，默认与数据文件在/var/named目录下，文件名称有zone语句的file选项设定。

常用的配置语句选项说明：

部署主域名服务器

先安装：

[root@localhost /]# yum -y install bind

[root@localhost /]# yum -y install bind-chroot

[root@localhost /]# yum -y install bind-utils

在修改配置：

[root@localhost /]# cp /usr/share/doc/bind-9.8.2/sample/etc/named.conf /var/named/chroot/etc/

[root@localhost /]# chown root.named /var/named/chroot/etc/named.conf

[root@localhost /]# gedit /var/named/chroot/etc/named.conf

options

{

directory "/var/named";

dump-file "data/cache_dump.db";

statistics-file "data/named_stats.txt";

memstatistics-file "data/named_mem_stats.txt";

listen-on port 53 { any; };

allow-query { any; };

allow-query-cache { any; };

recursion yes;

};

acl secondserver{

192.168.118.250;

};

zone "." IN {

type hint;

file "/var/named/named.ca";

};

zone "abc.com" IN{

type master;

allow-transfer { secondserver;};

file "abc.com.zone";

};

zone "168.192.in-addr.arpa" IN{

type master;

allow-transfer{secondserver;};

file "168.192.zone";

};

创建区数据文件

[root@localhost /]# cp /usr/share/doc/bind-9.8.2/sample/var/named/named.ca /var/named/chroot/etc/

[root@localhost /]# chown root.named /var/named/chroot/etc/named.ca

[root@localhost /]# cp /usr/share/doc/bind-9.8.2/sample/var/named/named.localhost /var/named/chroot/var/named/abc.com.zone

[root@localhost /]# chown root.named /var/named/chroot/var/named/abc.com.zone

[root@localhost /]# gedit /var/named/chroot/var/named/abc.com.zone

修改内容

$TTL 1D

@ IN SOA @ rname.invalid. (

10 ; serial

1D ; refresh

1H ; retry

1W ; expire

3H ) ; minimum

NS dns1.abc.com.

NS dns2.abc.com.

MX 10 mail.abc.com.

dns1 IN A 192.168.118.253

dns2 IN A 192.168.118.250

ntp.abc.com. IN A 192.168.118.20

mail.abc.com. IN A 192.168.118.25

fileserver IN A 192.168.118.100

Printserver IN A 192.168.118.101

www IN A 192.168.118.200

IN A 192.168.118.201

添加用于方向解析的192.168.zone域数据文件

[root@localhost /]# gedit /var/named/chroot/var/named/192.168.zone

$TTL 1D

@ IN SOA dns1.abc.com. jacob.abc.com. (

10 ; serial

1D ; refresh

1H ; retry

1W ; expire

3H ) ; minimum

NS dns1.abc.com.

NS dns2.abc.com.

253.118 IN PTR dns1.abc.com.

254.118 IN PTR dns2.abc.com.

20.118 IN PTR ntp.abc.com.

25.118 IN PTR mail.abc.com.

100.118 IN PTR fileserver.abc.com.

101.118 IN PTR Printserver.abc.com.

200.118 IN PTR www.abc.com.

201.118 IN PTR www.abc.com.

开启tcp的53端口用于主从复制，udp53端口用于数据查询

[root@localhost /]# iptables -I INPUT -p udp --dport 53 -i ACCEPT

[root@localhost /]# iptables -I INPUT -p tcp --dport 53 -i ACCEPT

[root@localhost /]# service iptables save

iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]

[root@localhost /]# chkconfig named on

在ubutu上查询，注意我还没设置默认的dns服务器为192.168.118.253，因此才会出现Non-authoritative answer。

root@ubuntu:/home/tempal# nslookup www.abc.com

Server: 127.0.0.1

Address: 127.0.0.1#53

Non-authoritative answer:

www.abc.com canonical name = abc.com.

Name: abc.com

Address: 199.181.132.250

部署从域名服务器可以防止出现单点故障或实现负载均衡。在192.168.118.250中安装：

[root@localhost /]# yum -y install bind

[root@localhost /]# yum -y install bind-chroot

[root@localhost /]# yum -y install bind-utils

在修改配置：

[root@localhost /]# cp /usr/share/doc/bind-9.8.2/sample/etc/named.conf /var/named/chroot/etc/

[root@localhost /]# chown root.named /var/named/chroot/etc/named.conf

[root@localhost /]# gedit /var/named/chroot/etc/named.conf

内容：

options

{

directory "/var/named";

dump-file "data/cache_dump.db";

statistics-file "data/named_stats.txt";

memstatistics-file "data/named_mem_stats.txt";

listen-on port 53 { any; };

allow-query { any; };

allow-query-cache { any; };

recursion yes;

};

acl secondserver{

192.168.118.250;

};

zone "." IN {

type hint;

file "/var/named/named.ca";

};

zone "abc.com" IN{

type slave;

allow-transfer { secondserver;};

file "abc.com.zone";

};

zone "168.192.in-addr.arpa" IN{

type slave;

allow-transfer{secondserver;};

file "168.192.zone";

};

设置同步文件

最后修改SELinux设置，否则无权限进行同步操作。

[root@test ~]# setsebool -P named_write_master_zones=1

[root@test ~]# mkdir -p /var/named/chroot/var/named/slaves/

[root@test ~]# chown root.named /var/named/chroot/var/named/slaves/

[root@test ~]# chmod 775 /var/named/chroot/var/named/slaves/

[root@test ~]# chkconfig named on