Установка и настройка Bind на Centos7. Настройка Master-Slave DNS-серверов на Centos7

Декабрь 23rd, 2016

Evgeniy Kamenev

Домен: kamaok.org.ua
Master-сервер (192.168.1.86) — Centos 7.2
Slave-сервер (192.168.1.84) — Ubuntu 14.04 LTS
Локальная сеть, которой будут разрешены рекурсивные запросы – 192.168.1.0/24

Настройка Standalone-сервера (кеширующего, без обслуживания какой-либо зоны)

1.Настройка конфигурационного файла Bind /etc/named.conf

# yum install bind bind-utils

1	# yum install bind bind-utils

# cp /etc/named.conf /etc/named.conf~

1	# cp /etc/named.conf /etc/named.conf~

# nano /etc/named.conf

1	# nano /etc/named.conf

options {
        listen-on port 53 { 127.0.0.1; 192.168.1.86; };
        listen-on-v6 { none; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { any; };

        recursion yes;
        allow-transfer { none;};
        allow-update { none; };
        allow-recursion {localhost; 192.168.1.0/24; };
        notify yes;
        version "My DNS Server";
        forwarders { 8.8.8.8; 8.8.4.4; };

        dnssec-enable yes;
        dnssec-validation yes;
        bindkeys-file "/etc/named.iscdlv.key";
        managed-keys-directory "/var/named/dynamic";
        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

options {

listen-on port 53 { 127.0.0.1; 192.168.1.86; };

listen-on-v6 { none; };

directory "/var/named";

dump-file "/var/named/data/cache_dump.db";

statistics-file "/var/named/data/named_stats.txt";

memstatistics-file "/var/named/data/named_mem_stats.txt";

allow-query { any; };

recursion yes;

allow-transfer { none;};

allow-update { none; };

allow-recursion {localhost; 192.168.1.0/24; };

notify yes;

version "My DNS Server";

forwarders { 8.8.8.8; 8.8.4.4; };

dnssec-enable yes;

dnssec-validation yes;

bindkeys-file "/etc/named.iscdlv.key";

managed-keys-directory "/var/named/dynamic";

pid-file "/run/named/named.pid";

session-keyfile "/run/named/session.key";

};

logging {

channel default_debug {

file "data/named.run";

severity dynamic;

};

zone "." IN {

type hint;

file "named.ca";

};

include "/etc/named.rfc1912.zones";

include "/etc/named.root.key";

Проверка синтаксиса основного конфигурационного файла /etc/named.conf

# named-checkconf /etc/named.conf

1	# named-checkconf /etc/named.conf

2. Отключение использования IPv6 для DNS

# nano /etc/sysconfig/named

1	# nano /etc/sysconfig/named

OPTIONS="-4"

1	OPTIONS="-4"

Перезапуск Bind и проверка корректности обслуживания запросов

# systemctl restart named

1	# systemctl restart named

# ps ax | grep [n]amed

1	# ps ax \| grep [n]amed

 1183 ?        Ssl    0:00 /usr/sbin/named -u named -4

1	1183 ? Ssl 0:00 /usr/sbin/named -u named -4

# netstat -nlpu | grep [n]amed

1	# netstat -nlpu \| grep [n]amed

udp        0      0 192.168.1.86:53         0.0.0.0:*                           1183/named
udp        0      0 127.0.0.1:53            0.0.0.0:*                           1183/named

1 2	udp 0 0 192.168.1.86:53 0.0.0.0:* 1183/named udp 0 0 127.0.0.1:53 0.0.0.0:* 1183/named

Проверяем локально на DNS-сервере

# dig +short  @127.0.0.1 ukr.net

1	# dig +short @127.0.0.1 ukr.net

212.42.76.253
212.42.76.252

1 2	212.42.76.253 212.42.76.252

# dig +short  @192.168.1.86 ya.ru

1	# dig +short @192.168.1.86 ya.ru

213.180.193.3
93.158.134.3
213.180.204.3

213.180.193.3

93.158.134.3

213.180.204.3

Проверяем с клиента в локальной сети(192.168.1.84)

# dig +short @192.168.1.86 gmail.com

1	# dig +short @192.168.1.86 gmail.com

216.58.214.197

1	216.58.214.197

3.Настройка rndc

# cat /etc/rndc.key

1	# cat /etc/rndc.key

key "rndc-key" {
        algorithm hmac-md5;
        secret "vRqEj7vmS5qGRVeaheBY1g==";
};

key "rndc-key" {

algorithm hmac-md5;

secret "vRqEj7vmS5qGRVeaheBY1g==";

};

Если файла нет, то можно сгенерировать командой

# rndc-confgen -a

1	# rndc-confgen -a

# nano /etc/named.conf

1	# nano /etc/named.conf

key "rndc-key" {
        algorithm hmac-md5;
        secret "vRqEj7vmS5qGRVeaheBY1g==";
};
controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { "rndc-key"; };
};

options {
………………

key "rndc-key" {

algorithm hmac-md5;

secret "vRqEj7vmS5qGRVeaheBY1g==";

};

controls {

inet 127.0.0.1 port 953

allow { 127.0.0.1; } keys { "rndc-key"; };

};

options {

………………

# named-checkconf /etc/named.conf

1	# named-checkconf /etc/named.conf

# systemctl restart named

1	# systemctl restart named

# rndc status

1	# rndc status

version: 9.9.4-RedHat-9.9.4-29.el7_2.3 (My DNS Server) <id:8f9657aa>
CPUs found: 1
worker threads: 1
UDP listeners per interface: 1
number of zones: 101
debug level: 0
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is OFF
recursive clients: 0/0/1000
tcp clients: 0/100
server is up and running

version: 9.9.4-RedHat-9.9.4-29.el7_2.3 (My DNS Server) <id:8f9657aa>

CPUs found: 1

worker threads: 1

UDP listeners per interface: 1

number of zones: 101

debug level: 0

xfers running: 0

xfers deferred: 0

soa queries in progress: 0

query logging is OFF

recursive clients: 0/0/1000

tcp clients: 0/100

server is up and running

Настройка связки Master-Slave

1.Настроим на мастере поддержку зоны kamaok.org.ua

# nano /etc/named.conf

1	# nano /etc/named.conf

zone "kamaok.org.ua" in {
type master;
file "kamaok.org.ua.zone";
};

zone "kamaok.org.ua" in {

type master;

file "kamaok.org.ua.zone";

};

# nano /var/named/kamaok.org.ua.zone

1	# nano /var/named/kamaok.org.ua.zone

$TTL    3600
@               IN      SOA     ns1.kamaok.org.ua. ns2.kamaok.org.ua. (
2016060500      ; Serial
900            ; Refresh
900             ; Retry
3600            ; Expire
3600            ; Minimum
)
@               IN      NS      ns1.kamaok.org.ua.
@               IN      NS      ns2.kamaok.org.ua.
@               IN      MX      10      mail.kamaok.org.ua.
@               IN      A       192.168.1.86
www             IN      CNAME   @
mail            IN      A       192.168.1.86
ns1             IN      A       192.168.1.86
ns2             IN      A       192.168.1.86

$TTL 3600

@ IN SOA ns1.kamaok.org.ua. ns2.kamaok.org.ua. (

2016060500 ; Serial

900 ; Refresh

900 ; Retry

3600 ; Expire

3600 ; Minimum

)

@ IN NS ns1.kamaok.org.ua.

@ IN NS ns2.kamaok.org.ua.

@ IN MX 10 mail.kamaok.org.ua.

@ IN A 192.168.1.86

www IN CNAME @

mail IN A 192.168.1.86

ns1 IN A 192.168.1.86

ns2 IN A 192.168.1.86

Проверка синтаксиcа файла описания зоны kamaok.org.ua

# named-checkzone kamaok.org.ua /var/named/kamaok.org.ua.zone

1	# named-checkzone kamaok.org.ua /var/named/kamaok.org.ua.zone

zone kamaok.org.ua/IN: loaded serial 2016060500
OK

1 2	zone kamaok.org.ua/IN: loaded serial 2016060500 OK

Проверка синтаксиcа основного конфигурационного файла и перезапуск BIND-сервера

# named-checkconf /etc/named.conf && systemctl restart named

1	# named-checkconf /etc/named.conf && systemctl restart named

В логах BIND-сервера

# tail -f /var/named/data/named.run

1	# tail -f /var/named/data/named.run

zone localhost/IN: loaded serial 0
zone kamaok.org.ua/IN: loaded serial 2016060500
all zones loaded
running
zone kamaok.org.ua/IN: sending notifies (serial 2016060500)

zone localhost/IN: loaded serial 0

zone kamaok.org.ua/IN: loaded serial 2016060500

all zones loaded

running

zone kamaok.org.ua/IN: sending notifies (serial 2016060500)

Локальная проверка на DNS-мастер сервере

# dig @192.168.1.86 kamaok.org.ua | grep -vE '^;|^$'

1	# dig @192.168.1.86 kamaok.org.ua \| grep -vE '^;\|^$'

kamaok.org.ua.          3600    IN      A       192.168.1.86
kamaok.org.ua.          3600    IN      NS      ns1.kamaok.org.ua.
kamaok.org.ua.          3600    IN      NS      ns2.kamaok.org.ua.
ns1.kamaok.org.ua.      3600    IN      A       192.168.1.86
ns2.kamaok.org.ua.      3600    IN      A       192.168.1.86

kamaok.org.ua. 3600 IN A 192.168.1.86

kamaok.org.ua. 3600 IN NS ns1.kamaok.org.ua.

kamaok.org.ua. 3600 IN NS ns2.kamaok.org.ua.

ns1.kamaok.org.ua. 3600 IN A 192.168.1.86

ns2.kamaok.org.ua. 3600 IN A 192.168.1.86

2.Настройка Master-сервера для связки master-slave

# nano /etc/named.conf

1	# nano /etc/named.conf

allow-transfer { 192.168.1.84;};

1	allow-transfer { 192.168.1.84;};

# named-checkconf /etc/named.conf && systemctl restart named

1	# named-checkconf /etc/named.conf && systemctl restart named

3.Настройка Slave-сервера(Ubuntu 14.04)

# apt-get install bind9 dnsutils

1	# apt-get install bind9 dnsutils

# cp /etc/bind/named.conf.options /etc/bind/named.conf.options~

1	# cp /etc/bind/named.conf.options /etc/bind/named.conf.options~

# nano /etc/bind/named.conf.options

1	# nano /etc/bind/named.conf.options

options {
        directory "/var/cache/bind";
        dnssec-validation auto;
        auth-nxdomain no;    # conform to RFC1035
allow-query { any; };
allow-transfer { none; };
allow-update { 192.168.1.86; };
recursion yes;
allow-recursion { 127.0.0.1; 192.168.1.0/24; };
notify yes;
listen-on-v6 { none; };
version "My DNS Server";
forwarders { 8.8.8.8; 8.8.4.4; };
};

options {

directory "/var/cache/bind";

dnssec-validation auto;

auth-nxdomain no; # conform to RFC1035

allow-query { any; };

allow-transfer { none; };

allow-update { 192.168.1.86; };

recursion yes;

allow-recursion { 127.0.0.1; 192.168.1.0/24; };

notify yes;

listen-on-v6 { none; };

version "My DNS Server";

forwarders { 8.8.8.8; 8.8.4.4; };

};

# nano /etc/bind/named.conf

1	# nano /etc/bind/named.conf

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
include "/etc/bind/named.conf.zones";

include "/etc/bind/named.conf.options";

include "/etc/bind/named.conf.local";

include "/etc/bind/named.conf.default-zones";

include "/etc/bind/named.conf.zones";

# nano /etc/bind/named.conf.zones

1	# nano /etc/bind/named.conf.zones

zone "kamaok.org.ua" {
        type slave;
        file "/etc/bind/zones/slave/kamaok.org.ua";
        masters { 192.168.1.86; };
        allow-notify { 192.168.1.86; };
};

zone "kamaok.org.ua" {

type slave;

file "/etc/bind/zones/slave/kamaok.org.ua";

masters { 192.168.1.86; };

allow-notify { 192.168.1.86; };

};

# mkdir -p /etc/bind/zones/slave && chown -R bind:bind /etc/bind/zones

1	# mkdir -p /etc/bind/zones/slave && chown -R bind:bind /etc/bind/zones

# named-checkconf /etc/bind/named.conf && service bind9 restart

1	# named-checkconf /etc/bind/named.conf && service bind9 restart

* Stopping domain name service... bind9
waiting for pid 3533 to die
   ...done.
 * Starting domain name service... bind9
   ...done.

* Stopping domain name service... bind9

waiting for pid 3533 to die

...done.

* Starting domain name service... bind9

...done.

В логах Slave-сервера

Jun  5 20:18:02 ubuntu141 named[3600]: zone kamaok.org.ua/IN: Transfer started.
Jun  5 20:18:02 ubuntu141 named[3600]: transfer of 'kamaok.org.ua/IN' from 192.168.1.86#53: connected using 192.168.1.84#58495
Jun  5 20:18:02 ubuntu141 named[3600]: zone kamaok.org.ua/IN: transferred serial 2016060500
Jun  5 20:18:02 ubuntu141 named[3600]: transfer of 'kamaok.org.ua/IN' from 192.168.1.86#53: Transfer completed: 1 messages, 10 records, 242 bytes, 0.001 secs (242000 bytes/sec)
Jun  5 20:18:02 ubuntu141 named[3600]: zone kamaok.org.ua/IN: sending notifies (serial 2016060500)

Jun 5 20:18:02 ubuntu141 named[3600]: zone kamaok.org.ua/IN: Transfer started.

Jun 5 20:18:02 ubuntu141 named[3600]: transfer of 'kamaok.org.ua/IN' from 192.168.1.86#53: connected using 192.168.1.84#58495

Jun 5 20:18:02 ubuntu141 named[3600]: zone kamaok.org.ua/IN: transferred serial 2016060500

Jun 5 20:18:02 ubuntu141 named[3600]: transfer of 'kamaok.org.ua/IN' from 192.168.1.86#53: Transfer completed: 1 messages, 10 records, 242 bytes, 0.001 secs (242000 bytes/sec)

Jun 5 20:18:02 ubuntu141 named[3600]: zone kamaok.org.ua/IN: sending notifies (serial 2016060500)

Проверка корректности обработки запросов для домена kamaok.org.ua на Slave-сервере

# dig @192.168.1.84 kamaok.org.ua | grep -vE '^;|^$'

1	# dig @192.168.1.84 kamaok.org.ua \| grep -vE '^;\|^$'

kamaok.org.ua.          3600    IN      A       192.168.1.86
kamaok.org.ua.          3600    IN      NS      ns1.kamaok.org.ua.
kamaok.org.ua.          3600    IN      NS      ns2.kamaok.org.ua.
ns1.kamaok.org.ua.      3600    IN      A       192.168.1.86
ns2.kamaok.org.ua.      3600    IN      A       192.168.1.86

kamaok.org.ua. 3600 IN A 192.168.1.86

kamaok.org.ua. 3600 IN NS ns1.kamaok.org.ua.

kamaok.org.ua. 3600 IN NS ns2.kamaok.org.ua.

ns1.kamaok.org.ua. 3600 IN A 192.168.1.86

ns2.kamaok.org.ua. 3600 IN A 192.168.1.86

Добавим на Master-сервере новую запись – поддомен test, а также изменим IP-адрес для ns2-сервера с IP-адреса Master-сервера на IP-адрес Slave-сервера и увеличим серийный номер#

# nano /var/named/kamaok.org.ua.zone

1	# nano /var/named/kamaok.org.ua.zone

2016060501      ; Serial
ns2             IN      A       192.168.1.84
test            IN      A       192.168.1.86

2016060501 ; Serial

ns2 IN A 192.168.1.84

test IN A 192.168.1.86

# systemctl restart named

1	# systemctl restart named

В логах Master-сервера

zone kamaok.org.ua/IN: sending notifies (serial 2016060501)
client 192.168.1.84#43549 (kamaok.org.ua): transfer of 'kamaok.org.ua/IN': AXFR-style IXFR started
client 192.168.1.84#43549 (kamaok.org.ua): transfer of 'kamaok.org.ua/IN': AXFR-style IXFR ended

zone kamaok.org.ua/IN: sending notifies (serial 2016060501)

client 192.168.1.84#43549 (kamaok.org.ua): transfer of 'kamaok.org.ua/IN': AXFR-style IXFR started

client 192.168.1.84#43549 (kamaok.org.ua): transfer of 'kamaok.org.ua/IN': AXFR-style IXFR ended

В логах Slave-сервера

Jun  5 20:32:12 ubuntu141 named[4625]: client 192.168.1.86#19471: received notify for zone 'kamaok.org.ua'
Jun  5 20:32:12 ubuntu141 named[4625]: zone kamaok.org.ua/IN: Transfer started.
Jun  5 20:32:12 ubuntu141 named[4625]: transfer of 'kamaok.org.ua/IN' from 192.168.1.86#53: connected using 192.168.1.84#43549
Jun  5 20:32:12 ubuntu141 named[4625]: zone kamaok.org.ua/IN: transferred serial 2016060501
Jun  5 20:32:12 ubuntu141 named[4625]: transfer of 'kamaok.org.ua/IN' from 192.168.1.86#53: Transfer completed: 1 messages, 11 records, 263 bytes, 0.001 secs (263000 bytes/sec)
Jun  5 20:32:12 ubuntu141 named[4625]: zone kamaok.org.ua/IN: sending notifies (serial 2016060501)

Jun 5 20:32:12 ubuntu141 named[4625]: client 192.168.1.86#19471: received notify for zone 'kamaok.org.ua'

Jun 5 20:32:12 ubuntu141 named[4625]: zone kamaok.org.ua/IN: Transfer started.

Jun 5 20:32:12 ubuntu141 named[4625]: transfer of 'kamaok.org.ua/IN' from 192.168.1.86#53: connected using 192.168.1.84#43549

Jun 5 20:32:12 ubuntu141 named[4625]: zone kamaok.org.ua/IN: transferred serial 2016060501

Jun 5 20:32:12 ubuntu141 named[4625]: transfer of 'kamaok.org.ua/IN' from 192.168.1.86#53: Transfer completed: 1 messages, 11 records, 263 bytes, 0.001 secs (263000 bytes/sec)

Jun 5 20:32:12 ubuntu141 named[4625]: zone kamaok.org.ua/IN: sending notifies (serial 2016060501)

Проверяем обработку запроса на поддомен test на Slave-сервере и IP-адреса ns2-сервера

# dig +short @192.168.1.84 test.kamaok.org.ua

1	# dig +short @192.168.1.84 test.kamaok.org.ua

192.168.1.86

1	192.168.1.86

# dig +short @192.168.1.84 ns2.kamaok.org.ua

1	# dig +short @192.168.1.84 ns2.kamaok.org.ua

192.168.1.84

1	192.168.1.84

Настройка передачи зон по защищенному ключу
Включаем использование DNSSEC путем добавления/проверки наличия строки
dnssec-enable yes;

Master(Centos)

# nano /etc/named.conf

1	# nano /etc/named.conf

options {
………
dnssec-enable yes;
);

options {

………

dnssec-enable yes;

);

Salve(Ubuntu)

# nano  /etc/bind/named.conf.options

1	# nano /etc/bind/named.conf.options

options {
dnssec-enable yes;
………
};

options {

dnssec-enable yes;

………

};

Установка пакета haveged для более быстрой генерации dnsseс-ключей

# yum install haveged

1	# yum install haveged

Генерирование пары dnssec-ключей(приватный и публичный ключи)для домена kamaok.org.ua

# dnssec-keygen -a hmac-md5 -b 128 -n host kamaok.org.ua

1	# dnssec-keygen -a hmac-md5 -b 128 -n host kamaok.org.ua

Kkamaok.org.ua.+157+50853

1	Kkamaok.org.ua.+157+50853

Просмотр hashkey

# grep Key  Kkamaok.org.ua.+157+50853.private

1	# grep Key Kkamaok.org.ua.+157+50853.private

Key: n/IfuMsOm/npXM5dx5gbAg==

1	Key: n/IfuMsOm/npXM5dx5gbAg==

Добавляем ключ на Master и Slave-сервера
Master

# nano /etc/named.conf

1	# nano /etc/named.conf

key "TRANSFER" {
        algorithm hmac-md5;
        secret "n/IfuMsOm/npXM5dx5gbAg==";
};

key "TRANSFER" {

algorithm hmac-md5;

secret "n/IfuMsOm/npXM5dx5gbAg==";

};

Slave

# nano /etc/bind/named.conf

1	# nano /etc/bind/named.conf

key "TRANSFER" {
        algorithm hmac-md5;
        secret "n/IfuMsOm/npXM5dx5gbAg==";
};

key "TRANSFER" {

algorithm hmac-md5;

secret "n/IfuMsOm/npXM5dx5gbAg==";

};

На MASTER-сервере добавим информация об использовании ключа для связки с Slave-сервером(192.168.1.84)

# nano /etc/named.conf

1	# nano /etc/named.conf

server 192.168.1.84 {
        keys { TRANSFER; };
};

server 192.168.1.84 {

keys { TRANSFER; };

};

Аналогичную запись добавляем и на SLAVE-сервера для взаимодействия по ключам с Master-сервером(192.168.1.86)

# nano /etc/bind/named.conf

1	# nano /etc/bind/named.conf

server 192.168.1.86 {
        keys { TRANSFER; };
};

server 192.168.1.86 {

keys { TRANSFER; };

};

Проверка синтаксиса конф.файл named.conf и рестарт DNS-службы
Master

# named-checkconf /etc/named.conf && systemctl restart named

1	# named-checkconf /etc/named.conf && systemctl restart named

Slave

# named-checkconf /etc/bind/named.conf && service bind9 restart

1	# named-checkconf /etc/bind/named.conf && service bind9 restart

Добавим новый поддомен test2 на Master-сервер и проверим работу передачи зон по защищенному каналу

# nano /var/named/kamaok.org.ua.zone

1	# nano /var/named/kamaok.org.ua.zone

2016060502      ; Serial
test2           IN      A       192.168.1.86

1 2	2016060502 ; Serial test2 IN A 192.168.1.86

# named-checkconf /etc/named.conf && rndc reload

1	# named-checkconf /etc/named.conf && rndc reload

Логи на Master-сервере

zone kamaok.org.ua/IN: loaded serial 2016060502
zone kamaok.org.ua/IN: sending notifies (serial 2016060502)
client 192.168.1.84#42170/key transfer (kamaok.org.ua): transfer of 'kamaok.org.ua/IN': AXFR-style IXFR started: TSIG transfer
client 192.168.1.84#42170/key transfer (kamaok.org.ua): transfer of 'kamaok.org.ua/IN': AXFR-style IXFR ended

zone kamaok.org.ua/IN: loaded serial 2016060502

zone kamaok.org.ua/IN: sending notifies (serial 2016060502)

client 192.168.1.84#42170/key transfer (kamaok.org.ua): transfer of 'kamaok.org.ua/IN': AXFR-style IXFR started: TSIG transfer

client 192.168.1.84#42170/key transfer (kamaok.org.ua): transfer of 'kamaok.org.ua/IN': AXFR-style IXFR ended

Логи на Slave-сервере

Jun  5 23:51:32 ubuntu141 named[5038]: client 192.168.1.86#46546/key transfer: received notify for zone 'kamaok.org.ua': TSIG 'transfer'
Jun  5 23:51:32 ubuntu141 named[5038]: zone kamaok.org.ua/IN: Transfer started.
Jun  5 23:51:32 ubuntu141 named[5038]: transfer of 'kamaok.org.ua/IN' from 192.168.1.86#53: connected using 192.168.1.84#42170
Jun  5 23:51:32 ubuntu141 named[5038]: zone kamaok.org.ua/IN: transferred serial 2016060502: TSIG 'transfer'
Jun  5 23:51:32 ubuntu141 named[5038]: transfer of 'kamaok.org.ua/IN' from 192.168.1.86#53: Transfer completed: 1 messages, 12 records, 363 bytes, 0.001 secs (363000 bytes/sec)
Jun  5 23:51:32 ubuntu141 named[5038]: zone kamaok.org.ua/IN: sending notifies (serial 2016060502)

Jun 5 23:51:32 ubuntu141 named[5038]: client 192.168.1.86#46546/key transfer: received notify for zone 'kamaok.org.ua': TSIG 'transfer'

Jun 5 23:51:32 ubuntu141 named[5038]: zone kamaok.org.ua/IN: Transfer started.

Jun 5 23:51:32 ubuntu141 named[5038]: transfer of 'kamaok.org.ua/IN' from 192.168.1.86#53: connected using 192.168.1.84#42170

Jun 5 23:51:32 ubuntu141 named[5038]: zone kamaok.org.ua/IN: transferred serial 2016060502: TSIG 'transfer'

Jun 5 23:51:32 ubuntu141 named[5038]: transfer of 'kamaok.org.ua/IN' from 192.168.1.86#53: Transfer completed: 1 messages, 12 records, 363 bytes, 0.001 secs (363000 bytes/sec)

Jun 5 23:51:32 ubuntu141 named[5038]: zone kamaok.org.ua/IN: sending notifies (serial 2016060502)

# dig +short @192.168.1.84 test2.kamaok.org.ua

1	# dig +short @192.168.1.84 test2.kamaok.org.ua

192.168.1.86

1	192.168.1.86

Настройка DNS в сhroot-окружении

# yum install bind-chroot

1	# yum install bind-chroot

# /usr/libexec/setup-named-chroot.sh /var/named/chroot on

1	# /usr/libexec/setup-named-chroot.sh /var/named/chroot on

# systemctl stop named

1	# systemctl stop named

# systemctl disable named

1	# systemctl disable named

# systemctl start named-chroot

1	# systemctl start named-chroot

# systemctl enable named-chroot

1	# systemctl enable named-chroot

# ps uax | grep [n]amed

1	# ps uax \| grep [n]amed

named     2914  0.0  0.6 160388 13984 ?        Ssl  21:54   0:00 /usr/sbin/named -u named -t /var/named/chroot -4

1	named 2914 0.0 0.6 160388 13984 ? Ssl 21:54 0:00 /usr/sbin/named -u named -t /var/named/chroot -4

# ls -al /var/named/chroot/etc/

1	# ls -al /var/named/chroot/etc/

total 40
drwxr-x--- 4 root named 4096 Jun 11 21:53 .
drwxr-x--- 7 root named 4096 Jun  5 19:24 ..
-rw-r--r-- 1 root root  2071 Apr 22 20:44 localtime
drwxr-x--- 2 root named 4096 Mar 16 15:40 named
-rw-r----- 1 root named 1658 Jun  5 23:46 named.conf
-rw-r--r-- 1 root named 2389 Mar 16 15:40 named.iscdlv.key
-rw-r----- 1 root named  931 Jun 21  2007 named.rfc1912.zones
-rw-r--r-- 1 root named  487 Jul 19  2010 named.root.key
drwxr-x--- 3 root named 4096 Jun  5 19:24 pki
-rw-r----- 1 root named   77 Jun  5 19:12 rndc.key

total 40

drwxr-x--- 4 root named 4096 Jun 11 21:53 .

drwxr-x--- 7 root named 4096 Jun 5 19:24 ..

-rw-r--r-- 1 root root 2071 Apr 22 20:44 localtime

drwxr-x--- 2 root named 4096 Mar 16 15:40 named

-rw-r----- 1 root named 1658 Jun 5 23:46 named.conf

-rw-r--r-- 1 root named 2389 Mar 16 15:40 named.iscdlv.key

-rw-r----- 1 root named 931 Jun 21 2007 named.rfc1912.zones

-rw-r--r-- 1 root named 487 Jul 19 2010 named.root.key

drwxr-x--- 3 root named 4096 Jun 5 19:24 pki

-rw-r----- 1 root named 77 Jun 5 19:12 rndc.key

ls -al /var/named/chroot/var/named/

1	ls -al /var/named/chroot/var/named/

total 44
drwxr-x--- 6 root  named 4096 Jun  5 19:30 .
drwxr-x--- 5 root  named 4096 Jun  5 19:24 ..
drwxr-x--- 7 root  named 4096 Jun  5 19:24 chroot
drwxrwx--- 2 named named 4096 Jun  5 19:12 data
drwxrwx--- 2 named named 4096 Jun 11 21:54 dynamic
-rw-r--r-- 1 root  root   637 Jun  5 23:50 kamaok.org.ua.zone
-rw-r----- 1 root  named 2076 Jan 28  2013 named.ca
-rw-r----- 1 root  named  152 Dec 15  2009 named.empty
-rw-r----- 1 root  named  152 Jun 21  2007 named.localhost
-rw-r----- 1 root  named  168 Dec 15  2009 named.loopback
drwxrwx--- 2 named named 4096 Mar 16 15:40 slaves

total 44

drwxr-x--- 6 root named 4096 Jun 5 19:30 .

drwxr-x--- 5 root named 4096 Jun 5 19:24 ..

drwxr-x--- 7 root named 4096 Jun 5 19:24 chroot

drwxrwx--- 2 named named 4096 Jun 5 19:12 data

drwxrwx--- 2 named named 4096 Jun 11 21:54 dynamic

-rw-r--r-- 1 root root 637 Jun 5 23:50 kamaok.org.ua.zone

-rw-r----- 1 root named 2076 Jan 28 2013 named.ca

-rw-r----- 1 root named 152 Dec 15 2009 named.empty

-rw-r----- 1 root named 152 Jun 21 2007 named.localhost

-rw-r----- 1 root named 168 Dec 15 2009 named.loopback

drwxrwx--- 2 named named 4096 Mar 16 15:40 slaves

Важно: все изменения в файле named.conf или в файлах описания зон необходимо проводить в конфигурационнных файлах,распологающихся в каталоге /var/named/chroot

Источник:
http://www.server-world.info/en/note?os=CentOS_7&p=dns&f=4

Опубликовано в рубрике Centos, DNS

Метки: Bind, centos7, named, rndc

Комментирование и размещение ссылок запрещено.

Комментарии закрыты.

Установка и настройка Bind на Centos7. Настройка Master-Slave DNS-серверов на Centos7

Страницы

Свежие записи

Архивы

Рубрики

Админ-панель