一，安装BIND
[root@localhost ~]# yum install bind bind-chroot bind-utils
Loaded plugins: product-id, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
cdrom | 4.1 kB ::
Resolving Dependencies
--> Running transaction check
---> Package bind.x86_64 :9.9.-.el7 will be installed
--> Processing Dependency: bind-libs = :9.9.-.el7 for package: :bind-9.9.-.el7.x86_64
--> Processing Dependency: libbind9.so.()(64bit) for package: :bind-9.9.-.el7.x86_64
--> Processing Dependency: libdns.so.()(64bit) for package: :bind-9.9.-.el7.x86_64
--> Processing Dependency: libisc.so.()(64bit) for package: :bind-9.9.-.el7.x86_64
--> Processing Dependency: libisccc.so.()(64bit) for package: :bind-9.9.-.el7.x86_64
--> Processing Dependency: libisccfg.so.()(64bit) for package: :bind-9.9.-.el7.x86_64
--> Processing Dependency: liblwres.so.()(64bit) for package: :bind-9.9.-.el7.x86_64
---> Package bind-chroot.x86_64 :9.9.-.el7 will be installed
---> Package bind-utils.x86_64 :9.9.-.el7 will be installed
--> Running transaction check
---> Package bind-libs.x86_64 :9.9.-.el7 will be installed
--> Finished Dependency Resolution Dependencies Resolved ==================================================================================================
Package Arch Version Repository Size
==================================================================================================
Installing:
bind x86_64 :9.9.-.el7 cdrom 1.8 M
bind-chroot x86_64 :9.9.-.el7 cdrom k
bind-utils x86_64 :9.9.-.el7 cdrom k
Installing for dependencies:
bind-libs x86_64 :9.9.-.el7 cdrom 1.0 M Transaction Summary
==================================================================================================
Install Packages (+ Dependent package) Total download size: 3.0 M
Installed size: 7.2 M
Is this ok [y/d/N]: y
Downloading packages:
--------------------------------------------------------------------------------------------------
Total MB/s | 3.0 MB ::
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : :bind-libs-9.9.-.el7.x86_64 /
Installing : :bind-9.9.-.el7.x86_64 /
Installing : :bind-chroot-9.9.-.el7.x86_64 /
Installing : :bind-utils-9.9.-.el7.x86_64 /
Verifying : :bind-9.9.-.el7.x86_64 /
Verifying : :bind-libs-9.9.-.el7.x86_64 /
Verifying : :bind-chroot-9.9.-.el7.x86_64 /
Verifying : :bind-utils-9.9.-.el7.x86_64 / Installed:
bind.x86_64 :9.9.-.el7 bind-chroot.x86_64 :9.9.-.el7
bind-utils.x86_64 :9.9.-.el7 Dependency Installed:
bind-libs.x86_64 :9.9.-.el7 Complete!
二，BIND配置
/etc/named.conf 主配置文件
/etc/named.rfc1912.zones 区域配置文件
/var/named/named.localhost 资源记录配置文件
1，编辑主配置文件
[root@localhost ~]# vim /etc/named.conf //
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
// options {
listen-on port { any; }; //将“127.0.0.1”改为any，可监听任何IP地址（域名服务器的IP）
listen-on-v6 port { ::; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; }; //将“localhost”改为any，代表允许任何主机查询 /*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes; dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto; /* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic"; pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
}; logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
}; zone "." IN {
type hint;
file "named.ca";
}; include "/etc/named.rfc1912.zones"; //区域配置文件
include "/etc/named.root.key";
2，编辑区域配置文件
[root@localhost ~]# vim /etc/named.rfc1912.zones // named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
zone "localhost.localdomain" IN {
type master;
file "named.localhost";
allow-update { none; };
}; zone "localhost" IN {
type master;
file "named.localhost";
allow-update { none; };
}; zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
}; zone "1.0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
}; zone "0.in-addr.arpa" IN {
type master;
file "named.empty";
allow-update { none; };
};
zone "kernel.org" IN { //"kernel.org"为域名
type master; //"master"代表主域名服务器
file "kernel.org.zone"; //"kernel.org.zone"为资源信息记录文件，在/var/named/目录下
allow-update { none; };
};
3，编辑资源信息文件
[root@localhost ~]# cp -a /var/named/named.localhost /var/named/kernel.org.zone
[root@localhost ~]# vim /var/named/kernel.org.zone $TTL 1D
@ IN SOA @ rname.invalid. ( //"@"表示域名，相当于"kernel.org"可替换成"kernel.org" "SOA"表示权威区域的开始 "rname.invalid."表示域名管理员邮箱
; serial //区域传送序列号
1D ; refresh //从服务器更新主服务器资源的时间
1H ; retry //"refresh"失败，重试的时间间隔
1W ; expire //从服务器过期时长
3H ) ; minimum //无效解析记录过期时长
NS ns.kernel.org. //域名服务器记录
ns IN A 192.168.16.20 //域名地址记录
IN MX 10 mail.kernel.org. //邮箱交换记录
www IN A 192.168.16.20 //加入一条资源信息，即"www.kernel.org"和"192.168.16.20"的对应关系
mail IN A 192.168.16.21
将DNS指向域名服务器IP地址
[root@localhost ~]# vim /etc/resolv.conf # Generated by NetworkManager
nameserver 192.168.16.20 //如果在其他客户端测试需要将其DNS地址更改为本域名服务器IP:"nameserver 192.168.16.20"
关闭SELinux、firewalld，清空防火墙
[root@localhost ~]# setenforce
[root@localhost ~]# getenforce
Permissive
[root@localhost ~]# systemctl stop firewalld
[root@localhost ~]# iptables -F
三，验证DNS
在另一台客户端查询“www.kernel.org”IP地址，需要将客户端DNS改为域名服务器IP地址
[root@localhost ~]# dig www.kernel.org ; <<>> DiG 9.9.-RedHat-9.9.-.el7 <<>> www.kernel.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
;; flags: qr aa rd ra; QUERY: , ANSWER: , AUTHORITY: , ADDITIONAL: ;; OPT PSEUDOSECTION:
; EDNS: version: , flags:; udp:
;; QUESTION SECTION:
;www.kernel.org. IN A ;; ANSWER SECTION:
www.kernel.org. IN A 192.168.16.20 ;; AUTHORITY SECTION:
kernel.org. IN NS ns.kernel.org. ;; ADDITIONAL SECTION:
ns.kernel.org. IN A 192.168.16.20 ;; Query time: msec
;; SERVER: 192.168.16.20#(192.168.16.20)
;; WHEN: Fri Feb :: CST
;; MSG SIZE rcvd:
查询“kernel.org”域的邮件记录
[root@localhost ~]# dig -t mx kernel.org ; <<>> DiG 9.9.-RedHat-9.9.-.el7 <<>> -t mx kernel.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
;; flags: qr aa rd ra; QUERY: , ANSWER: , AUTHORITY: , ADDITIONAL: ;; OPT PSEUDOSECTION:
; EDNS: version: , flags:; udp:
;; QUESTION SECTION:
;kernel.org. IN MX ;; AUTHORITY SECTION:
kernel.org. IN SOA kernel.org. rname.invalid. ;; Query time: msec
;; SERVER: 192.168.16.20#(192.168.16.20)
;; WHEN: Fri Feb :: CST
;; MSG SIZE rcvd: