环境
操作系统：CentOS 7
IP地址：10.27.106.201
测试域名：aec.testuc.com
作用：主要提供解析aec.testuc.com域名的服务
安装
|
1
|
yum -y install bind |
修改配置文件
主配置文件
|
1
|
vim /etc/named.conf |
主要修改以下两个地方
|
1
2
3
|
listen-on port 53 { any; };allow-query { any; }; |
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
|
//// named.conf//// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS// server as a caching only nameserver (as a localhost DNS resolver only).//// See /usr/share/doc/bind*/sample/ for example named configuration files.//// See the BIND Administrator's Reference Manual (ARM) for details about the// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.htmloptions { listen-on port 53 { any; }; # listen-on port 53 { 127.0.0.1; }; listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; recursing-file "/var/named/data/named.recursing"; secroots-file "/var/named/data/named.secroots"; allow-query { any; }; # allow-query { localhost; }; /* - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. - If you are building a RECURSIVE (caching) DNS server, you need to enable recursion. - If your recursive DNS server has a public IP address, you MUST enable access control to limit queries to your legitimate users. Failing to do so will cause your server to become part of large scale DNS amplification attacks. Implementing BCP38 within your network would greatly reduce such attack surface */ recursion yes; dnssec-enable yes; dnssec-validation yes; /* Path to ISC DLV key */ bindkeys-file "/etc/named.root.key"; managed-keys-directory "/var/named/dynamic"; pid-file "/run/named/named.pid"; session-keyfile "/run/named/session.key";};logging { channel default_debug { file "data/named.run"; severity dynamic; };};zone "." IN { type hint; file "named.ca";};include "/etc/named.rfc1912.zones";include "/etc/named.root.key"; |
区域配置文件，添加正向解析配置
|
1
|
vim /etc/named.rfc1912.zones |
末尾添加如下配置：
|
1
2
3
4
5
|
zone "aec.starnetuc.com" IN { #正向解析为"aec.starnetuc.com" type master; #类型：主缓存为master file "aec.starnetuc.com.zone"; #指定区域数据文件为aec.starnetuc.com.zone allow-update { none; };}; |
正向区域数据文件
拷贝其他区域数据文件，保留源文件的权限和属主的属性复制
|
1
|
cp -a /var/named/named.localhost /var/named/aec.starnetuc.com.zone |
修改该文件，结果如下：
|
1
2
3
4
5
6
7
8
9
10
11
12
13
|
$TTL 1D #有效解析记录的生成周期@ IN SOA aec.starnetuc.com. root.aec.starnetuc.com. (#@表示当前的DNS区域名表示这个域名 #SOA表示授权信息开启 # 后面表示邮件地址因为@有特殊含义 所以使用.代替 0 ; serial #更新序列号，可以是10以内的整数 1D ; refresh #刷新时间，重新下载地址数据的间隔 1H ; retry #重试延迟，下载失败后的重试延迟 1W ; expire #失效时间，超过该时间仍无法下载则放弃 3H ) ; minimum #无效解析记录的生存周期 IN NS aec.starnetuc.com. #记录当前区域DNS服务器的名称 IN MX 10 aec.starnetuc.com. #MX为邮件服务器 10表示优先级 数字越大优先级越低 IN A 10.27.106.214 #记录正向解析域名对应的IP，即将域名与IP绑捆 |
检查配置是否正确
|
1
|
named-checkconf -z /etc/named.conf |
仅检查语法不检查逻辑关系。当显示的全为0时表示没有语法错误
|
1
2
3
4
5
6
|
zone localhost.localdomain/IN: loaded serial 0zone localhost/IN: loaded serial 0zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 0zone 1.0.0.127.in-addr.arpa/IN: loaded serial 0zone 0.in-addr.arpa/IN: loaded serial 0zone aec.starnetuc.com/IN: loaded serial 0 |
启动DNS服务
启动前，检查防火墙、SELINUX安全模式是否是关闭或允许状态
启动
|
1
2
|
systemctl start namedsystemctl enable named |
查看53号监听端口是否开启
测试
将测试系统的DNS改为10.27.106.201，然后去
|
1
2
3
4
5
6
|
ping aec.starnetuc.comPING aec.starnetuc.com (10.27.106.214) 56(84) bytes of data.64 bytes from 10.27.106.214 (10.27.106.214): icmp_seq=1 ttl=64 time=1024 ms64 bytes from 10.27.106.214 (10.27.106.214): icmp_seq=2 ttl=64 time=4.31 ms64 bytes from 10.27.106.214 (10.27.106.214): icmp_seq=3 ttl=64 time=5.53 ms |
表明配置成功。
到此这篇关于关于在Linux下如何搭建DNS服务器的文章就介绍到这了,更多相关Linux搭建DNS服务器内容请搜索服务器之家以前的文章或继续浏览下面的相关文章希望大家以后多多支持服务器之家！
原文链接：https://blog.csdn.net/clearlxj/article/details/130052740
