解密RHEL5 DNS服务器

baobing

v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}

  Normal
  0
  false
  
  
  7.8 磅
  0
  2
  
  false
  false
  false
  
  EN-US
  ZH-CN
  X-NONE
  
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
  
  
   
   
   
   
   
   
   
   
   
   
   
  

  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  

/* Style Definitions */
table.MsoNormalTable
        {mso-style-name:普通表格;
        mso-tstyle-rowband-size:0;
        mso-tstyle-colband-size:0;
        mso-style-noshow:yes;
        mso-style-priority:99;
        mso-style-qformat:yes;
        mso-style-parent:"";
        mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
        mso-para-margin:0cm;
        mso-para-margin-bottom:.0001pt;
        mso-pagination:widow-orphan;
        font-size:10.5pt;
        mso-bidi-font-size:11.0pt;
        font-family:"Calibri","sans-serif";
        mso-ascii-font-family:Calibri;
        mso-ascii-theme-font:minor-latin;
        mso-hansi-font-family:Calibri;
        mso-hansi-theme-font:minor-latin;
        mso-font-kerning:1.0pt;}


  

Title：Fedora 8 and Red Hat
Enterprise Linux Bible
Chapter 25: Making Servers Public with DNS
Author：Christopher Negus（尼格斯.克里斯多佛）
任明哲 2008年9月25日翻译、整理
file:///C:/DOCUME%7E1/ADMINI%7E1/LOCALS%7E1/Temp/msohtmlclip1/01/clip_image001.gif
Making Servers Public with DNS
公共服务器DNS大曝光




  
  
  
  
  
  
  
  
  
  
  
  




Figure 1-1: The sample yourdomain.com
DNS server has a
combination of public servers and private client computers.
上图1-1中yourdomain.com域的DNS服务结合了服务器及客户端，是一个小型的网络环境。
The sections that follow describe how to set up a DNS
server for the example in Figure 25-1.
Quick-starting a DNS server
快速配置一个DNS服务
The DNS server software that comes with the current
Fedora and RHEL versions is Berkeley
Internet Name Domain (BIND) version 9. To configure BIND
9, you work with the following
components:
要配置DNS服务，首先应确定以下项目是否被正确地设定：
• Configuration
file (/var/named/chroot/etc/named.conf) ⎯ The main DNS
server configuration file. ------DNS的配置文件
• Zone directory
(/var/named/chroot/var/named) ⎯ The directory containing
files that keep information about Internet root DNS
servers (named.ca file) and
information about the zones that you create for your DNS
server. -------区域文件目录
• Daemon process
(/usr/sbin/named) ⎯ The daemon process that listens for DNS
requests and responds with information that the named.conf file presents. --------工作进程
• Debugging
tools (named-checkconf, and named-checkzone) ⎯ What you use to
determine whether you created your DNS configuration
correctly.---------调试工具
file:///C:/DOCUME%7E1/ADMINI%7E1/LOCALS%7E1/Temp/msohtmlclip1/01/clip_image008.gif
NOTE: Fedora and RHEL come
with a GUI tool for configuring Bind called system-config-bind.(Type yum install
system-config-bind to install it.) If you decide to use that tool, you need
to be careful editing the Bind configuration files by hand. It is recommended that
if there are changes you want to make to the named.conf file that are not supported by the system-config-bind window, you should put
those changes in the /etc/named.custom
file instead.

BIND 9 also includes tools for creating DNSSEC secured
zones. By using these tools, you can create and generate keys to provide authentication and
secure address resolution. The example illustrated in these sections doesn’t
include DNSSEC configuration.
The basic steps in creating a DNS server for your example
are as follows:
• Identifying your DNS
servers
• Creating DNS
Configuration files (named.conf
file and the named directory)
• Starting the named
daemon
• Monitoring named
activities
In the example configuration, you set up a primary master
DNS server and a slave DNS server.
The primary server holds the master copy of the
authoritative records for the domain. The
secondary server is there to share requests for
information about the domain, particularly in
case the primary goes down. The secondary typically gets
its records from the primary server.
The secondary is also considered to be authoritative in
regards to the DNS records for the
domains it controls.
1．Identifying your DNS servers
DNS配置步骤：确定你的DNS服务器基本信息
If you didn’t have your DNS servers set up at the time that you purchased
your domain name
with a registration authority, you might have just “parked” the domain
name there until you
configured your DNS servers. Whenever you’re ready to set up your DNS
servers, return to
that registration authority and provide the following information about
your DNS servers:
• DNS server IP
addresses (the static IP addresses of your DNS servers, probably primary
and slave)------确定DNS服务的IP地址，确保地址是静态的、固定地分配给DNS服务器
• DNS server hostnames
(often ns1.yourdomain.com, where you replace
yourdomain.com with your domain name for the primary; the slave hostname
is
ns2.yourdomain.com)------确定DNS的主机名，同样确保主机名是固定的，不易变得。
You should register both the primary and slave DNS servers. After you
update this record, that
information typically takes a day or two to propagate throughout the
Internet. When your DNS
servers are registered, you also need to tell the registration authority
to use those DNS servers
as the authority for addresses in your domain. The registration authority
probably offers an
online form you can fill out to identify your DNS servers.
2．Creating DNS configuration files
(named.conf and var/named)
创建DNS服务的配置文件(named.conf and var/named)
此例适合一个较小的办公环境。
Editing named.conf
The edited version of the /var/named/chroot/etc/named.conf
file is as follows:
file:///C:/DOCUME%7E1/ADMINI%7E1/LOCALS%7E1/Temp/msohtmlclip1/01/clip_image009.gif
options
{
directory
"/var/named";
dump-file
"/var/named/data/cache_dump.db";
statistics-file
"/var/named/data/named_stats.txt";
};
file:///C:/DOCUME%7E1/ADMINI%7E1/LOCALS%7E1/Temp/msohtmlclip1/01/clip_image010.gif
acl
"mylan" {
127/8; 10.0.0.0/24;
};
controls {
inet 127.0.0.1 allow
{ localhost; } keys { rndckey; };
};
view
"inside" {
match-clients
{ "mylan"; };
recursion
yes;
zone
"." IN {
type
hint;
file
"named.ca";
};
zone
"0.0.10.in-addr.arpa" IN {
type
master;
file
"yourlan.db";
};
file:///C:/DOCUME%7E1/ADMINI%7E1/LOCALS%7E1/Temp/msohtmlclip1/01/clip_image011.gif
zone "yourdomain.com" {
type
master;
file
"db.yourdomain.com.inside";
allow-transfer
{ 10.0.0.2; };
};
};
view
"outside" {
match-clients { any;
};
recursion no;
zone "."
IN {
type hint;
file
"named.ca";
};
zone "yourdomain.com" {
type master;
file "db.yourdomain.com.outside";
allow-transfer { 123.45.67.2;
};
};
};
include
"/etc/rndc.key";
关于view（DNS视图）的说明：
The DNS server is broken up into two views: inside and outside.
file:///C:/DOCUME%7E1/ADMINI%7E1/LOCALS%7E1/Temp/msohtmlclip1/01/clip_image012.gif
The inside view defines how IP addresses are resolved for requests
that come from the private LAN and localhost (as defined in mylan). By having recursion on (recursion yes), the named daemon will allow name
server queries to any domain (even domains that the local DNS server doesn't control)
from any computer on the LAN.
file:///C:/DOCUME%7E1/ADMINI%7E1/LOCALS%7E1/Temp/msohtmlclip1/01/clip_image013.gif
The outside view defines how
queries coming from all other places (presumably, the Internet) are handled.
With recursion off (recursion no), only queries from
other name servers for domains controlled by the local DNS server are honored.
Requests for information about other domains will be rejected with a not found message. (Turning recursion off can help
eliminate a common attack, where a cracker causes your server to seek
information from a DNS server controlled by the cracker.)
要保证在配置named.conf文件时不能有任何语法上的误差，否则将导致named不能正常加载服务文件。可在配置完成后使用以下命令检测配置文件的语法是否正确。
Be very careful editing the named.conf file. Forgetting a semicolon is all too easy, and
results in the entire file not loading. To ensure that
the named.conf file doesn’t contain
any
syntax errors, you can run the following command (as root
user):
file:///C:/DOCUME%7E1/ADMINI%7E1/LOCALS%7E1/Temp/msohtmlclip1/01/clip_image014.gif
#
named-checkconf

Setting up the zone files (inside)
The /var/named/chroot/var/named
directory contains the
zone files that the
/var/named/chroot/etc/named.conf
file points to. For
the example, you need to
create only three zone files from scratch. You can (and
should) leave the named.ca
file alone.
Most of the real work of the domain name server occurs in
the zone files. In the example, the
db.yourdomain.com.inside file contains the basic records for the yourdomain.com
domain, including all private names and addresses. The
following is an example of that file:

file:///C:/DOCUME%7E1/ADMINI%7E1/LOCALS%7E1/Temp/msohtmlclip1/01/clip_image015.gif
$TTL
86400
@       IN     SOA   yourdomain.com. hostmaster.yourdomain.com.
(
2007042701  ; Serial
28800        ;
Refresh
14400        ; Retry
3600000      ; Expire
86400 )      ; Minimum
; Name servers
IN NS ns1.yourdomain.com.
IN NS ns2.yourdomain.com.
; Mail server for
domain
IN MX 10 mail.yourdomain.com.
; Public servers
ns1 IN A 10.0.0.1
ns2 IN A 10.0.0.2
mail IN A
123.45.67.2
www IN A 123.45.67.3
ftp IN A 123.45.67.4
; Private clients on
the LAN
red IN A 10.0.0.2
blue IN A 10.0.0.3
file:///C:/DOCUME%7E1/ADMINI%7E1/LOCALS%7E1/Temp/msohtmlclip1/01/clip_image016.gif
green IN A 10.0.0.4
yellow IN A 10.0.0.5
; EOF

Setting up the zone files (outside)
For the “outside” yourdomain.com zone you made a db.yourdomain.com.outside
file using the same information from the “inside” file,
with the following exceptions:
• Removed all references
to private clients on the LAN. That way, someone poking
around from the Internet can’t get information about your
private computers.
• Changed the addresses
of the primary and slave DNS servers (ns1
and ns2) to
123.45.67.1 and 123.45.67.2, respectively. In that way,
only public addresses for name
servers are seen by the public. (Of course, you need to
use your own public IP addresses
instead of the examples 123.45.67.1 and 123.45.67.2.)
Setting up the zone files (reverse
lookup)
The other new file in the example is the yourlan.db file, which contains
the information
necessary to perform reverse IP lookups for the computers
on your LAN. Here’s an example:

file:///C:/DOCUME%7E1/ADMINI%7E1/LOCALS%7E1/Temp/msohtmlclip1/01/clip_image017.gif
$TTL 86400
@ IN SOA ns1.yourdomain.com hostmaster.yourdomain.com.
(
2006042701   ; Serial
28800         ; Refresh
14400         ; Retry
3600000     
; Expire
86400 )       ; Minimum
IN NS ns1.yourdomain.com
1 IN PTR yourdomain.com.
2 IN PTR red.yourdomain.com.
3 IN PTR blue.yourdomain.com.
4 IN PTR green.yourdomain.com.
5 IN PTR yellow.yourdomain.com.
; EOF

After you finish creating your own zone files, you can
use the named-checkzone command
file:///C:/DOCUME%7E1/ADMINI%7E1/LOCALS%7E1/Temp/msohtmlclip1/01/clip_image018.gif
to make sure that each zone file is formed correctly.
Here is how you’d run the namedcheckzone
command (as root user)
to check the two yourdomain.com zone files (be sure to type each command on one line, even though each is
shown here on two):
# named-checkzone yourdomain.com
/var/named/chroot/var/named/db.yourdomain.com.inside
zone yourdomain.com/IN:
loaded serial 2007042701
OK
# named-checkzone yourdomain.com
/var/named/chroot/var/named/db.yourdomain.com.outside
zone
yourdomain.com/IN: loaded serial 2007042701
OK
此处实验使用named-checkzone命令的结果如下图所示：


实验完成后，使用host命令在本机成功解析，如下图所示：


使用dig命令显示结果如下：


在此实验中，共使用客户端计算机两台，分别充当内部网络的两台客户机，此次实验没有设置DNS外部视图，在服务器本地成功解析后，发现在两个客户机上不能解析到
www.westos.com
域名，查找防火墙、selinux等相关设定后，还是不能正常解析，后检查主配置文件，发现问题，如下图所示进行设定既可正常。


2008年10月1日在配置DNS视图时，发现要注意问题如下：
在内部视图的正向区域文件west.zone里，如果此文件中存在内网中那台主机的“A”记录，则不会受ACL和客户端的匹配过滤检查，此客户机可直接访问DNS服务器进行解析；如果在正向区域文件中没有内网某台主机的“A”记录，并且ACL设置限制或“match-clients”一项对客户端主机有规定，则这台客户主机不能访问DNS服务器进行解析；如果要内部网络的任意主机都可访问DNS服务器进行解析，此项要设置为”any”。


本文来自ChinaUnix博客，如果查看原文请点：http://blog.chinaunix.net/u1/44125/showart_1844458.html