利用BIND搭建自己的私有根及授权域

这篇文章是对之前博客写的DNS的再深一层的搭建，其中包括搭建私有根，还有顶级域以及授权子域，转发域，反向解析等等

上一篇DNS的博客链接：http://www.cnblogs.com/hjc4025/p/6708314.html

这是我自己用word画的图片，比较难看，但大体阐述了我搭建的层次

在以下的内容中都是笔者自己对DNS的理解，可能会有一定的错误

一：搭建平台及IP选定：

在VMware上使用的Centos6.7 64位

bind：使用的BIND9.8版本

.（根）：192.168.32.199

.com：192.168.32.150

hanjiacheng.com的主：192.168.32.128

hanjiacheng.com的从：192.168.32.129

fin.hanjiacheng.com：192.168.32.130

里面的一些没用授权的子域名对应的IP，都是笔者自己瞎写测试用的。

二：配置文件：

1. 根的配置文件

.(根)的named.conf文件：

options {
        directory "/var/named";
        allow-recursion { 192.168.32.0/24; };
};
 
zone "." IN {
        type master;
        file "named.zone";
};

zone "32.168.192.in-addr.arpa" IN {
        type master;
        file "192.168.32.zone";
};
 
zone "localhost" IN {
        type master;
        file "named.localhost";
};
 
zone "0.0.127.in-addr.arpa" IN {
        type master;
        file "named.loopback";
};

 .（根）的/var/named/named.zone文件

$TTL 600
.               IN      SOA     ns.root ns.root (
                                1
                                1H
                                5M
                                2D
                                6H )
.               IN      NS      ns.root.
ns.root         IN      A       192.168.32.199
net             IN      A       192.168.32.233

com             IN      NS      ns.com
ns.com          IN      A       192.168.32.150

 .(根)的/var/named/192.168.32.zone文件

$TTL 600
@               IN      SOA     ns.root ns.root (
                                1
                                1H
                                5M
                                2D
                                6H )
                IN      NS      ns.root.
                IN      NS      ns.com.
199             IN      PTR     ns.root.
150             IN      PTR     ns.com.
233             IN      PTR     net

2.  .com的配置

.com的配置文件named.conf

options {
        directory "/var/named";
        allow-recursion { 192.168.32.0/24; };
};
 
zone "." IN {
        type hint;
        file "named.ca";
};
 
zone "localhost" IN {
        type master;
        file "named.localhost";
};
 
zone "0.0.127.in-addr.arpa" IN {
        type master;
        file "named.loopback";
};
 
zone "com" IN {
        type master;
        file "com.zone";
};
 
zone "32.168.192.in-addr.arpa" IN {
        type master;
        file "192.168.32.zone";
};

 .com的/var/named/com.zone：

$TTL 600
com.            IN      SOA     ns      admin.com. (
                                1
                                1H
                                5M
                                2D
                                6H )
com.            IN      NS      ns.com.
ns              IN      A       192.168.32.150
jiachenghan     IN      A       192.168.32.188

hanjiacheng     IN      NS      ns1.hanjiacheng
ns1.hanjiacheng IN      A       192.168.32.128

 .com的/var/named/192.168.32.zone:

$TTL 600
@               IN      SOA     ns      admin.com. (
                                1
                                1H
                                5M
                                2D
                                6H )
                IN      NS      ns.com.
                IN      NS      ns1.hanjiacheng.com.
150             IN      PTR     ns.com.
128             IN      PTR     ns1.hanjiacheng.com.
188             IN      PTR     jiachenghan.com.

 3. hanjiacheng.com的配置文件：

hanjiacheng.com（主域名服务器）的主配置文件named.conf：

options {
        directory "/var/named";
	allow-recursion { 192.168.32.0/24; };
};
 
zone "." IN {
        type hint;
        file "named.ca";
};
 
zone "localhost" IN {
        type master;
        file "named.localhost";
	allow-transfer { none; };
};
 
zone "0.0.127.in-addr.arpa" IN {
        type master;
        file "named.loopback";
	allow-transfer { none; };
};
 
zone "hanjiacheng.com" IN {
        type master;
        file "hanjiacheng.com.zone";
	allow-transfer { 192.168.32.129; };
};
 
zone "32.168.192.in-addr.arpa" IN {
        type master;
        file "192.168.32.zone";
	allow-transfer { 192.168.32.129; };
};

zone "com" IN {
	type forward;
	forward only;
	forwarders { 192.168.32.150; };
};

 hanjiacheng.com（主域名服务器）的区域文件：/var/named/hanjiacheng.com.zone

$TTL 600
hanjiacheng.com.	IN	SOA	ns1	admin.hanjiacheng.com. (
				3
				1H
				5M
				2D
				6H )
hanjiacheng.com.	IN	NS	ns1.hanjiacheng.com.
hanjiacheng.com.	IN	NS	ns2.hanjiacheng.com.
hanjiacheng.com.	IN	MX  10  mail.hanjiacheng.com.
ns1		IN	A	192.168.32.128
ns2		IN	A	192.168.32.129
mail		IN	A	192.168.32.77
www		IN	A	192.168.32.78
ftp		IN	CNAME	www
hehe		IN	A	192.168.32.222

fin		IN	NS	ns1.fin
ns1.fin		IN	A	192.168.32.130

 hanjiacheng.com（主域名服务器）的区域文件：/var/named/192.168.32.zone

$TTL 600
@		IN	SOA	ns1	admin.hanjiacheng.com. (
				3
				1H
				5M
				2D
				6H )
		IN	NS	ns1.hanjiacheng.com.
		IN	NS	ns2.hanjiacheng.com.
		IN	NS	ns1.fin.hanjiacheng.com.
128		IN	PTR	ns1.hanjiacheng.com.
129		IN	PTR	ns2.hanjiacheng.com.
130		IN	PTR	ns1.fin.hanjiacheng.com.
77		IN	PTR	mail.hanjiacheng.com.
78		IN	PTR	www.hanjiacheng.com.
78		IN	PTR	ftp.hanjiacheng.com.

 hanjiacheng.com（从域名服务器）的主配置文件named.conf：

options {
        directory "/var/named";
        allow-recursion { 192.168.32.0/24; };
};
 
zone "." IN {
        type hint;
        file "named.ca";
};
 
zone "localhost" IN {
        type master;
        file "named.localhost";
        allow-transfer { none; };
};
 
zone "0.0.127.in-addr.arpa" IN {
        type master;
        file "named.loopback";
        allow-transfer { none; };
};
 
zone "hanjiacheng.com" IN {
        type slave;
        file "slaves/hanjiacheng.com.zone";
        masters { 192.168.32.128; };
        allow-transfer { none; };
};
 
zone "32.168.192.in-addr.arpa" IN {
        type slave;
        file "slaves/192.168.32.zone";
        masters { 192.168.32.128; };
        allow-transfer { none; };
};
zone "com" IN {
	type forward;
	forward only;
	forwarders { 192.168.32.150; };
};

  hanjiacheng.com（域名服务器）的区域文件都是从主服务器上传送过来的，所以不需要配置区域文件

4.fin.hanjiacheng.com的配置：

fin.hanjiacheng.com的主配置文件/etc/named.conf

options {
        directory "/var/named";
	allow-recursion { 192.168.32.0/24; };
};
 
zone "." IN {
        type hint;
        file "named.ca";
};
 
zone "localhost" IN {
        type master;
        file "named.localhost";
};
 
zone "0.0.127.in-addr.arpa" IN {
        type master;
        file "named.loopback";
};
 
zone "fin.hanjiacheng.com" IN {
	type master;
	file "fin.hanjiacheng.com";
};
 
zone "32.168.192.in-addr.arpa" IN {
        type master;
        file "192.168.32.zone";
};

zone "hanjiacheng.com" IN {
        type forward;
	forward first;
        forwarders { 192.168.32.128;192.168.32.129; };
};

 fin.hanjiacheng.com的区域配置文件/var/named/fin.hanjiacheng.com

$TTL 600
fin.hanjiacheng.com.	IN	SOA	ns1	admin.fin.hanjiacheng.com. (
				2
				1H
				5M
				2D
				6H )
fin.hanjiacheng.com.	IN	NS	ns1.fin.hanjiacheng.com.
fin.hanjiacheng.com.	IN	MX  10  mail.fin.hanjiacheng.com.
ns1		IN	A	192.168.32.130
mail		IN	A	192.168.32.22
www		IN	A	192.168.32.33
ftp		IN	CNAME	www
kkk		IN	A	192.168.32.123

 fin.hanjiacheng.com的区域配置文件/var/named/192.168.32.zone

$TTL 600
@               IN      SOA     ns1     admin.fin.hanjiacheng.com. (
                                1
                                1H
                                5M
                                2D
                                6H )
                IN      NS      ns1.fin.hanjiacheng.com.
130             IN      PTR     ns1.fin.hanjiacheng.com.
22              IN      PTR     mail.fin.hanjiacheng.com.
33              IN      PTR     www.fin.hanjiacheng.com.
33              IN      PTR     ftp.fin.hanjiacheng.com.

 5.至此配置文件就都写完了，这里一定要注意既然我们建立了私有的根域，那么一定要在每台机器上的/var/named/named.ca清空，并填写上自己的私有的根信息

使用命令：dig -t NS . @192.168.32.199 > /var/named/named.ca

这样即可，这里的信息应该如下：

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6_9.2 <<>> -t NS . @192.168.32.199
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28617
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:
;.				IN	NS

;; ANSWER SECTION:
.			600	IN	NS	ns.root.

;; ADDITIONAL SECTION:
ns.root.		600	IN	A	192.168.32.199

;; Query time: 1 msec
;; SERVER: 192.168.32.199#53(192.168.32.199)
;; WHEN: Sat May 27 00:51:44 2017
;; MSG SIZE  rcvd: 53

 还要注意的一点就是一定要将每台机器的/etc/resolv.conf的文件里的nameserver地址更改成自己的ip地址

除此关闭防火墙，关闭selinux等一切不确定因素，并依此重启DNS服务器，每台机器执行service named restart

三、测试

下面我们随便找了一台测试机器，观察一下dig的情况：（@后面的地址可以随意的变更）

例如：

[root@localhost ~]# dig +trace -t A www.fin.hanjiacheng.com @192.168.32.128 

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6_9.2 <<>> +trace -t A www.fin.hanjiacheng.com @192.168.32.128
;; global options: +cmd
.			600	IN	NS	ns.root.
;; Received 37 bytes from 192.168.32.128#53(192.168.32.128) in 9 ms

com.			600	IN	NS	ns.com.
;; Received 74 bytes from 192.168.32.199#53(192.168.32.199) in 4 ms

hanjiacheng.com.	600	IN	NS	ns1.hanjiacheng.com.
;; Received 75 bytes from 192.168.32.150#53(192.168.32.150) in 8 ms

fin.hanjiacheng.com.	600	IN	NS	ns1.fin.hanjiacheng.com.
;; Received 75 bytes from 192.168.32.128#53(192.168.32.128) in 7 ms

www.fin.hanjiacheng.com. 600	IN	A	192.168.32.33
fin.hanjiacheng.com.	600	IN	NS	ns1.fin.hanjiacheng.com.
;; Received 91 bytes from 192.168.32.130#53(192.168.32.130) in 1 ms

 例如：

[root@localhost ~]# dig -t A www.fin.hanjiacheng.com @192.168.32.150

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6_9.2 <<>> -t A www.fin.hanjiacheng.com @192.168.32.128
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33879
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;www.fin.hanjiacheng.com.	IN	A

;; ANSWER SECTION:
www.fin.hanjiacheng.com. 318	IN	A	192.168.32.33

;; AUTHORITY SECTION:
fin.hanjiacheng.com.	318	IN	NS	ns1.fin.hanjiacheng.com.

;; ADDITIONAL SECTION:
ns1.fin.hanjiacheng.com. 318	IN	A	192.168.32.130

;; Query time: 1 msec
;; SERVER: 192.168.32.128#53(192.168.32.128)
;; WHEN: Sat May 27 05:41:29 2017
;; MSG SIZE  rcvd: 91

 随便测试几个就好

以上内容可能有部分错误的情况，请大家谅解，我也是个菜鸟，都是自己琢磨的，估计有很多不对的地方。