来源: ChinaUnix博客 日期： 2007.10.12 16:00 (共有0条评论)
我要评论1.2. 安装
安装
$ ./configure --prefix=/usr/local/bind
$ make depend
$ make
$ make install
创建链接
$ mkdir -p /usr/local/bind/var/run
$ mkdir -p /usr/local/bind/var/named
$ mkdir -p /usr/local/bind/etc
$ touch /usr/local/bind/etc/named.conf
$ touch /usr/local/bind/etc/rndc.conf
$ ln -sf /usr/local/bind/etc/named.conf /etc/named.conf
$ ln -sf /usr/local/bind/etc/rndc.conf /etc/rndc.conf
$ ln -sf /usr/local/bind/var/named /var/named
$ ln -sf /usr/local/bind/sbin/rndc /usr/sbin/rndc
$ ln -sf /usr/local/bind/sbin/named /usr/sbin/named
1.3. 配置 DNS
1.3.1. BIND 的配置
1.3.2. DNS区域文件的配置
1.3.1. BIND 的配置
创建密钥
$ cd /usr/local/bind
$ sbin/dnssec-keygen -a hmac-md5 -b 128 -n HOST worldhello.
为 BIND 提供了一种安全机制——TSIG（Transaction SIGnatures ），使用共享密钥进行安全的DNS通知、更新。
生成的密钥文件 K*****.key, K*****.private。其中*.private文件包含的 Key: ******* 即为共享密钥。
创建配置文件：etc/rndc.conf
rndc: 远程域名服务控制器（The remote name daemon control:rndc）。是管理员用来控制域名服务器的应用程序，用于动态加载、停止、配置 DNS服务。它需要的配置文件为 /etc/rndc.conf：
key worldhello. {
algorithm "hmac-md5";
secret "nvNpPbfDZixmFzqSUVJn6w==";
};
options {
default-server localhost;
default-key worldhello. ;
};
server localhost {
key worldhello. ;
};
共享密钥。用于和受控DNS服务器之间完成认证。
管理的DNS主机名称。本例为管理本机。
创建配置文件：etc/named.conf
named.conf 是域名服务器的主配置文件。zone 是配置文件中的最重要的组成部分，描述了一个授权域名下的域名解析信息。一个复杂的配置例子如下：
key worldhello. {
algorithm "hmac-md5";
secret "nvNpPbfDZixmFzqSUVJn6w==";
};
controls {
inet 127.0.0.1 allow { localhost; } keys { worldhello.; };
};
acl bogus-nets { 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8;};
acl our-inner-nets { 127.0.0.1/32; 10.0.0.0/8; };
acl our-outer-nets { 192.168.0.0/16; };
acl transfer-inner-ips { 10.0.0.2; };
acl transfer-outer-ips { 192.168.0.2; };
options {
version "$Id, worldhello.net";
directory "/var/named";
allow-query { any; };
allow-recursion { our-inner-nets; our-outer-nets; };
blackhole { bogus-nets; };
notify yes;
recursion yes;
forward first;
forwarders{
202.106.0.20;
};
listen-on-v6 { none; };
auth-nxdomain no;
};
view "internal" {
match-clients { our-inner-nets; };
recursion yes;
zone "0.0.127.in-addr.arpa"{
type master;
file "named.local";
notify no;
};
zone "0.0.10.in-addr.arpa"{
type master;
file "named.10.0.0";
notify yes;
allow-transfer{ transfer-inner-ips; };
};
zone "worldhello.net"{
type master;
file "named.inner.worldhello.net";
allow-query { any; };
allow-transfer{ transfer-inner-ips; };
notify yes;
};
};
view "external" {
match-clients { any; };
recursion no;
zone "0.0.127.in-addr.arpa"{
type master;
file "named.local";
notify no;
};
zone "0.0.10.in-addr.arpa"{
type master;
file "named.10.0.0";
notify yes;
allow-transfer{ transfer-inner-ips; };
};
zone "worldhello.net"{
type master;
file "named.outer.worldhello.net";
allow-query { any; };
allow-transfer{ transfer-outer-ips; };
notify yes;
};
};
共享密钥。只有和改共享密钥匹配的主机，方能管理 DNS 服务器。
非法的网络地址。对于非法地址，拒绝提供服务。
内部网络地址范围。
私有的外部网络地址范围。（示例）
内部的辅DNS服务器地址。用于和辅DNS服务器通讯，同步DNS信息。
外部的辅DNS服务器地址。用于和辅DNS服务器通讯，同步DNS信息。
对于内网地址，和私有的外网地址，提供DNS的递归查询服务。
递归查询时，如果本地的 cache 没有命中，则依次对 forwarders 中的主机进行DNS查询。
view 提供了根据来访的地址范围，提供不同的服务。该 internal 视图为本地提供解析服务。
localhost 的反相解析域
10.0.0 网段的反相解析域
worldhello.net 在内部网的域名解析域
outerview 视图为外部提供解析服务。
worldhello.net 在外部网的域名解析域
1.3.2. DNS区域文件的配置
/var/named/named.local
$TTL3600
@ IN SOA localhost. root.localhost. (
2001030801 ; serial
28800 ; refresh
14400 ; retry
3600000 ; expire
86400 ; default_ttl
)
@ IN NS localhost.
1 IN PTR localhost.
; End of File
/var/named/named.10.0.0
$TTL3600
@ IN SOA ns1.worldhello.net. johnson.worldhello.net. (
2001030801 ; serial
600 ; refresh
600 ; retry
3600000 ; expire
3400 ; default_ttl
)
@ IN NS ns1.worldhello.net.
@ IN NS ns2.worldhello.net.
1 IN PTR ns1.worldhello.net.
2 IN PTR ns2.worldhello.net.
10 IN PTR johnson.worldhello.net.
; End of File
/var/named/named.inner.worldhello.net
$TTL 3600
@ IN SOA ns1.worldhello.net. johnson.worldhello.net. (
2001021802 ; serial
300 ; refresh
300 ; retry
7200000 ; expire
3600 ; default_ttl
)
@ IN NS ns1.worldhello.net.
@ IN NS ns2.worldhello.net.
@ IN MX 5 mail.worldhello.net.
@ IN MX 10 mail2.worldhello.net.
@ IN A 10.0.0.1
localhost IN A 127.0.0.1
ns1 IN A 10.0.0.1
ns2 IN A 10.0.0.2
johnson IN A 10.0.0.10
www IN A 10.0.0.1
mail IN A 10.0.0.2
mail2 IN A 10.0.0.3
* IN CNAME johnson
/var/named/named.outer.worldhello.net
$TTL 3600
@ IN SOA ns1.worldhello.net. johnson.worldhello.net. (
2001021802 ; serial
300 ; refresh
300 ; retry
7200000 ; expire
3600 ; default_ttl
)
@ IN NS ns1.worldhello.net.
@ IN NS ns2.worldhello.net.
@ IN MX 5 mail.worldhello.net.
@ IN MX 10 mail2.worldhello.net.
@ IN A 192.169.0.100
localhost IN A 127.0.0.1
ns1 IN A 192.168.0.1
ns2 IN A 192.168.0.2
www IN A 192.168.0.1
johnson IN A 192.168.0.10
mail IN A 192.168.0.2
mail2 IN A 192.168.0.3
/var/named/named.192.168.0
$TTL3600
@ IN SOA ns1.worldhello.net. johnson.worldhello.net. (
2001030801 ; serial
600 ; refresh
600 ; retry
3600000 ; expire
3400 ; default_ttl
)
@ IN NS ns2.worldhello.net.
@ IN NS ns1.worldhello.net.
1 IN PTR ns1.worldhello.net.
2 IN PTR ns2.worldhello.net.
10 IN PTR johnson.worldhello.net.
; End of File
1.4. 启动 DNS
创建启动文件 /etc/rc.d/inet.d/named
#!/bin/sh
#
# named This shell script takes care of starting and stopping
# named (BIND DNS server).
#
# chkconfig: 345 55 45
# description: named (BIND) is a Domain Name Server (DNS) \
# that is used to resolve host names to IP addresses.
# probe: true
# Source function library.
. /etc/rc.d/init.d/functions
# Source networking configuration.
. /etc/sysconfig/network
# Check that networking is up.
[ ${NETWORKING} = "no" ] && exit 0
[ -f /usr/sbin/named ] || exit 0
[ -f /etc/named.conf ] || exit 0
# See how we were called.
case "$1" in
start)
# Start daemons.
echo -n "Starting named: "
daemon named
echo
touch /var/lock/subsys/named
;;
stop)
# Stop daemons.
echo -n "Shutting down named: "
killproc named
rm -f /var/lock/subsys/named
echo
;;
status)
/usr/sbin/rndc status
exit $?
;;
restart)
/usr/sbin/rndc restart
exit $?
;;
reload)
/usr/sbin/rndc reload
exit $?
;;
probe)
# named knows how to reload intelligently; we don't want linuxconf
# to offer to restart every time
/usr/sbin/rndc reload >/dev/null 2>&1 || echo start
exit 0
;;
*)
echo "Usage: named {start|stop|status|restart}"
exit 1
esac
exit 0
创建 symbollink
$ ln -s /etc/rc.d/init.d/named /etc/rc.d/rc0.d/K45named
$ ln -s /etc/rc.d/init.d/named /etc/rc.d/rc1.d/K45named
$ ln -s /etc/rc.d/init.d/named /etc/rc.d/rc2.d/K45named
$ ln -s /etc/rc.d/init.d/named /etc/rc.d/rc3.d/S55named
$ ln -s /etc/rc.d/init.d/named /etc/rc.d/rc4.d/S55named
$ ln -s /etc/rc.d/init.d/named /etc/rc.d/rc5.d/S55named
$ ln -s /etc/rc.d/init.d/named /etc/rc.d/rc6.d/K45named
启动
$ tail -f /var/log/message &
$ /etc/rc.d/init.d/named start
2.1. 检查
$ sbin/named-checkconf
$ sbin/named-checkzone
2.2. nslookup
$ nslookup - 127.0.0.1
> set all
...
> ns1.worldhello.net.
...
> set query=any
> worldhello.net.
...
> set query=ptr
> 10.0.0.1
...
> set class=CHAOS
> version.bind
...
