centos7 use bind dns server set up domain name

Article Source:

https://cshihong.github.io/2018/10/15/DNS%E6%9C%8D%E5%8A%A1%E5%99%A8%E6%90%AD%E5%BB%BA%E4%B8%8E%E9%85%8D%E7%BD%AE/

 

Linux DNS server configuration under test

Configuring DNS Forward Analysis:

When configuring Bind service, mainly used in the following three profiles:

• The main configuration file (the /etc/named.conf) : used to define bind to run the service program.

• Zone configuration file (/etc/named.rfc1912.zones) : used to save names and IP addresses corresponding to the location relations. Similar to the book catalog, to a specific location for each domain and the corresponding IP address belongs to, when you need to view or modify, in accordance with relevant documents can be found in this location.

• Data configuration file directory (/ var / named) : the directory used to save the real correspondence between domain names and IP address data configuration file.

The first step: Modify the main configuration file the /etc/named.conf . The listen address and address are changed to run queries any, represent all IP addresses on the server can provide DNS domain name resolution services, and allow everyone to send DNS queries to this server.

 

Figure: the main configuration file to be modified where

 

Step Two: Modify zone configuration file (/etc/named.rfc1912.zones) . To save names and IP addresses corresponding to the location relations. In this file, we define the domain name and IP address resolution to save the rule file location and type of service content, but does not contain a specific domain name, IP address correspondence information relations. There are three service types, namely hint (root region), master (main area), slave (auxiliary area), which commonly refers to the master and slave master and slave.

copy

1 2 3

zone "example.com" IN { type master; file "example.com.zone";

DNS is the default port 53 TCP and UPD, UDP is for users to query from the master copy with TCP and UDP port 53 are used.

BIND's ACL: bind has four built-acl:

　　 none: no host

　　 any: any host

　　 localhost: Native

　　 localnet: IP masking operation with the machine of the network addresses obtained

　　 Note: You can define, after use; therefore generally defined in the configuration file, located in front of the options, of course, also be customized as follows

　　 ACL and {

​ 　　192.168.25.0/24

　　 } ;

Access control:

　　Access control instructions: allow-query {}: host allows query; whitelist

　　　　　　　　　　 allow-transfer {}: zone transfer allows the host; (white list, generally used for master-slave)

　　　　　　　　　　 allow-recursion {}: allow recursive host is recommended to use the global

　　　　　　　　　　 allow-update {}: allowing updates to the database area

The third step: configuration file editing data. ** Copy the template file (named.localhost) a positive resolution from the / var / named directory, and the data corresponding to the domain name and IP address of the data to fill in the configuration file and save. Remember when the -a parameter copying, which can retain information owner, owning group, permissions and other attributes of the original file, so that bind service program successfully read the contents of the file:

copy

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

[the named the root @ localhost] # CP -a named.localhost the example.com [the named the root @ localhost] # Vim example.com.zone $ the TTL 1D @ @ the IN the example.com the SOA (. # authorization information Start: #DNS region address followed by a domain administrator can also add a mailbox address, not add @, was used instead.. 20,181,001; serial # update sequence number 1D; Refresh # update IH; the retry # retry 1W; the expire # expiration time 3H); Minimum # invalid resolution records of cache time NS ns.example.com. address #DNS area ns a 192.168.245.128 # address records the WWW a 192.168.245.128 #www site record mail a 192.168.245.129 # address records MX 10 mail.example .com. #-mail exchange record for example.com. A 192.168.245.200 # Even without writing the host name, DNS can resolve to another address specified by $ GENERATE A $ 1-245 Server 1.1.1 $. # If too many servers, host name corresponding to a lot, you can write this example: # server1.example.com correspondence address: 1.1.1.1 # server100.exmaple.com correspondence address: 1.1.1.50 BBS a CNAME www # alias records * A 192.168.245.128 # "*" represents all, even if the wrong www host, the DNS It can be correctly parsed. This is the Pan-domain name resolution

 

Figure: Forward parsing configuration files

 

Step 4: Check the configuration, restart the service and testing.

Check and restart the service:

copy

1 2 3 4 5 6 7 8 9 10 11

[root@localhost ~]# named-checkconf #检查主配置文件语法 [root@localhost ~]# named-checkzone eample.com /var/named/example.com.zone #检查区域配置文件语法 /var/named/example.com.zone:13: ignoring out-of-zone data (example.com) zone eample.com/IN: loaded serial 20181001 [root@localhost ~]# vi /etc/resolv.conf #进入该配置文件，指定使用的域名解析服务器。 # Generated by NetworkManager nameserver 192.168.245.128 search 192.168.245.128 [root@localhost ~]# systemctl restart named #重启服务

测试：

图；正向解析测试

 

nslookup测试

 

配置DNS反向解析：

在DNS域名解析服务中，反向解析的作用是将用户提交的IP地址解析为对应的域名信息，它一般用于对某个IP地址上绑定的所有域名进行整体屏蔽，屏蔽由某些域名发送的垃圾邮件。它也可以针对某个IP地址进行反向解析，大致判断出有多少个网站运行在上面。当购买虚拟主机时，可以使用这一功能验证虚拟主机提供商是否有严重的超售问题。

第一步：配置区域文件。

反向解析是把IP地址解析成域名格式，因此在定义zone（区域）时应该要把IP地址反写，比如原来是192.168.10.0，反写后应该就是10.168.192，而且只需写出IP地址的网络位即可。

复制

1 2 3 4 5 6

[root@localhost ~]# vim /etc/named.rfc1912.zones #在中添加反向数据文件的记录 zone "245.168.192.in-addr.arpa" IN { type master; file "245.168.192.arpa"; };

第二步：编辑数据配置文件。

反向解析是把IP地址解析成域名格式，因此在定义zone（区域）时应该要把IP地址反写，比如原来是192.168.10.0，反写后应该就是10.168.192，而且只需写出IP地址的网络位即可。

复制

1 2 3 4

[root@localhost ~]# cp -a /var/named/named.loopback /var/named/245.168.192.arpa [root@localhost ~]# vi /var/named/245.168.192.arpa #编辑反正配置文件即可，和正向解析格式类似 #PTR为指针记录，仅用于反向解析中。

 

图：反向配置文件

 

第三步：检查配置文件，重启服务，测试。

复制

1 2 3 4 5

[root@localhost ~]# named-checkconf [root@localhost ~]# named-checkzone 245.168.192 /var/named/245.168.192.arpa zone 245.168.192/IN: loaded serial 20181001 OK [root@localhost ~]# systemctl restart named