BIND Berkeley Internet Name Domain
FQDN Fully Qualified Domain Name
資源記錄:
網域名稱 [TTL] [類別] 記錄的類型 值
網域名稱:也可以是IP位址
TTL:記錄存活的時間值
類別:以TCP/IP網路,則一定是 IN
記錄的類型:
SOA: 權限開始
NS: DNS伺服器
MX: 郵件交換器
A: 位址
PTR: 指標
CNAME:標準名稱
值:記錄的值
# yum install -y bind bind-chroot bind-utils
# rpm -qa | grep bind
bind-libs-9.9.4-38.el7_3.3.x86_64
bind-chroot-9.9.4-38.el7_3.3.x86_64
bind-libs-lite-9.9.4-38.el7_3.3.x86_64
bind-license-9.9.4-38.el7_3.3.noarch
bind-9.9.4-38.el7_3.3.x86_64
bind-utils-9.9.4-38.el7_3.3.x86_64
---------------------------------------------------------------------------
bind:DNS伺服器主要套件,提供基礎的DNS功能
重要目錄與檔案說明:
/etc/named.conf //bind主設定檔
/etc/named.rfc1912.zones //管轄網域設定檔
/usr/sbin/named //系統服務執行檔,名稱為named
# ls /var/named //所有管轄網域的資源紀錄預設放在此目錄
chroot data dynamic named.ca named.empty named.localhost named.loopback slaves
bind-chroot:加強bind套件的安全性,將bind工作目錄移至獨立的目錄下
禁錮機制:
# ls -l /var/named/chroot
總計 0
drwxr-x---. 2 root named 41 5月 3 15:11 dev
drwxr-x---. 4 root named 28 5月 3 15:11 etc
drwxr-x---. 3 root named 18 5月 3 15:11 run
drwxrwx---. 3 named named 18 5月 3 15:11 usr
drwxr-x---. 5 root named 48 5月 3 15:11 var
bind-utils:DNS相關工具套件,提供dig等測試工具
-----------------------------------------------------------------------
# firewall-cmd --permanent --add-service=dns
success
# firewall-cmd --reload
success
# systemctl start named
# systemctl enable named
Created symlink from /etc/systemd/system/multi-user.target.wants/named.service to /usr/lib/systemd/system/named.service.
dig @[名稱伺服器位址] 名稱 [查詢類型]
查詢類型:
a:查詢IP位址,預設,可省
mx:查郵件伺服器
ns:查名稱伺服器
cname:查別名
ptr:由IP位址反查名稱
hinfo:DNS伺服器系統資訊
//預設DNS伺服器
# cat /etc/resolv.conf
# Generated by NetworkManager
search centos
nameserver 163.16.1.23
# dig tw.yahoo.com
...
;; QUESTION SECTION: //我們向DNS提出的問題
;tw.yahoo.com. IN A
;; ANSWER SECTION: //DNS查詢後得到的答案
tw.yahoo.com. 52 IN CNAME media-router-fp1.prod.media.yahoo.com.
...
;; AUTHORITY SECTION: //該名稱的管轄單位
wg1.b.yahoo.com. 105017 IN NS yf1.yahoo.com.
wg1.b.yahoo.com. 105017 IN NS yf3.a1.b.yahoo.net.
wg1.b.yahoo.com. 105017 IN NS yf2.yahoo.com.
wg1.b.yahoo.com. 105017 IN NS yf4.a1.b.yahoo.net.
;; ADDITIONAL SECTION: //額外資訊
yf1.yahoo.com. 18617 IN A 68.142.254.15
yf2.yahoo.com. 18617 IN A 68.180.130.15
;; Query time: 4 msec
;; SERVER: 163.16.1.23#53(163.16.1.23) //由哪提供資料
;; WHEN: 五 5月 05 11:28:35 CST 2017
;; MSG SIZE rcvd: 285
# dig @168.95.1.1 tw.yahoo.com
...
;; Query time: 2 msec
;; SERVER: 168.95.1.1#53(168.95.1.1) //指定hinet的DNS查詢
;; WHEN: 五 5月 05 11:46:18 CST 2017
;; MSG SIZE rcvd: 167
# dig @localhost www.google.com
...
;; ANSWER SECTION:
www.google.com. 300 IN A 64.233.187.103
...
# dig @127.0.0.1 www.google.com
...
;; ANSWER SECTION:
www.google.com. 149 IN A 64.233.187.105
...
# dig @163.16.63.191 www.google.com
; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.3 <<>> @163.16.63.191 www.google.com
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached
# vi /etc/named.conf
...
options {
// listen-on port 53 { 127.0.0.1; };
listen-on port 53 { any; }; //可以公開服務的DNS
...
allow-query { 163.16.63.0/24; };
...
# systemctl restart named
# dig @163.16.63.191 www.google.com
...
;; ANSWER SECTION:
www.google.com. 300 IN A 64.233.187.104
...
-----------管理一個網域
# vi /etc/named.rfc1912.zones
...
zone "kk.rwm" IN {
type master;
file "named.kk";
allow-update { none; };
};
# cp /var/named/named.empty /var/named/named.kk
# vi /var/named/named.kk
$TTL 1D
@ IN SOA @ rname.invalid. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS @
A 163.16.63.191
www A 163.16.63.191
# chown root:named /var/named/named.kk
# ls -l /var/named/named.kk
-rw-r-----. 1 root named 166 5月 5 13:59 /var/named/named.kk
# systemctl restart named
# dig @127.0.0.1 www.kk.rwm
...
;; QUESTION SECTION:
;www.kk.rwm. IN A
;; ANSWER SECTION:
www.kk.rwm. 86400 IN A 163.16.63.191
...
# dig @163.16.63.191 www.kk.rwm
...
;; QUESTION SECTION:
;www.kk.rwm. IN A
;; ANSWER SECTION:
www.kk.rwm. 86400 IN A 163.16.63.191
...
---------------------------------windows10測試
ipv4網卡,慣用伺服器:163.16.63.191
C:\Users\User>nslookup
DNS request timed out.
timeout was 2 seconds.
預設伺服器: UnKnown
Address: 163.16.63.191
>
> www.kk.rwm
伺服器: UnKnown
Address: 163.16.63.191
名稱: www.kk.rwm
Address: 163.16.63.191
>
> www.google.com
伺服器: UnKnown
Address: 163.16.63.191
未經授權的回答:
名稱: www.google.com
Addresses: 2404:6800:4008:c05::93
172.217.17.196
>
> exit