<b>Linux下利用Bind搭建域名服务器</b>[服务器安全]

学校的DNS服务器是Linux操作系统,绑定DNS的时刻发现总有点问题,常常客户端电脑无法得到精确的解析.于是我就自己研究了下Linux下的绑定域名设置bind软件.

我本地用的是Ubuntu 10.04,  利用前更新了下bind软件至最新bind9

bind 利用端口号５３来举行通信,包含与别的DNS服务器交换解析信息,所以此商品不能被别的程序占用.
bind8 与bind9 的辨别(自己翻译的,供应原文)
除了利用了多线程、程序代码重构,从而供应了更好的安定性和安全性,还有别的一些辨别:

Apart from being multi-threaded, and a complete code rewrite - which should provide better stability and security in the long term, there are other differences

假如在named.conf文件中有语法错误,ＢＩＮＤ９会将它写到日记文件中并且不再重启域名服务器,ＢＩＮＤ８会记录日记然后服务死掉.

If there is a syntax error in named.conf, BIND9 will log errors and not reload the named server. BIND8 will log errors and the daemon will die!

获得掌握权的TSIGs(shared keys)扩大支持,比方“update-policy"可以获得掌握从而动态更新数据.

Extensive support of TSIGs (shared keys) for access control, for example, “update-policy” can be used for fine grained access control of dynamic updates.

启动／终止／重启　工具等,rndc与bind８的ndc差别－差别的通信、受权和特点.

The tool for starting/stopping/reloading etc., rndc is different from the v8 ndc - different communications, authentication and features.

区域配置文件的语法越发严峻（比方ＴＴＬ行必须存在）

Syntax in zone files is more rigorously checked (e.g. a TTL line must exist)

有关named.conf文件的设定

bind8的"check-names"和"statistics-interval"这两项设定没有被移植到bind9中

v8 options ‘check-names’ and ‘statistics-interval’ are not yet implemented in V9.

"auth-nxdomain" 的默许值是"no",假如你没有手动设定这一项,bind9会在启动时生成呼应的一条日记消息

the default for the option ‘auth-nxdomain’ is now ‘no’, if you don’t set this manually, BIND 9 logs a corresponding message on startup.

根域名服务器列表,在bind8中的named.root 或 root.hints不需求在ＢＩＮＤ９中设定,因为它已经被服务器默许包含了.

The root server list, often called named.root or root.hints in BIND8 is not necessary in BIND 9, as it is included within the server.

在Ubuntu中安装bind

sudo apt-get install bind9 dnsutils

配置bind

sudo vi /etc/bind/named.conf.local

改正这个文件,在里面增添下面这些内容:

zone "myqdc.com" {
type master;
file "/etc/bind/zones/myqdc.com.db";
};
zone "100.168.192.in-addr.arpa" {
type master;
file "/etc/bind/zones/rev.100.168.192.in-addr.arpa";
};
zone "myqdc.com" {type master;file "/etc/bind/zones/myqdc.com.db";};

zone "100.168.192.in-addr.arpa" {type master;file "/etc/bind/zones/rev.100.168.192.in-addr.arpa";};

此中,myqdc.com改成呼应的域名,我本地ＩＰ地址是192.168.100.100接着当然需求新建两个文件, myqdc.com.db(用来配置解析记录,比方Ａ,ＣＮＡＭＥ等), rev.100.168.192.in-addr.arpa(反向解析配置文件）

myqdc.com.db需求放到/etc/bind/zones文件夹下,内容以下:

myqdc.com. IN SOA ns1.myqdc.com. admin.myqdc.com. (
2007031001

28800

3600

604800

38400

)

myqdc.com. IN NS ns1.myqdc.com.

www IN A 221.215.217.101

* IN A 221.215.217.101

此中,括号中的内容不要改正.呼应的域名和ＩＰ地址可以按照实际情形更改.此中最后一行
* IN A 221.215.217.101
配置了一条泛域名解析,经测试没问题.
接下下:rev.100.168.192.in-addr.arpa　这个文件,一样放到zones文件夹下,内容以下:
@ IN SOA ns1.myqdc.com. admin.myqdc.com. (
2007031001;
28800;
604800;
604800;
86400
)
IN NS ns1.myqdc.com.
100 IN PTR myqdc.com.
最后一行,由于我的ＩＰ地址是:192.168.100.100,所以取ＩＰ的最后８位:１００
接下来试下重启服务:
service bind9 restart
假如呈现connection refuced 的fail信息,那么就持续举行下面步骤:
重新生成rndc.conf
rndc-confgen > /etc/bind/rndc.conf
然后将rndc.conf下面注释部份copy到/etc/bind/rndc.key文件中,把#去掉.
接着在/etc/bind/named.conf文件最后加入一行:
include "/etc/bind/rndc.key";
接着试下运行named -g  看下有没有出错信息,假若有的话,按照提醒改正下配置文件.
最后一步,可以举行测试了:
改正/etc/resolv.conf 文件,在全部的nameserver 开首的行之前加入一行:
nameserver 192.168.100.100
ＩＰ地址当然就是你搭建的DNS服务器的地址.
然后再重启服务:
service bind9 restart
nslookup 一下:
root@www.linuxidc.com-laptop:/etc/bind/zones# nslookup www.linuxidc.com
Server: 192.168.100.100
Address: 192.168.100.100#53
Name: www.linuxidc.com
Address: 221.215.217.101
由于配置的泛解析,所以:
root@www.linuxidc.com-laptop:/etc/bind/zones# nslookup www.linuxidc.net
Server: 192.168.100.100
Address: 192.168.100.100#53
Name: www.linuxidc.net
Address: 221.215.217.101
用dig 号令查看更具体的DNS查询信息:
root@www.linuxidc.com-laptop:/etc/bind/zones# dig www.linuxidc.com
; <<>> DiG 9.7.0-P1 <<>> www.linuxidc.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40293
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
;; QUESTION SECTION:
;www.linuxidc.com. IN A
;; ANSWER SECTION:
www.linuxidc.com. 38400 IN A 221.215.217.101
;; AUTHORITY SECTION:
myqdc.com. 38400 IN NS ns1.myqdc.com.
;; ADDITIONAL SECTION:
ns1.myqdc.com. 38400 IN A 221.215.217.101
;; Query time: 0 msec
;; SERVER: 192.168.100.100#53(192.168.100.100)
;; WHEN: Mon Apr  4 11:34:21 2011
;; MSG SIZE  rcvd: 81
好了,到此为止,DNS服务就架设成功了. 　　以上是“<b>Linux下利用Bind搭建域名服务器</b>[服务器安全]”的内容，如果你对以上该文章内容感兴趣，你可以看看七道奇为您推荐以下文章：