Linux下DNS简单部署（主从域名服务器）

1）安装DNS服务所需要的软件包
[root@test ~]# yum -y install bind bind-chroot bind-util bind-libs 
------------------------------------------------------------------------------------------------
解释：
bind           提供了域名服务的主要程序及相关文件
bind-utils     提供了对DNS服务器的测试工具程序（如nslookup、dig等）
bind-chroot    为bind提供一个伪装的根目录以增强安全性（将“/var/named/chroot/”文件夹作为BIND的根目录）
------------------------------------------------------------------------------------------------2）DNS服务器的配置（服务端要能联网）
[root@test ~]# cp /etc/named.conf /etc/named.conf.bak
[root@test ~]# vim /etc/named.conf
options {listen-on port 53 { any; };      #使用53端口监听，默认监听的是127.0.0.1，这里修改为any（或者直接修改为服务端的ip地址，如服务器ip为192.168.1.24）listen-on-v6 port 53 { ::1; };            #监听ipv6的IP地址选项directory       "/var/named";             #DNS的根目录，由于安装了bind-chroot的所致，因此服务的实际工作目录为/var/named/chroot/var/nameddump-file       "/var/named/data/cache_dump.db";      #缓存转储文件statistics-file "/var/named/data/named_stats.txt";    #记录了内存使用的统计信息memstatistics-file "/var/named/data/named_mem_stats.txt";allow-query     { any; };         #允许查询的主机，默认为localhost，这里修改为anyrecursion yes;                    #可以递归查询dnssec-enable yes;dnssec-validation yes;dnssec-lookaside auto;bindkeys-file "/etc/named.iscdlv.key";managed-keys-directory "/var/named/dynamic";
};logging {                               #named服务的日志文件信息channel default_debug {file "data/named.run";severity dynamic;};
};
zone "." IN {                        #根(.)域的配置及信息（也可以通过其它上级域名转发功能来配置缓存域名服务器，可以去了解下）type hint;file "named.ca";
};[root@test ~]# chmod 770 /var/named/
[root@test ~]# ls -lh /etc/named.conf 
-rw-r-----. 1 root named 984 Nov 20  2015 /etc/named.conf
[root@test ~]# /etc/init.d/named start
Generating /etc/rndc.key:                                  [  OK  ]
Starting named:                                            [  OK  ]
[root@test ~]# ps -ef|grep name
named     1592     1  0 15:03 ?        00:00:00 /usr/sbin/named -u named -t /var/named/chroot
root      1614 32378  0 15:03 pts/0    00:00:00 grep name[root@test ~]# netstat -tunlp|grep named
tcp        0      0 127.0.0.1:53                0.0.0.0:*                   LISTEN      1592/named         
tcp        0      0 127.0.0.1:953               0.0.0.0:*                   LISTEN      1592/named         
tcp        0      0 ::1:53                      :::*                        LISTEN      1592/named         
tcp        0      0 ::1:953                     :::*                        LISTEN      1592/named         
udp        0      0 127.0.0.1:53                0.0.0.0:*                               1592/named         
udp        0      0 ::1:53                      :::*                                    1592/named3）客户端测试
将上面服务器的ip地址添加到客户端的/etc/resolv.conf文件里
[root@test2 ~]# cat /etc/resolv.conf
nameserver 192.168.1.24                          //此处的192.168.1.24是上面DNS服务器的ip地址[root@test2 ~]# ping www.baidu.com
PING www.a.shifen.com (119.75.213.51) 56(84) bytes of data.
64 bytes from 119.75.213.51: icmp_seq=1 ttl=55 time=2.58 ms
64 bytes from 119.75.213.51: icmp_seq=2 ttl=55 time=2.29 ms
.......[root@test2 ~]# dig www.baidu.com; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6_9.2 <<>> www.baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55147
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 5, ADDITIONAL: 5;; QUESTION SECTION:
;www.baidu.com.         IN  A;; ANSWER SECTION:
www.baidu.com.      1100    IN  CNAME   www.a.shifen.com.
www.a.shifen.com.   200 IN  A   119.75.213.50
www.a.shifen.com.   200 IN  A   119.75.213.51;; AUTHORITY SECTION:
a.shifen.com.       1100    IN  NS  ns4.a.shifen.com.
a.shifen.com.       1100    IN  NS  ns2.a.shifen.com.
a.shifen.com.       1100    IN  NS  ns3.a.shifen.com.
a.shifen.com.       1100    IN  NS  ns1.a.shifen.com.
a.shifen.com.       1100    IN  NS  ns5.a.shifen.com.;; ADDITIONAL SECTION:
ns5.a.shifen.com.   1100    IN  A   119.75.222.17
ns3.a.shifen.com.   1100    IN  A   61.135.162.215
ns4.a.shifen.com.   1100    IN  A   115.239.210.176
ns1.a.shifen.com.   1100    IN  A   61.135.165.224
ns2.a.shifen.com.   1100    IN  A   180.149.133.241;; Query time: 1 msec
;; SERVER: 192.168.1.233#53(192.168.1.233)
;; WHEN: Wed Jun 21 15:12:20 2017
;; MSG SIZE  rcvd: 260------------注意事项-------------
客户端必须要跟服务器端能够通信（能ping通）及关闭selinux---------------------------------------扩展-------------------------------------------
上面在/etc/named.conf文件里没有自定义域名去进行解析设置，下面说下自定义域名的设置：
1) DNS主域名服务器配置[root@test ~]# cp /etc/named.conf /etc/named.conf2.bak
[root@test ~]# vim /etc/named.conf               #追加下面内容,即添加wangshibo.com域名配置。如果有多个域名，就如下添加多个类似配置。
......
zone "wangshibo.com" IN {                       #指定区名。正向解析type master;                            #服务器类别，master为主域名file "wangshibo.com_zone";              #正向解析区域文件名wangshibo.com_zone，在/var/named目录下创建allow-transfer {192.168.1.23;};         #指定从（辅助）域名服务器IP。即DNS从服务器的ip是192.168.1.23
};
zone "1.168.192.in-addr.arpa" IN {        #域名对应的ip地址网段为192.168.1.0，此处必须按照相 。反向解析                                          同的格式写type master;file "192.168.1.zone";               #反向解析文件名192.168.1.zoneallow-transfer {192.168.1.23;};
};[root@test ~]# vim /var/named/wangshibo.com_zone
$TTL 1D
@       IN SOA  ns1.wangshibo.com. mail.www.wangshibo.com. (2014102101    #主DNS的此解析文件没改动一次，都要修改一次这个值，然后重启naned或rndc reload重启，从DNS就会自动同步过去1D    1H     1W    3H )  
@               IN      NS      ns1.wangshibo.com.            #主域名的域名地址。NS是域名服务器
ns1.wangshibo.com.    IN      A       192.168.1.24            #主域名的ip地址
@               IN      NS      ns2.wangshibo.com.            #从域名的域名地址。NS是域名服务器
ns2.wangshibo.com.    IN      A       192.168.1.23            #从域名的ip地址
@               IN      MX 10   mail.ww.wangshibo.com.        #邮件服务器的域名地址
mail.www.wangshibo.com.  IN   A       192.168.1.4            
www.wangshibo.com.    IN      A       192.168.1.2
ftp.wangshibo.com     IN      A       192.168.1.3
win7.wangshibo.com.   IN      A       192.168.1.224
linux.wangshibo.com.  IN      CNAME   ns1.wangshibo.com.
smb.wangshibo.com.    IN      CNAME   ns1.wangshibo.com.
dhcp.wangshibo.com.   IN      CNAME   ns1.wangshibo.com.[root@test ~]# vim /var/named/192.168.1.zone
$TTL 1D                       
@       IN SOA  ns1.wangshibo.com. mail.www.wangshibo.com. (2014102101    #主DNS的此解析文件没改动一次，都要修改一次这个值，然后重启naned或rndc reload重启，从DNS就会自动同步过去1D1H 1W     3H )   
@               IN      NS      ns1.wangshibo.com.
@               IN      NS      ns2.wangshibo.com.
24              IN      PTR     ns1.wangshibo.com.
23              IN      PTR     ns2.wangshibo.com.
@               IN      MX 10   mail.www.wangshibo.com.
4               IN      PTR     mail.www.wangshibo.com.
2               IN      PTR     www.wangshibo.com.
3               IN      PTR     ftp.wangshibo.com.
23             IN      PTR     win7.wangshibo.com.[root@test ~]# /etc/init.d/named restart
Stopping named:                                            [  OK  ]
Starting named:                                            [  OK  ]在客户端测试
[root@test2 ~]# cat /etc/resolv.conf
search wangshibo.com
nameserver 192.168.1.24[root@test2 ~]# dig www.wangshibo.com; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6_9.2 <<>> www.wangshibo.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29152
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2;; QUESTION SECTION:
;www.wangshibo.com.     IN  A;; ANSWER SECTION:
www.wangshibo.com.  86400   IN  A   192.168.1.2;; AUTHORITY SECTION:
wangshibo.com.      86400   IN  NS  ns2.wangshibo.com.
wangshibo.com.      86400   IN  NS  ns1.wangshibo.com.;; ADDITIONAL SECTION:
ns1.wangshibo.com.  86400   IN  A   192.168.1.24
ns2.wangshibo.com.  86400   IN  A   192.168.1.23;; Query time: 1 msec
;; SERVER: 192.168.1.24#53(192.168.1.24)       #注意这行，说明是主DNS从域名服务器解析的
;; WHEN: Wed Jun 21 15:39:09 2017
;; MSG SIZE  rcvd: 1191) DNS从域名服务器配置
从域名服务器的ip为192.168.1.23
服务的安装过程在上面已介绍，此处省略
[root@test33 ~]# cp /etc/named.conf /etc/named.conf.bak
[root@test33 ~]# vim /etc/named.conf
options {listen-on port 53 { any; };listen-on-v6 port 53 { ::1; };directory       "/var/named";dump-file       "/var/named/data/cache_dump.db";statistics-file "/var/named/data/named_stats.txt";memstatistics-file "/var/named/data/named_mem_stats.txt";allow-query     { any; };recursion yes;dnssec-enable yes;dnssec-validation yes;dnssec-lookaside auto;bindkeys-file "/etc/named.iscdlv.key";managed-keys-directory "/var/named/dynamic";
};logging {                          channel default_debug {file "data/named.run";severity dynamic;};
};
zone "." IN {                  type hint;file "named.ca";
};zone "wangshibo.com" IN {type slave;file "wangshibo.com_zone";masters {192.168.1.24;};
};
zone "1.168.192.in-addr.arpa" IN {type slave;file "192.168.1.zone";masters {192.168.1.24;};
};[root@test33 ~]# chmod 770 /var/named/
[root@test33 ~]# ll /var/named/ -d
drwxrwx---. 6 root named 4096 Jun 21 15:44 /var/named/[root@test33 ~]# service named restart
Stopping named:                                            [  OK  ]
Generating /etc/rndc.key:                                  [  OK  ]
Starting named:                                            [  OK  ]客户端测试
[root@test2 ~]# dig @192.168.1.23 www.wangshibo.com; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6_9.2 <<>> @192.168.1.23 www.wangshibo.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12862
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2;; QUESTION SECTION:
;www.wangshibo.com.     IN  A;; ANSWER SECTION:
www.wangshibo.com.  86400   IN  A   192.168.1.2;; AUTHORITY SECTION:
wangshibo.com.      86400   IN  NS  ns2.wangshibo.com.
wangshibo.com.      86400   IN  NS  ns1.wangshibo.com.;; ADDITIONAL SECTION:
ns1.wangshibo.com.  86400   IN  A   192.168.1.24
ns2.wangshibo.com.  86400   IN  A   192.168.1.23;; Query time: 1 msec
;; SERVER: 192.168.1.23#53(192.168.1.23)                 #注意这行，说明是从DNS从域名服务器解析的
;; WHEN: Wed Jun 21 15:53:47 2017
;; MSG SIZE  rcvd: 119最后，在客户机的/etc/resolv.conf文件里添加上面主从DNS地址，就可以正常解析上面在/var/named/192.168.1.zone里设置的域名了
# vim /etc/resolv.conf
nameserver 192.168.1.24
nameserver 192.168.1.23-----------------------------------------注意事项--------------------------------------------
a）如果还是无法解析，请返回主域名服务器的/var/named目录给区域配置文件加上权限(单纯是为了练习的话，可以加到最大权限到777)
b）以上的练习都是在关闭防火墙与seLinux的状态下操作的，如果防火墙开启，可自行去添加规则