DNS之三-----实现DNS的TCP/UDP功能及子域委派

验证TCP和UDP的53端口作用：

将从服务器B的/var/named/slaves/目录下的文件删掉：

[root@centos7_1 slaves]# rm -rf /var/named/slaves/baidu.com.zone.slave   删除slaves目录下的文件
[root@centos7_1 slaves]# systemctl restart named  重启DNS服务
[root@centos7_1 slaves]# ls  还可以复制主服务器的文件
baidu.com.zone.slave
[root@ansible~]#iptables -A INPUT -p tcp --dport 53 -j REJECT  将目标tcp的53端口拒绝。
[root@centos7_1 slaves]# systemctl restart named 重启服务
[root@centos7_1 slaves]# ls  此时不能复制主服务器的文件

在客户端C上dig可以查询到当前的53信息内容，此时的内容是来自于UDP的53端口

[root@centos6network-scripts]#dig www.baidu.com

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6 <<>> www.baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3449
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;www.baidu.com.			IN	A

;; ANSWER SECTION:
www.baidu.com.		86400	IN	CNAME	webs.baidu.com.
webs.baidu.com.		86400	IN	A	66.66.66.66

;; AUTHORITY SECTION:
baidu.com.		86400	IN	NS	dns1.baidu.com.
baidu.com.		86400	IN	NS	dns2.baidu.com.

;; ADDITIONAL SECTION:
dns1.baidu.com.		86400	IN	A	192.168.34.101
dns2.baidu.com.		86400	IN	A	192.168.34.103

;; Query time: 10 msec
;; SERVER: 192.168.34.101#53(192.168.34.101)
;; WHEN: Thu Nov  7 11:14:25 2019
;; MSG SIZE  rcvd: 136

总结：TCP 的53端口影响了主从复制、UDP的53端口是供查询

实现子域委派：子域和父域在同一台主机上（可以忽略不看）

（1）创建子域，在主服务器A（主域）上将beijing.baidu.com域写入到/etc/named.rfc1912.zones配置文件内：

[root@ansiblenamed]#vim /etc/named.rfc1912.zones 
zone  "baidu.com" {
        type master;
        file "baidu.com.zone";
};

zone  "beijing.baidu.com" {
        type master;
        file "beijing.baidu.com.zone";
};

创建一个beijing.baidu.com区域库文件，配置完之后启动DNS，systemctl start named：

[root@ansible~]#cd /var/named
[root@ansiblenamed]#ls
192.168.34.zone  beijing.baidu.com.zone  dynamic   named.empty      named.loopback
baidu.com.zone   data                    named.ca  named.localhost  slaves
[root@ansiblenamed]#vim beijing.baidu.com.zone 

$TTL 1D
@       IN SOA  dns1  admin (
                                        1       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      dns1
dns1    A   192.168.34.101  # 当前的IP地址指向顶级域的IP地址
www    CNAME    webs
webs   A      88.88.88.88

[root@ansiblenamed]# chgrp named beijing.baidu.com.zone  # 修改属组为named，保持权限一致
[root@ansiblenamed]#  chmod  640   beijing.baidu.com.zone  # 文件修改权限为640，防止文件内容被泄露

（2）在客户端C上dig查询配置好后的子域信息：

[root@centos6network-scripts]#dig www.baidu.com  查看主服务器的baidu.com域

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6 <<>> www.baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41274
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;www.baidu.com.			IN	A

;; ANSWER SECTION:
www.baidu.com.		86400	IN	CNAME	webs.baidu.com.
webs.baidu.com.		86400	IN	A	66.66.66.66

;; AUTHORITY SECTION:
baidu.com.		86400	IN	NS	dns2.baidu.com.
baidu.com.		86400	IN	NS	dns1.baidu.com.

;; ADDITIONAL SECTION:
dns1.baidu.com.		86400	IN	A	192.168.34.101
dns2.baidu.com.		86400	IN	A	192.168.34.103

;; Query time: 0 msec
;; SERVER: 192.168.34.103#53(192.168.34.103)
;; WHEN: Thu Nov  7 11:57:45 2019
;; MSG SIZE  rcvd: 136

[root@centos6network-scripts]#dig www.beijing.baidu.com  查看当前的子域内容

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6 <<>> www.beijing.baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59333
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;www.beijing.baidu.com.		IN	A

;; ANSWER SECTION:
www.beijing.baidu.com.	86400	IN	CNAME	webs.beijing.baidu.com.
webs.beijing.baidu.com.	86400	IN	A	88.88.88.88

;; AUTHORITY SECTION:
beijing.baidu.com.	86400	IN	NS	dns1.beijing.baidu.com.

;; ADDITIONAL SECTION:
dns1.beijing.baidu.com.	86400	IN	A	192.168.34.101

;; Query time: 4 msec
;; SERVER: 192.168.34.101#53(192.168.34.101)
;; WHEN: Thu Nov  7 11:57:54 2019
;; MSG SIZE  rcvd: 109

实现子域委派：父域和子域在不同主机上

父域与子域委派架构图：

1、在主DNS服务器上配置一个shenzhen子域

（1）将主服务器A的配置文件/var/named/baidu.com.zone进行修改，添加一个shenzhen域：

[root@ansiblenamed]#vim /var/named/baidu.com.zone 

$TTL 1D
@       IN SOA  dns1  admin.baidu.com. (
                                        1       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      dns1
        NS      dns2
shenzhen NS     dns3        # 添加一个shenzhen域
dns1    A   192.168.34.101
dns2    A   192.168.34.103
dhs3    A   192.168.34.102   # 将shenzhen域委派给192.168.7.102主机

www    CNAME    webs
webs   A      66.66.66.66

（2）重启主服务器A的DNS服务：

[root@ansiblenamed]#rndc reload
server reload successful

注意：检查配置文件是否书写错误

# named-checkconf 查看配置文件是否有误
# named-checkzone  baidu.com  /var/named/baidu.com.zone  检查域文件是否有误

2、在子域DNS服务器上创建子域

在子域DNS服务器上安装DNS服务，并DNS配置相关文件

yum  install bind

[root@centos102 ~]# vim /etc/named.conf
options {
//      listen-on port 53 { 127.0.0.1; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
//      allow-query     { localhost; };

（4）修改子域DNS服务器的/etc/named.rfc1912.zones配置文件：

[root@centos102 ~]# vim /etc/named.rfc1912.zones 
zone "shenzhen.baidu.com" {
        type master;
        file "shenzhen.baidu.com.zone";
};

（5）在子域DNS服务器上远程复制主服务器A的区域库文件，并将所属组属性进行修改：

[root@centos102 ~]# scp -p 192.168.34.103:/var/named/baidu.com.zone  /var/named/shenzhen.baidu.com.zone
[root@centos102 named]# ll
total 32
drwxrwx--- 2 named named 4096 Mar 23  2017 data
drwxrwx--- 2 named named 4096 Mar 23  2017 dynamic
-rw-r----- 1 root  named 3171 Jan 11  2016 named.ca
-rw-r----- 1 root  named  152 Dec 15  2009 named.empty
-rw-r----- 1 root  named  152 Jun 21  2007 named.localhost
-rw-r----- 1 root  named  168 Dec 15  2009 named.loopback
-rw-r----- 1 root  root   296 Nov  7 12:11 shenzhen.baidu.com.zone  此时的文件所属组属性有问题
drwxrwx--- 2 named named 4096 Mar 23  2017 slaves
[root@centos102 named]# chgrp named shenzhen.baidu.com.zone   修改当前的shenzhen.baidu.com.zone所属组属性

（6）修改子域DNS服务器当前的shenzhen.baidu.com.zone配置文件：

[root@centos7-2 named]# vim shenzhen.baidu.com.zone 
$TTL 1D
@       IN SOA  dns1  admin (
                                        1       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      dns1
dns1    A   192.168.34.102

www    CNAME    webs
webs   A      7.7.7.7

注意：需要检查配置文件和域文件是否有误。

named-checkconf 查看配置文件是否有误
named-checkzone  baidu.com  /var/named/baidu.com.zone  检查域文件是否有误

（7）启动（子域）DNS服务：

[root@centos7-2 named]# systemctl start named

3、在客户端上验证效果

此时，我们的客户端并没有配置执行shenzhen.baidu.com.zone子域的DNS  IP地址，

   在客户端执行dig查看当前的shenzhen.baidu.com.zone子域情况：

[root@centos6~]#cat /etc/resolv.conf  # 查看当前的DNS指向的IP地址
# Generated by NetworkManager
search 10.localdomain
nameserver 192.168.34.101
nameserver 192.168.34.103
[root@centos6~]#dig www.shenzhen.baidu.com   # 此时已经实现了迭代查询功能

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6 <<>> www.shenzhen.baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15796
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;www.shenzhen.baidu.com.		IN	A

;; ANSWER SECTION:
www.shenzhen.baidu.com.	86266	IN	CNAME	webs.shenzhen.baidu.com.
webs.shenzhen.baidu.com. 86266	IN	A	7.7.7.7

;; AUTHORITY SECTION:
shenzhen.baidu.com.	86266	IN	NS	dns1.shenzhen.baidu.com.

;; ADDITIONAL SECTION:
dns1.shenzhen.baidu.com. 86266	IN	A	192.168.34.102

;; Query time: 4 msec
;; SERVER: 192.168.34.101#53(192.168.34.101)
;; WHEN: Thu Nov  7 16:35:25 2019
;; MSG SIZE  rcvd: 110