Centos 7.1 Bind Master/Slave Construction

Centos 7.1 Bind Master/Slave Construction

Centos 7.1 Bind Master/Slave Construction

######################################## ##################################

Overview

Brief DNS description

1. Prepare the environment

2. Configure the primary DNS Server

2. 1. Main configuration file

2. Configure/etc/named. conf

2. 3. Configure/etc/named. rfc1912.zones

2. 4. Configure/var/named/database file

2.5 start service and Test

3. Configure the slave dns Server

3. 1. Modification on the primary DNS Server

3. 2. Modify from DNS Server

3. Start the service test

######################################## ###################################

Brief DNS description

As we all know, in network communication, data links Use MAC addresses, network layer uses IP addresses, and transport layer uses port numbers. IP addresses are the most closely related to users. Each incoming computer (whether Internet or Intranet) must have its own IP address to ensure correct information transmission. However, IP addresses are composed of numbers, which are difficult to remember and express their actual use. Therefore, people use domain names in images instead of IP addresses to facilitate communication and memory. However, note that, packet transmission in network communication relies on IP addresses. That is to say, when www.syd.com and www1.syd.com send messagesYou must convert your domain name and the other party's domain name to the actual IP address, and fill in the header of the data packet before data transmission. CompleteThe software for translation (resolution) from a domain name to an IP address or an IP address to a domain name is the DNS service system. The DNS service system must be installed on a computer, which is called a DNS server.

So far, there are three main methods to implement such domain name resolution:

1) hosts file, but all servers that parse each other must be configured

2) NIS (SUN technology) manages domain names in a centralized manner and is only applicable to lan.

3) DNS implements hierarchical and Distributed Management of domain names. Most of them are currently in this way.

It is difficult to configure DNS services and may require ISP support. DNS is also the basis of various network application services, such as websites and emails. All Require Domain Name support, and with DNS, it is much easier to port IP addresses.

######################################## ###################################

1. Prepare the environment

Master Server IP Address: 192.168.1.150

Slave Server IP: 192.168.1.200

Disable firewalld and selinux

OS: CentOS Linux release 7.1.1503 (Core)

Bind software: # yum install bindbind-utils

# Rpm-qa bind *

Bind-license-9.9.4-18.el7_1.5.noarch

Bind-libs-lite-9.9.4-18.el7_1.5.x86_64

Bind-libs-9.9.4-18.el7_1.5.x86_64

Bind-utils-9.9.4-18.el7_1.5.x86_64

Bind-9.9.4-18.el7_1.5.x86_64

Domain Name: zrd.com

######################################## ##################################

2. Configure the primary DNS Server:

Bytes ------------------------------------------------------------------------------------------------------------

2. 1. Main configuration file:

/Etc/named. conf mainly configures ports, security, log-related logs

/Etc/named. rfc1912.zones

/Var/named/positive/negative database solution

Bytes ------------------------------------------------------------------------------------------------------------

2. Configure/etc/named. conf

Bytes ------------------------------------------------------------------------------------------------------------

#---------------------------------

# Back up the/etc/named. conf configuration file

#---------------------------------

[Root @ ns1 ~] # Cp/etc/named. conf/etc/named. conf. bak

#---------------------------------

# Edit the/etc/named. conf configuration file

# The double slash is the comment content.

#---------------------------------

[Root @ ns1 ~] # Vim/etc/named. conf

//

// Named. conf

//

// Provided by Red Hat bindpackage to configure the isc bind named (8) DNS

// Server as a caching onlynameserver (as a localhost DNS resolver only ).

//

// See/usr/share/doc/bind */sample/for example named configuration files.

//

Options {

// Listen-onport 53 {127.0.0.1 ;};

// Listen-on-v6port 53 {:: 1 ;};

Directory "/var/named ";

Dump-file "/var/named/data/cache_dump.db ";

Statistics-file "/var/named/data/named_stats.txt ";

Memstatistics-file "/var/named/data/named_mem_stats.txt ";

Allow-query {any ;};

/*

-If you are building an AUTHORITATIVE DNSserver, do NOT enable recursion.

-If you are building a RECURSIVE (caching) DNS server, you need to enable

Recursion.

-If your recursive DNS server has a public IPaddress, you MUST enable access

Control to limit queries to your legitimateusers. Failing to do so will

Cause your server to become part of largescale DNS amplification

Attacks. Implementing BCP38 within yournetwork wowould greatly

Reduce such attack surface

*/

Recursion yes;

// Dnssec-enableyes;

// Dnssec-validationyes;

// Dnssec-lookasideauto;

/* Path to isc dlv key */

Bindkeys-file "/etc/named. iscdlv. key ";

Managed-keys-directory "/var/named/dynamic ";

Pid-file "/run/named. pid ";

Session-keyfile "/run/named/session. key ";

};

Logging {

Channel default_debug {

File "data/named. run ";

Severity dynamic;

};

};

Zone "." IN {

Type hint;

File "named. ca ";

};

Include "/etc/named. rfc1912.zones ";

// Include "/etc/named. root. key ";

2. 3. Configure/etc/named. rfc1912.zones

#------------------------------------------------------------------

# Back up the/etc/named. rfc1912.zones configuration file

#------------------------------------------------------------------

[Root @ ns1 ~] # Cp/etc/named. rfc1912.zones/etc/named. rfc1912.zones. bak

#------------------------------------------------------------------

# Edit the/etc/named. rfc1912.zones configuration file

# The double slash is the comment content.

#------------------------------------------------------------------

[Root @ ns1 ~] # Vim/etc/named. rfc1912.zones

Zone "1.0.0.127.in-addr. arpa" IN {

Type master;

File "named. loopback ";

Allow-update {none ;};

};

Zone "0. in-addr.arpa" IN {

Type master;

File "named. empty ";

Allow-update {none ;};

};

//##########################

// Customize the zrd.com forward solution region

//##########################

Zone "zrd.com" IN {

Type master;

File "zrd.com. zone ";

};

//###################################### ##############

// Customize reverse resolution

//###################################### ##############

Zone "1.168.192.in-addr. arpa" IN {

Type master;

File "1.168.192.in-addr-arpa ";

};

2. 4. Configure/var/named/database file

#------------------------------------------------------------------

# Create a forward parsing database file/var/named/zrd.com. zone

#------------------------------------------------------------------

[Root @ ns1 ~] # Vimzrd.com. zone

$ TTL 600

@ INSOA dns.zrd.com. admin.zrd.com .(

2015091901

1 H

5 M

3D

12 H

)

INNS dns

INMX 10 mail

Dns INA 192.168.1.150

Www INA 192.168.1.151

Mail INA 192.168.1.152

Pop INCNAME mail

Modify Group

[Root @ ns1 ~] # Chown. named/var/named/zrd.com. zone

#------------------------------------------------------------------

# Create a reverse resolution database file/var/named/1.168.192.in-addr-arpa

#------------------------------------------------------------------

[Root @ ns1 ~] # Vim/var/named/1.168.192.in-addr-arpa

$ TTL 600

@ INSOA dns.zrd.com. admin.zrd.com .(

2015091901

1 H

5 M

3D

12 H

)

INNS dns.zrd.com.

150 INPTR dns.zrd.com.

151 INPTRwww.zrd.com.

152 INPTR mail.zrd.com.

2.5 start service and Test

2.5.1 service related (STOP, start, query, server self-start, disable auto-start)

[Root @ ns1 ~] # Systemctl stop named

[Root @ ns1 ~] # Systemctl start named

[Root @ ns1 ~] # Systemctl status named

[Root @ ns1 ~] # Systemctl enable named

[Root @ ns1 ~] # Systemctl disable named

2.5.2 Test

Check whether the listening port 53 domain service is enabled

Check whether the forward and reverse resolution services are normal

PS: so far. If the slave DNS server is not configured, a simple DNS server has been configured!

######################################## ###############################

######################################## ###############################

3. Configure the slave dns Server

Bytes ------------------------------------------------------------------------------------------------------------

3. 1. Modification on the primary DNS Server

3.1.1 Modify/etc/named. rfc1912.zones

[Root @ ns1 ~] # Vim/etc/named. rfc1912.zones

// Named. rfc1912.zones:

//

// Provided by RedHat caching-nameserver package

//

// Isc bind namedzone configuration for zones recommended

// RFC 1912 section4.1: localhost TLDs and address zones

// Andhttp: // www.ietf.org/internet-drafts/drastmietf-dnsop-default-local-zones-02.txt

// (C) 2007 R WFranks

//

// See/usr/share/doc/bind */sample/for example named configuration files.

//

Zone "localhost. localdomain" IN {

Type master;

File "named. localhost ";

Allow-update {none ;};

};

Zone "localhost" IN {

Type master;

File "named. localhost ";

Allow-update {none ;};

};

Zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {

Type master;

File "named. loopback ";

Allow-update {none ;};

};

Zone "1.0.0.127.in-addr. arpa" IN {

Type master;

File "named. loopback ";

Allow-update {none ;};

};

Zone "0. in-addr.arpa" IN {

Type master;

File "named. empty ";

Allow-update {none ;};

};

/////////////////////////////////

// Customize the zrd.com positive solution region

////////////////////////////////

Zone "zrd.com" IN {

Type master;

File "zrd.com. zone ";

Allow-transfer {127.0.0.1; 192.168.1.150; 192.168.1.200 ;}; // only allow specific DNS servers to synchronize zones

};

////////////////////////////

// Custom anti-resolution

////////////////////////////

Zone "1.168.192.in-addr. arpa" IN {

Type master;

File "1.168.192.in-addr-arpa ";

Allow-transfer {127.0.0.1; 192.168.1.150; 192.168.1.200 ;}; // only allow specific DNS servers to synchronize zones

};

3.1.2. Forward resolution File Modification

3.1.3. Reverse resolution File Modification

3. 2. Modify from DNS Server

#----------------------------------------------------------

#3.2.1./etc/named. conf configuration

#----------------------------------------------------------

[Root @ nsslaves] # vim/etc/named. conf

Dnssec-validation yes;

Dnssec-lookaside auto;

*/

/* Path to isc dlv key */

Bindkeys-file "/etc/named. iscdlv. key ";

Managed-keys-directory "/var/named/dynamic ";

Pid-file "/run/named. pid ";

Session-keyfile "/run/named/session. key ";

};

Logging {

Channel default_debug {

File "data/named. run ";

Severity dynamic;

};

};

Zone "." IN {

Type hint;

File "named. ca ";

};

Include "/etc/named. rfc1912.zones ";

// Include "/etc/named. root. key ";

----------------------------------------------------------------

#----------------------------------------------------------

#3.2.2/etc/named. rfc1912.zones Configuration

#----------------------------------------------------------

[Root @ nsslaves] # vim/etc/named. rfc1912.zones

Type master;

File "named. loopback ";

Allow-update {none ;};

};

Zone "0. in-addr.arpa" IN {

Type master;

File "named. empty ";

Allow-update {none ;};

};

////////////////////////////

// Configure the slave server

////////////////////////////

Zone "zrd.com." IN {

Type slave;

Masters {192.168.1.150 ;};

File "slaves/zrd.com. zone ";

Allow-transfer {none ;};

};

/////////////////////////

// Reverse DNS settings

/////////////////////////

Zone "1.168.192.in-addr. arpa." IN {

Type slave;

Masters {192.168.1.150 ;};

File "slaves/1.168.192.in-addr. zone ";

Allow-transfer {none;}; // The slave server should not be transferred to other server zones.

};

######################################## ###############

3. Start the service test

# Systemctlstart named

Forward parsing Test

Reverse Resolution Test