实战案例dns服务与管理

第3章Linux系统与服务构建3.11实战案例——DNS服务与管

地CetnOS7.2

（两个节点 [root@master~]#[root@master~]#mv/etc/yum.repos.d/*[root@master[root@master~]#vi03 [root@master~]#yum [root@master~]#systemctlstop [root@master~]#yuminstallbind-chrootbind-utils- 0303进入bind- [root@masterchroot]#[root@masterchroot]#cp-R/usr/share/doc/bind-9.9.4/sample/var/*03 [root@masterchroot]#[root@masterchroot]#cd od-R777od-R777 03[root@masterchroot]#cp/etc/named.conf将DNS服务named.conf文件[root@masterchroot]#cp/etc/named.conf编辑配置文件IfyouarebuildingIfyouarebuildinganAUTHORITATIVEDNSserver,doNOTenableIfyouarebuildingaRECURSIVE(caching)DNSserver,youneedtoenableIfyourrecursiveDNSserverhasapublicIPaddress,youMUSTenableaccesscontroltolimitqueriestoyourlegitimateusers.Failingtodosowillcauseyourserverto epartoflargescaleDNSamplificationattacks.ImplementingBCP38withinyournetworkwouldgreatlyreducesuchattacksurfacerecursiondnssec-enableyes;/*PathtoISCDLVkey//optionslisten-onport53{any; listen-on-v6port53{::1;}; dump- statistics-file"/var/named/data/named_stats.txt"; {any;};03pid-file"/run/named/named.pid";loggingchanneldefault_debug{severitydynamic;zone "typefile include设置named.conf文件的用户权限为named，示例代码如[root@master[root@masternamed]#chownnamed03[root@masternamed]#cp/var/named/named.localhost 拷贝模板文件named.localhost[root@masternamed]#cp/var/named/named.localhost [root@masternamed]#$TTL @IN[root@masternamed]#$TTL @IN .;serial1D;refresh1H;retry1W;expire3H;minimum)IN ns1INA0wwwINA1ftpINAod-R od-R 03[root@masternamed]#date-s设置主机[root@masternamed]#date-s关闭named服务，取消开机启动，命令如下[root@master[root@masternamed]#systemctlstop设置bind-chroot服务开机启动，并重启0303配置主机DNS服务器nameserver[root@masternamed]#vinameserver[root@masternamed]#vi[root@masternamed]#rndcreload[root@masternamed]#rndcreload[root@masternamed]#rndcnotify使用bind基[root@masternamed]#rndcreload[root@masternamed]#rndcreload[root@masternamed]#rndcnotify0303[root@masterchroot]#03[root@masterchroot]#cat//options{listen-onport53{any; listen-on-v6port53{::1; statistics-file"/var/named/data/named_stats.txt"; {any;在Master上操作，修改Masternamed.conf配置文03dnssec-enableyes;/*PathtoISCDLVkeypid-filechanneldefault_debug{severitydynamic;zone" "{typefile notifyalso-notifyinclude03$TTL @IN .1D$TTL @IN .1D;refresh1H;1W;3H;minimumIN ns1INAwwwINAwww2INAftpINA0303在slave上操作，修改slave服务器上的named.conf文件，示例代码如下[root@slave[root@slavenamed]#vi////ProvidedbyRedHatbindpackagetoconfiguretheISCBINDnamed(8)//serverasacachingonlynameserver(asalocalhostDNSresolveroptions{listen-onport53{any; listen-on-v6port53{::1; 03 {any;/*PathtoISCDLVkey03pid-filepid-filechanneldefault_debug{severitydynamic;zone "typefile masters{;include03设置 权限 的所有者为named用户，示例代码如下[root@slave~]#chown-Rnamed:named [root@slave~]#[root@s