實戰(zhàn)案例dns服務與管理

第3章Linux系統(tǒng)與服務構建3.11實戰(zhàn)案例——DNS服務與管

地CetnOS7.2

（兩個節(jié)點 [root@master~]#[root@master~]#mv/etc/yum.repos.d/*[root@master[root@master~]#vi03 [root@master~]#yum [root@master~]#systemctlstop [root@master~]#yuminstallbind-chrootbind-utils- 0303進入bind- [root@masterchroot]#[root@masterchroot]#cp-R/usr/share/doc/bind-9.9.4/sample/var/*03 [root@masterchroot]#[root@masterchroot]#cd od-R777od-R777 03[root@masterchroot]#cp/etc/named.conf將DNS服務named.conf文件[root@masterchroot]#cp/etc/named.conf編輯配置文件IfyouarebuildingIfyouarebuildinganAUTHORITATIVEDNSserver,doNOTenableIfyouarebuildingaRECURSIVE(caching)DNSserver,youneedtoenableIfyourrecursiveDNSserverhasapublicIPaddress,youMUSTenableaccesscontroltolimitqueriestoyourlegitimateusers.Failingtodosowillcauseyourserverto epartoflargescaleDNSamplificationattacks.ImplementingBCP38withinyournetworkwouldgreatlyreducesuchattacksurfacerecursiondnssec-enableyes;/*PathtoISCDLVkey//optionslisten-onport53{any; listen-on-v6port53{::1;}; dump- statistics-file"/var/named/data/named_stats.txt"; {any;};03pid-file"/run/named/named.pid";loggingchanneldefault_debug{severitydynamic;zone "typefile include設置named.conf文件的用戶權限為named，示例代碼如[root@master[root@masternamed]#chownnamed03[root@masternamed]#cp/var/named/named.localhost 拷貝模板文件named.localhost[root@masternamed]#cp/var/named/named.localhost [root@masternamed]#$TTL @IN[root@masternamed]#$TTL @IN .;serial1D;refresh1H;retry1W;expire3H;minimum)IN ns1INA0wwwINA1ftpINAod-R od-R 03[root@masternamed]#date-s設置主機[root@masternamed]#date-s關閉named服務，取消開機啟動，命令如下[root@master[root@masternamed]#systemctlstop設置bind-chroot服務開機啟動，并重啟0303配置主機DNS服務器nameserver[root@masternamed]#vinameserver[root@masternamed]#vi[root@masternamed]#rndcreload[root@masternamed]#rndcreload[root@masternamed]#rndcnotify使用bind基[root@masternamed]#rndcreload[root@masternamed]#rndcreload[root@masternamed]#rndcnotify0303[root@masterchroot]#03[root@masterchroot]#cat//options{listen-onport53{any; listen-on-v6port53{::1; statistics-file"/var/named/data/named_stats.txt"; {any;在Master上操作，修改Masternamed.conf配置文03dnssec-enableyes;/*PathtoISCDLVkeypid-filechanneldefault_debug{severitydynamic;zone" "{typefile notifyalso-notifyinclude03$TTL @IN .1D$TTL @IN .1D;refresh1H;1W;3H;minimumIN ns1INAwwwINAwww2INAftpINA0303在slave上操作，修改slave服務器上的named.conf文件，示例代碼如下[root@slave[root@slavenamed]#vi////ProvidedbyRedHatbindpackagetoconfiguretheISCBINDnamed(8)//serverasacachingonlynameserver(asalocalhostDNSresolveroptions{listen-onport53{any; listen-on-v6port53{::1; 03 {any;/*PathtoISCDLVkey03pid-filepid-filechanneldefault_debug{severitydynamic;zone "typefile masters{;include03設置 權限 的所有者為named用戶，示例代碼如下[root@slave~]#chown-Rnamed:named [root@slave~]#[root@s