rndc: connect failed: 127.0.0.1#953: connection refused

精选转载

yxh1157686920 2013-09-11 21:55:01 博主文章分类：Linux server

文章标签 failed secret controls 文章分类 服务器

rndc: connect failed: 127.0.0.1#953: connection refused

2010-05-12 10:24:05| 分类：rhel_DNS|字号订阅

dc: connect failed: connection refused
rndc: connect failed: connection refused

解决办法：
默认安装BIND9以后，是无法直接使用 ndc 或 rndc 命令的。

先重新生成 rndc.conf
rndc-confgen > /etc/rndc.conf

将 rndc.conf 下面注释部分 Copy 到 /etc/rndc.key 文件中(必须将前面的#去掉)。

如：
# key "rndc-key" {
# algorithm hmac-md5;
# secret "xbPNyGOcwJp8pEJDLo26cQ==";
# };
#
# controls {
# inet 127.0.0.1 port 953
# allow { 127.0.0.1; } keys { "rndc-key"; };
# };

如果 /etc/named.conf 中包含有 controls 这一Section，先注释掉。

然后在后面添加一行 include "/etc/rndc.key";

这样做是为了安全考虑，否则可以直接copy到 named.conf 文件中。

inet / port 的意思是，在本机运行一个 rndc 监听端口，允许本机执行 ndc 或 rndc 命令。

[root@example etc]# named -g
12-May-2010 11:15:03.197 starting BIND 9.3.6-P1-RedHat-9.3.6-4.P1.el5 -g
12-May-2010 11:15:03.211 adjusted limit on open files from 4096 to 1048576
12-May-2010 11:15:03.211 found 1 CPU, using 1 worker thread
12-May-2010 11:15:03.212 using up to 4096 sockets
12-May-2010 11:15:03.266 loading configuration from '/etc/named.conf'
12-May-2010 11:15:03.270 using default UDP/IPv4 port range: [1024, 65535]
12-May-2010 11:15:03.271 using default UDP/IPv6 port range: [1024, 65535]
12-May-2010 11:15:03.288 listening on IPv4 interface lo, 127.0.0.1#53
12-May-2010 11:15:03.311 listening on IPv4 interface eth1, 192.168.1.108#53
12-May-2010 11:15:03.312 listening on IPv4 interface vmnet1, 192.168.157.1#53
12-May-2010 11:15:03.313 listening on IPv4 interface vmnet8, 172.16.237.1#53
12-May-2010 11:15:03.336 listening on IPv4 interface virbr0, 192.168.122.1#53
12-May-2010 11:15:03.337 binding TCP socket: address in use
12-May-2010 11:15:03.395 command channel listening on 127.0.0.1#953
12-May-2010 11:15:03.396 ignoring config file logging statement due to -g option
12-May-2010 11:15:03.396 couldn't open pid file '/var/run/named/named.pid': Permission denied

[root@example etc]#chmod 777 /var/run/named/
[root@example etc]# named -g
12-May-2010 11:24:08.058 starting BIND 9.3.6-P1-RedHat-9.3.6-4.P1.el5 -g
12-May-2010 11:24:08.059 adjusted limit on open files from 4096 to 1048576
12-May-2010 11:24:08.059 found 1 CPU, using 1 worker thread
12-May-2010 11:24:08.060 using up to 4096 sockets
12-May-2010 11:24:08.119 loading configuration from '/etc/named.conf'
12-May-2010 11:24:08.146 using default UDP/IPv4 port range: [1024, 65535]
12-May-2010 11:24:08.189 using default UDP/IPv6 port range: [1024, 65535]
12-May-2010 11:24:08.196 listening on IPv4 interface lo, 127.0.0.1#53
12-May-2010 11:24:08.198 listening on IPv4 interface eth1, 192.168.1.108#53
12-May-2010 11:24:08.198 listening on IPv4 interface vmnet1, 192.168.157.1#53
12-May-2010 11:24:08.223 listening on IPv4 interface vmnet8, 172.16.237.1#53
12-May-2010 11:24:08.224 listening on IPv4 interface virbr0, 192.168.122.1#53
12-May-2010 11:24:08.224 binding TCP socket: address in use
12-May-2010 11:24:08.273 command channel listening on 127.0.0.1#953
12-May-2010 11:24:08.273 ignoring config file logging statement due to -g option
12-May-2010 11:24:08.277 running

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
本节将详细介绍DNS服务器的rndc配置，实现使用rndc开启DNS的解析日志和刷新缓存，重载配置文件和关闭DNS服务器，一旦配置好了rndc，这些操作都可以在本地和远程服务器上进行。DNS服务目前算是比较安全的服务，不但进程的属主改成named用户，而且还运行在一个chroot环境中，将来关闭DNS服务还可能需要使用rndc来控制，这也可能是将来的服务器设计潮流。 rndc是远程DNS服务器进程控制的英文简写，rndc的工作机制使用了/etc/rndc.key和/etc/rndc.conf两个配置文件，rndc.key文件为锁头，尽管它的名字为key; rndc.conf则是打开rndc.key锁头的对应钥匙；这两个文件可以使用rndc-confgen命令来生成，该命令采用的是对称加密算法；下面来演示下配置，演示中将使用server来控制client端的DNS服务器，rndc的控制端也可以不是dns服务器…

一：配置client端127.0.0.1上的rndc

[root@client ~]# rndc-confgen |grep -v '^#' //使用rndc-confgen命令生成rndc.key和rndc.conf
key "rndckey" {
algorithm hmac-md5;
secret "q2yvOY2JiyUU2aV4qahzAw==";
};

options {
default-key "rndckey";
default-client 127.0.0.1;
default-port 953;
};

[root@client ~]# rm -rf /etc/rndc.key //删除默认的rndc.key文件
[root@client ~]# cd /var/named/chroot/etc/
[root@client etc]# cat rndc.key //将前面rndc-confgen命令生成的“key”一节中的内容写到rndc.key文件中
key "rndckey" {
algorithm hmac-md5;
secret "q2yvOY2JiyUU2aV4qahzAw==";
};

[root@client etc]# chown named.named rndc.key //修改文件属主属组主为named
[root@client etc]# ln -s /var/named/chroot/etc/rndc.key /etc/ //符号链接至/etc目录下
[root@client etc]# cat /etc/rndc.conf //将前面rndc-confgen命令生成的全部内容写到rndc.key文件中
key "rndckey" {
algorithm hmac-md5;
secret "q2yvOY2JiyUU2aV4qahzAw==";
};

options {
default-key "rndckey";
default-client 127.0.0.1;
default-port 953;
};

[root@client etc]# chown named.named /etc/rndc.conf //修改文件属主属组主为named
[root@client etc]# cat /etc/named.conf
options {
listen-on port 53 { 192.168.100.20; };
directory "/var/named";

allow-query { any; };
allow-transfer {192.168.100.254;};
};

};
include "/etc/named.rfc1912.zones";
include "/etc/rndc.key"; //包含前面定义好的锁头文件

controls {
inet 127.0.0.1 port 953 allow { 127.0.0.1; } keys { "rndckey"; }; //允许本机的环回接口使用/etc/rndc.conf文件中rndckey

这把钥匙控制953端口
};
…………………………输出省略…………………………

[root@client etc]# service named restart //重启服务
Stopping named: [ OK ]
Starting named: [ OK ]
[root@client etc]# netstat -ntpl |grep 953
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 3243/named
[root@client etc]# service named status
number of zones: 8
debug level: 0
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is OFF
recursive clients: 0/1000
tcp clients: 0/100
client is up and running
named (pid 3243) is running...
[root@client etc]# rndc stop //测试
[root@client etc]# service named status
rndc: connect failed: 127.0.0.1#953: connection refused
named dead but subsys locked

二：配置server端使用rndc控制client

root@client etc]# rndc-confgen |grep -v '^#' //和前面一样生成新的rndc.key和rndc.conf
key "rndckey" {
algorithm hmac-md5;
secret "p3DukvXgufSpbZdavZy1YA==";
};

options {
default-key "rndckey";
default-client 127.0.0.1;
default-port 953;
};

[root@client etc]# cat /etc/rndc.key //将新生成的文件的“key”节写到/etc/rndc.key文件末尾，并将其改名为rndckey-254
key "rndckey" {
algorithm hmac-md5;
secret "q2yvOY2JiyUU2aV4qahzAw==";
};

key "rndckey-254" {
algorithm hmac-md5;
secret "p3DukvXgufSpbZdavZy1YA==";
};

[root@client etc]# grep 'rndckey-254' /etc/named.conf //在主配置文件添加下面内容
inet 192.168.100.20 port 953 allow { 192.168.100.254; } keys { "rndckey-254"; };

//允许192.168.100.254这台服务器通过192.168.100.20这个接口，使用rndckey-254这把钥匙来控制953端口

[root@client etc]# service named restart //重启服务
Stopping named: [ OK ]
Starting named: [ OK ]
[root@client etc]# netstat -ntpl |grep 953
tcp 0 0 192.168.100.20:953 0.0.0.0:* LISTEN 3869/named
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 3869/named

[root@server ~]# cat /etc/rndc.conf //将前面生成的文件的全部内容写到server的/etc/rndc.conf文件中，需要修改key的名称和default-server的IP
key "rndckeyi-254" {
algorithm hmac-md5;
secret "p3DukvXgufSpbZdavZy1YA==";
};

options {
default-key "rndckey-254";
default-server 192.168.100.20;
default-port 953;
};
[root@server ~]# chown named.named /etc/rndc.conf //修改文件属主属组主为named
[root@server ~]# rndc -h //查看rndc命令帮助
rndc: illegal option -- h
Usage: rndc [-c config] [-s server] [-p port]
[-k key-file ] [-y key] [-V] command

command is one of the following:

reload Reload configuration file and zones.
reload zone [class [view]]
Reload a single zone.
refresh zone [class [view]]
Schedule immediate maintenance for a zone.
retransfer zone [class [view]]
Retransfer a single zone without checking serial number.
freeze zone [class [view]]
Suspend updates to a dynamic zone.
thaw zone [class [view]]
Enable updates to a frozen dynamic zone and reload it.
reconfig Reload configuration file and new zones only.
stats Write server statistics to the statistics file.
querylog Toggle query logging.
dumpdb [-all|-cache|-zones] [view ...]
Dump cache(s) to the dump file (named_dump.db).
stop Save pending updates to master files and stop the server.
stop -p Save pending updates to master files and stop the server
reporting process id.
halt Stop the server without saving pending updates.
halt -p Stop the server without saving pending updates reporting
process id.
trace Increment debugging level by one.
trace level Change the debugging level.
notrace Set debugging level to 0.
flush Flushes all of the server's caches.
flush [view] Flushes the server's cache for a view.
flushname name [view]
Flush the given name from the server's cache(s)
status Display status of the server.
recursing Dump the queries that are currently recursing (named.recursing)
*restart Restart the server.

* == not yet implemented
Version: 9.3.6-P1-RedHat-9.3.6-4.P1.el5

测试：
[root@server ~]# rndc reload //重载client端DNS配置文件
server reload successful
[root@server ~]# rndc querylog on //开启解析日志记录功能，开启后默认解析日志保存在client服务器的/var/log/messages文件中，开启此项功能会降低服务器性能
[root@server ~]# dig www.dodo.666.com @192.168.100.20 //测试解析
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5 <<>> www.dodo.666.com @192.168.100.20
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59157

[root@server ~]# rndc stop //远程关闭client上的DNS服务

[root@client ~]# tail -f /var/log/messages //客户端上查看日志
Mar 23 23:13:45 client named[3792]: loading configuration from '/etc/named.conf'
Mar 23 23:13:45 client named[3792]: using default UDP/IPv4 port range: [1024, 65535]
Mar 23 23:13:45 client named[3792]: using default UDP/IPv6 port range: [1024, 65535]
Mar 23 23:13:45 client named[3792]: the working directory is not writable
Mar 23 23:14:07 client named[3792]: query logging is now on //开启解析日志记录功能
Mar 23 23:14:52 client named[3792]: client 192.168.100.254#45815: query: www.dodo.666.com IN A + //记录的解析日志
Mar 23 23:15:49 client named[3792]: shutting down: flushing changes
Mar 23 23:15:49 client named[3792]: stopping command channel on 127.0.0.1#953
Mar 23 23:15:49 client named[3792]: stopping command channel on 192.168.100.20#953
Mar 23 23:15:49 client named[3792]: no longer listening on 192.168.100.20#53
Mar 23 23:15:50 client named[3792]: exiting //成功关闭DNS服务
提示：配置rndc，需要注意服务器时间问题，如果两台服务器的系统时间存在很大出入，那必定rndc命令执行会失败