四、bind（named）配置文件

Description : BIND (Berkeley Internet Name Domain) is an implementation of the DNS
            : (Domain Name System) protocols. BIND includes a DNS server (named),
            : which resolves host names to IP addresses; a resolver library
            : (routines for applications to use when interfacing with DNS); and
            : tools for verifying that the DNS server is operating properly.

bind：包里主要包含：
    named DNS服务
    named-chkconfig（named.conf文件检查工具）
    named-checkzone(zone文件检车工具）
    rndc（本地和远程dns控制工具）
bind-libs：named DNS服务的库
bind-utils：包含一系列辅助工具来测试
    host
    dig
    nslookup
    nsupdate
bind-chroot：切根程序，用来切换默认目录到另外一个深层的安全的目录/var/named/chroot，类似于前面光盘进入救援模式的那种情况。

/etc/named.conf              # bind主配置文件
/etc/named.rfc1912.zones     # 定义zone的文件
/etc/rc.d/init.d/named       # bind脚本文件
/etc/rndc.conf               # rndc配置文件
/usr/sbin/named-checkconf    # 检测/etc/named.conf文件语法
/usr/sbin/named-checkzone    # 检测zone和对应zone文件的语法
/usr/sbin/rndc               # 远程dns管理工具
/usr/sbin/rndc-confgen       # 生成rndc密钥
/var/named/named.ca          # 根解析库
/var/named/named.localhost   # 本地主机解析库
/var/named/slaves            # 从ns服务器文件夹

[root@centos7 sample]#tree
.
├── etc
│   ├── named.conf
│   └── named.rfc1912.zones
└── var
    └── named
        ├── data
        ├── my.external.zone.db
        ├── my.internal.zone.db
        ├── named.ca
        ├── named.empty
        ├── named.localhost
        ├── named.loopback
        └── slaves
            ├── my.ddns.internal.zone.db
            └── my.slave.internal.zone.db

[root@centos7 named]#cat /etc/named.conf 
options {
   listen-on port 53 { 127.0.0.1; };// ipv4监听端口和ip地址，默认只有本地的
   listen-on-v6 port 53 { ::1; }; // ipv6的监听端口和ip地址
   directory    "/var/named";
   dump-file    "/var/named/data/cache_dump.db";
   statistics-file "/var/named/data/named_stats.txt";
   memstatistics-file "/var/named/data/named_mem_stats.txt";
   allow-query     { localhost; };

   /* 
    - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
    - If you are building a RECURSIVE (caching) DNS server, you need to enable 
      recursion. 
    - If your recursive DNS server has a public IP address, you MUST enable access 
      control to limit queries to your legitimate users. Failing to do so will
      cause your server to become part of large scale DNS amplification 
      attacks. Implementing BCP38 within your network would greatly
      reduce such attack surface 
   */
   recursion yes; // 递归还是迭代查询

   dnssec-enable yes; // dns安全扩展,可以改为no关闭
   dnssec-validation yes; //可以改为no关闭

   /* Path to ISC DLV key */
   bindkeys-file "/etc/named.iscdlv.key";

   managed-keys-directory "/var/named/dynamic";

   pid-file "/run/named/named.pid";
   session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN { // 定义zone文件，这里是定义的根域的文件位置
   type hint;
   file "named.ca";
};

include "/etc/named.rfc1912.zones"; // 把named.rfc1912.zones文件包含进来
include "/etc/named.root.key"; // 把/etc/named.root.key文件包含进来

options {
    listen-on port 53 { 192.168.111.254; 127.0.0.1; };  //监听端口修改为某一网卡地址，和回环地址。
    listen-on-v6 port 53 { ::1; };
    directory   "/var/named";
    dump-file   "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    allow-query     { 192.168.111.0/24; }; //查询范围只允许192.168.111.0网段查询。
    recursion yes;
    dnssec-enable no;  //关闭dnssec
    dnssec-validation no;  //关闭dnssec
    bindkeys-file "/etc/named.iscdlv.key";
    managed-keys-directory "/var/named/dynamic";
    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";
};
logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};
zone "." IN {
    type hint;
    file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

zone "ZONE_NAME" IN {
    type {master|slave|hint|forward};
    file "ZONE_NAME.zone";
};
zone "ZONE_NAME“：定义解析库名字，通常和解析库文件前缀对应起来。
type：
    master指的是主dns解析
    slave指的是从dns解析
    hint指的是根域名解析（根提示域）
    forward指的是转发，转发不使用file
file ：定义区域解析库文件名字（位置默认在/var/named下面）,file的前缀通常和zone的名字通常对应起来，然后加一个.zone的后缀。

zone "zhangqifei.top" IN {
    type master;
    file "zhangqifei.top.zone";
};

$TTL 1D
@    IN  SOA  ns1.zhangqifei.top. me.zhangqifei.top ( 0 1H 10M 1D 3H)
     IN  NS   ns1.zhangqifei.top
     IN  NS   ns2
         MX 10 mail1
         MX 20 mail2
ns1.zhangqifei.top  IN  A  192.168.111.254
ns2  IN  A  192.168.111.253  
db1   A    192.168.111.100
db2   A    192.168.111.111
web1  A    192.168.111.200
web2  A    192.168.111.222
mail1 A    192.168.111.10
mail2 A    192.168.111.20
www   CNAME   web1

@指的就是本域 zhangqifei.top
IN ns2.zhangqifei.top可以省略写成IN ns2
IN都可以省略不写,比如直接写MX mail
设置.zone文件权限（参照/var/named/name.xxxx的权限来设置，这里xxx为任意字符）

chmod 640 zhangqifei.top.zone
chown :named zhangqifei.top.zone

配置完毕后，启动或重启(已启动的话）服务。

service named start|restart

区域名称：是网络地址的犯些.in-addr.arpa.

192.168.111. –> 111.168.192.in-addr.arpa.

配置方法：

先在/etc/named.rfc1512.zones文件下插入下面内容：
zone "Reverse_Net_Addr.in-addr.arpa" IN {
    type {master|slave|forward};
    file "Net_Addr.zone"
}

例子：
zone "111.168.192.in-addr.arpa" IN {
    type master;
    file "192.168.111.zone";
};
配置/var/named/ZONE_NAME.zone
不需要MX、A、AAAA，要有NS记录，以PTR记录为主。

$TTL 1D
@   IN  SOA ns1.magedu.com. me.zhangqifei.top (
                    20170001
                    1H
                    5M
                    7D
                    1D)
    IN NS ns1.zhangqifei.top.
    IN NS ns2.zhangqifei.top.
254 IN PTR ns1.zhangqifei.top.
253 IN PTR ns2.zhangqifei.top.
100 IN PTR db1.magedu.com.
111 IN PTR db2.magedu.com.
200 IN PTR web1.magedu.com.
222 IN PTR web2.magedu.com.
10  IN PTR mail1.magedu.com.
20  IN PTR mail2.magedu.com.