关于在Linux下如何搭建DNS服务器

目录 环境 安装 修改配置文件 主配置文件 区域配置文件，添加正向解析配置 正向区域数据文件 启动DNS服务 测试

环境

操作系统：CentOS 7

IP地址：10.27.106.201

测试域名：aec.testuc.com

作用：主要提供解析aec.testuc.com域名的服务

安装

yum -y install bind

修改配置文件

主配置文件

vim /etc/named.conf

主要修改以下两个地方

listen-on port 53 { any; }; allow-query { any; }; // // named.conf // // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS // server as a caching only nameserver (as a localhost DNS resolver only). // // See /usr/share/doc/bind*/sample/ for example named configuration files. // // See the BIND Administrators Reference Manual (ARM) for details about the // configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html options { listen-on port 53 { any; }; # listen-on port 53 { 127.0.0.1; }; listen-on-v6 port 53 { ::1; }; directory “/var/named”; dump-file “/var/named/data/cache_dump.db”; statistics-file “/var/named/data/named_stats.txt”; memstatistics-file “/var/named/data/named_mem_stats.txt”; recursing-file “/var/named/data/named.recursing”; secroots-file “/var/named/data/named.secroots”; allow-query { any; }; # allow-query { localhost; }; /* – If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. – If you are building a RECURSIVE (caching) DNS server, you need to enable recursion. – If your recursive DNS server has a public IP address, you MUST enable access control to limit queries to your legitimate users. Failing to do so will cause your server to become part of large scale DNS amplification attacks. Implementing BCP38 within your network would greatly reduce such attack surface */ recursion yes; dnssec-enable yes; dnssec-validation yes; /* Path to ISC DLV key */ bindkeys-file “/etc/named.root.key”; managed-keys-directory “/var/named/dynamic”; pid-file “/run/named/named.pid”; session-keyfile “/run/named/session.key”; }; logging { channel default_debug { file “data/named.run”; severity dynamic; }; }; zone “.” IN { type hint; file “named.ca”; }; include “/etc/named.rfc1912.zones”; include “/etc/named.root.key”;

区域配置文件，添加正向解析配置

vim /etc/named.rfc1912.zones

末尾添加如下配置：

zone “aec.starnetuc.com” IN { #正向解析为”aec.starnetuc.com” type master; #类型：主缓存为master file “aec.starnetuc.com.zone”; #指定区域数据文件为aec.starnetuc.com.zone allow-update { none; }; };

正向区域数据文件

拷贝其他区域数据文件，保留源文件的权限和属主的属性复制

cp -a /var/named/named.localhost /var/named/aec.starnetuc.com.zone

修改该文件，结果如下：

$TTL 1D #有效解析记录的生成周期 @ IN SOA aec.starnetuc.com. root.aec.starnetuc.com. ( #@表示当前的DNS区域名表示这个域名 #SOA表示授权信息开启 # 后面表示邮件地址因为@有特殊含义 所以使用.代替 0 ; serial #更新序列号，可以是10以内的整数 1D ; refresh #刷新时间，重新下载地址数据的间隔 1H ; retry #重试延迟，下载失败后的重试延迟 1W ; expire #失效时间，超过该时间仍无法下载则放弃 3H ) ; minimum #无效解析记录的生存周期 IN NS aec.starnetuc.com. #记录当前区域DNS服务器的名称 IN MX 10 aec.starnetuc.com. #MX为邮件服务器 10表示优先级 数字越大优先级越低 IN A 10.27.106.214 #记录正向解析域名对应的IP，即将域名与IP绑捆

检查配置是否正确

named-checkconf -z /etc/named.conf

仅检查语法不检查逻辑关系。当显示的全为0时表示没有语法错误

zone localhost.localdomain/IN: loaded serial 0 zone localhost/IN: loaded serial 0 zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 0 zone 1.0.0.127.in-addr.arpa/IN: loaded serial 0 zone 0.in-addr.arpa/IN: loaded serial 0 zone aec.starnetuc.com/IN: loaded serial 0

启动DNS服务

启动前，检查防火墙、SELINUX安全模式是否是关闭或允许状态

启动

systemctl start named systemctl enable named

查看53号监听端口是否开启

测试

将测试系统的DNS改为10.27.106.201，然后去

ping aec.starnetuc.com PING aec.starnetuc.com (10.27.106.214) 56(84) bytes of data. 64 bytes from 10.27.106.214 (10.27.106.214): icmp_seq=1 ttl=64 time=1024 ms 64 bytes from 10.27.106.214 (10.27.106.214): icmp_seq=2 ttl=64 time=4.31 ms 64 bytes from 10.27.106.214 (10.27.106.214): icmp_seq=3 ttl=64 time=5.53 ms

表明配置成功。