1、详细描述一次加密通讯的过程，结合图示最佳。
2、描述创建私有CA的过程，以及为客户端发来的证书请求进行办法证书。
3、搭建一套DNS服务器，负责解析magedu.com域名（自行设定主机名及IP）
(1)、能够对一些主机名进行正向解析和逆向解析；
(2)、对子域cdn.magedu.com进行子域授权，子域负责解析对应子域中的主机名；
(3)、为了保证DNS服务系统的高可用性，请设计一套方案，并写出详细的实施过程
第一步，配置主配置文件/etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options { //
listen-on port 53 { 127.0.0.1; }; //监听本地端口
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; }; //允许查询
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;//是否递归 如果是no 那么这台DNS服务器讲不会解析 yes或注释掉不写，默认是允许；
dnssec-enable no;
dnssec-validation no;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones"; //区域配置文件
include "/etc/named.root.key";第二步，添加magedu.com的正反向解析
zone "magedu.com" IN {
type master;
file "magedu.com.zone";
allow-transfer { 192.168.0.103; };
};
zone "0.168.192.in-addr.arpa" IN {
type master;
file "0.168.192.zone";
allow-transfer { 192.168.0.103; };
};第三步，添加正反方向区域文件
$TTL 1D $ORIGIN magedu.com. @ IN SOA ns1.magedu.com. admin.magedu.com. ( 2016102901 1H 5M 7D 12H ) IN NS ns1 IN NS ns2 IN MX 10 mx1 ns1 IN A 192.168.0.102 ns2 IN A 192.168.0.103 mx1 IN A 192.168.0.102 www IN A 192.168.0.102 cdn IN CNAME 192.168.0.111 ftp IN CNAME www
$TTL 86400
$ORIGIN 0.168.192.in-addr.arpa.
@ IN SOA ns1.magedu.com. admin.magedu.com. (
2016102601
1H
5M
7D
12H )
IN NS ns1.magedu.com.
@ IN NS ns2.magedu.com.
102 IN PTR ns1.magedu.com.
103 IN PTR ns2.magedu.com.
102 IN PTR www.magedu.com.
102 IN PTR mx1.magedu.com.
111 IN PTR cdn.magedu.com
第四步，重启服务
[root@localhost ~]# systemctl restart named.service
第五步，测试
[root@localhost ~]# dig -t [root@localhost ~]# dig -x 192.168.0.111@cdn.magedu.com
4、请描述一次完整的http请求处理过程；
