BIND域名服务器的安装与配置

实验一、BIND域名服务器的安装与配置

1．实验目的

通过对BIND服务器系统的安装与配置实验，加深对 DNS协议及工作过程的理解，掌握DNS服务器的安装与配置方法，为将来从事网络工程建设打下基础。

2．实验要求

下载BIND域名服务器源代码，在Linux 环境下，编译生成执行代码，并进行安装，然后根据以下实验环境配置域名服务器，并进行正反域名解析，以测试BIND域名服务器系统工作是否正常。

假定需要建立一台某企业网络的DNS主服务器，应用环境如下：

(a) 企业使用的二个C类网段地址:192.168.25.xxx, 192.168.26.yyy；

(b) 企业域名为 https://www.360docs.net/doc/1216860530.html,，并已注册,主域名服务器地址 192.168.25.188，主机名为 https://www.360docs.net/doc/1216860530.html,,辅域名服务器地址 192.168.25.168,外部域名服务器为:202.106.0.98；

(c) 企业的 WWW服务器地址为 192.168.25.1, 名字为https://www.360docs.net/doc/1216860530.html,

(d)企业的 Mail 服务器地址为 192.168.25.2, 名字为https://www.360docs.net/doc/1216860530.html,

(e)企业的 Database 服务器地址为 192.168.25.3, 名字为https://www.360docs.net/doc/1216860530.html,

(f)企业的 ftp 服务器地址为 192.168.25.3, 名字为https://www.360docs.net/doc/1216860530.html,

(g)企业的 proxy 服务器地址为 192.168.25.4, 名字为https://www.360docs.net/doc/1216860530.html,

(h)拒绝服务的二个C类网段地址:192.0.0.xxx, 192.1.0.yyy

3．实验步骤

3.1 实验准备

1、系统要求

●系统配置

建议CPU 为PIII 900MHZ以上, 内存128MB以上，磁盘可用空间100MB以上，具有10M/100M网卡，操作系统采用 Red Hat 6.0 版本或更高版本。

●编译器环境

系统必须装有ANSI-C编译器，推荐使用来自Free Software Foundation (FSF)的GNU C compiler (GCC)。

2、下载源代码

BIND最新版本的源代码可以从https://www.360docs.net/doc/1216860530.html,/index.pl?/sw/bind/站点下载，本书附带的光盘上包括了 Bind 9.2.4rc6版本的原代码。

3、源代码解包

将下载的安装包bind-9.2.4rc6.tar.gz复制到某一个用户目录下（下面以/usr/src/目录为例介绍），然后用以下命令解压：

$ cd /usr/src

$ tar xvfz bind-9.2.4rc6.tar.gz

将会在/usr/src/目录下创建/ bind-9.2.4rc6子目录，该目录下包含Bind 的所有的源代码和相关文档。

3.2安装设置

$ cd bind-9.2.4rc6

$ ./configure --prefix=/usr/local/bind

$ make depend

3.3编译

$ make

3.4安装

$ make install

手工创建链接文件：

$ mkdir -p /usr/local/bind/var/run

$ mkdir -p /usr/local/bind/var/named

$ mkdir -p /usr/local/bind/etc

$ touch /usr/local/bind/etc/named.conf

$ touch /usr/local/bind/etc/rndc.conf

$ ln -sf /usr/local/bind/etc/named.conf /etc/named.conf

$ ln -sf /usr/local/bind/etc/rndc.conf /etc/rndc.conf

$ ln -sf /usr/local/bind/var/named /var/

$ ln -sf /usr/local/bind/sbin/rndc /usr/sbin/rndc

$ ln -sf /usr/local/bind/sbin/named /usr/sbin/named

3.5配置

3.5.1实验环境设立

假定我们需要为某企业网络建立一台DNS主服务器，应用环境如实验要求所示。

3.5.2远程管理配置

BIND 提供远程域名服务控制器（The remote name daemon control: RNDC），是管理员用来控制域名服务器的应用程序，用于动态加载、停止、配置 DNS服务，它需要的配置文件为 /etc/rndc.conf，其内容如下：

$ vi /etc/rndc.conf

//共享密钥，用于和受控DNS服务器之间完成认证.

key test.

{

algorithm "hmac-md5";

secret "xxxxxxxxxxxxxxxxxxxxxx==";//此处的xxxx即为下面将要生成

//的共享密钥KEY.

};

options

{

//管理的DNS主机名称，本例为管理本机。

default-server localhost;

default-key test. ;

};

server localhost

{

key test. ;

};

BIND 提供了一种安全机制――TSIG（Transaction SIGnatures ），使用共享密钥进行安全的DNS通知、更新，创建共享密钥的方法如下：

$ cd /usr/local/bind

$ sbin/dnssec-keygen -a hmac-md5 -b 128 -n HOST test.

生成的密钥文件为 K*****.key和 K*****.private，其中*.private文件包含的 KEY "xxxxxxxxxxxxxxxxxxxxxx==" 即为共享密钥。

3.5.3运行配置

Bind的主配置文件为named.conf ，zone 是配置文件中的最重要的组成部分，描述了一个授权域名下的域名解析信息，一个配置的例子如下：

key test.

{

algorithm "hmac-md5";

//共享密钥，只有和改共享密钥匹配的主机，方能管理 DNS 服务器。

secret "xxxxxxxxxxxxxxxxxxxxxx==";//此处的KEY即为上述生成的密钥. };

controls

{

inet 127.0.0.1 allow { localhost; } keys { test.; };

};

//非法的网络地址：

acl bogus-nets { 192.0.0.0/16; 192.1.0.0/16;};

//内部网络地址范围：

acl our-inner-nets { 127.0.0.1/32; 192.168.25.0/16; 192.168.26.0/16; };

//私有的外部网络地址范围：

acl our-outer-nets { 192.168.0.0/16; };

//内部的辅DNS服务器地址：

acl transfer-inner-ips { 192.168.25.168 };

//外部的辅DNS服务器地址：

acl transfer-outer-ips { 192.168.0.2; };

options

{

version "$Id, https://www.360docs.net/doc/1216860530.html,";

directory "/var/named";

allow-query { any; };

//对于内网地址，和私有的外网地址，提供DNS的递归查询服务。

allow-recursion { our-inner-nets; our-outer-nets; };

//对于非法地址，拒绝提供服务.

blackhole { bogus-nets; };

notify yes;

recursion yes;

forward first;

//递归查询时，如果本地的 cache 没有命中，则依次对 forwarders 中的//主机进行DNS查询：

forwarders

{

202.106.0.98;

};

listen-on-v6 { none; };

auth-nxdomain no;

};

//view提供了根据来访的地址范围，提供不同的服务。该 internal 视图为本地提供解析服务。

view "internal"

{

match-clients { our-inner-nets; };

recursion yes;

zone "0.0.127.in-addr.arpa"

{

type master;

//localhost 的反相解析域

file "named.local";

notify no;

};

zone "25.168.192.in-addr.arpa"

{

type master;

//192.168.25 网段的反相解析域

file "named.192.168.25";

notify yes;

allow-transfer{ transfer-inner-ips; };

};

zone "26.168.192.in-addr.arpa"

{

type master;

//192.168.26 网段的反相解析域

file "named.192.168.26";

notify yes;

allow-transfer{ transfer-inner-ips; };

};

zone "https://www.360docs.net/doc/1216860530.html,"

{

type master;

//https://www.360docs.net/doc/1216860530.html, 在内部网的域名解析域

file "https://www.360docs.net/doc/1216860530.html,";

allow-query { any; };

allow-transfer{ transfer-inner-ips; };

notify yes;

};

};

//outerview 视图为外部提供解析服务。

view "external"

{ match-clients { any; };

recursion no;

zone "0.0.127.in-addr.arpa"

{

type master;

file "named.local";

notify no;

};

zone "25.168.192.in-addr.arpa"

{

type master;

file "named.192.168.25";

notify yes;

allow-transfer{ transfer-inner-ips; };

};

zone "26.168.192.in-addr.arpa"

{

type master;

file "named.192.168.26";

notify yes;

allow-transfer{ transfer-inner-ips; };

};

zone "https://www.360docs.net/doc/1216860530.html,"

{

type master;

//https://www.360docs.net/doc/1216860530.html, 在外部网的域名解析域

file "https://www.360docs.net/doc/1216860530.html,"; allow-query { any; };

allow-transfer{ transfer-outer-ips; };

notify yes;

};

};

3.5.4区域文件的配置

$ cd /var/named

用vi 依次编辑各区域文件。

//var/named/named.local的内容如下：

$TTL 3600

@ IN SOA localhost. root.localhost. (

2001030801 ; serial

28800 ; refresh

14400 ; retry

3600000 ; expire

86400 ; default_ttl

)

@ IN NS localhost.

1 IN PTR localhost.

; End of File

/var/named/named.192.168.25的内容如下:

$TTL 3600

@ IN SOA https://www.360docs.net/doc/1216860530.html,. https://www.360docs.net/doc/1216860530.html,. (

2001030801 ; serial

600 ; refresh

600 ; retry

3600000 ; expire

3400 ; default_ttl

)

@ IN NS https://www.360docs.net/doc/1216860530.html,.

@ IN NS https://www.360docs.net/doc/1216860530.html,.

1 IN PTR aaa; 192.168.25.1对应的名字为 https://www.360docs.net/doc/1216860530.html,

2 IN PTR bbb; 192.168.25.2 对应的名字为 https://www.360docs.net/doc/1216860530.html,

3 IN PTR ccc.; 192.168.25.3 对应的名字为 ccc

4 IN PTR ddd.; 192.168.25.4 对应的名字为 ddd

; End of File

/var/named/named.192.168.26的内容如下:

$TTL 3600

@ IN SOA https://www.360docs.net/doc/1216860530.html,. https://www.360docs.net/doc/1216860530.html,. (

2001030801 ; serial

600 ; refresh

600 ; retry

3600000 ; expire

3400 ; default_ttl

)

@ IN NS https://www.360docs.net/doc/1216860530.html,.

@ IN NS https://www.360docs.net/doc/1216860530.html,.

1 IN PTR aaa ; 192.168.26.1 对应的名字为 https://www.360docs.net/doc/1216860530.html,

2 IN PTR bbb; 192.168.26.2 对应的名字为 https://www.360docs.net/doc/1216860530.html,

3 IN PTR ccc.; 192.168.26.3 对应的名字为 ccc

4 IN PTR ddd.; 192.168.26.4 对应的名字为 ddd

; End of File

/var/named/https://www.360docs.net/doc/1216860530.html,的内容如下:

$TTL 3600

@ IN SOA https://www.360docs.net/doc/1216860530.html,. https://www.360docs.net/doc/1216860530.html,. (

2001030801 ; serial

600 ; refresh

600 ; retry

3600000 ; expire

3400 ; default_ttl

)

@ IN NS https://www.360docs.net/doc/1216860530.html,.

@ IN NS https://www.360docs.net/doc/1216860530.html,.

@ IN MX 5 https://www.360docs.net/doc/1216860530.html,.

localhost IN A 127.0.0.1

ns1 IN A 192.168.25.188

ns2 IN A 192.168.25.168

abc IN A 192.168.25.188

www IN A 192.168.25.1

mail IN A 192.168.25.2

db IN A 192.168.25.3

ftp IN A 192.168.25.3

proxy IN A 192.168.25.4

/var/named/https://www.360docs.net/doc/1216860530.html,

$TTL 3600

@ IN SOA https://www.360docs.net/doc/1216860530.html,. https://www.360docs.net/doc/1216860530.html,. (

2001030801 ; serial

600 ; refresh

600 ; retry

3600000 ; expire

3400 ; default_ttl

)

@ IN NS https://www.360docs.net/doc/1216860530.html,.

@ IN NS https://www.360docs.net/doc/1216860530.html,.

@ IN MX 5 https://www.360docs.net/doc/1216860530.html,.

localhost IN A 127.0.0.1

ns1 IN A 192.168.25.188

ns2 IN A 192.168.25.168

abc IN A 192.168.25.188

www IN A 192.168.25.1

mail IN A 192.168.25.2

db IN A 192.168.25.3

ftp IN A 192.168.25.3

proxy IN A 192.168.25.4

3.6运行与停止

3.6.1 启动文件

用vi在/etc/rc.d/init.d/目录下编辑一个启动文件named

#!/bin/sh

#

# This shell script takes care of starting and stopping named (BIND DNS server).

#

# description: named (BIND) is a Domain Name Server (DNS)

# that is used to resolve host names to IP addresses.

# probe: true

# Source function library.

. /etc/rc.d/init.d/functions

# Source networking configuration.

. /etc/sysconfig/network

# Check that networking is up.

[ ${NETWORKING} = "no" ] && exit 0

[ -f /usr/sbin/named ] || exit 0

[ -f /etc/named.conf ] || exit 0

# See how we were called.

case "$1" in

start)

# Start daemons.

echo -n "Starting named: "

daemon named

echo

touch /var/lock/subsys/named

;;

stop)

# Stop daemons.

echo -n "Shutting down named: "

killproc named

rm -f /var/lock/subsys/named

echo

;;

status)

/usr/sbin/rndc status

exit $?

;;

restart)

/usr/sbin/rndc restart

exit $?

;;

reload)

/usr/sbin/rndc reload

exit $?

;;

probe)

# named knows how to reload intelligently; we don't want linuxconf # to offer to restart every time

/usr/sbin/rndc reload >/dev/null 2>&1 || echo start

exit 0

;;

*)

echo "Usage: named {start|stop|status|restart}"

exit 1

esac

exit 0

3.6.2 创建符号联结

$ ln -s /etc/rc.d/init.d/named /etc/rc.d/rc0.d/K45named

$ ln -s /etc/rc.d/init.d/named /etc/rc.d/rc1.d/K45named

$ ln -s /etc/rc.d/init.d/named /etc/rc.d/rc2.d/K45named

$ ln -s /etc/rc.d/init.d/named /etc/rc.d/rc3.d/S55named

$ ln -s /etc/rc.d/init.d/named /etc/rc.d/rc4.d/S55named

$ ln -s /etc/rc.d/init.d/named /etc/rc.d/rc5.d/S55named

$ ln -s /etc/rc.d/init.d/named /etc/rc.d/rc6.d/K45named

3.6.3启动/停止

$ tail -f /var/log/messages &

$ /etc/rc.d/init.d/named start //Start the name server

$ /etc/rc.d/init.d/named stop //Stop the name server

4．实验评测

4.1. 配置检查

$ sbin/named-checkconf

$ sbin/named-checkzone zonename zonefilename

4.2. nslookup 测试

在LINUX 系统中,测试前必需编辑/etc/resolv.conf 文件:

#cd /etc

#vi resolv.conf

search https://www.360docs.net/doc/1216860530.html,

nameserver 192.168.25.188

然后再用 nslookup测试。

# nslookup

Note: nslookup is deprecated and may be removed from future releases. Consider using the `dig' or `host' programs instead. Run nslookup with the `-sil[ent]' option to prevent this message from appearing.

set all

Default server: 192.168.25.188

Address: 192.168.25.188#53

Set options:

novc nodebug nod2

search recurse

timeout = 0 retry = 2 port = 53

querytype = A class = IN

srchlist = https://www.360docs.net/doc/1216860530.html,

→ ns1

Server: 192.168.25.188

Address: 192.168.25.188#53

Name: https://www.360docs.net/doc/1216860530.html,

Address: 192.168.25.188

→ www

Server: 192.168.25.188

Address: 192.168.25.188#53

Name: https://www.360docs.net/doc/1216860530.html,

Address: 192.168.25.1

→ mail

Server: 192.168.25.188

Address: 192.168.25.188#53

Name: https://www.360docs.net/doc/1216860530.html,

Address: 192.168.25.2

反向解析：

→ set query=ptr

→ 192.168.25.1

Server: 192.168.25.188

Address: 192.168.25.188#53

1.25.168.19

2.in-addr.arpa name = 111.25.168.192.in-addr.arpa. → 192.168.25.5

Server: 192.168.25.188

Address: 192.168.25.188#53

5.25.168.192.in-addr.arpa name = 555.

→ exit