DNS 深度理解 [ 一 ]

# cat /var/named/named.ca	全球13组根DNS服务器解析地址的存放位置
# cp /etc/named.conf{,.bak}	先备份配置文件再编辑
# > /etc/named.conf		bind的主配置文件,主要提供全局配置
# vi /etc/named.conf
// 全局配置段,注意,dns工作在tcp/53和udp/53端口上,tcp/53一般主要用来进行区域同步,而udp/53主要用来负责正常的解析请求和响应
options {
	version "1.1.1";
	listen-on port 53 { 192.168.3.60;127.0.0.1; };	// 把dns端口监听在本地指定的ip上
	directory "/var/named/chroot/etc/";		
	pid-file "/var/named/chroot/var/run/named/named.pid";
	allow-query { any; };	// 允许任意主机向我进行dns请求
	Dump-file "/var/named/chroot/var/log/binddump.db";
	Statistics-file "/var/named/chroot/var/log/named_stats";
	zone-statistics yes;
	memstatistics-file "log/mem_stats";
	empty-zones-enable no;
	forwarders { 114.114.114.114;8.8.8.8; };
};
// 设置rndc通信共享秘钥
key "rndc-key" { 
	algorithm hmac-md5;
	secret "Eqw4hClGExUWeDkKBX/pBg==";
};
controls {
	inet 127.0.0.1 port 953
	allow { 127.0.0.1; } keys { "rndc-key"; };
};
// bind日志配置区段	
logging {
	channel warning {
		file "/var/named/chroot/var/log/dns_warning" versions 10 size 10m;
		severity warning;
		print-category yes;
		print-severity yes;
		print-time yes;
	};
	channel general_dns {
		file "/var/named/chroot/var/log/dns_log" versions 10 size 100m;
		severity info;
		print-category yes;
		print-severity yes;
		print-time yes;
	};
	category default {
		warning;
	};
	category queries {
		general_dns;
	};
};
// 为了简化bind主配置文件,可以通过include的方式来引入区域文件
include "/var/named/chroot/etc/view.conf";

# vi /etc/rndc.key
key "rndc-key" {
    algorithm hmac-md5;
    secret "Eqw4hClGExUWeDkKBX/pBg==";
};
# vi /etc/rndc.conf
key "rndc-key" {
	algorithm hmac-md5;
	secret "Eqw4hClGExUWeDkKBX/pBg==";
};
options {
	default-key "rndc-key";
	default-server 127.0.0.1;	// 让它只监听在本地,禁止rndc远程连接,防止被利用
	default-port 953;
};

# vi /var/named/chroot/etc/view.conf
view "MasterView" {
	zone "admin.org" {
		type    master;
		file    "admin.org.zone";  // 区域文件名,此处的文件名可以随意
		allow-transfer {	   // 允许传送的主机,所谓的区域传送漏洞也就出在这里
			192.168.3.61;
			// any;		   // 如果此处设置为any,则允许任意主机来传送,这就是产生区域传送漏洞的根源
					   // 所以务必谨记,跟谁传送,就只写谁的ip
		};
		notify  yes;
		also-notify {
			192.168.3.61;
		};
	};
};

# vi /var/named/chroot/etc/admin.org.zone
$TTL 3600   ; 1h
@     IN SOA  ns1.admin.org. email.admin.org (
                        2003       ; serial   // 时刻谨记,每次如果是手工修改完解析库文件以后都要自增一下
                        900        ; refresh (15 minutes)
                        600        ; retry (10 minutes)
                        86400      ; expire (1 day)
                        3600       ; minimum (1 hour)
                         )
                IN      NS      ns1.admin.org.
                IN      NS      ns2.admin.org.
                IN      MX  10  mx1.admin.org.
                IN      MX  20  mx2.admin.org.
ns1		IN	A	192.168.3.3
ns2		IN	A	192.168.3.61
mx1		IN	A	192.168.3.4
mx2		IN	A	192.168.3.5
www		IN	A	192.168.3.6
www		IN	A	192.168.3.3
ftp		IN	CNAME	www.admin.org.
*		IN	A	192.168.3.110	//此处,即为泛解析的两种书写方式
admin.org.	IN	A	192.168.3.120
cacti		IN	A	192.168.3.16
zabbix		IN	A	192.168.3.18

# rndc reload
# cat /var/named/chroot/etc/192.168.3.zone	依然是在重载服务以后,该反向区域解析库文件会被自动同步过来
# host -t ptr 192.168.3.3 192.168.3.61