失眠网 > CentOS7 搭建 DNS 域名解析服务器

CentOS7 搭建 DNS 域名解析服务器

时间：2020-11-15 07:06:33

1. 安装 BIND 服务器软件并启动

yum -y install bind bind-utilssystemctl start named.service // 启动服务systemctl enable named // 设为开机启动

1.1. 查看named进程是否正常启动

ps -eaf|grep named // 检查进程ss -nult|grep :53 // 检查监听端口

如图:

[root@localhost named]# ss -nltp |grep :53LISTEN010192.168.1.194:53 *:* users:(("named",pid=29998,fd=24))LISTEN010127.0.0.1:53 *:* users:(("named",pid=29998,fd=21))LISTEN010172.17.0.1:53 *:* users:(("named",pid=29998,fd=23))LISTEN010 ::1:53 :::* users:(("named",pid=29998,fd=22))

1.2. 开放 TCP 和 UDP 的 53 端口

firewall-cmd --permanent --add-port=53/tcpfirewall-cmd --permanent --add-port=53/udpfirewall-cmd --reload // 重新加载防火墙配置，让配置生效

2. DNS 服务的相关配置文件

2.1. 修改主要文件`/etc/named.conf`

修改前先备份：cp -p /etc/named.conf /etc/named.conf.bak// 参数-p表示备份文件与源文件的属性一致。

修改配置：vi /etc/named.conf，配置内容如下：

options {listen-on port 53 { any; };listen-on-v6 port 53 { any; };directory "/var/named";dump-file "/var/named/data/cache_dump.db";statistics-file "/var/named/data/named_stats.txt";memstatistics-file "/var/named/data/named_mem_stats.txt";allow-query{ any; };/*- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.- If you are building a RECURSIVE (caching) DNS server, you need to enablerecursion.- If your recursive DNS server has a public IP address, you MUST enable accesscontrol to limit queries to your legitimate users. Failing to do so willcause your server to become part of large scale DNS amplificationattacks. Implementing BCP38 within your network would greatlyreduce such attack surface*/recursion yes;dnssec-enable yes;dnssec-validation yes;/* Path to ISC DLV key */bindkeys-file "/etc/named.iscdlv.key";managed-keys-directory "/var/named/dynamic";pid-file "/run/named/named.pid";session-keyfile "/run/named/session.key";};logging {channel default_debug {file "data/named.run";severity dynamic;};};zone "." IN {type hint;file "named.ca";};include "/etc/named.rfc1912.zones";include "/etc/named.root.key";

named-checkconf // 检查named.conf是否有语法问题

2.2. 配置正向解析和反向解析

2.2.1. 修改/etc/named.rfc1912.zones

添加配置：vi /etc/named.rfc1912.zones，配置内容如下：

zone "ldky.xyz" IN {type master;file "ldky.xyz";allow-update { none; };};zone "1.168.192.in-addr.arpa" {type master;file "192.168.1";allow-update { none; };};

2.2.2. 添加正向解析域

基于 name.localhost 模板，创建配置文件：cp -p /var/named/named.localhost /var/named/ldky.xyz

配置正向域名解析文件 ldky.xyz ：vi /var/named/ldky.xyz，配置内容如下：

$TTL 1D@ IN SOA @ ldky.xyz. (0 ; serial1D; refresh1H; retry1W; expire3H ) ; minimum@ INNS dns1.ldky.xyz.dns1 INA 192.168.1.66jyyINA 192.168.1.90wwwINCNAME jyy.ldky.xyz.

说明：

jyy.ldky.xyz 将会解析为 192.168.1.90

检查区域文件是否正确named-checkzone "ldky.xyz" "/var/named/ldky.xyz"，如图：

[root@localhost named]# named-checkzone "ldky.xyz" "/var/named/ldky.xyz"zone ldky.xyz/IN: loaded serial 0OK

2.2.3. 添加反向解析域

基于 name.localhost 模板，创建配置文件：cp -p /var/named/named.localhost /var/named/192.168.1

配置反向域名解析文件 192.168.1 ：vi /var/named/192.168.1

$TTL 1D@ IN SOA @ ldky.xyz. (0 ; serial1D; refresh1H; retry1W; expire3H ) ; minimum@ IN NS dns1.ldky.xyz.66IN PTR dns1.ldky.xyz.90IN PTR jyy.ldky.xyz.

检查区域文件是否正确named-checkzone "1.168.192.in-addr.arpa" "/var/named/192.168.0"，如图：

[root@localhost named]# named-checkzone "1.168.192.in-addr.arpa" "/var/named/192.168.1"zone 1.168.192.in-addr.arpa/IN: loaded serial 0OK