linux安装dns

精选转载

wdy198622 2016-01-07 10:50:21 博主文章分类：linux服务器搭建

文章标签 DNS 文章分类 服务器

转自一论坛网友的帖子

linux安装dns，rndc-confgen没反应

前几天，一位朋友问我安装linux 的时候有没有遇到执行rndc-confgen没反应的情况，我还真没有遇到过，朋友很急，我就让他把SSH 发过来，我连过去帮他看了一下，执行rndc-confgen就卡住了，不懂了只能ctrl+c 中断操作，后来我看了下rndc-confgen –help 看到randomfile，我印象这个是个生成器，应该跟他有关系，google 后果然没错在官网上看到：

在官方网站上看到这么一条信息
You must use the keyboard to create entropy, since your system is lacking
/dev/random (or equivalent)

start typing:
rndc-confgen: generate key: out of entropy

大概意思就是服务器上没有random产生器，这种情况下我们就手动伪造一个文件代替/dev/random的功能

好了废话不多说了，看我是怎么给他解决的吧

测试域名： www.nginxs.com

shell $>wget http://ftp.isc.org/isc/bind9/9.6.1-P3/bind-9.6.1-P3.tar.gz

shell $> tar zxvf bind-9.6.1-P3.tar.gz
shell $> cd bind-9.6.1-P3
shell $> ./configure –prefix=/usr/local/named –enable-epoll–enable-openssl-version-check –enable-threads –disable-ipv6 –enable-largefile
shell $> make
shell $> make install
shell $> cd /usr/local/named/etc
###问题就出在这里了，没反映，google##
shell $> ../sbin/rndc-confgen > rndc.conf
在官方网站上看到这么一条信息
You must use the keyboard to create entropy, since your system is lacking
/dev/random (or equivalent)

start typing:
rndc-confgen: generate key: out of entropy

大概意思就是服务器上没有random产生器，这种情况下我们就手动伪造一个文件代替/dev/random的功能
###新建一个 random 文件随即输入一串数字“记得要长~~
shell $> vim random
asdkfjalsjdflajsldfjlasjdflajsldfjalsjdflajslfjalsjflasjfl

###查看 rndc-confgen 帮助
shell $> ../sbin/rndc-confgen –help
rndc-confgen: invalid argument –
Usage:
rndc-confgen [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-rrandomfile] [-s addr] [-t chrootdir] [-u user]
-a:           generatejust the key clause and write it to keyfile (/usr/local/named/etc/rndc.key)
-b bits:      from 1 through 512, default 128;total length of the secret
-c keyfile:   specify an alternate key file (requires -a)
-k keyname:   the name as it will be used in named.confand rndc.conf
-p port:      the port named will listen on andrndc will connect to
-r randomfile: a file containing random data
-s addr:      the address to which rndc shouldconnect
-t chrootdir: write a keyfile in chrootdir as well (requires -a)
-u user:      set the keyfile owner to “user”(requires -a)
shell $> ../sbin/rndc-confgen -r random > rndc.key

ok 问题解决了，接下来我们配置我们的域名服务器吧
#### 从 rndc.key文件中提取 named.conf用的 key 生成 named.conf 文件，当然你也可以复制rndc.key 没被注释的内容到 named.conf
shell $> tail -10 rndc.key | head -9 | sed ‘s/# //g’ > named.conf
shell $> cat named.conf
key “rndc-key” {
algorithm hmac-md5;
secret “O0SuB34RK+E3r+m5Fbh2eA==”;
};
controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { “rndc-key”; };
};

#### dig 命令直接生成 named.root 文件，这个文件是很标准的东东，
#### 有了它，本地 dns 不能解的就上总部去问

shell $> dig > named.root

配置 named.conf

shell $> vim named.conf

key “rndc-key” {
algorithm hmac-md5;
secret “O0SuB34RK+E3r+m5Fbh2eA==”;
};
controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { “rndc-key”; };
};

options {
        // Relative to the chroot directory,if any
       directory       “/usr/local/named/etc”;
       pid-file       “/usr/local/named/var/run/named/pid”;
       dump-file      “/usr/local/named/var/dump/named_dump.db”;
        statistics-file“/usr/local/named/var/stats/named.stats”;
       listen-on       { 192.168.6.44; };
            forwarders {
               202.106.0.20;
        };
};

zone “.” {
type hint;
file “/usr/local/named/etc/named.root”;
};
zone “ludy.com” {
type master;
file “dynamic/www.nginxs.com”;
};

创建域名解析文件

shell $> mkdir dynamic
shell $> vim dynamic/www.nginxs.com
$TTL    86400
$ORIGIN ludy.com.
@       IN     SOA     nginxs.com. root.nginxs.com. (
                       2009072901      ;
                       68400           ;
                       86400           ;
                       3600000;        ;
                       36000   )       ;
        IN     NS      ns.nginxs.com.
        IN     MX      10 mail.nginxs.com.
www     IN     A       192.168.6.44
mail    IN     A       192.168.6.44
ns      IN     A       192.168.6.44

因为我不需要反向解析“所以我不需要设置了“然后启动 debug模式看看有错误吗。
shell $> ../sbin/named -g
27-Jan-2010 02:48:57.508 starting BIND 9.6.1-P3 -g
27-Jan-2010 02:48:57.508 built with ‘–prefix=/usr/local/named’ ‘–enable-epoll’‘–enable-openssl-version-check’ ‘–enable-threads’ ‘–disable-ipv6′‘–enable-largefile’
27-Jan-2010 02:48:57.508 adjusted limit on open files from 1024 to 1048576
27-Jan-2010 02:48:57.508 found 1 CPU, using 1 worker thread
27-Jan-2010 02:48:57.510 using up to 4096 sockets
27-Jan-2010 02:48:57.519 loading configuration from ‘/usr/local/named/etc/named.conf’
27-Jan-2010 02:48:57.521 using default UDP/IPv4 port range: [1024, 65535]
27-Jan-2010 02:48:57.522 using default UDP/IPv6 port range: [1024, 65535]
27-Jan-2010 02:48:57.526 listening on IPv4 interface eth0, 192.168.6.105#53
27-Jan-2010 02:48:57.532 automatic empty zone: 0.IN-ADDR.ARPA
27-Jan-2010 02:48:57.533 automatic empty zone: 127.IN-ADDR.ARPA
27-Jan-2010 02:48:57.533 automatic empty zone: 254.169.IN-ADDR.ARPA
27-Jan-2010 02:48:57.534 automatic empty zone: 2.0.192.IN-ADDR.ARPA
27-Jan-2010 02:48:57.534 automatic empty zone: 255.255.255.255.IN-ADDR.ARPA
27-Jan-2010 02:48:57.535 automatic empty zone:0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
27-Jan-2010 02:48:57.535 automatic empty zone: 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
27-Jan-2010 02:48:57.536 automatic empty zone: D.F.IP6.ARPA
27-Jan-2010 02:48:57.536 automatic empty zone: 8.E.F.IP6.ARPA
27-Jan-2010 02:48:57.537 automatic empty zone: 9.E.F.IP6.ARPA
27-Jan-2010 02:48:57.537 automatic empty zone: A.E.F.IP6.ARPA
27-Jan-2010 02:48:57.537 automatic empty zone: B.E.F.IP6.ARPA
27-Jan-2010 02:48:57.545 command channel listening on 127.0.0.1#953
27-Jan-2010 02:48:57.546 ignoring config file logging statement due to -goption
27-Jan-2010 02:48:57.550 zone nginxs.com/IN: loaded serial 2009072901
27-Jan-2010 02:48:57.552 running
27-Jan-2010 02:48:57.553 zone ludy.com/IN: sending notifies (serial 2009072901)

OK了。

现在 DNS 服务器还不是很安全，因为你的DNS是暴露在公网的，如果你只想做域名解析服务的话，就不用户查询关掉

shell $> vim named.conf

key “rndc-key” {
algorithm hmac-md5;
secret “bMXdKGcP5tqUFUnG7CTzmw==”;
};

controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { “rndc-key”; };
};
acl “trusted”{
192.168.6.0/24;
}

options {
        // Relative to the chroot directory,if any
       directory       “/usr/local/named/etc”;
       pid-file       “/usr/local/named/var/run/named/pid”;
       dump-file      “/usr/local/named/var/dump/named_dump.db”;
        statistics-file“/usr/local/named/var/stats/named.stats”;
        allow-query { any; };
        allow-recursion { trusted; };
        allow-query-cache { trusted; };
       listen-on       { 192.168.6.105; };
            forwarders {
               202.106.0.20;
        };
};

zone “.” {
type hint;
file “/usr/local/named/etc/named.root”;
};

zone “ludy.com” {
type master;
file “dynamic/www.nginxs.com”;
};

我个人感觉上allow-query-cache在未设置allow-recursion的情况下可以取代allow-recursion的功能，有继承关系。如果想禁止用户的递归查询请求，还需要将 allow-query-cache 选项关闭，否则用户仍然可能在 cache 中查到数据上面我建立acl规则来指定用户来使用你的DNS服务器。

下来我们在 192.168.6.0/24 网段找个机器测试下吧如图所视：

查询 www.nginxs.com

# nslookup www.nginxs.com