DNS主从服务同步时,主服务每次修改配置文件需要修改一下序列号，主从同步主要 根据序列号的变化(即master端每次更改配置后需要重启named服务,才会自动进行同步到salve)。
主从原理：从会监听主的 TCP 53 端口，它会隔一段时间去探测 主配置文件中的序列号，如果主端 序列号更新后 从端探测到会 将主端内容 同步到本地。
DNS主从部署环境:
1 2 3 4 | 操作系统：CentOS Linux release 7.3.1611 (Core)master服务器：10.20.9.7slave 服务器：10.20.9.8 |
关闭防火墙和selinux:
1 2 3 4 5 6 | #systemctl stop firewalld#systemctl disable firewalld#systemctl status firewalld <br>#sed -i 's#SELINUX=enforcing#SELINUX=disabled#g' /etc/sysconfig/selinux重启主机(reboot) |
一.安装bind软件
master端和slave端都安装
1 | # yum install -y bind bind-utils bind-chroot |
二.修改服务器配置文件
1.master端配置修改(10.20.9.7)
1.1> 配置/etc/named.conf文件.
这个配置文件主要分3段内容,options是全局配置，logging是日志配置，最后是区域解析库配置以及所包含的区域解析库文件配置.
只修改第二行和最后一行为any
options {
listen-on port 53 { any; }; #修改为any
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; }; #修改为any
};1.2> 编辑/etc/named.rfc1912.zones在文件末尾添加一个正向解析区域和一个反向解析区域.
#######################################################################
zone "saneri.com" IN {
type master; #定义区域类型，type可选值为：hint(根的)|master(主的)|slave(辅助的)|forward(转发)
file "saneri.com.zone"; #定义区域文件名称
allow-update { none; };
allow-transfer { 10.20.9.8; }; #指定允许转发的目标主机，即从服务器
};
zone "9.20.10.in-addr.arpa" IN {
type master;
file "10.20.9.zone";
allow-update { none; };
allow-transfer { 10.20.9.8; };
};修改后检查下：这个命令会同时检查named.conf和named.rfc1912.zones两个文件的配置信息
1 | # named-checkconf |
没有任何输出表示 /etc/named.conf没有语法错误.
1.3> 在/var/named目录下创建saneri.com.zone正向解析库文件和10.20.9.zone反向解析库文件
# cd /var/named/[root@ops-dns-01 named]# vim saneri.com.zone $TTL 1D @ IN SOA dns1.saneri.com. mail.saneri.com. ( 2018030422 2H 10M 1W 1D ) @ IN NS dns1.saneri.com. @ IN NS dns2.saneri.com. @ IN MX 10 mail.saneri.com. dns1 IN A 10.20.9.7dns2 IN A 10.20.9.8mail IN A 10.20.9.7www IN A 10.20.9.7
检查正向解析库文件有没有错误
正向解析语法检查:
[root@ops-dns-01 named]# named-checkzone "saneri.com" saneri.com.zone zone saneri.com/IN: loaded serial 2018030422OK [root@ops-dns-01 named]#
添加反向解析库文件.
[root@ops-dns-01 named]# vim 10.20.9.zone $TTL 1d @ IN SOA dns1.saneri.com. mail.saneri.com. ( 2018030422; 2H; 10M; 1W; 1D; ) IN NS dns1.saneri.com. IN NS dns2.saneri.com.7 IN PTR www.saneri.com.7 IN PTR mail.saneri.com.7 IN PTR dns1.saneri.com.8 IN PTR dns2.saneri.com.
反向解析语法检查:
[root@ops-dns-01 named]# named-checkzone "9.20.10.in-addr.arpa" 10.20.9.zone zone 9.20.10.in-addr.arpa/IN: loaded serial 2018030422OK [root@ops-dns-01 named]#
查看权限：目录下文件，属组应为named用户
[root@ops-dns-01 named]# chown -R named.named /var/named/
启动服务并查看服务状态
1 2 | [root@ops-dns-01 named]# systemctl start named.service[root@ops-dns-01 named]# systemctl status named.service |
1.4> 如果服务状态正常，就可以进行域名解析测试.
正向解析
[root@ops-dns-01 named]# dig -t A www.saneri.com @10.20.9.7; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7_5.1 <<>> -t A www.saneri.com @10.20.9.7;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44586;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096;; QUESTION SECTION: ;www.saneri.com. IN A ;; ANSWER SECTION: www.saneri.com. 86400 IN A 10.20.9.7;; AUTHORITY SECTION: saneri.com. 86400 IN NS dns1.saneri.com. saneri.com. 86400 IN NS dns2.saneri.com. ;; ADDITIONAL SECTION: dns1.saneri.com. 86400 IN A 10.20.9.7dns2.saneri.com. 86400 IN A 10.20.9.8;; Query time: 0 msec ;; SERVER: 10.20.9.7#53(10.20.9.7) ;; WHEN: Tue Sep 18 21:43:56 CST 2018;; MSG SIZE rcvd: 128[root@ops-dns-01 named]#
反向解析：
[root@ops-dns-01 named]# dig -x 10.20.9.8 @10.20.9.7; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7_5.1 <<>> -x 10.20.9.8 @10.20.9.7;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17606;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096;; QUESTION SECTION: ;8.9.20.10.in-addr.arpa. IN PTR ;; ANSWER SECTION:8.9.20.10.in-addr.arpa. 86400 IN PTR dns2.saneri.com. ;; AUTHORITY SECTION:9.20.10.in-addr.arpa. 86400 IN NS dns2.saneri.com.9.20.10.in-addr.arpa. 86400 IN NS dns1.saneri.com. ;; ADDITIONAL SECTION: dns1.saneri.com. 86400 IN A 10.20.9.7dns2.saneri.com. 86400 IN A 10.20.9.8;; Query time: 0 msec ;; SERVER: 10.20.9.7#53(10.20.9.7) ;; WHEN: Tue Sep 18 23:45:43 CST 2018;; MSG SIZE rcvd: 145[root@ops-dns-01 named]#
至此DNS主服务器已经配置完毕并能正常工作！！！
2.从服务器salve端配置(10.20.9.8)
2.1> 编辑/etc/named.conf将监听IP地址改一下，其它不需要更改
options {
listen-on port 53 { 10.20.9.8;127.0.0.1; }; //添加本机的ip地址
}2.2> 编辑/etc/named.rfc1912.zones文件，添加如下配置
#######################################################################
zone "saneri.com" IN {
type slave;
masters { 10.20.9.7; };
file "slaves/saneri.com.zone";
};
zone "9.20.10.in-addr.arpa" IN {
type slave;
masters { 10.20.9.7; };
file "slaves/10.20.9.zone";
};注意事项：从服务器的区域解析库文件应当是从主服务器加载过来的，所以无需创建区域解析库文件.
2.3> 启动从named服务，并查看状态.
[root@ops-dns-02 ~]# systemctl start named.service
[root@ops-dns-02 ~]# systemctl status named.service
a—? named.service - Berkeley Internet Name Domain (DNS)
Loaded: loaded (/usr/lib/systemd/system/named.service; disabled; vendor preset: disabled)
Active: active (running) since Tue 2018-09-18 15:46:56 CST; 24min ago
Process: 2140 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} $OPTIONS (code=exited, status=0/SUCCESS)
Process: 2137 ExecStartPre=/bin/bash -c if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi (code=exited, status=0/SUCCESS)
Main PID: 2142 (named)
CGroup: /system.slice/named.service
a””a”€2142 /usr/sbin/named -u named -c /etc/named.conf
Sep 18 15:47:11 ops-dns-02 named[2142]: zone 9.20.10.in-addr.arpa/IN: Transfer started.
Sep 18 15:47:11 ops-dns-02 named[2142]: transfer of '9.20.10.in-addr.arpa/IN' from 10.20.9.7#53: connected using 10.20.9.8#45002Sep 18 15:47:11 ops-dns-02 named[2142]: zone 9.20.10.in-addr.arpa/IN: transferred serial 2018030422Sep 18 15:47:11 ops-dns-02 named[2142]: transfer of '9.20.10.in-addr.arpa/IN' from 10.20.9.7#53: Transfer completed: 1 mess...es/sec)
Sep 18 15:47:11 ops-dns-02 named[2142]: zone 9.20.10.in-addr.arpa/IN: sending notifies (serial 2018030422)
Sep 18 15:47:11 ops-dns-02 named[2142]: zone saneri.com/IN: Transfer started.
Sep 18 15:47:11 ops-dns-02 named[2142]: transfer of 'saneri.com/IN' from 10.20.9.7#53: connected using 10.20.9.8#51488Sep 18 15:47:11 ops-dns-02 named[2142]: zone saneri.com/IN: transferred serial 2018030422Sep 18 15:47:11 ops-dns-02 named[2142]: transfer of 'saneri.com/IN' from 10.20.9.7#53: Transfer completed: 1 messages, 9 rec...es/sec)
Sep 18 15:47:11 ops-dns-02 named[2142]: zone saneri.com/IN: sending notifies (serial 2018030422)
Hint: Some lines were ellipsized, use -l to show in full.从状态日志中发现，zone区域文件已同步到从服务器
2.4> 检查测试同步功能
查看/var/named/slaves/目录，发现多了两个文件。
[root@ops-dns-02 ~]# cd /var/named/[root@ops-dns-02 named]# ll total 16drwxr-x--- 7 root named 61 Sep 18 15:20 chroot drwxrwx--- 2 named named 23 Sep 18 15:30 data drwxrwx--- 2 named named 31 Sep 18 15:38 dynamic-rw-r----- 1 root named 2281 May 22 2017 named.ca-rw-r----- 1 root named 152 Dec 15 2009 named.empty-rw-r----- 1 root named 152 Jun 21 2007 named.localhost-rw-r----- 1 root named 168 Dec 15 2009 named.loopback drwxrwx--- 2 named named 48 Sep 18 15:47 slaves [root@ops-dns-02 named]# ll slaves/total 8-rw-r--r-- 1 named named 357 Sep 18 15:47 10.20.9.zone-rw-r--r-- 1 named named 394 Sep 18 15:47 saneri.com.zone [root@ops-dns-02 named]#
查看文件内容，可以看到该文件和主DNS服务器上的文件内容是一样的。说明这2个文件是自动从主服务器同步过来的。
以后添加DNS记录，只需修改正向解析文件/var/named/saneri.com.zone，和 反向解析文件/var/named/10.20.9.zone，并更新序列号（需要重载named）。则主服务器会自动将zone区域文件推送至从服务器/var/named/slaves下。
2.5> 遇到文件同步问题排查.
1、主服务器zone文件无法同步到从服务器的slaves目录下，从服务slaves目录下为空,查看日志信息.
[root@ops-dns-02 named]# tail -f /var/log/messages Sep 18 15:41:36 localhost named[11919]: command channel listening on ::1#953Sep 18 15:41:36 localhost named[11919]: managed-keys-zone: loaded serial 2Sep 18 15:41:36 localhost named[11919]: zone 0.in-addr.arpa/IN: loaded serial 0Sep 18 15:41:36 localhost named[11919]: zone 1.0.0.127.in-addr.arpa/IN: loaded serial 0Sep 18 15:41:36 localhost named[11919]: zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 0Sep 18 15:41:36 localhost named[11919]: zone localhost/IN: loaded serial 0Sep 18 15:41:36 localhost named[11919]: zone localhost.localdomain/IN: loaded serial 0Sep 18 15:41:36 localhost named[11919]: all zones loaded Sep 18 15:41:36 localhost named[11919]: running Sep 18 15:41:36 localhost systemd: Started Berkeley Internet Name Domain (DNS). Sep 18 15:43:06 localhost named[11919]: zone saneri.com/IN: refresh: retry limit for master 10.20.9.7#53 exceeded (source 0.0.0.0#0) Sep 18 15:43:06 localhost named[11919]: zone saneri.com/IN: Transfer started. Sep 18 15:43:06 localhost named[11919]: transfer of 'saneri.com/IN' from 10.20.9.7#53: failed to connect: host unreachable Sep 18 15:43:06 localhost named[11919]: transfer of 'saneri.com/IN' from 10.20.9.7#53: Transfer completed: 0 messages, 0 records, 0 bytes, 0.001 secs (0 bytes/sec) Sep 18 15:43:06 localhost named[11919]: zone 9.20.10.in-addr.arpa/IN: refresh: retry limit for master 10.20.9.7#53 exceeded (source 0.0.0.0#0) Sep 18 15:43:19 localhost kernel: ip_tables: (C) 2000-2006 Netfilter Core Team Sep 18 15:44:36 localhost named[11919]: zone saneri.com/IN: refresh: retry limit for master 10.20.9.7#53 exceeded (source 0.0.0.0#0) Sep 18 15:44:37 localhost named[11919]: zone 9.20.10.in-addr.arpa/IN: refresh: retry limit for master 10.20.9.7#53 exceeded (source 0.0.0.0#0) Sep 18 15:44:37 localhost named[11919]: zone 9.20.10.in-addr.arpa/IN: refresh: skipping zone transfer as master 10.20.9.7#53 (source 0.0.0.0#0) is unreachable (cached) Sep 18 15:44:41 localhost named[11919]: zone saneri.com/IN: refresh: skipping zone transfer as master 10.20.9.7#53 (source 0.0.0.0#0) is unreachable (cached) Sep 18 15:45:03 localhost systemd: Reloading.
发现无法连接机器，考虑是iptables和seLinux的问题，检查下主服务器和从服务器是否已关闭，或正确设置然后重启即可.
2.6> 测试从DNS服务器。
正向解析：
[root@ops-dns-02 slaves]# dig -t A www.saneri.com @10.20.9.8; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7_5.1 <<>> -t A www.saneri.com @10.20.9.8;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17466;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096;; QUESTION SECTION: ;www.saneri.com. IN A ;; ANSWER SECTION: www.saneri.com. 86400 IN A 10.20.9.7;; AUTHORITY SECTION: saneri.com. 86400 IN NS dns2.saneri.com. saneri.com. 86400 IN NS dns1.saneri.com. ;; ADDITIONAL SECTION: dns1.saneri.com. 86400 IN A 10.20.9.7dns2.saneri.com. 86400 IN A 10.20.9.8;; Query time: 0 msec ;; SERVER: 10.20.9.8#53(10.20.9.8) ;; WHEN: Tue Sep 18 15:57:21 CST 2018;; MSG SIZE rcvd: 128[root@ops-dns-02 slaves]#
反向解析：
[root@ops-dns-02 ~]# dig -x 10.20.9.7 @10.20.9.8; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7_5.1 <<>> -x 10.20.9.7 @10.20.9.8;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58389;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 2, ADDITIONAL: 3;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096;; QUESTION SECTION: ;7.9.20.10.in-addr.arpa. IN PTR ;; ANSWER SECTION:7.9.20.10.in-addr.arpa. 86400 IN PTR mail.saneri.com.7.9.20.10.in-addr.arpa. 86400 IN PTR dns1.saneri.com.7.9.20.10.in-addr.arpa. 86400 IN PTR www.saneri.com. ;; AUTHORITY SECTION:9.20.10.in-addr.arpa. 86400 IN NS dns2.saneri.com.9.20.10.in-addr.arpa. 86400 IN NS dns1.saneri.com. ;; ADDITIONAL SECTION: dns1.saneri.com. 86400 IN A 10.20.9.7dns2.saneri.com. 86400 IN A 10.20.9.8;; Query time: 0 msec ;; SERVER: 10.20.9.8#53(10.20.9.8) ;; WHEN: Tue Sep 18 16:21:26 CST 2018;; MSG SIZE rcvd: 181[root@ops-dns-02 ~]#
dig命令
dig命令是常用的域名查询工具，可以用来测试域名系统工作是否正常。
语法
dig(选项)(参数)
选项
@<服务器地址>：指定进行域名解析的域名服务器；-b<ip地址>：当主机具有多个IP地址，指定使用本机的哪个IP地址向域名服务器发送域名查询请求；-f<文件名称>：指定dig以批处理的方式运行，指定的文件中保存着需要批处理查询的DNS任务信息；-P：指定域名服务器所使用端口号；-t<类型>：指定要查询的DNS数据类型；-x<IP地址>：执行逆向域名查询；-4：使用IPv4；-6：使用IPv6；-h：显示指令帮助信息。
参考文档：https://blog.csdn.net/fanren224/article/details/79693801.
推荐本站淘宝优惠价购买喜欢的宝贝:
本文链接：https://hqyman.cn/post/1338.html 非本站原创文章欢迎转载，原创文章需保留本站地址！
微信支付宝扫一扫，打赏作者吧～休息一下~~
官码2024000195号
萌ICP备20248119号
