DNS學(xué)習(xí)筆記
1.DNS概述
- DNS（Domain Name System）
- 分布式數(shù)據(jù)庫(kù)，域名空間
- DNS服務(wù)運(yùn)行在UDP協(xié)議之上忽冻，使用端口號(hào)53惦银。
2.DNS解析過(guò)程
- 本地緩存
- DNS服務(wù)器緩存
- DNS服務(wù)器數(shù)據(jù)庫(kù)
- 根域DNS服務(wù)器望蜡，頂級(jí)-》二級(jí)域 -》三級(jí)域
- 解析結(jié)果返回或返回錯(cuò)誤信息
3.DNS的分類(lèi)
- 主DNS服務(wù)器
- 從DNS服務(wù)器
- 緩存服務(wù)器
- 轉(zhuǎn)發(fā)器
4.DNS的記錄類(lèi)型
- SOA - 自己dns說(shuō)明文本
- NS - 域的授權(quán)名稱(chēng)服務(wù)器
- MX - 域的郵件交換器绒窑，優(yōu)先級(jí)值棕孙，越小越高
- A - IPV4主機(jī)地址
- AAAA - IPV6主機(jī)地址
- PTR - 解析IP的指針，反向記錄
- CNAME - 權(quán)威名稱(chēng)些膨，定義別名記錄
5.DNS命名規(guī)范
- 字母蟀俊、數(shù)字、下劃線(xiàn)订雾、最多63字節(jié)長(zhǎng)度
- 如果命名不規(guī)范肢预，在master-view文件上配置check-names ignore
6.DIG，NSLOOKUP洼哎，HOST
[root@linux-node1 ~]# host www.baidu.com
www.baidu.com is an alias for www.a.shifen.com.
www.a.shifen.com has address 14.215.177.38
www.a.shifen.com has address 14.215.177.37
[root@linux-node1 ~]# nslookup www.baidu.com
Server: 192.168.88.2
Address: 192.168.88.2#53
Non-authoritative answer:
www.baidu.com canonical name = www.a.shifen.com.
Name: www.a.shifen.com
Address: 14.215.177.38
Name: www.a.shifen.com
Address: 14.215.177.37
[root@linux-node1 ~]# dig www.baidu.com
; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.3 <<>> www.baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50183
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; MBZ: 0005 , udp: 4096
;; QUESTION SECTION:
;www.baidu.com. IN A
;; ANSWER SECTION:
www.baidu.com. 5 IN CNAME www.a.shifen.com.
www.a.shifen.com. 5 IN A 14.215.177.38
www.a.shifen.com. 5 IN A 14.215.177.37
;; Query time: 2481 msec
;; SERVER: 192.168.88.2#53(192.168.88.2)
;; WHEN: Thu Aug 17 11:42:28 CST 2017
;; MSG SIZE rcvd: 101
7. 部署B(yǎng)IND9
Bind是一款開(kāi)源DNS服務(wù)器軟件烫映，Berkeley Internet Name Domain
- 安裝軟件
yum install -y bind-utils bind bind-devel bind-chroot
- vim /etc/named.conf
options {
listen-on port 53 { any; };
directory "/var/named/chroot/etc/";
allow-query { any; };
dump-file "/var/named/chroot/var/log/binddump.db";
Statistics-file "/var/named/chroot/var/log/named_stats";
zone-statistics yes;
memstatistics-file "log/mem_stats";
empty-zones-enable no;
forwarders {202.106.196.115;8.8.8.8; };
};
key "rndc-key" {
algorithm hmac-md5;
secret "Eqw4hClGExUWeDkKBX/pBg==";
};
controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys {"rndc-key";};
};
logging {
channel warning {
file "/var/named/chroot/var/log/dns_warning" versions 10 size 10m;
severity warning;
print-category yes;
print-severity yes;
print-time yes;
};
channel general_dns {
file "/var/named/chroot/var/log/dns_log";
severity info;
print-category yes;
print-severity yes;
print-time yes;
};
category default {
warning;
};
category queries {
general_dns;
};
};
include "/var/named/chroot/etc/view.conf";
- vim /etc/rndc.key
key "rndc-key" {
algorithm hmac-md5;
secret "Eqw4hClGExUWeDkKBX/pBg==";
};
- vim /etc/rndc.conf
key "rndc-key" {
algorithm hmac-md5;
secret "Eqw4hClGExUWeDkKBX/pBg==";
};
options {
default-key "rndc-key";
default-server 127.0.0.1;
default-port 953;
};
- vim /var/named/chroot/etc/view.conf
view "View" {
zone "fbo.com" {
type master;
file "fbo.com.zone";
allow-transfer {
192.168.57.200;
};
notify yes;
also-notify {
192.168.57.200;
};
};
};
- vim /var/named/chroot/etc/fbo.com.zone
$ORIGIN .
$TTL 3600 ; 1 hour
fbo.com IN SOA op.fbo.com. dns.fbo.com. (
2000 ; serial
900 ; refresh (15 minutes)
600 ; retry (10 minutes)
86400 ; expire (1 day)
3600 ; minimum (1 hour)
)
NS op.fbo.com.
$ORIGIN fbo.com.
shanks A 1.2.3.4
op A 1.2.3.4
- 啟動(dòng)服務(wù)
systemctl enable named
systemctl start named
- 檢查結(jié)果
[root@linux-node1 var]# dig @127.0.0.1 shanks.fbo.com
; <<>> DiG 9.9.4-RedHat-9.9.4-50.el7_3.1 <<>> @127.0.0.1 shanks.fbo.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23459
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;shanks.fbo.com. IN A
;; ANSWER SECTION:
shanks.fbo.com. 3600 IN A 1.2.3.4
;; AUTHORITY SECTION:
fbo.com. 3600 IN NS op.fbo.com.
;; ADDITIONAL SECTION:
op.fbo.com. 3600 IN A 1.2.3.4
;; Query time: 2 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Aug 17 15:05:18 CST 2017
;; MSG SIZE rcvd: 92
8.部署從DNS服務(wù)器
- 安裝軟件
yum install -y bind-utils bind bind-devel bind-chroot
- vim /etc/named.conf
options {
listen-on port 53 { any; };
directory "/var/named/chroot/etc/";
allow-query { any; };
dump-file "/var/named/chroot/var/log/binddump.db";
Statistics-file "/var/named/chroot/var/log/named_stats";
zone-statistics yes;
memstatistics-file "log/mem_stats";
empty-zones-enable no;
forwarders {202.106.196.115;8.8.8.8; };
};
key "rndc-key" {
algorithm hmac-md5;
secret "Eqw4hClGExUWeDkKBX/pBg==";
};
controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys {"rndc-key";};
};
logging {
channel warning {
file "/var/named/chroot/var/log/dns_warning" versions 10 size 10m;
severity warning;
print-category yes;
print-severity yes;
print-time yes;
};
channel general_dns {
file "/var/named/chroot/var/log/dns_log";
severity info;
print-category yes;
print-severity yes;
print-time yes;
};
category default {
warning;
};
category queries {
general_dns;
};
};
include "/var/named/chroot/etc/view.conf";
- vim /etc/rndc.key
key "rndc-key" {
algorithm hmac-md5;
secret "Eqw4hClGExUWeDkKBX/pBg==";
};
- vim /etc/rndc.conf
key "rndc-key" {
algorithm hmac-md5;
secret "Eqw4hClGExUWeDkKBX/pBg==";
};
options {
default-key "rndc-key";
default-server 127.0.0.1;
default-port 953;
};
- vim /var/named/chroot/etc/view
view "SalveView" {
zone "fbo.com" {
type slave;
masters {192.168.57.100;};
file "slave.fbo.com.zone";
};
};
- 修改master上的view.conf配置沼本，將slave節(jié)點(diǎn)ip加入，之后再fbo.com.zone將serial+1
- 在salve上修改目錄權(quán)限窑邦，并啟動(dòng)
- 在master上執(zhí)行
rdnc reload
9.添加A擅威、CNAME、MX冈钦、PTR記錄
- 在zone文件末尾里添加A記錄(實(shí)現(xiàn)負(fù)載均衡)
a A x.x.x.x
[root@linux-node1 ~]# host a.fbo.com localhost
Using domain server:
Name: localhost
Address: 127.0.0.1#53
Aliases:
a.fbo.com has address 192.168.122.100
- 在zone文件末尾里添加CNAME
cname CNAME a.fbo.com.
[root@linux-node1 ~]# rndc reload
WARNING: key file (/etc/rndc.key) exists, but using default configuration file (/etc/rndc.conf)
server reload successful
[root@linux-node1 ~]# host cname.fbo.com localhost
Using domain server:
Name: localhost
Address: 127.0.0.1#53
Aliases:
cname.fbo.com is an alias for a.fbo.com.
a.fbo.com has address 192.168.122.100
- 在zone文件末尾添加mx記錄,mx值越小優(yōu)先級(jí)越高
mx mx 5 x.x.x.x
mx mx 10 x.x.x.x
- 添加PTR記錄
# /var/named/chroot/etc/view.conf
zone "168.192.in-addr.arpa" {
type master;
file "168.192.zone";
allow-transfer {
10.6.0.254;
};
notify yes;
also-notify {
10.6.0.254;
};
};
# /var/named/chroot/etc/168.192.zone
$TTL 3600 ; 1 hour
IN SOA op.fbo.com. dns.fbo.com. (
2004 ; serial
900 ; refresh (15 minutes)
600 ; retry (10 minutes)
86400 ; expire (1 day)
3600 ; minimum (1 hour)
)
NS op.fbo.com.
102.122 IN PTR a.fbo.com.
- 配置DNS視圖（智能DNS）- 分區(qū)訪問(wèn)
# master節(jié)點(diǎn)/var/name/chroot/etc/named.conf,在include上面添加
acl group1 {
192.168.57.100;
};
acl group2 {
192.168.57.200;
};
# 修改/var/named/chroot/etc/view.conf為
view "GROUP1" {
match-clients { group1; };
zone "viewfbo.com" {
type master;
file "group1.viewfbo.com.zone";
};
};
view "GROUP2" {
match-clients { group2; };
zone "viewfbo.com" {
type master;
file "group2.viewfbo.com.zone";
};
};
# master節(jié)點(diǎn)/var/named/chroot/etc/group1.viewfbo.com.zone
$ORIGIN .
$TTL 3600 ; 1 hour
viewfbo.com IN SOA op.viewfbo.com. dns.viewfbo.com. (
2004 ; serial
900 ; refresh (15 minutes)
600 ; retry (10 minutes)
86400 ; expire (1 day)
3600 ; minimum (1 hour)
)
NS op.viewfbo.com.
$ORIGIN viewfbo.com.
op A 192.168.122.1
view A 192.168.122.1
# master節(jié)點(diǎn)/var/named/chroot/etc/group2.viewfbo.com.zone
$ORIGIN .
$TTL 3600 ; 1 hour
viewfbo.com IN SOA op.viewfbo.com. dns.viewfbo.com. (
2004 ; serial
900 ; refresh (15 minutes)
600 ; retry (10 minutes)
86400 ; expire (1 day)
3600 ; minimum (1 hour)
)
NS op.viewfbo.com.
$ORIGIN viewfbo.com.
op A 192.168.122.2
view A 192.168.122.2
# 修改文件權(quán)限
chown named.named /var/named/chroot/etc/group*.zone
rndc reload
dig @192.168.57.100 view.viewfbo.com
高可用、高性能
壓測(cè)：queryperf
queryperf -d test.txt -s 8.8.8.8
配置管理自動(dòng)化：bind-dlz
https://github.com/shanks1127/dns
其他軟件
- DNSMASQ
- HTTPDNS
