[DNS] ACLS, Also-notify, view servers, and security settings

1. ACL: The access control list is placed on the head of named.conf, if the ACL is too much content, you can create another file, put the ACL in the file, and then load the file in the main configuration file named.conf with include (remember to put it on the head)

the role of access control lists: can be used in configuration files like allow-query{mynet;}; so that we only need to define an ACL, without knocking over the same address
Example:
# vim/etc/named.conf
ACL mynet {
10.0.0.0/16;
192.168.10.10;
172.16.0.0/24;
};

bind default pre-defined address matching list of 4 names
any: All hosts
localhost: Native
localhosts: All hosts on the local network
None: does not match any address

2. also-notify: Proactive notification from the Domain name server update , after the primary domain name server is updated, and does not need to wait for a specified time after the update from the domain name server
# vim/etc/named.conf
Options {
also-notify {10.0.5.151;};
};

3. View-based domain name server

(1) Separation analysis (split)
function: Provides different parsing results when a customer request from a different address is resolved to the same domain name


Case: Now I do before I do the primary domain server to do the view Domain name server, now this host by two network cards, IP is 192.168.100.20,192.168.200.20, I am now going to implement if the host of the 192.168.100.0 network segment does domain name resolution, for example Nslookup dns.hngd.com, The IP that will return the domain name is 192.168.100.20; If the host of the 192.168.200.0 network segment does the domain name resolution, for example Nslookup dns.hngd.com, the IP that will return the domain name is 192.168.200.20.

1. Enable different zone locales for different client addresses in the named.conf master configuration file, using separate data files for each
[[email protected] Master ~]# cat/etc/named.conf

Options {
listen-on Port: (any;};
listen-on-v6 port: 1;};
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query {any;};
recursion yes;

dnssec-enable Yes;
dnssec-validation Yes;
dnssec-lookaside Auto;

/ * Path to ISC DLV key * /
bindkeys-file "/etc/named.iscdlv.key";

managed-keys-directory "/var/named/dynamic";
};

/*logging {
Channel Default_debug {
file "Data/named.run";
severity dynamic;
};
};
zone "." in {
type hint;
file "named.ca";
};
*/

View ' internal ' {//Internal network
match-clients{192.168.100.0/24;}; Clients matching the 192.168.100.0 network segment
Zone "Hngd.com" in{
Type master;
File "Inter.hngd.zones";
allow-update {none;};
};

Zone "100.168.192.in-addr.arpa" in{
Type master;
File "Inter.192.168.100.zone";
allow-update{none;};
};
};
View ' external ' {//external network
match-clients{192.168.200.0/24;}; Clients matching the 192.168.200.0 network segment
Zone "Hngd.com" in{
Type master;
File "Exter.hngd.zones";
allow-update {none;};
};

Zone "200.168.192.in-addr.arpa" in{
Type master;
File "Exter.192.168.100.zone";
allow-update{none;};
};
};


#include "/etc/named.rfc1912.zones";
#include "/etc/named.root.key";

2. Configuring Zone Files
[[Email protected] Master ~]# cat/var/named/inter.hngd.zones
$ORIGIN hngd.com.
$TTL 1D
@IN SOAdns.hngd.com. Admin.hngd.com. (
2016032012
1D
1H
1W
3H
)
NSdns.hngd.com.
NSslave.hngd.com.
MX5mail.hngd.com.
slaveINA192.168.100.2
dnsINA192.168.100.20
mailINA192.168.100.10
wwwINA192.168.100.11
Bbsincnamewww

[[Email protected] Master ~]# cat/var/named/inter.192.168.100.zone
$ORIGIN 100.168.192.in-addr.arpa.
$TTL 1D
@IN SOAdns.hngd.com. Admin.hngd.com. (
2016032012
1D
1H
1W
3H
)
NSdns.hngd.com.
INPTRdns.hngd.com.
10IN PTRmail.hngd.com.
11INPTRwww.hngd.com.
2inptrslave.hngd.com.

[[Email protected] Master ~]# cat/var/named/exter.hngd.zones
$ORIGIN hngd.com.
$TTL 1D
@IN SOAdns.hngd.com. Admin.hngd.com. (
2016032012
1D
1H
1W
3H
)
NSdns.hngd.com.
MX5mail.hngd.com.
dnsINA192.168.200.20
mailINA192.168.200.10
wwwINA192.168.200.11
Bbsincnamewww

[[Email protected] Master ~]# cat/var/named/exter.192.168.100.zone
$ORIGIN 200.168.192.in-addr.arpa.
$TTL 1D
@IN SOAdns.hngd.com. Admin.hngd.com. (
2016032012
1D
1H
1W
3H
)
NSdns.hngd.com.
INPTRdns.hngd.com.
10IN PTRmail.hngd.com.
11INPTRwww.hngd.com.
2inptrslave.hngd.com.

3. Note To change the owner and group of the zone data file to named
-rw-r--r--1 named named 243 March 10:20 Exter.192.168.100.zone
-rw-r--r--1 named named 238 March 10:20 Exter.hngd.zones
-rw-r--r--1 named named 243 March 19:07 Inter.192.168.100.zone
-rw-r--r--1 named named 283 March 19:05 Inter.hngd.zones

4. Change the nameserver of the/etc/resolv.conf file to 192.168.100.20
5. Restart the named service
6. Turn off the firewall and SELinux
7. Test: Find the same domain name in different network segments to obtain different IP
[[Email protected] Master ~]# nslookup dns.hngd.com 192.168.100.20
server:192.168.100.20
address:192.168.100.20#53

Name:dns.hngd.com
address:192.168.100.20

[[Email protected] Master ~]# nslookup dns.hngd.com 192.168.200.20
server:192.168.200.20
address:192.168.200.20#53

Name:dns.hngd.com
address:192.168.200.20


Digression: If the owner of a file is deleted, then when we use Ls-l to query the file, we will find that the owner of the file is a number, which is the UID of the user.
[[email protected] ~]# ll AA
-rw-r--r--1 AA bb 5 March 15:30 AA
[[email protected] ~]# Userdel AA
[[email protected] ~]# ll AA
-rw-r--r--1 516 bb 5 March 15:30 AA

Security Settings

allow-transfer{192.168.100.2;}; Allow only 192.168.100.2 hosts to pass data from the primary domain server

Transaction signing
TSIG: Guaranteed replication Security between master and slave DNS
* Using symmetric encryption technology
* Generate key on primary DNS


Generate key
[Email protected] ~]# dnssec-keygen-a hmac-md5-b 128-n HostDomain name | view name
-A: algorithm
-B: The length of the generated key
-N: Name
A key is generated for each view if the primary DNS has a view

----------
case: I still take the previous master DNS to do TSIG transaction signature, to achieve secure communication
The current primary DNS has two network adapters: 192.168.200.20,192.168.100.20
There are two network adapters from DNS: 192.168.200.1,192.168.100.1

1. Generate keys on primary DNS (each view will generate a key)

[[Email protected] Master ~]# dnssec-keygen-a hmac-md5-b 128-n Host Internal
kinternal.+157+18216
[[Email protected] Master ~]# dnssec-keygen-a hmac-md5-b 128-n Host External
kexternal.+157+33008
[[Email protected] Master ~]# cat Kexternal.+157+33008.key//Public key, private key is consistent
External. In KEY 3 157 kw2b3l1xyd26/p9dyaqv+w==
[[Email protected] Master ~]# cat Kexternal.+157+33008.private
private-key-format:v1.3
algorithm:157 (HMAC_MD5)
key:kw2b3l1xyd26/p9dyaqv+w==
Bits:aaa=
created:20160327153349
publish:20160327153349
activate:20160327153349

2. Load the key in the master configuration file

#/etc/named.conf
Key "Internal" {
Algorithm HMAC-MD5;
Secret "0itnpuvy5kobjfkaafn6xa==";
};

Key "external" {
Algorithm HMAC-MD5;
Secret "kw2b3l1xyd26/p9dyaqv+w==";
};

3. Set the named.conf configuration file for the master server and use the key access in the specific view

#/etc/named.conf
View ' internal ' {
match-clients{192.168.100.0/24;};
Server 192.168.100.1 {keys {internal;};}; Specifies IP from DNS and requires data transfer via key
Zone "Hngd.com" in{
Type master;
File "Inter.hngd.zones";
allow-update {none;};
Allow-transfer {key internal;}; Obtaining data files from primary DNS requires key authentication
also-notify {192.168.100.1;}; Master-side configuration, and proactively send update notification messages to slave after configuration modification
};

Zone "100.168.192.in-addr.arpa" in{
Type master;
File "Inter.192.168.100.zone";
allow-update{none;};
Allow-transfer {key internal;};
also-notify {192.168.100.1;};
};
};
View ' External ' {
match-clients{192.168.200.0/24;};
Server 192.168.200.1 {keys {external;};};
Zone "Hngd.com" in{
Type master;
File "Exter.hngd.zones";
allow-update {none;};
Allow-transfer {key external;};
also-notify {192.168.200.1;};
};

Zone "200.168.192.in-addr.arpa" in{
Type master;
File "Exter.192.168.100.zone";
allow-update{none;};
Allow-transfer {key external;};
also-notify {192.168.200.1;};
};
};

4. Configure key authentication access from the server

Key "Internal" {
Algorithm HMAC-MD5;
Secret "0itnpuvy5kobjfkaafn6xa==";
};

Key "external" {
Algorithm HMAC-MD5;
Secret "kw2b3l1xyd26/p9dyaqv+w==";
};

View "Internal" {
match-clients{192.168.100.0/24;};
Server 192.168.100.20 {keys {internal;};};
Zone "Hngd.com" in{
Type slave;
File "Slaves/inter.hngd.zones";
Masters {192.168.100.20;};
Notify-source 192.168.100.20; The default is *, indicates the current host IP, you can specify an IP and port, IP must be included in the master of slave, and then through the grab packet (the packet that slave sends notify information on Master) discovers

};

Zone "100.168.192.in-addr.arpa" in{
Type slave;
File "Slaves/inter.192.168.100.zone";
Masters {192.168.100.20;};
Notify-source 192.168.100.20;
};
};
View "external" {
match-clients{192.168.200.0/24;};
Server 192.168.200.20 {keys {external;};};
Zone "Hngd.com" in{
Type slave;
File "Slaves/exter.hngd.zones";
Masters {192.168.200.20;};
Masters {192.168.200.20;};
Notify-source 192.168.200.20;
};

Zone "200.168.192.in-addr.arpa" in{
Type slave;
File "Slaves/exter.192.168.100.zone";
Masters {192.168.200.20;};
Notify-source 192.168.200.20;
};
};

5. After configuring the above, restart the named service from DNS, and then review/var/named/slaves if you see the following data file


6. If not, look at the master-slave DNS server firewall and SELinux have not shut down, there is/etc/resolv.conf file nameserver has not been written as the corresponding DNS IP
7. If not, look at the/var/log/messgage, check the error message, if it is not the reason for the master-slave server synchronization, then proceed

The master-slave domain name server requires time synchronization, if the master-slave server time is not synchronized will cause from the domain name server can not generate data files, view/var/message discovery Clock is not synchronized, so we can use the following method to achieve synchronization (master, slave server need to install)
1. See/etc/xinetd.d/below for Time-dgram, Time-stream
[[Email protected] Master ~]# ls/etc/xinetd.d/
Chargen-dgram Daytime-stream Echo-dgram Tcpmux-server
Chargen-stream Discard-dgram Echo-stream Time-dgram
Daytime-dgram Discard-stream rsync Time-stream

2. If not, you need to install xinetd
[email protected] xinetd.d]# Yum install xinetd
3. After installation, start Time-dgram, time-stream,xinetd service
[Email protected] xinetd.d]# chkconfig Time-dgram on
[A[[email protected] xinetd.d]# chkconfig Time-stream on

[Email protected] xinetd.d]# service xinetd restart
stopping xinetd: [FAILED]
Starting xinetd: [OK]

4.rdate-s [IP of target host]: Implementing synchronization
[[Email protected] Master ~]# rdate-s 192.168.100.1

[DNS] ACLS, Also-notify, view servers, and security settings