High-speed cache instance solution for Linux Network Services

High-speed cache instance solution for Linux Network Services

Resolution of High-speed cache instances for Linux Network Services

1. What is DNS:

DNS:

Concept: (Domain Name Server) is a Server that converts domain names and corresponding IP addresses. DNS stores a domain name and the corresponding IP address table to resolve the domain name of the message. A domain name is the name of a computer or computer group on the Internet. It is used to identify the electronic location (or geographic location) of a computer during data transmission ). A domain name is composed of a string of names separated by dots. It usually contains the Organization Name and always contains two to three letter suffixes, to specify the type of the Organization or the country or region where the domain is located.

Authoritative DNS: the host itself has

Non-authoritative DNS: Ask me, I will go

The specified IP address is the host address/etc/resolv. conf.

Local parsing file/etc/hosts

Loopback interface lo: similar to conditioned reflection, the local machine asks the local machine, the loopback interface is fast, and the external interface uses apache

Main configuration file/etc/named. conf

Advantages of High-speed cache: reduces network latency and bandwidth usage

Default Time: 8630 s (1 day). You need to cache the expired data again.

2. High-speed cache Experiment Simulation

(1) Preparation

[Root @ foundation103 ~] # Yum repolist list // view yum source information

[Root @ foundation103 ~] # Yum clean all // clear yum Cache

[Root @ foundation103 ~] # Yum repolist list

Loaded plugins: langpacks

Rhel_dvd | 4.1 kB

(1/2): rhel_dvd/group_gz | 134 kB

(2/2): rhel_dvd/primary_db | 3.4 MB

Repolist: 0

(2) install DNS

[Root @ foundation103 ~] # Yum install bind. x86_64-y // install the DNS Service

[Root @ foundation103 ~] # Systemctl start named // after the service is started,/etc/rndc. key is generated.

// When DNS is started, the verification code is insufficient. You need to press the keyboard in the host.

[Root @ foundation103 ~] # Ls-l/etc/rndc. key

[Root @ foundation103 ~] # Cat/etc/rndc. key // view key

[Root @ foundation103 ~] # Vim/etc/resolv. conf

[Root @ foundation103 ~] # Cat/etc/services | grep domain // view the dns Service port

Domain 53/tcp # name-domain server

Domain 53/udp

Domaintime 9909/tcp # domaintime

Domaintime 9909/udp # domaintime

[Root @ foundation103 ~] # Firewall-cmd-list-all

Public (default, active)

Interfaces: eth0

Sources:

Services: dhcpv6-client ssh

Ports:

Masquerade: no

Forward-ports:

Icmp-blocks:

Rich rules:

(3) add dns in the fire wall

[Root @ foundation103 ~] # Firewall-cmd-permanent-add-service = dns

Success

[Root @ foundation103 ~] # Firewall-cmd-reload

Success

[Root @ foundation103 ~] # Cat/etc/services | grep domain // view the dns Service port

Domain 53/tcp # name-domain server

Domain 53/udp

Domaintime 9909/tcp # domaintime

Domaintime 9909/udp # domaintime

[Root @ foundation103 ~] # Firewall-cmd-list-all

Public (default, active)

Interfaces: eth0

Sources:

Services: dhcpv6-client dns ssh

Ports:

Masquerade: no

Forward-ports:

Icmp-blocks:

Rich rules:

(4) Experiment

[Root @ foundation103 ~] # Netstat-antlupe | grep 53 // view, port 120 is added with 53

[Root @ foundation103 ~] # Ifconfig

Lo: flags = 73

3. DNS Server

. Com. cn. edu. org. net and so on.

Noerror: Query successful

Nxdomain: the server does not have such a name

Servfail: DNS server downtime or response failure

Refused: the DNS server rejects the answer.

4. Forward DNS resolution

[Root @ foundation3 Desktop] # dig www.baidu.com

[Root @ foundation103 ~] # Vim/etc/named. conf // view the sub-configuration file

57 include "/etc/named. rfc1912.zones ";

58 include "/etc/named. root. key ";

Delete row 18th forwarders {172.25.254.250 ;};

[Root @ foundation103 ~] # Vim/etc/named. rfc1912.zones // view the sub-configuration file

25 zone "westos.com" IN {

26 type master;

27 file "westos.com. zone ";

28 allow-update {none ;};

29 };

[Root @ foundation103 ~] # Cd/var/named

[Root @ foundation103 named] # cp-p named. localhost westos.com. zone //-p add permission

[Root @ foundation103 named] # vim westos.com. zone

$ TTL 1D

@ In soa dns.westos.com. root.westos.com .(

0; serial

1D; refresh

1 H; retry

1 W; expire

3 H); minimum

NS dns.westos.com.

Dns A 172.25.254.103

Www AAAA 172.25.254.20

~

// @: Westos.com. It means it is over. Without '.', it is equivalent to adding '.westos.com.' to the end .'

// 1D indicates 1 day

// @ Indicates westos.com // The @ symbol is automatically added to files that do not end with a. symbol.

// SOA indicates the authorized host

// NS indicates the name of the nameserver Domain Name Server. It indicates the end

// AAAA: IPV6 resolution mode, A: IPV4 resolution Mode

[Root @ foundation103 named] # systemctl restart named

In the real machine:

[Root @ foundation3 Desktop] # dig www.westos.com

; Answer section:

Www.westos.com. 86400 in a 172.25.254.20 // parse the file to OK

; Authority section:

Westos.com. 86400 in ns dns.westos.com.

; Additional section:

Dns.westos.com. 86400 in a 172.25.254.103

5. DNS converts the customer access name to an internal name

[Root @ foundation3 Desktop] # dig www.baidu.com

; Answer section:

Www.baidu.com. 901 in cname www.a.shifen.com.

Www.a.shifen.com. 1 in a 220.181.111.188

Www.a.shifen.com. 1 in a 220.181.112.244

[Root @ foundation103 named] # vim westos.com. zone

NS dns.westos.com.

Dns A 172.25.254.103

Www CNAME bbs.westos.com.

Bbs A 172.25.254.20

[Root @ foundation103 named] # systemctl restart named

[Root @ foundation3 Desktop] # dig www.westos.com

; Answer section:

Www.westos.com. 86400 in cname bbs.westos.com.

Bbs.westos.com. 86400 in a 172.25.254.20

6. DNS Server Lookup

[Root @ foundation3 Desktop] # dig www.baidu.com

; Answer section:

Www.baidu.com. 901 in cname www.a.shifen.com.

Www.a.shifen.com. 1 in a 220.181.111.188

Www.a.shifen.com. 1 in a 220.181.112.244

; Authority section:

A.shifen.com. 901 in ns ns2.a.shifen.com.

A.shifen.com. 901 in ns ns5.a.shifen.com.

A.shifen.com. 901 in ns ns4.a.shifen.com.

A.shifen.com. 901 in ns ns1.a.shifen.com.

A.shifen.com. 901 in ns ns3.a.shifen.com.

// Five server round-robin services are available in ns12345.

[Root @ foundation103 named] # vim westos.com. zone

NS dns.westos.com.

Dns A 172.25.254.103

Www CNAME bbs.westos.com.

Bbs A 172.25.254.20

Bbs A 172.25.254.120

[Root @ foundation103 named] # systemctl restart named

[Root @ foundation3 Desktop] # dig www.westos.com // View

7. Reverse resolution: Specify the IP address to resolve the Domain Name

[Root @ foundation103 named] # vim/etc/named. rfc1912.zones

48 zone "254.25.172.in-addr. arpa" IN {

49 type master;

50 file "westos.com. ptr ";

51 allow-update {none ;};

52 };

[Root @ foundation103 named] # cp-p named. loopback westos.com. ptr

[Root @ foundation103 named] # vim westos.com. ptr

1 $ TTL 1D

2 @ in soa dns.westos.com. root.westos.com .(

3 0; serial

4 1D; refresh

5 1 H; retry

6 1 W; expire

7 3 H); minimum

8 NS dns.westos.com.

9 dns A 172.25.254.103

10 20 PTR www.westos.com.

11 120 PTR bbs.westos.com.

[Root @ foundation103 named] # systemctl restart named

[Root @ foundation3 Desktop] # dig-x 172.25.254.20 // reverse resolution

[Root @ foundation3 Desktop] # dig-x 172.25.254.120

Troubleshooting: Port, network, permission, configuration file

8. Bidirectional Resolution:

Intranet HOST: internal enterprise host resolution 192 Internet: External enterprise resolution 172

[Root @ foundation103 ~] # Cd/var/named/

[Root @ foundation103 named] # ls // view the Directory

Data named. empty slaves

Dynamic named. localhost westos.com. ptr

Named. ca named. loopback westos.com. zone

[Root @ foundation103 named] # cp westos.com. zone westos.com.. zone. inter-p // copy the file

[Root @ foundation103 etc] # cd/etc/

[Root @ foundation103 etc] # cp named. rfc1912.zones named. rfc1912.zones. inter-p

[Root @ foundation103 etc] # vim named. rfc1912.zones. inter

25 zone "westos.com" IN {

26 type master;

27 file "westos.com. inter ";

28 allow-update {none ;};

29 };

[Root @ foundation103 etc] # man 5 named. conf // view the command

/View

[Root @ foundation103 etc] # vim named. conf // edit the configuration file

Comment out lines from 51-58

59 view localnet {

60 match-clients {172.25.254.103;}; // a 103 ip address is parsed on the 103 server.

61 zone "." IN {

62 type hint;

63 file "named. ca ";

64 };

65 include "/etc/named. rfc1912.zones. inter ";

66 };

67

68 view internet {

69 match-clients {any ;};

70 zone "." IN {

71 type hint;

72 file "named. ca ";

73 };

74 include "/etc/named. rfc1912.zones ";

75 };

[Root @ foundation103 named] # vim westos.com. zone. inter

$ TTL 1D

@ In soa dns.westos.com. root.westos.com .(

0; serial

1D; refresh

1 H; retry

1 W; expire

3 H); minimum

NS dns.westos.com.

Dns A 192.25.254.103

Www CNAME bbs.westos.com.

Bbs A 192.25.254.20

Bbs A 192.25.254.120

[Root @ foundation103 etc] # systemctl restart named

Real machine and virtual machine at the same time [root @ foundation103 etc] # dig www.westos.com

9. Secondary DNS:

3: identifier, which can be changed at will

1D: refresh frequency

1 H: reconnection time

1 W: Failure days

3 H: the shortest access time. After the first access, the content accessed within 3 hours is consistent.

[Root @ server3 ~] # Vim/etc/yum. repos. d/rhel_dvd.repo

[Root @ server3 ~] # Yum clean all

[Root @ server3 ~] # Yum install bind-y

[Root @ server3 ~] # Vim/etc/named. conf

11 // listen-on port 53 {127.0.0.1 ;}###// Annotation

12 // listen-on-v6 port 53 {: 1 ;};

17 // allow-query {localhost ;};

[Root @ server3 ~] # Vim/etc/named. rfc1912.zones

25 zone "westos.com" IN {

26 type slave;

27 masters {172.25.254.103 ;};

28 file "slaves/westos.com. zone ";

29 allow-update {none ;};

30 };

[Root @ server3 ~] # Cd/var/named

[Root @ server3 named] # ls slaves/

[Root @ server3 named] # systemctl restart named // specifies the number of times that the VM has typed

[Root @ server3 named] # ls slaves/

Westos.com. zone

[Root @ foundation103 named] # vim/etc/resolv. conf

Nameserver 172.25.254.203

[Root @ foundation103 named] # vim westos.com. zone // change the address

[Root @ server3 named] # dig www.westos.com // View

[Root @ foundation103 named] # vim/etc/named. rfc1912.zones

Zone "westos.com" IN {

Type master;

File "westos.com. zone ";

Allow-update {none ;};

Also-policy {172.25.254.203 ;};

};

[Root @ server3 named] # systemctl stop firewalld

[Root @ foundation103 named] # systemctl restart named

[Root @ foundation103 named] # systemctl restart named

[Root @ server3 named] # dig www.westos.com

; Answer section:

Www.westos.com. 86400 in cname bbs.westos.com.

Bbs.westos.com. 86400 in a 172.25.254.50

Bbs.westos.com. 86400 in a 172.25.254.220

[Root @ foundation103 named] # vim/etc/named. rfc1912.zones

Zone "westos.com" IN {

Type master;

File "westos.com. zone ";

Allow-update {none ;};

Also-policy {172.25.254.203 ;};

};

[Root @ server3 named] # systemctl stop firewalld

[Root @ foundation103 named] # vim/var/named/westos.com. zone

$ TTL 1D

@ In soa dns.westos.com. root.westos.com .(

1; serial // 1: identifier. modify it as needed.

1D; refresh // 1D: refresh frequency

1 H; retry // 1 H: reconnection time

1 W; expire // 1 W: Expiration days

3 H); minimum

// 3 H: The minimum access time. After the first access, the content accessed within 3 hours is consistent.

NS dns.westos.com.

Dns A 172.25.254.103

Www CNAME bbs.westos.com.

Bbs A 172.25.254.50

Bbs A 172.25.254.220

[Root @ server3 named] # dig www.westos.com

; Answer section:

Www.westos.com. 86400 in cname bbs.westos.com.

Bbs.westos.com. 86400 in a 172.25.254.50

Bbs.westos.com. 86400 in a 172.25.254.220

3 H: the shortest access time. After the first access, the content accessed within 3 hours is consistent.

10. DNS remote Resolution:

(1) Preparation

[Root @ foundation103 named] # cp-p westos.com. zone/mnt/

[Root @ foundation103 named] # ls/mnt/

Westos.com. zone

(2) Experiment

[Root @ foundation103 named] # vim/etc/named. rfc1912.zones

28 allow-update {172.25.254.203 ;};

[Root @ server3 named] # vim/etc/named. rfc1912.zones

[Root @ localhost ~] # Vim/etc/named. conf

Comment all rows from 59 to the end and restore rows from 51 to 58.

[Root @ localhost ~] # Systemctl restart named

[Root @ server3 named] # nsupdate

Server 172.25.254.103

Update add hello.westos.com 86400 A 172.25.254.120 // 86400 s A-> Ipv4

Send

Update failed: REFUSED

[Root @ foundation103 named] # vim/var/log/messages

Feb 5 03:24:44 localhost named [2763]: client 172.25.254.203 #24244: view internet: update 'westos. com/in' denied // you need to add permissions

[Root @ foundation103 named] # ls-ld

Drwxr-x-5 root named 4096 Feb 5

[Root @ foundation103 named] # chmod g + w/var/named/

[Root @ foundation103 named] # ls-ld

Drwxrwx-5 root named 4096 Feb 5

[Root @ foundation103 named] #>/var/log/messages

[Root @ server3 named] # nsupdate

Update add hello.westos.com 86400 A 172.25.254.120

Send

Update failed: REFUSED // set SELinux

[Root @ localhost ~] # Setsebool-P named_write_master_zones 1

[Root @ server3 named] # nsupdate

Update add hello.westos.com 86400 A 172.25.254.120

Update add hello.westos.com 86400 A 172.25.254.122

Send

[Root @ localhost ~] # Vim/var/named/westos.com. zone

Hello A 172.25.254.120

A 172.25.254.122

Encrypted updates

Restore previous backups

[Root @ localhost mnt] # cd/var/named/

[Root @ localhost named] # rm-fr westos.com. zone westos.com. zone. jnl

[Root @ localhost named] # cp-p/mnt/westos.com. zone/var/named/

[Root @ localhost named] # vim westos.com. zone // check whether the restoration is successful.

[Root @ localhost named] # vim/etc/rndc. key // view the key template

Key "rndc-key "{

Algorithm hmac-md5;

Secret "/W3/O/dH7EaKNJqqZwuxIQ = ";

};

[Root @ localhost named] # cp/etc/rndc. key/etc/westos. key // create key

[Root @ localhost named] # dnssec-keygen-help // view the help for generating the key

[Root @ localhost named] # dnssec-keygen-a HMAC-MD5-B 128-n HOST westos

//-A -B length 0-512-n: HOST resolution westos name

Kwestos. + 157 + 14973 // multiple times in the VM

[Root @ localhost named] # ls

Kwestos. + 157 + 14973. private

Kwestos. + 157 + 14973.key

[Root @ localhost named] # cat Kwestos. + 157 + 14973. private

Key: T3ltQ1Ypb8YNfQIeP61i6w ==// ciphertext

[Root @ localhost named] # cat Kwestos. + 157 + 14973.key

Westos. in key 512 3 157 T3ltQ1Ypb8YNfQIeP61i6w ==// ciphertext

// The ciphertext is the same.-> md5 encryption is symmetric encryption.

[Root @ localhost named] # vim/etc/westos. key // change the encrypted file

Key "westos "{

Algorithm hmac-md5;

Secret "T3ltQ1Ypb8YNfQIeP61i6w = ";

};

[Root @ localhost named] # vim/etc/named. conf // modify the configuration file

44 include "/etc/westos. key ";

[Root @ localhost named] # vim/etc/named. rfc1912.zones

28 allow-update {key westos ;};

[Root @ localhost named] # systemctl restart named

[Root @ localhost named] # scp Kwestos. + 157 + 14973. * root@172.25.254.203:/mnt // send Password

[Root @ server3 mnt] # nsupdate-k Kwestos. + 157 + 14973. private

Server 172.25.254.103

Update add hello.westos.com 86400 A 172.25.254.9

Send

Quit