当前位置：首页 > news >正文

DNS作业

news 2025/2/22 2:05:59

作业：

1.搭建dns服务器能够对自定义的正向或者反向域完成数据解析查询。
2.配置从DNS服务器，对主dns服务器进行数据备份。

一、配置DNS主服务器

# systemctl stop firewalld
# setenforce 0

1.创建主配置文件，定义正反向解析域

# vim /etc/named.conf

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

options {
   listen-on port 53 { 192.168.107.129; };
   listen-on-v6 port 53 { ::1; };
   directory    "/var/named";
   dump-file    "/var/named/data/cache_dump.db";
   statistics-file "/var/named/data/named_stats.txt";
   memstatistics-file "/var/named/data/named_mem_stats.txt";
   secroots-file   "/var/named/data/named.secroots";
   recursing-file   "/var/named/data/named.recursing";
   allow-query { any; };

   /*
   - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
   - If you are building a RECURSIVE (caching) DNS server, you need to enable
   recursion.
   - If your recursive DNS server has a public IP address, you MUST enable access
   control to limit queries to your legitimate users. Failing to do so will
   cause your server to become part of large scale DNS amplification
   attacks. Implementing BCP38 within your network would greatly
   reduce such attack surface
   */
   recursion yes;

   dnssec-validation yes;

   managed-keys-directory "/var/named/dynamic";
   geoip-directory "/usr/share/GeoIP";

   pid-file "/run/named/named.pid";
   session-keyfile "/run/named/session.key";

   /* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
   include "/etc/crypto-policies/back-ends/bind.config";
};

logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};

zone "openlab.com" IN {
   type master;
   file "named.openlab.com";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";