bind 安装手册

mrjbydd 2011-08-15

展开全文

bind 安装手册

来源: ChinaUnix博客　日期： 2007.10.12 16:00　(共有0条评论) 我要评论

1.2. 安装
安装
$ ./configure --prefix=/usr/local/bind
$ make depend
$ make
$ make install
创建链接
$ mkdir -p /usr/local/bind/var/run
$ mkdir -p /usr/local/bind/var/named
$ mkdir -p /usr/local/bind/etc
$ touch /usr/local/bind/etc/named.conf
$ touch /usr/local/bind/etc/rndc.conf
$ ln -sf /usr/local/bind/etc/named.conf  /etc/named.conf
$ ln -sf /usr/local/bind/etc/rndc.conf /etc/rndc.conf
$ ln -sf /usr/local/bind/var/named    /var/named
$ ln -sf /usr/local/bind/sbin/rndc    /usr/sbin/rndc
$ ln -sf /usr/local/bind/sbin/named    /usr/sbin/named
1.3. 配置 DNS
1.3.1. BIND 的配置
1.3.2. DNS区域文件的配置
1.3.1. BIND 的配置
创建密钥
$ cd /usr/local/bind
$ sbin/dnssec-keygen -a hmac-md5 -b 128 -n HOST worldhello.
  为 BIND 提供了一种安全机制——TSIG（Transaction SIGnatures ），使用共享密钥进行安全的DNS通知、更新。
生成的密钥文件 K*****.key, K*****.private。其中*.private文件包含的 Key: ******* 即为共享密钥。

创建配置文件：etc/rndc.conf
rndc: 远程域名服务控制器（The remote name daemon control:rndc）。是管理员用来控制域名服务器的应用程序，用于动态加载、停止、配置 DNS服务。它需要的配置文件为 /etc/rndc.conf：
key worldhello. {
   algorithm "hmac-md5";
   secret "nvNpPbfDZixmFzqSUVJn6w==";
};
options {
   default-server localhost;
   default-key worldhello. ;
};
server localhost {
      key worldhello. ;
};
  共享密钥。用于和受控DNS服务器之间完成认证。

  管理的DNS主机名称。本例为管理本机。

创建配置文件：etc/named.conf
named.conf 是域名服务器的主配置文件。zone 是配置文件中的最重要的组成部分，描述了一个授权域名下的域名解析信息。一个复杂的配置例子如下：
key worldhello. {
   algorithm "hmac-md5";
   secret "nvNpPbfDZixmFzqSUVJn6w==";
};
controls {
inet 127.0.0.1 allow { localhost; } keys { worldhello.; };
};
acl bogus-nets { 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8;};
acl our-inner-nets { 127.0.0.1/32; 10.0.0.0/8; };
acl our-outer-nets { 192.168.0.0/16; };
acl transfer-inner-ips { 10.0.0.2; };
acl transfer-outer-ips { 192.168.0.2; };
options {
      version "$Id, worldhello.net";
      directory "/var/named";
      allow-query { any; };
      allow-recursion { our-inner-nets; our-outer-nets; };
      blackhole { bogus-nets; };
      notify yes;
      recursion yes;
      forward first;
      forwarders{
            202.106.0.20;
      };
      listen-on-v6  { none; };
      auth-nxdomain no;
};
view "internal" {
      match-clients { our-inner-nets; };
      recursion yes;
      zone "0.0.127.in-addr.arpa"{
            type master;
            file "named.local";
            notify no;
      };
      zone "0.0.10.in-addr.arpa"{
            type master;
            file "named.10.0.0";
            notify yes;
            allow-transfer{ transfer-inner-ips; };
      };
      zone "worldhello.net"{
            type master;
            file "named.inner.worldhello.net";
            allow-query { any; };
            allow-transfer{ transfer-inner-ips; };
            notify yes;
      };
};
view "external" {
      match-clients { any; };
      recursion no;
      zone "0.0.127.in-addr.arpa"{
            type master;
            file "named.local";
            notify no;
      };
      zone "0.0.10.in-addr.arpa"{
            type master;
            file "named.10.0.0";
            notify yes;
            allow-transfer{ transfer-inner-ips; };
      };
      zone "worldhello.net"{
            type master;
            file "named.outer.worldhello.net";
            allow-query { any; };
            allow-transfer{ transfer-outer-ips; };
            notify yes;
      };
};
  共享密钥。只有和改共享密钥匹配的主机，方能管理 DNS 服务器。

  非法的网络地址。对于非法地址，拒绝提供服务。

  内部网络地址范围。

  私有的外部网络地址范围。（示例）

  内部的辅DNS服务器地址。用于和辅DNS服务器通讯，同步DNS信息。

  外部的辅DNS服务器地址。用于和辅DNS服务器通讯，同步DNS信息。

  对于内网地址，和私有的外网地址，提供DNS的递归查询服务。

  递归查询时，如果本地的 cache 没有命中，则依次对 forwarders 中的主机进行DNS查询。

  view 提供了根据来访的地址范围，提供不同的服务。该 internal 视图为本地提供解析服务。

  localhost 的反相解析域

  10.0.0 网段的反相解析域

  worldhello.net 在内部网的域名解析域

  outerview 视图为外部提供解析服务。

  worldhello.net 在外部网的域名解析域

1.3.2. DNS区域文件的配置
/var/named/named.local
$TTL 3600
@             IN    SOA    localhost.    root.localhost. (
                     2001030801 ; serial
                     28800 ; refresh
                     14400 ; retry
                     3600000 ; expire
                     86400 ; default_ttl
                     )
@             IN    NS    localhost.
1             IN    PTR    localhost.
; End of File
/var/named/named.10.0.0
$TTL 3600
@             IN    SOA    ns1.worldhello.net.    johnson.worldhello.net. (
                     2001030801 ; serial
                     600 ; refresh
                     600 ; retry
                     3600000 ; expire
                     3400 ; default_ttl
                     )
@             IN    NS    ns1.worldhello.net.
@             IN    NS    ns2.worldhello.net.
1             IN    PTR    ns1.worldhello.net.
2             IN    PTR    ns2.worldhello.net.
10  IN    PTR    johnson.worldhello.net.
; End of File
/var/named/named.inner.worldhello.net
$TTL          3600
@             IN    SOA    ns1.worldhello.net.    johnson.worldhello.net. (
                     2001021802 ; serial
                     300 ; refresh
                     300 ; retry
                     7200000 ; expire
                     3600 ; default_ttl
                     )
@             IN    NS    ns1.worldhello.net.
@             IN    NS    ns2.worldhello.net.
@             IN    MX    5    mail.worldhello.net.
@             IN    MX    10    mail2.worldhello.net.
@             IN    A    10.0.0.1
localhost    IN    A    127.0.0.1
ns1          IN    A    10.0.0.1
ns2          IN    A    10.0.0.2
johnson       IN    A    10.0.0.10
www          IN    A    10.0.0.1
mail  IN A 10.0.0.2
mail2  IN A 10.0.0.3
*  IN    CNAME johnson
/var/named/named.outer.worldhello.net
$TTL          3600
@             IN    SOA    ns1.worldhello.net.    johnson.worldhello.net. (
                     2001021802 ; serial
                     300 ; refresh
                     300 ; retry
                     7200000 ; expire
                     3600 ; default_ttl
                     )
@             IN    NS    ns1.worldhello.net.
@             IN    NS    ns2.worldhello.net.
@             IN    MX    5    mail.worldhello.net.
@             IN    MX    10    mail2.worldhello.net.
@             IN    A    192.169.0.100
localhost    IN    A    127.0.0.1
ns1          IN    A    192.168.0.1
ns2          IN    A    192.168.0.2
www          IN    A    192.168.0.1
johnson       IN    A    192.168.0.10
mail  IN A 192.168.0.2
mail2  IN A 192.168.0.3
/var/named/named.192.168.0
$TTL 3600
@             IN    SOA    ns1.worldhello.net.    johnson.worldhello.net. (
                     2001030801 ; serial
                     600 ; refresh
                     600 ; retry
                     3600000 ; expire
                     3400 ; default_ttl
                     )
@             IN    NS    ns2.worldhello.net.
@             IN    NS    ns1.worldhello.net.
1             IN    PTR    ns1.worldhello.net.
2             IN    PTR    ns2.worldhello.net.
10             IN    PTR    johnson.worldhello.net.
; End of File
1.4. 启动 DNS
创建启动文件 /etc/rc.d/inet.d/named
#!/bin/sh
#
# named          This shell script takes care of starting and stopping
#                named (BIND DNS server).
#
# chkconfig: 345 55 45
# description: named (BIND) is a Domain Name Server (DNS) \
# that is used to resolve host names to IP addresses.
# probe: true
# Source function library.
. /etc/rc.d/init.d/functions
# Source networking configuration.
. /etc/sysconfig/network
# Check that networking is up.
[ ${NETWORKING} = "no" ] && exit 0
[ -f /usr/sbin/named ] || exit 0
[ -f /etc/named.conf ] || exit 0
# See how we were called.
case "$1" in
  start)
      # Start daemons.
      echo -n "Starting named: "
      daemon named
      echo
      touch /var/lock/subsys/named
      ;;
  stop)
      # Stop daemons.
      echo -n "Shutting down named: "
      killproc named
      rm -f /var/lock/subsys/named
      echo
      ;;
  status)
      /usr/sbin/rndc status
      exit $?
      ;;
  restart)
      /usr/sbin/rndc restart
      exit $?
      ;;
  reload)
      /usr/sbin/rndc reload
      exit $?
      ;;
  probe)
      # named knows how to reload intelligently; we don't want linuxconf
      # to offer to restart every time
      /usr/sbin/rndc reload >/dev/null 2>&1 || echo start
      exit 0
      ;;
  *)
      echo "Usage: named {start|stop|status|restart}"
      exit 1
esac
exit 0
创建 symbollink
$ ln -s /etc/rc.d/init.d/named  /etc/rc.d/rc0.d/K45named
$ ln -s /etc/rc.d/init.d/named  /etc/rc.d/rc1.d/K45named
$ ln -s /etc/rc.d/init.d/named  /etc/rc.d/rc2.d/K45named
$ ln -s /etc/rc.d/init.d/named  /etc/rc.d/rc3.d/S55named
$ ln -s /etc/rc.d/init.d/named  /etc/rc.d/rc4.d/S55named
$ ln -s /etc/rc.d/init.d/named  /etc/rc.d/rc5.d/S55named
$ ln -s /etc/rc.d/init.d/named  /etc/rc.d/rc6.d/K45named
启动
$ tail -f /var/log/message &
$ /etc/rc.d/init.d/named start
2.1. 检查
$ sbin/named-checkconf
$ sbin/named-checkzone
2.2. nslookup
$ nslookup - 127.0.0.1
> set all
...
> ns1.worldhello.net.
...
> set query=any
> worldhello.net.
...
> set query=ptr
> 10.0.0.1
...
> set class=CHAOS
> version.bind
...