Bind-chroot
After install, copy
named.conf from /usr/share/doc/bind-9.3.6/sample/etc/named.conf
to
/var/named/chroot/etc/
In order for rndc to connect to a named service, there must be a controls statement in the BIND server's /etc/named.conf file.
The controls statement, shown in the following example, allows rndc to connect from the localhost.
controls {
inet 127.0.0.1 allow { localhost; }
keys { <key-name>; };
};
This statement tells named to listen on the default TCP port 953 of the loopback address and allow rndc commands coming from the localhost, if the proper key is given. The <key-name> specifies a name in the key statement within the /etc/named.conf file. The next example illustrates a sample key statement.
key "<key-name>" {
algorithm hmac-md5;
secret "<key-value>";
};
The key is the most important statement in /etc/rndc.conf.
key "<key-name>" {
algorithm hmac-md5;
secret "<key-value>";
};
The <key-name> and <key-value> should be exactly the same as their settings in /etc/named.conf.
To match the keys specified in the target server's /etc/named.conf, add the following lines to /etc/rndc.conf.
options {
default-server localhost;
default-key "<key-name>";
};
ZONE
open named.conf and edit
vi /var/named/chroot/etc/named.conf
---------------------------------------------------------------------------------------------------------
zone "gab.lan" {
type master;
file "gab.lan.zone";
};
--------------------------------------------------------------------------------------------------------
zone "gab.lan" {
type master;
file "gab.lan.zone";
};
--------------------------------------------------------------------------------------------------------
save it and exit
then at /var/named/chroot/var/named/
create gab.lan.zone
open and edit it
--------------------------------------------------------------------------------------------------------
$TTL 3h
@ IN SOA gab.lan. root (
2011022101;
30m; refresh
15m; retry interval
1W; expire
1D); negative cache TTL
@ IN NS ns.gab.lan.
forum IN A 169.0.0.1.
wiki IN A 169.0.0.2.
ns IN A 169.0.0.0
@ IN SOA gab.lan. root (
2011022101;
30m; refresh
15m; retry interval
1W; expire
1D); negative cache TTL
@ IN NS ns.gab.lan.
forum IN A 169.0.0.1.
wiki IN A 169.0.0.2.
ns IN A 169.0.0.0
--------------------------------------------------------------------------------------------------------
save and exit.
then make a soft link to /var/named
ln -s /var/named/chroot/var/named/gab.lan.zone /var/named/gab.lan.zone
then start the services
/etc/init.d/named start
then you can check the status by using
/etc/init.d/named status
Use dig to check if it is running
dig wiki.gab.lan
if it is setup correct, it will show something like this
------------------------------------------------------------------------------------------------------
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_5.3 <<>> wiki.gab.lan
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50877
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;wiki.gab.lan. IN A
;; ANSWER SECTION:
wiki.gab.lan. 10800 IN A 169.0.0.2
;; AUTHORITY SECTION:
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50877
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;wiki.gab.lan. IN A
;; ANSWER SECTION:
wiki.gab.lan. 10800 IN A 169.0.0.2
;; AUTHORITY SECTION:
gab.lan. 10800 IN NS gab.lan.
;; Query time: 0 msec
;; SERVER: 172.30.10.98#53(172.30.10.98)
;; WHEN: Tue Feb 22 12:18:35 2011
;; MSG SIZE rcvd: 80
;; Query time: 0 msec
;; SERVER: 172.30.10.98#53(172.30.10.98)
;; WHEN: Tue Feb 22 12:18:35 2011
;; MSG SIZE rcvd: 80
-----------------------------------------------------------------------------------------------------
Highlight out
please highlight out this part from named.conf
----------------------------------------------------------------------------------------------------------
// All BIND 9 zones are in a "view", which allow different zones to be served
// to different types of client addresses, and for options to be set for groups
// of zones.
//
// By default, if named.conf contains no "view" clauses, all zones are in the
// "default" view, which matches all clients.
//
// If named.conf contains any "view" clause, then all zones MUST be in a view;
// so it is recommended to start off using views to avoid having to restructure
// your configuration files in the future.
//
#view "localhost_resolver"
#{
/* This view sets up named to be a localhost resolver ( caching only nameserver ).
* If all you want is a caching-only nameserver, then you need only define this view:
*/
# match-clients { localhost; };
# match-destinations { localhost; };
# recursion yes;
# all views must contain the root hints zone:
# include "/etc/named.root.hints";
/* these are zones that contain definitions for all the localhost
* names and addresses, as recommended in RFC1912 - these names should
* ONLY be served to localhost clients:
*/
# include "/etc/named.rfc1912.zones";
#};
#view "internal"
#{
/* This view will contain zones you want to serve only to "internal" clients
that connect via your directly attached LAN interfaces - "localnets" .
*/
# match-clients { localnets; };
# match-destinations { localnets; };
# recursion yes;
// all views must contain the root hints zone:
# include "/etc/named.root.hints";
// include "named.rfc1912.zones";
// you should not serve your rfc1912 names to non-localhost clients.
// These are your "authoritative" internal zones, and would probably
// also be included in the "localhost_resolver" view above :
# zone "my.internal.zone" {
# type master;
# file "my.internal.zone.db";
# };
# zone "my.slave.internal.zone" {
# type slave;
# file "slaves/my.slave.internal.zone.db";
# masters { /* put master nameserver IPs here */ 127.0.0.1; } ;
# // put slave zones in the slaves/ directory so named can update them
# };
# zone "my.ddns.internal.zone" {
# type master;
# allow-update { key ddns_key; };
# file "slaves/my.ddns.internal.zone.db";
# // put dynamically updateable zones in the slaves/ directory so named can update them
# };
#};
#key ddns_key
#{
# algorithm hmac-md5;
# secret "use /usr/sbin/dns-keygen to generate TSIG keys";
#};
#view "external"
#{
#/* This view will contain zones you want to serve only to "external" clients
# * that have addresses that are not on your directly attached LAN interface subnets:
# */
# match-clients { any; };
# match-destinations { any; };
#
# recursion no;
# // you'd probably want to deny recursion to external clients, so you don't
# // end up providing free DNS service to all takers
#
# allow-query-cache { none; };
# // Disable lookups for any cached data and root hints
#
# // all views must contain the root hints zone:
# include "/etc/named.root.hints";
#
# // These are your "authoritative" external zones, and would probably
# // contain entries for just your web and mail servers:
#
# zone "my.external.zone" {
# type master;
# file "my.external.zone.db";
# };
#};
// to different types of client addresses, and for options to be set for groups
// of zones.
//
// By default, if named.conf contains no "view" clauses, all zones are in the
// "default" view, which matches all clients.
//
// If named.conf contains any "view" clause, then all zones MUST be in a view;
// so it is recommended to start off using views to avoid having to restructure
// your configuration files in the future.
//
#view "localhost_resolver"
#{
/* This view sets up named to be a localhost resolver ( caching only nameserver ).
* If all you want is a caching-only nameserver, then you need only define this view:
*/
# match-clients { localhost; };
# match-destinations { localhost; };
# recursion yes;
# all views must contain the root hints zone:
# include "/etc/named.root.hints";
/* these are zones that contain definitions for all the localhost
* names and addresses, as recommended in RFC1912 - these names should
* ONLY be served to localhost clients:
*/
# include "/etc/named.rfc1912.zones";
#};
#view "internal"
#{
/* This view will contain zones you want to serve only to "internal" clients
that connect via your directly attached LAN interfaces - "localnets" .
*/
# match-clients { localnets; };
# match-destinations { localnets; };
# recursion yes;
// all views must contain the root hints zone:
# include "/etc/named.root.hints";
// include "named.rfc1912.zones";
// you should not serve your rfc1912 names to non-localhost clients.
// These are your "authoritative" internal zones, and would probably
// also be included in the "localhost_resolver" view above :
# zone "my.internal.zone" {
# type master;
# file "my.internal.zone.db";
# };
# zone "my.slave.internal.zone" {
# type slave;
# file "slaves/my.slave.internal.zone.db";
# masters { /* put master nameserver IPs here */ 127.0.0.1; } ;
# // put slave zones in the slaves/ directory so named can update them
# };
# zone "my.ddns.internal.zone" {
# type master;
# allow-update { key ddns_key; };
# file "slaves/my.ddns.internal.zone.db";
# // put dynamically updateable zones in the slaves/ directory so named can update them
# };
#};
#key ddns_key
#{
# algorithm hmac-md5;
# secret "use /usr/sbin/dns-keygen to generate TSIG keys";
#};
#view "external"
#{
#/* This view will contain zones you want to serve only to "external" clients
# * that have addresses that are not on your directly attached LAN interface subnets:
# */
# match-clients { any; };
# match-destinations { any; };
#
# recursion no;
# // you'd probably want to deny recursion to external clients, so you don't
# // end up providing free DNS service to all takers
#
# allow-query-cache { none; };
# // Disable lookups for any cached data and root hints
#
# // all views must contain the root hints zone:
# include "/etc/named.root.hints";
#
# // These are your "authoritative" external zones, and would probably
# // contain entries for just your web and mail servers:
#
# zone "my.external.zone" {
# type master;
# file "my.external.zone.db";
# };
#};
-----------------------------------------------------------------------------------------------------------------
Change the current Linux DNS point back to yourself at
system-config-network
Reverse Zone
at named.conf, add this zone into it
---------------------------------------------------------------------------------------------------------------
zone "0.0.169.in-addr.arpa." {
type master;
file "db.0.0.169";
};
type master;
file "db.0.0.169";
};
---------------------------------------------------------------------------------------------------------------
then at /var/named/chroot/var/named
create a db.0.0.169
open and edit it like this
--------------------------------------------------------------------------------------------------------------
$TTL 3h
@ IN SOA gab.lan. root (
2011022101;
30m; refresh
15m; retry interval
1W; expire
1D); negative cache TTL
@ IN NS ns.gab.lan.
1 IN PTR forum.gab.lan.
@ IN SOA gab.lan. root (
2011022101;
30m; refresh
15m; retry interval
1W; expire
1D); negative cache TTL
@ IN NS ns.gab.lan.
1 IN PTR forum.gab.lan.
2 IN PTR wiki.gab.lan.
--------------------------------------------------------------------------------------------------------------
save it and reload the services
/etc/init.d/named reload
then try to use dig to see success or not
dig -x 169.0.0.1
and you should get something like this
--------------------------------------------------------------------------------------------------------------; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_5.3 <<>> -x 169.0.0.1
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16382
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;1.0.0.169.in-addr.arpa. IN PTR
;; ANSWER SECTION:
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16382
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;1.0.0.169.in-addr.arpa. IN PTR
;; ANSWER SECTION:
1.0.0.169.in-addr.arpa. 10800 IN PTR forum.gab.lan.0.0.169.in-addr.arpa.
;; AUTHORITY SECTION:
;; AUTHORITY SECTION:
0.0.169.in-addr.arpa. 10800 IN NS gab.lan.0.0.169.in-addr.arpa.
;; Query time: 0 msec
;; SERVER: 172.30.10.98#53(172.30.10.98)
;; WHEN: Tue Feb 22 12:37:06 2011
;; MSG SIZE rcvd: 96
;; Query time: 0 msec
;; SERVER: 172.30.10.98#53(172.30.10.98)
;; WHEN: Tue Feb 22 12:37:06 2011
;; MSG SIZE rcvd: 96
---------------------------------------------------------------------------------------------------------------
Master - Slave
At slave server install and etup bind
open named.conf and add this zone
--------------------------------------------------------------------------------------------------------------
zone "gab.lan" {
type slave;
master {192.168.0.0;};
};
--------------------------------------------------------------------------------------------------------------
DNS Round Robin (DNSRR) load balancing
to balance 2 server or more together, just need to add another A entry for that server
example
www IN A 192.160.0.1
www IN A 192.168.0.2
No comments:
Post a Comment