使用unbound提供DNS域名解析服务
Posted 周万春
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了使用unbound提供DNS域名解析服务相关的知识，希望对你有一定的参考价值。
使用unbound提供DNS域名解析服务
# 作者：Eric # 微信：loveoracle11g # 先配yum仓库 [[email protected] ~]# cd /etc/yum.repos.d/ [[email protected] yum.repos.d]# ls [[email protected] yum.repos.d]# vim racooler.repo [racooler] name=rhel7 baseurl=file:///media/cdrom enabled=1 gpgcheck=0 [[email protected] yum.repos.d]# mkdir -p /media/cdrom [[email protected] yum.repos.d]# mount /dev/cdrom /media/cdrom/ mount: /dev/sr0 is write-protected, mounting read-only [[email protected] yum.repos.d]# yum repolist all Loaded plugins: langpacks, product-id, subscription-manager This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register. racooler | 4.1 kB 00:00:00 (1/2): racooler/group_gz | 134 kB 00:00:00 (2/2): racooler/primary_db | 3.4 MB 00:00:00 repo id repo name status racooler rhel7 enabled: 4,305 repolist: 4,305 [[email protected] yum.repos.d]# [[email protected] yum.repos.d]# yum clean Loaded plugins: langpacks, product-id, subscription-manager This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register. Error: clean requires an option: headers, packages, metadata, dbcache, plugins, expire-cache, rpmdb, all [[email protected] yum.repos.d]# [[email protected] yum.repos.d]# yum list all | wc -l 4405 # DNS的查询方式 迭代查询：服务器与服务器之间的查询。本地域名服务器向根域名服务器的查询通常是采用迭代查询(反复查询)。当根域名服务器收到本地域名服务器的迭代查询请求报文时，要么给出所要查询的IP地址，要么告诉本地域名服务器下一步应向那个域名服务器进行查询。然后让本地域名服务器进行后续的查询。 递归查询：客户端与服务器之间的查询。主机向本地域名服务器的查询一般都是采用递归查询。如果主机所询问的本地域名服务器不知道被查询域名的 IP 地址，那么本地域名服务器就以 DNS 客户的身份，向其他根域名服务器继续发出查询请求报文。最后会给客户端一个准确的返回结果，无论是成功与否。 # DNS解析类型 正向解析：由域名解析到IP地址。 反向解析：由IP地址解析到域名。 # 名称解析方式 hosts文件（etc/hosts）、dns、广播、解析缓存、dns、wins（windows中）等 DNS安装配置： 在RHEL5、6中dns都是用的是bind软件包，而在RHEL7用的是unbound安装包，配置文件也有了改变。 [[email protected] ~]# yum -y install unbound* [[email protected] ~]# systemctl start unbound [[email protected] ~]# systemctl enable unbound ln -s ‘/usr/lib/systemd/system/unbound.service‘ ‘/etc/systemd/system/multi-user.target.wants/unbound.service‘ [[email protected] ~]# systemctl stop iptables [[email protected] ~]# systemctl disable iptables [[email protected] ~]# systemctl mask iptables ln -s ‘/dev/null‘ ‘/etc/systemd/system/iptables.service‘ [[email protected] ~]# systemctl stop ebtables [[email protected] ~]# systemctl disable ebtables [[email protected] ~]# systemctl mask ebtables ln -s ‘/dev/null‘ ‘/etc/systemd/system/ebtables.service‘ [[email protected] ~]# firewall-cmd --permanent --add-service=dns success [[email protected] ~]# firewall-cmd --reload success [[email protected] ~]# firewall-cmd --list-all public (default, active) interfaces: eno16777728 sources: services: dhcpv6-client dns ssh ports: masquerade: no forward-ports: icmp-blocks: rich rules: [[email protected] ~]# # DNS服务器上firewall开放DNS访问OK [[email protected] ~]# netstat -tunlp | grep unbound tcp 0 0 127.0.0.1:8953 0.0.0.0:* LISTEN 2114/unbound tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 2114/unbound tcp6 0 0 ::1:8953 :::* LISTEN 2114/unbound tcp6 0 0 ::1:53 :::* LISTEN 2114/unbound udp 0 0 127.0.0.1:53 0.0.0.0:* 2114/unbound udp6 0 0 ::1:53 :::* 2114/unbound [[email protected] ~]# [[email protected] ~]# ss -tunlp | grep unbound tcp UNCONN 0 0 127.0.0.1:53 *:* users:(("unbound",2114,5)) tcp UNCONN 0 0 ::1:53 :::* users:(("unbound",2114,3)) tcp LISTEN 0 5 127.0.0.1:8953 *:* users:(("unbound",2114,8)) tcp LISTEN 0 5 127.0.0.1:53 *:* users:(("unbound",2114,6)) tcp LISTEN 0 5 ::1:8953 :::* users:(("unbound",2114,7)) tcp LISTEN 0 5 ::1:53 :::* users:(("unbound",2114,4)) [[email protected] ~]# # 默认监听本地回环地址，也就是现在只有自己能访问DNS服务，其它主机不能访问本机的DNS服务。 [[email protected] ~]# vim /etc/unbound/unbound.conf # 修改监听地址 38 # interface: 0.0.0.0 39 interface: 0.0.0.0 # 让所有主机能够向本机查询DNS 177 # access-control: 0.0.0.0/0 refuse 178 access-control: 0.0.0.0/0 allow # 禁用服务用户 # 每个服务都是有其专用的服务用户，DNS的服务用户为unbound，实际情况下服务用户的启用有可能有安全隐患，这里要即禁用服务用户。 213 # username: "unbound" 214 username: "" [[email protected] ~]# systemctl restart unbound [[email protected] ~]# netstat -tunlp | grep unbound tcp 0 0 127.0.0.1:8953 0.0.0.0:* LISTEN 2814/unbound tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN 2814/unbound tcp6 0 0 ::1:8953 :::* LISTEN 2814/unbound udp 0 0 0.0.0.0:53 0.0.0.0:* 2814/unbound [[email protected] ~]# # 现在53号端口监听的是0.0.0.0，即所有网段都监听。 # 创建解析文件 [[email protected] ~]# hostname server1.example.com [[email protected] ~]# vim /etc/unbound/local.d/example.conf local-zone: "example.com." static local-data: "example.com. 86400 IN SOA ns.example.com. root 1 1D 1H 1W 1H" local-data: "ns.example.com. IN A 192.168.10.201" local-data: "www.example.com. IN A 192.168.10.201" local-data-ptr: "192.168.10.201 ns.example.com." local-data-ptr: "192.168.10.201 www.example.com." # 检查解析结果 [[email protected] ~]# unbound-checkconf unbound-checkconf: no errors in /etc/unbound/unbound.conf [[email protected] ~]# systemctl restart unbound [[email protected] ~]# [[email protected] ~]# vim /etc/sysconfig/network-scripts/ifcfg-eno16777728 TYPE=Ethernet BOOTPROTO=static DEFROUTE=yes IPV4_FAILURE_FATAL=no IPV6INIT=yes IPV6_AUTOCONF=yes IPV6_DEFROUTE=yes IPV6_FAILURE_FATAL=no NAME=eno16777728 UUID=cbce3ee7-6d18-4fc1-9ad4-4d175aa4ddbc ONBOOT=yes IPADDR0=192.168.10.201 PREFIX0=24 GATEWAY0=192.168.10.1 DNS1=192.168.10.201 HWADDR=00:0C:29:FA:32:28 IPV6_PEERDNS=yes IPV6_PEERROUTES=yes [[email protected] ~]# systemctl restart network [[email protected] ~]# nslookup > 192.168.10.201 Server: 192.168.10.201 Address: 192.168.10.201#53 201.10.168.192.in-addr.arpa name = www.example.com. 201.10.168.192.in-addr.arpa name = ns.example.com. > www.example.com Server: 192.168.10.201 Address: 192.168.10.201#53 Name: www.example.com Address: 192.168.10.201 > exit [[email protected] ~]#
以上是关于使用unbound提供DNS域名解析服务的主要内容，如果未能解决你的问题，请参考以下文章