安裝主(primary/master) DNS Server [root@masterdns ~]# yum install bind* -y 1.配置DNS Server 添加如下所示行到/etc/named.conf文件中 [root@masterdns ~]# vi /etc/named.conf
//// named.conf
//// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
listen-on port 53 { 127.0.0.1; 192.168.1.100; }; ### 主DNS 的 IP地址 ###
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; 192.168.1.0/24; }; ### 允許訪問網(wǎng)絡(luò)的IP范圍 ，末尾的 /24 是網(wǎng)絡(luò)掩碼的縮寫表示（在本例中為 255.255.255.0）###
allow-transfer{ localhost; 192.168.1.101; }; ### 從 DNS IP ###
recursion yes; ###是否允許遞歸，有建議說應(yīng)設(shè)置為no，為了是防止DDOS攻擊###
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};//自定義的正向和反向解析
zone"unixmen.local" IN {
type master;
file "forward.unixmen"; //正向解析文件名
allow-update { none; };
};
zone"1.168.192.in-addr.arpa" IN {
type master;
file "reverse.unixmen";//反向解析文件名
allow-update { none; };
};include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
2.1 創(chuàng)建正向Zone 創(chuàng)建forward.unixmen 文件在 /var/named 目錄下 [root@masterdns ~]# vi /var/named/forward.unixmen
$TTL 86400
@ IN SOA masterdns.unixmen.local. root.unixmen.local. (
2011071001 ;Serial
3600 ;Refresh
1800 ;Retry
604800 ;Expire
86400 ;Minimum TTL
)
@ IN NS masterdns.unixmen.local.
@ IN NS secondarydns.unixmen.local.
@ IN A 192.168.1.100
@ IN A 192.168.1.101
@ IN A 192.168.1.102
masterdns IN A 192.168.1.100
secondarydns IN A 192.168.1.101
client IN A 192.168.1.102
?
2.2創(chuàng)建反向Zone 創(chuàng)建reverse.unixmen 文件在 /var/named 目錄下 [root@masterdns ~]# vi /var/named/reverse.unixmen
$TTL 86400
@ IN SOA masterdns.unixmen.local. root.unixmen.local. (
2011071001 ;Serial
3600 ;Refresh
1800 ;Retry
604800 ;Expire
86400 ;Minimum TTL
)
@ IN NS masterdns.unixmen.local.
@ IN NS secondarydns.unixmen.local.
@ IN PTR unixmen.local.
masterdns IN A 192.168.1.100
secondarydns IN A 192.168.1.101
client IN A 192.168.1.102100 IN PTR masterdns.unixmen.local.
101 IN PTR secondarydns.unixmen.local.
102 IN PTR client.unixmen.local.
?
3.啟動DNS服務(wù) [root@masterdns ~]# service named start Starting named: [ OK ] [root@masterdns ~]# chkconfig named on
4.調(diào)整防火墻允許DNS Server 訪問外部網(wǎng)絡(luò) 添加以下內(nèi)容到 /etc/sysconfig/iptables 文件中 [root@masterdns ~]# vi /etc/sysconfig/iptables
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]#添加DNS Server
-A INPUT -p udp -m state --state NEW --dport 53 -j ACCEPT
-A INPUT -p tcp -m state --state NEW --dport 53 -j ACCEPT-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
?
5.重啟防火墻 [root@masterdns ~]# service iptables restart
iptables: Flushing firewall rules: [ OK ]
iptables: Setting chains to policy ACCEPT: filter [ OK ]
iptables: Unloading modules: [ OK ]
iptables: Applying firewall rules: [ OK ]
?
6.設(shè)置當前的DNS服務(wù)器 添加以下內(nèi)容到 /etc/resolv.conf 文件中 [root@masterdns ~]# vim /etc/resolv.conf nameserver 192.168.1.131
7.測試DNS配置和zone文件是否有語法錯誤 [root@masterdns ~]# named-checkconf /etc/named.conf [root@masterdns ~]# named-checkzone unixmen.local /var/named/forward.unixmen zone unixmen.local/IN: loaded serial 2011071001 OK [root@masterdns ~]# named-checkzone unixmen.local /var/named/reverse.unixmen zone unixmen.local/IN: loaded serial 2011071001 OK
8.測試DNS Server [root@masterdns ~]# dig masterdns.unixmen.local
安裝從(Secondary/Slave) DNS Server [root@secondarydns ~]# yum install bind* -y 1.配置從DNS Server 添加如下所示行到/etc/named.conf文件中 [root@secondarydns ~]# vi /etc/named.conf
//// named.conf
//// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
listen-on port 53 { 127.0.0.1; 192.168.1.101; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; 192.168.1.0/24; };
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
zone"unixmen.local" IN {
type slave;
file "slaves/unixmen.fwd";
masters { 192.168.1.100; };
};
zone"1.168.192.in-addr.arpa" IN {
type slave;
file "slaves/unixmen.rev";
masters { 192.168.1.100; };
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
?
2.啟動DNS服務(wù) [root@secondarydns ~]# service named start Generating /etc/rndc.key: [ OK ] Starting named: [ OK ] [root@secondarydns ~]# chkconfig named on
現(xiàn)在主DNS server上的正向和反向zone文件，被自動復制到了從 DNS Server 的 /var/named/slaves/ 目錄下 [root@secondarydns ~]# ls /var/named/slaves/ unixmen.fwd unixmen.rev
