bind子域名服务器和辅助域名服务器的配置 [ 网站地图 ]

发表于:2009-10-26 浏览:331 作者: 来源:互联网

关键字:域名服务器,BIND,辅助域名服务器,子域名服务器

描述:一、规划说明: 主机A:双网卡 192.168.1.7-->mydomain.org主域名服务器 192.168.10.7-->myzone.org主域名服务器,其有两个子域,为market.myzone.org和develog.myzone.org 主机B:双网卡 192.1

一、规划说明:

主机A: 双网卡

192.168.1.7 --> mydomain.org主域名服务器

192.168.10.7 --> myzone.org主域名服务器,其有两个子域,为market.myzone.org和develog.myzone.org

主机B:双网卡

192.168.1.6 --> mydomain.org辅助域名服务器

192.168.10.6 --> market.myzone.org子域名服务器

两台服务器均有DNS独立的日志,用以记录查询(query_logs)记录和错误(err_logs)记录,以便于DNS后期管理;本文不过多涉及安全方面的问题。安装过程请参照另一篇文章“Bind 9.4.0rc2安装笔记(一步步学习配置简易DNS)”。

二、主机A:

1. 主配置文件/etc/named.conf

options {

directory "/var/named/";

version "0.0.0";

};

logging {

channel dns_errors

{ file "/var/log/named/err_logs" versions 3 size 10m;

severity error;

print-category yes;

print-severity yes;

print-time yes;

};

channel dns_queries

{ file "/var/log/named/query_logs" versions 3 size 10m;

severity info;

print-category yes;

print-severity yes;

print-time yes;

};

category default { dns_errors; };

category queries { dns_queries; };

};

zone "." {

type hint;

file "named.ca";

};

zone "localhost" {

type master;

file "named.local";

};

zone "0.0.127.IN-addr.arpa" {

type master;

file "named.rev";

};

zone "mydomain.org" {

type master;

file "mydomain.org.zone";

allow-transfer { 192.168.1.6/32; };

};

zone "myzone.org" {

type master;

file "myzone.org.zone";

allow-transfer { 192.168.10.0/24; };

};

zone "10.168.192.in-addr.arpa" {

type master;

file "192.168.10.zone";

allow-transfer { 192.168.10.0/24; };

};

zone "1.168.192.in-addr.arpa" {

type master;

file "192.168.1.zone";

allow-transfer { 192.168.1.6/32; };

};

key "rndc-key" {

algorithm hmac-md5;

secret "oKLRLl8BolNj883OX1YcxQ==";

};

controls {

inet 127.0.0.1 port 953

allow { 127.0.0.1; } keys { "rndc-key"; };

};

# End of named.conf

2.域mydomain.org的正向解析文件/var/named/mydomain.org.zone$TTL 1D

$ORIGIN mydomain.org.

@    1D   IN   SOA   mydomain.org.  root.mail.mydomain.org. (

20070301

1H

15M

1W

1D )

IN   NS   ns.mydomain.org.

IN   MX 10  mail.mydomain.org.

mydomain.org.  IN   A    192.168.1.7   #泛域名解析

ns       IN   A    192.168.1.7

mail      IN   A    192.168.1.100

www       IN   CNAME  mail

ftp       IN   CNAME  mail

3.域mydomain.org的反向解析文件/var/named/192.168.1.zone

$TTL 1D

@    1D   IN   SOA   mydomain.org.  root.mail.mydomain.org. (

20070301

1H

15M

1W

1D )

IN   NS   ns.mydomain.org.

7        IN   PTR   marion.org.

7        IN   PTR   ns.mydomain.org.

100       IN   PTR   mail.mydomain.org.

4.域myzone.org的正向解析文件/var/named/myzone.org.zone

# more /var/named/myzone.org.zone

$TTL 1D

$ORIGIN myzone.org.

@    1D   IN   SOA   myzone.org.   root.mail.myzone.org. (

20070301

1H

15M

1W

1D )

IN   NS   ns.myzone.org.

IN   MX 10  mail.myzone.org.

myzone.org.   IN   A    192.168.10.7

ns       IN   A    192.168.10.7

mail      IN   A    192.168.10.5

www       IN   CNAME  mail

ftp       IN   CNAME  mail

market     IN   NS   ns.market     #指明授权的子域market

ns.market    IN   A    192.168.10.6

$ORIGIN develop.myzone.org.   #指明授权的子域develop,和上一种方法稍有不同.

IN   NS   ns.develop.myzone.org.

ns       IN   A    192.168.10.2

5.域myzone.org的反向解析文件/var/named/192.168.10.zone$TTL 1D

@    1D   IN   SOA   myzone.org.   root.mail.myzone.org. (

20070301

1H

15M

1W

1D )

IN   NS   ns.myzone.org.

6        IN   PTR   ns.market.myzone.org

2        IN   PTR   ns.develop.myzone.org

7        IN   PTR   ns.myzone.org.

5        IN   PTR   mail.myzone.org.

7        IN   PTR   myzone.org.

{[csc:pagelist]}

三、主机B:

1.named主配置文件/etc/named.conf

options {

directory "/var/named/";

version "unknown";

forwarders { 192.168.1.7; };

};

logging {

channel dns_errors

{ file "/var/log/named/err_logs" versions 3 size 10m;

severity error;

print-category yes;

print-severity yes;

print-time yes;

};

channel dns_queries

{ file "/var/log/named/query_logs" versions 3 size 10m;

severity info;

print-category yes;

print-severity yes;

print-time yes;

};

category default { dns_errors; };

category queries { dns_queries; };

};

zone "." {

type hint;

file "named.ca";

};

zone "localhost" {

type master;

file "named.local";

};

zone "0.0.127.IN-addr.arpa" {

type master;

file "named.rev";

};

zone "mydomain.org" {

type slave;

file "mydomain.org.zone";

masters { 192.168.1.7; };

};

zone "1.168.192.in-addr.arpa" {

type slave;

file "192.168.1.zone";

masters { 192.168.1.7; };

};

zone "market.myzone.org" {

type master;

file "market.myzone.org.zone";

};

zone "10.168.192.in-addr.arpa" {

type master;

file "192.168.10.zone";

};

key "rndc-key" {

algorithm hmac-md5;

secret "NiBZCqWP0IsvMPuZpUKdog==";

};

controls {

inet 127.0.0.1 port 953

allow { 127.0.0.1; } keys { "rndc-key"; };

};

# End of named.conf

2.子域market.myzone.org的正向解析文件/var/named/market.myzone.org.zone$TTL 1D

$ORIGIN market.myzone.org.

@    1D   IN   SOA   market.myzone.org.   root.mail.market.myzone.org. (

20070301

1H

15M

1W

1D )

IN   NS   ns.market.myzone.org.

IN   MX 10  mail.market.myzone.org.

market.myzone.org.   IN   A    192.168.10.6

ns       IN   A    192.168.10.6

mail      IN   A    192.168.10.100

www       IN   CNAME  mail

3.子域market.myzone.org的反向解析文件/var/named/192.168.10.zone

$TTL 1D

@    1D   IN   SOA   myzone.org.   root.mail.myzone.org. (

20070301

1H

15M

1W

1D )

IN   NS   ns.myzone.org.

6        IN   PTR   ns.myzone.org.

100       IN   PTR   mail.myzone.org.

注:辅助域的解析文件将会由区域传送获得,不需要手动建立。如果你想要反复尝试区域传送的效果,请将TTL值改小。本机的如下所示:

4.域mydomain.org的正向解析文件/var/named/mydomain.org.zone

$ORIGIN .

$TTL 86400   ; 1 day

mydomain.org      IN SOA mydomain.org. root.mail.mydomain.org. (

20070301  ; serial

3600    ; refresh (1 hour)

900    ; retry (15 minutes)

604800   ; expire (1 week)

86400   ; minimum (1 day)

)

NS   ns.mydomain.org.

A    192.168.1.7

MX   10 mail.mydomain.org.

$ORIGIN mydomain.org.

ftp           CNAME  mail

mail          A    192.168.1.100

ns           A    192.168.1.7

www           CNAME  mail

5.域mydomain.org的反向解析文件/var/named/192.168.1.zone$ORIGIN .

$TTL 86400   ; 1 day

1.168.192.in-addr.arpa IN SOA mydomain.org. root.mail.mydomain.org. (

20070301  ; serial

3600    ; refresh (1 hour)

900    ; retry (15 minutes)

604800   ; expire (1 week)

86400   ; minimum (1 day)

)

NS   ns.mydomain.org.

$ORIGIN 1.168.192.in-addr.arpa.

100           PTR   mail.mydomain.org.

7            PTR   marion.org.

PTR   ns.mydomain.org.

四:测试结果

1.主机A:

#nslookup

> set type=NS

> market.myzone.org

Server:     127.0.0.1

Address:    127.0.0.1#53

Non-authoritative answer:

market.myzone.org    nameserver = ns.market.myzone.org.

Authoritative answers can be found from:

ns.market.myzone.org  internet address = 192.168.10.6

> myzone.org

Server:     127.0.0.1

Address:    127.0.0.1#53

myzone.org   nameserver = ns.myzone.org.

> mydomain.org

Server:     127.0.0.1

Address:    127.0.0.1#53

mydomain.org  nameserver = ns.mydomain.org.

>

2.主机B:

#nslookup

> set type=NS

> mydomain.org

Server:     127.0.0.1

Address:    127.0.0.1#53

mydomain.org  nameserver = ns.mydomain.org.

> myzone.org

Server:     127.0.0.1

Address:    127.0.0.1#53

Non-authoritative answer:

myzone.org   nameserver = ns.myzone.org.

Authoritative answers can be found from:

ns.myzone.org  internet address = 192.168.10.7

> market.myzone.org

Server:     127.0.0.1

Address:    127.0.0.1#53

market.myzone.org    nameserver = ns.market.myzone.org.


 


站长资讯网 做中国最丰富的资讯网站 沪ICP备05004089号