[Linux] DNS服务部署(单点&主从)

1、关闭防火墙开启相应的服务

1 2	[root@localhost ~]#setenforce 0 [root@localhost ~]#iptables -F

2、主节点安装dns

1	yum -y install bind bind-chroot bind-utils

3、修改配置文件

3.1、/etc/named.conf—–主配置文件,服务器主要运行参数

修改dns主配置文件：

options {
        listen-on port 53 { 10.0.30.95;127.0.0.1 };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { any; };
        forwarders { 8.8.8.8; };

3.2、/etc/named.rfc1912.zones—–区域文件，主要指定要解析哪个域名

vim /etc/named.rfc1912.zones

// 首先对文件中正向解析的区域进行修改
zone "node" IN {
        type master;
        file "node.conf";
        allow-update { none; };
};
// 设置好域名格式以及相应的数据文件接下来进行反向解析区域的配置
zone  "30.0.10.in -addr.arpa"  IN{
          type master;
          file "node.txt";
          allow-update { none; };
    }

3.3、配置完成之后校验一下文件配置是否正确：

1
2
3

[root@node4 named]# named-checkconf
[root@node4 named]# 
没有任何输出表示 /etc/named.conf没有语法错误

3.4、/var/named/xxx.xx ——-数据文件，用来正向和反向的解析

主文件及区域文件修改完成后接下来进行数据文件的修改,切换到/var/named目录下,对数据文件进行相应的选项配置：

1 2	cd /var/named/ cp named.empty node.conf

首先对其正向解析的数据文件进行配置
vim node.com

$TTL 3H
@	IN SOA gfs.com rname.invalid. (
					0	; serial
					1D	; refresh
					1H	; retry
					1W	; expire
					3H )	; minimum
                NS	dns.gfs.com.
dns.gfs.com	    A 10.0.30.95
node1.gfs.com 1 A 10.0.30.51
	           AAAA	::1

对反向解析的数据文件进行配置，反向解析数据文件里面只有SOA、NS、PTR资源记录，所有A记录都要改为PTR记录，名称为IP地址，IP地址可以写全也可以简写，如果写全则是IP地址反写加上.in-addr.arpa.例如：116.2.16.172.in-addr.arpa. PTR资源记录的值为域名。

1	cp named.empty node.txt

vim node.txt

$TTL 3H
@	IN SOA gfs.com rname.invalid. (
					0	; serial
					1D	; refresh
					1H	; retry
					1W	; expire
					3H )	; minimum
     NS	dns.gfs.com.
95	PTR dns.gfs.com.
51  PTR node1.gfs.com.

3.5、解析文件参数详解

区域解析库文件第一个记录必须是SOA记录，必须有NS记录并且正解区域要有NS记录的A记录，反解则不需要有NS记录对应的A记录。
$TTL表示宏定义，TTL(Time- To-Live)，dns记录在本地DNS服务器上保留的时间
@符号可代表区域文件/etc/named.conf里面定义的区域名称，即："gfs.com."。
2018030422 ;标识序列号，十进制数字，不能超过10位，通常使用日期
2H ;刷新时间，即每隔多久到主服务器检查一次，此处为2小时，实验环境可以设置小一点
4M ;重试时间，应该小于刷新时间，此处为4分钟，实验环境可以设置小一点
1D ;过期时间，此处为1天
2D ;主服务器挂后，从服务器至多工作的时间，此处为2天)
这个文件里所有的域名结尾的点号一定不能省略。
区域解析库文件是放在/var/named目录下，由named进程是以named用户运行，因此区域解析库文件的属组应设置为named。

（1）A记录（Address）正向解析
A记录是将一个主机名（全称域名FQDN）和一个IP地址关联起来。这也是大多数客户端程序默认的查询类型。
（2）PTR记录（Pointer）反向解析
PTR记录将一个IP地址对应到主机名（全称域名FQDN）。这些记录保存在in-addr.arpa域中。
（3）CNAME记录(Canonical Name)别名
别名记录，也称为规范名字(Canonical Name)。这种记录允许您将多个名字映射到同一台计算机。
（4）MX记录（Mail eXchange）
MX记录是邮件交换记录，它指向一个邮件服务器，用于电子邮件系统发邮件时根据 收信人的地址后缀来定位邮件服务器。MX记录也叫做邮件路由记录，用户可以将该域名下的邮件服务器指向到自己的mail server上，然后即可自行操控所有的邮箱设置。
当有多个MX记录（即有多个邮件服务器）时，则需要设置数值来确定其优先级。通过设置优先级数字来指明首选服务器，数字越小表示优先级越高。
（5）NS记录（Name Server）
NS（Name Server）记录是域名服务器记录，也称为授权服务器，用来指定该域名由哪个DNS服务器来进行解析。
将网站的NS记录指向到目标地址，在设置NS记录的同时还需要设置目标网站的指向，否则NS记录将无法正常解析
NS记录优先于A记录。即，如果一个主机地址同时存在NS记录和A记录，则A记录不生效。
（6）AAAA记录 IPV6解析记录
该记录是将域名解析到一个指定的IPV6的IP上。

3.6、相应的数据配置文件完成后对数据文件的属主进行修改

[root@localhost  named]#chown  named  node.*
[root@node4 named]# ll node.*
-rw-r-----. 1 named root 286 Nov 22 16:12 node.conf
-rw-r-----. 1 named root 310 Nov 22 16:12 node.txt

3.7、配置完成后检测解析文件是否正确

[root@node4 named]# named-checkzone “gfs.com” node.conf
zone gfs.com/IN: loaded serial 0
OK

3.8、检测反向解析库配置有没有错误

1
2
3

[root@node4 named]# named-checkzone "30.0.10.in-addr.arpa" node.txt
zone 30.0.10.in-addr.arpa/IN: loaded serial 0
OK

4、修改完成后启动dns服务

1	systemctl start named.service

5、在客户端配置dns信息

5.1、修改 /etc/NetworkManager/NetworkManager.conf 文件，防止重启网卡后dns被重置，在main部分添加 “dns=none” 选项

1
2
3

[main]
plugins=ifcfg-rh
dns=none

5.2、NetworkManager重新装载上面修改的配置

1	# systemctl restart NetworkManager.service

5.3、之后修改/etc/resolv.conf配置文件：

[root@node2 ~]# more /etc/resolv.conf
# Generated by NetworkManager
nameserver 10.0.30.95
[root@node2 ~]# /etc/init.d/network restart
Restarting network (via systemctl):                        [  OK  ]
[root@node2 ~]# more /etc/resolv.conf
# Generated by NetworkManager
nameserver 202.106.0.20
nameserver 8.8.8.8
[root@node2 ~]# 
[root@node2 ~]# ls
anaconda-ks.cfg  Desktop  Documents  Downloads  initial-setup-ks.cfg  Music  Pictures  Public  Templates  Videos
[root@node2 ~]# vim /etc/NetworkManager/NetworkManager.conf 
[root@node2 ~]# 
[root@node2 ~]# systemctl restart NetworkManager.service
[root@node2 ~]# vim /etc/resolv.conf
[root@node2 ~]# 
[root@node2 ~]# more /etc/resolv.conf
# Generated by NetworkManager
nameserver 10.0.30.95
[root@node2 ~]# /etc/init.d/network restart
Restarting network (via systemctl):                        [  OK  ]
[root@node2 ~]# more /etc/resolv.conf
# Generated by NetworkManager
nameserver 10.0.30.95

5.4、测试dns是否能正常解析：

正向解析：

[root@node2 ~]# dig -t A node1.gfs.com

; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> -t A node1.gfs.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30794
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;node1.gfs.com.			IN	A

;; ANSWER SECTION:
node1.gfs.com.		10800	IN	A	10.0.30.51

;; AUTHORITY SECTION:
gfs.com.		10800	IN	NS	dns1.gfs.com.
gfs.com.		10800	IN	NS	dns2.gfs.com.

;; ADDITIONAL SECTION:
dns1.gfs.com.		10800	IN	A	10.0.30.95
dns2.gfs.com.		10800	IN	A	10.0.30.117

;; Query time: 2 msec
;; SERVER: 10.0.30.95#53(10.0.30.95)
;; WHEN: Thu Nov 22 17:44:35 CST 2018
;; MSG SIZE  rcvd: 128

反向解析：

[root@node2 ~]# dig -x 10.0.30.51 

; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> -x 10.0.30.51
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50154
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;51.30.0.10.in-addr.arpa.	IN	PTR

;; ANSWER SECTION:
51.30.0.10.in-addr.arpa. 10800	IN	PTR	node1.gfs.com.

;; AUTHORITY SECTION:
30.0.10.in-addr.arpa.	10800	IN	NS	dns2.gfs.com.
30.0.10.in-addr.arpa.	10800	IN	NS	dns1.gfs.com.

;; ADDITIONAL SECTION:
dns1.gfs.com.		10800	IN	A	10.0.30.95
dns2.gfs.com.		10800	IN	A	10.0.30.117

;; Query time: 2 msec
;; SERVER: 10.0.30.95#53(10.0.30.95)
;; WHEN: Thu Nov 22 17:44:47 CST 2018
;; MSG SIZE  rcvd: 149

上面单节点的dns配置完成，下面配置dns主从，从节点实时同步主节点更新的数据。

6、主节点修改/etc/named.rfc1912.zones

allow-transfer { 10.0.30.117; }; #指定允许转发的目标主机，即从服务器
also-notify:主动通知从域名服务器进行更新，在主域名服务器进行更新后，而不需要在等规定的时间后才通知从域名服务器进行更新

zone "gfs.com" IN {
        type master;
        file "node.conf";
        allow-transfer { 10.0.30.117; };
        also-notify { 10.0.30.117; };
};

zone  "30.0.10.in-addr.arpa"  IN{
          type master;
          file "node.txt";
          also-notify { 10.0.30.117; };
          allow-transfer { 10.0.30.117; };
};

7、修改主节点正向解析文件

[root@node4 named]# more node.conf

$TTL 3H
@	IN SOA	gfs.com. rname.invalid. (
					2	; serial
					1D	; refresh
					1H	; retry
					1W	; expire
					3H )	; minimum
	NS	dns1.gfs.com.
    NS  dns2.gfs.com.
dns1 A 10.0.30.95
dns2 A 10.0.30.117
node1  A 10.0.30.51
node2  A 10.0.30.35
node3  A 10.0.30.117
	AAAA	::1

8、修改主节点反向解析文件

[root@node4 named]# more node.txt

$TTL 3H
@	IN SOA gfs.com. rname.invalid. (
					2	; serial
					1D	; refresh
					1H	; retry
					1W	; expire
					3H )	; minimum
      NS  dns1.gfs.com.
      NS  dns2.gfs.com.
95   PTR dns1.gfs.com.
117  PTR dns2.gfs.com.
51   PTR node1.gfs.com.
35   PTR node2.gfs.com.
117  PTR node3.gfs.com.

9、重新启动dns服务器

1	systemctl restart named.service

10、在从服务器上安装dns服务

1	yum -y install bind bind-chroot bind-utils

11、修改从节点/etc/named.conf配置文件

options {
	listen-on port 53 { 10.0.30.117;127.0.0.1; };
	listen-on-v6 port 53 { ::1; };
	directory 	"/var/named";
	dump-file 	"/var/named/data/cache_dump.db";
	statistics-file "/var/named/data/named_stats.txt";
	memstatistics-file "/var/named/data/named_mem_stats.txt";
	allow-query     { any; };
	forwarders { 8.8.8.8; };

12、修改/etc/named.rfc1912.zones

allow-notify 接受这个网段内的主机发送来的通知

zone "gfs.com" IN {
        type slave;
        masters { 10.0.30.95; };
        allow-notify { 10.0.30.95; };
        file "slaves/node.conf";
};

zone  "30.0.10.in-addr.arpa"  IN{
          type slave;
          masters { 10.0.30.95; };
          allow-notify { 10.0.30.95; };
          file "slaves/node.txt";
};

13、从服务器启动dns服务

1	systemctl start named.service

14、查看/var/named/slaves目录下已经多出了node.*的两个文件

[root@node3 slaves]# pwd
/var/named/slaves
[root@node3 slaves]# ll
total 8
-rw-r--r--. 1 named named 416 Nov 22 16:12 node.conf
-rw-r--r--. 1 named named 514 Nov 22 16:12 node.txt

15、测试主从文件能否正常同步，修改主节点node.*配置文件

[root@node4 named]# vim node.conf 
[root@node4 named]# vim node.txt 
[root@node4 named]# 
[root@node4 named]# ll node.*
-rw-r-----. 1 named root 265 Nov 22 18:48 node.conf
-rw-r-----. 1 named root 272 Nov 22 18:48 node.txt

***注意修改配置文件的时候一定要修改配置文件中serial那一行，只有该行的数值大于前一个值，才会同步到从节点。

16、主节点重新加载dns

1	systemctl reload named.service

17、查看从节点日志信息

Nov 22 18:48:55 node3 named[98442]: client 10.0.30.95#52505: received notify for zone 'gfs.com'
Nov 22 18:48:55 node3 named[98442]: zone gfs.com/IN: Transfer started.
Nov 22 18:48:55 node3 named[98442]: transfer of 'gfs.com/IN' from 10.0.30.95#53: connected using 10.0.30.117#58148
Nov 22 18:48:55 node3 named[98442]: zone gfs.com/IN: transferred serial 3
Nov 22 18:48:55 node3 named[98442]: transfer of 'gfs.com/IN' from 10.0.30.95#53: Transfer completed: 1 messages, 9 records, 252 bytes, 0.008 secs (31500 bytes/sec)
Nov 22 18:48:55 node3 named[98442]: zone gfs.com/IN: sending notifies (serial 3)
Nov 22 18:48:55 node3 named[98442]: client 10.0.30.95#54023: received notify for zone '30.0.10.in-addr.arpa'
Nov 22 18:48:55 node3 named[98442]: zone 30.0.10.in-addr.arpa/IN: Transfer started.
Nov 22 18:48:55 node3 named[98442]: transfer of '30.0.10.in-addr.arpa/IN' from 10.0.30.95#53: connected using 10.0.30.117#51530
Nov 22 18:48:55 node3 named[98442]: zone 30.0.10.in-addr.arpa/IN: transferred serial 3
Nov 22 18:48:55 node3 named[98442]: transfer of '30.0.10.in-addr.arpa/IN' from 10.0.30.95#53: Transfer completed: 1 messages, 8 records, 249 bytes, 0.002 secs (124500 bytes/sec)
Nov 22 18:48:55 node3 named[98442]: zone 30.0.10.in-addr.arpa/IN: sending notifies (serial 3)

18、查看从节点配置文件信息

[root@node3 slaves]# ll
total 8
-rw-r--r--. 1 named named 375 Nov 22 18:48 node.conf
-rw-r--r--. 1 named named 433 Nov 22 18:48 node.txt

从节点文件已和主节点正常同步

19、客户端测试主节点dns服务器挂掉从节点能否正常使用

[root@node2 ~]# more /etc/resolv.conf
# Generated by NetworkManager
nameserver 10.0.30.95
nameserver 10.0.30.117

20、测试正向解析是否正常

[root@node2 ~]# dig -t A node1.gfs.com

; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> -t A node1.gfs.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55761
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;node1.gfs.com.			IN	A

;; ANSWER SECTION:
node1.gfs.com.		10800	IN	A	10.0.30.51

;; AUTHORITY SECTION:
gfs.com.		10800	IN	NS	dns1.gfs.com.
gfs.com.		10800	IN	NS	dns2.gfs.com.

;; ADDITIONAL SECTION:
dns1.gfs.com.		10800	IN	A	10.0.30.95
dns2.gfs.com.		10800	IN	A	10.0.30.117

;; Query time: 0 msec
;; SERVER: 10.0.30.95#53(10.0.30.95)
;; WHEN: Thu Nov 22 18:54:03 CST 2018
;; MSG SIZE  rcvd: 128

21、主节点停掉dns服务：

[root@node4 named]# systemctl stop named.service
[root@node4 named]# systemctl status named.service
● named.service - Berkeley Internet Name Domain (DNS)
   Loaded: loaded (/usr/lib/systemd/system/named.service; disabled; vendor preset: disabled)
   Active: inactive (dead)

Nov 22 18:48:55 node4 named[10366]: zone 30.0.10.in-addr.arpa/IN: sending notifies (serial 3)
Nov 22 18:48:55 node4 named[10366]: client 10.0.30.117#58148 (gfs.com): transfer of 'gfs.com/IN': AXFR-style IXFR started
Nov 22 18:48:55 node4 named[10366]: client 10.0.30.117#58148 (gfs.com): transfer of 'gfs.com/IN': AXFR-style IXFR ended
Nov 22 18:48:55 node4 named[10366]: client 10.0.30.117#28664: received notify for zone 'gfs.com'
Nov 22 18:48:55 node4 named[10366]: client 10.0.30.117#51530 (30.0.10.in-addr.arpa): transfer of '30.0.10.in-addr.arpa/IN': AXFR-style IXFR started
Nov 22 18:48:55 node4 named[10366]: client 10.0.30.117#51530 (30.0.10.in-addr.arpa): transfer of '30.0.10.in-addr.arpa/IN': AXFR-style IXFR ended
Nov 22 18:48:56 node4 named[10366]: client 10.0.30.117#41288: received notify for zone '30.0.10.in-addr.arpa'
Nov 22 18:59:26 node4 systemd[1]: Stopping Berkeley Internet Name Domain (DNS)...
Nov 22 18:59:26 node4 named[10366]: received control channel command 'stop'
Nov 22 18:59:26 node4 systemd[1]: Stopped Berkeley Internet Name Domain (DNS).

22、客户端解析仍然正常

[root@node2 ~]# dig -t A node1.gfs.com

; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> -t A node1.gfs.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39672
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;node1.gfs.com.			IN	A

;; ANSWER SECTION:
node1.gfs.com.		10800	IN	A	10.0.30.51

;; AUTHORITY SECTION:
gfs.com.		10800	IN	NS	dns2.gfs.com.
gfs.com.		10800	IN	NS	dns1.gfs.com.

;; ADDITIONAL SECTION:
dns1.gfs.com.		10800	IN	A	10.0.30.95
dns2.gfs.com.		10800	IN	A	10.0.30.117

;; Query time: 2 msec
;; SERVER: 10.0.30.117#53(10.0.30.117)
;; WHEN: Thu Nov 22 18:59:48 CST 2018
;; MSG SIZE  rcvd: 128

23、指定dns为主节点，解析失败

[root@node2 ~]# dig -t A node1.gfs.com @10.0.30.95

; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> -t A node1.gfs.com @10.0.30.95
;; global options: +cmd
;; connection timed out; no servers could be reached

24、指定为从节点，解析正常

[root@node2 ~]# dig -t A node1.gfs.com @10.0.30.117

; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> -t A node1.gfs.com @10.0.30.117
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53270
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;node1.gfs.com.			IN	A

;; ANSWER SECTION:
node1.gfs.com.		10800	IN	A	10.0.30.51

;; AUTHORITY SECTION:
gfs.com.		10800	IN	NS	dns1.gfs.com.
gfs.com.		10800	IN	NS	dns2.gfs.com.

;; ADDITIONAL SECTION:
dns1.gfs.com.		10800	IN	A	10.0.30.95
dns2.gfs.com.		10800	IN	A	10.0.30.117

;; Query time: 2 msec
;; SERVER: 10.0.30.117#53(10.0.30.117)
;; WHEN: Thu Nov 22 19:01:30 CST 2018
;; MSG SIZE  rcvd: 128

25、把从节点dns服务也关掉

1	[root@node3 slaves]# systemctl stop named.service

26、解析域名报错

[root@node2 ~]# dig -t A node1.gfs.com

; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> -t A node1.gfs.com
;; global options: +cmd
;; connection timed out; no servers could be reached

27、额外参考信息

1
2
3

DNS服务器监听端口:
PORT: udp/tcp  53   ---> 服务端口
PORT: udp/tcp 953  ---> 主从连接端口

1	dns各参数详解，点击[此处](https://blog.csdn.net/bpingchang/article/details/38427113)跳转