网络系统管理Linux环境——3.ISPSRV之DNS

root@Ispsrv:~# apt -y install bind9 dnsutils

root@Ispsrv:~# cd /etc/bind/

db.127                 #反向区域数据库，用于将ip解析为对应的域名
db.local             #正向区域数据库，用于将域名解析为对应的IP地址
named.conf.default-zones     #默认区域
named.conf.local          #用于定义解析域，也可以直接在named.conf中直接划定解析域
named.conf.options        #配置文件，全局选项配置
named.conf           #Bind的主配置文件,不包含DNS数据

#先去named.conf.default-zones 文件内复制最后一个zone然后粘贴到named.conf.local

root@Ispsrv:~# cd /etc/bind/
root@Ispsrv:/etc/bind# vim named.conf.default-zones  进入复制
#保存退出然后进入
root@Ispsrv:/etc/bind# vim named.conf.local
#原内容
-----------------------------------------------------------------------------
root@Ispsrv:/etc/bind# cat named.conf.local 
//
// Do any local configuration here
//

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";
-----------------------------------------------------------------------------
#添加后内容为：
-----------------------------------------------------------------------------
root@Ispsrv:/etc/bind# cat named.conf.local 
//
// Do any local configuration here
//

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";

zone "." {
type master;
file "/etc/bind/root.zone";
};
zone "chinaskills.cn" {
type slave;
file "/etc/bind/chinaskills.cn.zone";
masters { 81.6.63.254;};
};
-----------------------------------------------------------------------------

root@Ispsrv:/etc/bind# cp -a db.local root.zone
root@Ispsrv:/etc/bind# vim root.zone 
#原内容
-----------------------------------------------------------------------------
root@Ispsrv:/etc/bind# cat root.zone 
;
; BIND data file for local loopback interface
;
$TTL    604800
@       IN      SOA     localhost. root.localhost. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      localhost.
@       IN      A       127.0.0.1
@       IN      AAAA    ::1
-----------------------------------------------------------------------------
#修改后内容为
-----------------------------------------------------------------------------
root@Ispsrv:/etc/bind# cat root.zone 
$TTL    604800
@       IN      SOA     localhost. root.localhost. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      localhost.
*       IN      A       81.6.63.100
-----------------------------------------------------------------------------

root@Ispsrv:/etc/bind# vim named.conf.options 
#原文件内容
-----------------------------------------------------------------------------
root@Ispsrv:/etc/bind# cat named.conf.options 
options {
        directory "/var/cache/bind";

        // If there is a firewall between you and nameservers you want
        // to talk to, you may need to fix the firewall to allow multiple
        // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

        // If your ISP provided one or more IP addresses for stable 
        // nameservers, you probably want to use them as forwarders.  
        // Uncomment the following block, and insert the addresses replacing 
        // the all-0's placeholder.

        // forwarders {
        //      0.0.0.0;
        // };

        //========================================================================
        // If BIND logs error messages about the root key being expired,
        // you will need to update your keys.  See https://www.isc.org/bind-keys
        //========================================================================
        dnssec-validation auto;

        listen-on-v6 { any; };
};
-----------------------------------------------------------------------------
#修改后内容
-----------------------------------------------------------------------------
root@Ispsrv:/etc/bind# cat named.conf.options 
options {
        directory "/var/cache/bind";
        version "[unknow]";
        // If there is a firewall between you and nameservers you want
        // to talk to, you may need to fix the firewall to allow multiple
        // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

        // If your ISP provided one or more IP addresses for stable 
        // nameservers, you probably want to use them as forwarders.  
        // Uncomment the following block, and insert the addresses replacing 
        // the all-0's placeholder.

        // forwarders {
        //      0.0.0.0;
        // };

        //========================================================================
        // If BIND logs error messages about the root key being expired,
        // you will need to update your keys.  See https://www.isc.org/bind-keys
        //========================================================================
        dnssec-validation auto;

        listen-on-v6 { any; };
};
-----------------------------------------------------------------------------

#修改在/var/named下运行
root@Ispsrv:~# vim /etc/default/bind9 
#原文件内容
-----------------------------------------------------------------------------
root@Ispsrv:~# cat /etc/default/bind9 
#
# run resolvconf?
RESOLVCONF=no

# startup options for the server
OPTIONS="-u bind"
-----------------------------------------------------------------------------
#修改后文件
-----------------------------------------------------------------------------
root@Ispsrv:~# cat /etc/default/bind9 
#
# run resolvconf?
RESOLVCONF=no

# startup options for the server
OPTIONS="-u bind -t /var/named/chroot"
-----------------------------------------------------------------------------

root@Ispsrv:~# cd /
root@Ispsrv:~# mkdir -p /var/named/chroot/{etc,dev,run/named,/var/cache/bind}  #创建运行目录
root@Ispsrv:~# mknod /var/named/chroot/dev/null c 1 3 
root@Ispsrv:~# mknod /var/named/chroot/dev/random c 1 8
root@Ispsrv:~# mknod /var/named/chroot/dev/urandom c 1 9 
root@Ispsrv:~# chmod 660 /var/named/chroot/dev/{null,random,urandom} #修改权限
root@Ispsrv:~# cp /etc/bind /var/named/chroot/etc -r #将bind移动到chroot目录中
root@Ispsrv:~# ln -s /var/named/chroot/etc/bind /etc/bind   #创建软连接
root@Ispsrv:~# chown bind:bind /var/named/chroot/etc/bind/rndc.key
root@Ispsrv:~# chown bind:bind /var/named/chroot/run/named
root@Ispsrv:~# chmod 775 /var/named/chroot/{var/cache/bind,/run/named}
root@Ispsrv:~# chgrp bind /var/named/chroot/{var/cache/bind,/run/named} #更改所有权

root@Ispsrv:~# mkdir -p /var/named/chroot/usr/share/dns      #创建目录
root@Ispsrv:~# cp /usr/share/dns/* /var/named/chroot/usr/share/dns/  #复制文件

root@Ispsrv:~# echo "\$AddUnixListenSocket /var/named/chroot/dev/log" > /etc/rsyslog.d/bind-chroot.conf

root@Ispsrv:/# systemctl restart rsyslog
root@Ispsrv:/# systemctl restart bind9

root@Ispsrv:/# rm /etc/bind -rf
root@Ispsrv:/# vim /var/named/chroot/etc/bind/named.conf.local
root@Ispsrv:/# ln -s /var/named/chroot/etc/bind /etc/bind
root@Ispsrv:/# systemctl restart bind9

root@Ispsrv:/# vim /etc/resolv.conf  
#添加如下内容即可
nameserver 81.6.63.100

root@skills-PC:~# nslookup www.chinaskills.cn    
Server:         81.6.63.100
Address:        81.6.63.100#53

Name:   www.chinaskills.cn
Address: 192.168.100.100

root@skills-PC:/etc/bind# nslookup any.any.any   
Server:         81.6.63.100
Address:        81.6.63.100#53

Name:   any.any.any
Address: 81.6.63.100

root@skills-PC:/var/named/chroot/etc/bind# nslookup -q=txt -class=CHAOS version.bind. localhost
Server:         localhost
Address:        127.0.0.1#53

version.bind    text = "[unknow]"

root@skills-PC:/var/named/chroot/etc/bind#