DNSandBIND主講：馬永亮(馬哥)

客服，1661815153博客：主站：BIND高級(jí)應(yīng)用主講：馬永亮(馬哥)

客服，1661815153博客：主站：BIND9編譯安裝

及壓力測(cè)試主講：馬永亮(馬哥)

客服，1661815153博客：主站：/etc/resolv.conf

ns.www...權(quán)威DNS服務(wù)器

ns主機(jī)名稱,知本主義IP

名稱解析hosts搜索鍵/etc/passwdnsswitchloginlogin:password:root0loginDNS樹(shù)狀結(jié)構(gòu)，testst1ftp

nfsmailpopwww

正主正從反主反從dnspod,dns.lazone“.”zone“l(fā)ocalhost”zone“27..”

主bindfile“.zone”10:059:459:48

opsdev

CDN

www,mail,ftptech.ns.tech.www.tech.mail.tech.fin.nswwwmailzone“”IN{typeforward;forwarders{};ddns:dynamicdns

/dev/random:熵池/dev/urandomClienthostsLocalDNScacheDNSServerServerCacheServerrootDNS服務(wù)器的類型：主DNS服務(wù)器輔助DNS服務(wù)器緩存DNS服務(wù)器轉(zhuǎn)發(fā)器listen-on[portinteger]{address_match_element;...};querylogboolean;version(quoted_string|none);allow-recursion{address_match_element;...};allow-query{address_match_element;...};TheDomainNameSystemisadistributeddatabase.Allowslocalcontrolofthesegmentsoftheoveralldatabase,yetdataineachsegmentisavailableacrosstheentirenetworkthroughaclient/serverscheme.ProgramscallednameserversconstitutetheserverhalfofDNS'sclient/servermechanism.Nameserverscontaininformationaboutsomesegmentsofthedatabaseandmakethatinformationavailabletoclients,calledresolvers.Resolversareoftenjustlibraryroutinesthatcreatequeriesandsendthemacrossanetworktoanameserver.forwardonly;Ifyouuseforward-onlymode,youmusthaveforwardersconfigured.ForwardZonesTraditionally,usingforwardershasbeenanall-or-nothingproposition:eitheryouuseforwarderstoresolveeveryqueryyournameservercan'tansweritself,oryoudon'tuseforwardersatall.However,therearesomesituationsinwhichitwouldbenicetohavemorecontroloverforwarding.Forexample,maybeyou'dliketoresolvecertaindomainnamesusingaparticularforwarderbutresolveotherdomainnamesiteratively.BIND8.2introducedanewfeature,forwardzones,thatallowsyoutoconfigureyournameservertouseforwardersonlywhenlookingupcertaindomainnames.zone“"{typeforward;forwarders{54;};};There'sanothervarietyofforwardzone,inawaytheoppositeofthekindprevious.Theseallowyoutospecifywhichqueriesdon'tgetforwarded.Theseforwardzonesareconfiguredusingazonestatement,butnotoftypeforward.Instead,thesearenormalzonesmaster,slave,orstubwithaforwarderssubstatement.To"undo"theforwardingconfiguredintheoptionsstatement,wespecifyanemptylistofforwarders:AnExampleoptions{directory"/var/named";forwarders{;;};};zone“"{typeslave;masters{;};file"";forwarders{};};mysqlpostgresqlLDAPBDB,BerkeleyDB,sleepycatkey-valuepowerDNS,cache,30000

x86armDNS0.2540.73客戶端不同，結(jié)果不同DNSWeb

100G

.zonewww..zone2www.主DNSweb從DNSweb/www/htdocsmysqld1、:,，phpwind（V1），phpmyadmin(V2)2、SSL,https://3、DNS，自已名稱解析服務(wù)，主、從架構(gòu)4、要能實(shí)現(xiàn)web健康狀態(tài)檢查,5s進(jìn)行一次檢查5、ab對(duì)服務(wù)器壓力測(cè)試ViewViewsallowyoutopresentonenameserverconfigurationtoonecommunityofhostsandadifferentconfigurationtoanothercommunity.Theviewstatementmustcomeafteranyoptionsstatement,thoughnotnecessarilyrightafterit.Youcanselectwhichhosts"see"aparticularviewusingthematch-clientsviewsubstatement,whichtakesanaddressmatchlistasanargument.Ifyoudon'tspecifyacommunityofhostswithmatch-clients,theviewappliestoallhosts.JustbesureyoudefinetheACLoutsidetheviewbecauseyoucan'tuseaclstatementsinsideviews.Whatcanyouputinsideaviewstatement?Almostanything(well,exceptforaclstatements).Anyconfigurationoptionyouspecifywithinaviewoverridesthelike-namedglobaloption(e.g.,oneintheoptionsstatement)forhoststhatmatchmatch-clients.AvoidingaBogusNameserverInyourtermasnameserveradministrator,youmightfindsomeremotenameserverthatrespondswithbadinformationold,incorrect,badlyformatted,orevendeliberatelydeceptive.Youcanattempttofindanadministratortofixtheproblem.Oryoucansaveyourselfsomegriefandconfigureyournameservernottoaskquestionsofthisserver,whichispossiblewithBIND8,andBIND9.1.0andlater.Hereistheconfigurationfilestatement:server{bogusyes;};Ifyoutellyournameservertostoptalkingtoaserverthatistheonlyserverforazone,don'texpecttobeabletolookupnamesinthatzone.Hopefully,thereareotherserversforthatzonethatcanprovidegoodinformation.options{blackhole{10/8;172.16/12;192.168/16;};};MonitoringwithloggingBINDhasaveryflexibleandconfigurableloggingsystemchanneldefineswhereloginformationshouldgoCanusecustomchanneloruseroneoffourpredefinedchannelscategorydefineswhatshouldbeloggedAlllogmessagesaredividedintooneoffifteencategories.Acategorydirectivewillbeusedtodeterminetowhichchannelslogmessagesshouldbedirected.MessagesinonecategorymaybedirectedtomultiplechannelschannelchanneldefinestargetforlogsCansyslogtoanyfacilityoruseafileChannelsallowyoutofilterbymessageseveritySimilartosyslogseveritycriticalerrorwarningnoticeinfodebug[level]dynamicdebuganddynamicareuniquetoBINDdefaultisinfoAdditionaloptionsforverboseoutputprint-severitylogtheseveritylevelofmessagesprint-categorylogthecategoryofmessagesprint-timelogthedateandtimeofmessagesNote:syslog()alreadyrecordsthisinformationFourpredefinedchannelsare:channel“default_syslog”{syslogdaemon;severityinfo;}channel“default_debug”{file“named.run”;severitydynamic;}channel“default_stderr”{stderr;severityinfo;};channel“null”{null;};categorycategorystatementassociatesacategorywithachannelforloggingFifteencategoriestochoosefromdefaultDefinesdefaultchannelforcategoriesgeneralCatch-allcategoryforunclassifiedmessagesclientClientrequestproblemsconfigConfigurationfileproblemsdispatchDispatchofinboundpacketstointernalservermodulesdnssecDNSSECandTSIGlame-serversProblemsduetoremoteservermisconfigurationnetworkRelatedtonetworkoperationsnotifyNOTIFYannouncementsqueriesQueryprocessingresolverRecursivequeryprocessingsecurityAcceptedordeniedrequestsupdateDynamicupdatesxfer-inZonetransfersreceivedbytheserverxfer-outZonetransferssentbytheserverAnexamplelogging{channelmy_file{file"log.msgs"versions3size10k;severitydynamic;};channelmy_syslog{sysloglocal0;severityinfo;};categoryxfer-in{my_file;};categoryupdate{my_syslog;};};TheloggingStatement定義一個(gè)channel，要求使用file來(lái)記錄日志，滾動(dòng)數(shù)目為10，每個(gè)最大為10M級(jí)別為dynamic要求記錄額外信息；定義一個(gè)類別，記錄查詢?nèi)罩拘畔⒅燎懊娴腸hannel中去logging{channel“query_log”{file“/var/log/bind9/query.log”versions10size10M;severitydynamic;print-categoryyes;print-severityyes;print-timeyes;};categoryqueries{query_log;};};channelerror_log{file/var/log/bind9/error.logversions10size1M;severityerror;print-severityyes;print-categoryyes;print-timeyes;};categorydefault{error_log;};rndcrndc-confgen>/etc/rndc.confreloadReloadsthenameserver.Sendthiscommandtoaprimarynameserveraftermodifyingitsconfigurationfileoroneormoreofitszonedatafiles.Youcanalsospecifyoneormoredomainnamesofzonesasargumentstoreload;ifyoudo,thenameserverwillreloadonlythesezones.stopCausesthenameservertoexit,writingdynamiczonestotheirzonedatafiles.freezezoneSuspendsdynamicupdatestothespecifiedzone.thawzoneResumesdynamicupdatestothespecifiedzone.reconfig[-noexpired]Tellsthenameservertocheckitsconfigurationfilefornewordeletedzones.Sendthiscommandtoanameserverifyou'veaddedordeletedzonesbuthaven'tchangedanyexistingzones'data.Specifyingthe-noexpiredflagtellsthenameservernottobotheryouwitherrormessagesaboutzonesthathaveexpired.flushFlushes(empties)thenameserver'scache.TSIGTransactionSIGnaturesUsessharedsecretsandaone-wayhashfunctiontoauthenticateDNSmessages,particularlyresponsesandupdates.Berelativelysimpletoconfigure,light-weightforresolversandnameserverstouse,andflexibleenoughtosecureDNSmessages(includingzonetransfers)anddynamicupdates.dnssec-keygen-aHAC-MD5-b128-n\HOST.BeforeusingTSIGforauthentication,weneedtoconfigureoneormoreTSIGkeysoneitherendofthetransaction.Forexample:key“keyname”{algorithmhmac-md5;secret“skrKc4Twy/cIgIykQu7JZA==”;};ThekeytoconfiguringournameserverswithTSIGkeysistheserverstatement'skeyssubstatement,whichtellsanameservertosignqueriesandzonetransferrequestssenttoaparticularremotenameserver.Sytax:server(ipv4_address){keys{somekey;};};channel->syslog,file,stderr,nullcategory->類別，DNS服務(wù)器產(chǎn)生服務(wù)器信息的類別，bind-chrootbindjail/var/named/chroot/etc//var/named/chroot/var/named/data實(shí)踐項(xiàng)目所使用的網(wǎng)絡(luò)拓?fù)浣Y(jié)構(gòu)DMZGWsshEx_ClientDNS-S&In_Client

DNS-P&

telnet,http,vsftpDNAT

內(nèi)網(wǎng)主機(jī)名字：