管理服务器的DNS

1.使 serverb 成为 backend.lab.example.com 的主名称服务器，以及 192.168.0/24 和 fde2:6494:1e09:2::/64 的反向区域。

在 serverb 上安装BIND9。根据以下规范配置BIND：

在任何接口上侦听 IPv4 和 IPv6 查询。
允许 localhost、172.25.250.254 和 192.168.0.0/24 请求资源数据。
禁用递归。
删除 root(.) 提示节。
为 /etc/named.backend.conf 添加一个包含语句。
在 /etc/named.backend.conf 中配置区域指令以引用您的区域文件。您可以从workstation上的/dns-review/files/primary-named.backend.conf 复制此文件。
将现有区域文件从workstation上的

/dns-review/files/zones 复制到 serverb 上的 /var/named 并确保 named 可以读取它们。

1.1 在workstation上，以学生身份登录到serverb，然后切换成为root用户。

[student@serverb <sub>]$ ssh serverb
student@serverb's password: student
[student@serverb </sub>]$ sudo -i
[sudo] password for student: student

1.2 安装bind软件包

oot@serverb ~]# yum -y install bind

1.3 编辑 /etc/named.conf 以匹配以下内容：

...output omitted...
options {
        listen-on port 53 { any; };
        listen-on-v6 port 53 { any; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        secroots-file   "/var/named/data/named.secroots";
        recursing-file  "/var/named/data/named.recursing";
        allow-query     { localhost; 172.25.250.254; 192.168.0.0/24; };
        
        recursion no;

...output omitted...

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
include "/etc/named.backend.conf";

1.4 创建 /etc/named.backend.conf 包含文件，用于标识 backend.lab.example.com 子域的正向和反向区域。

[root@serverb ~]# vim /etc/named.backend.conf
zone "backend.lab.example.com" IN {
        type master;
        file "backend.lab.example.com.zone";
        forwarders {};
};

zone "0.168.192.in-addr.arpa" IN {
        type master;
        file "192.168.0.zone";
        forwarders {};
};

zone "2.0.0.0.9.0.E.1.4.9.4.6.2.E.D.F.ip6.arpa" IN {
        type master;
        file "fde2.6494.1e09.2.zone";
        forwarders {};
};

确保 /etc/named.backend.conf 文件对named组是可读的，而不是可写的。

[root@serverb <sub>]# chmod 640 /etc/named.backend.conf 
[root@serverb </sub>]# chgrp named /etc/named.backend.conf

1.5 将工作站上 ~/dns-review/files/zones 目录中的三个区域文件复制到 serverb 上的 /var/named。

/var/named/backend.example.com.zone
/var/named/192.168.0.zone
/var/named/ fde2.6494.1e09.2.zone

[root@serverb <sub>]# scp student@workstation:</sub>/dns-review/files/zones/* /var/named/
student@workstation's password: 
192.168.0.zone                     100%  801   405.2KB/s   00:00    
backend.lab.example.com.zone       100%  984   802.1KB/s   00:00    
fde2.6494.1e09.2.zone              100%  813   731.4KB/s   00:00

区域文件的内容应与以下内容匹配：

/var/named/backend.lab.example.com.zone

[root@serverb ~]# cat /var/named/backend.lab.example.com.zone 
$TTL 300
@ IN  SOA serverb.backend.lab.example.com. root.serverb.backend.lab.example.com. (
                        2020041806  ;serial number
                        1H          ;refresh secondary
                        5m          ;retry refresh
                        1w          ;expire zone
                        1m )        ;cache time-to-live for negative answers

; owner                   TTL     CL  type    RDATA
                          600     IN  NS      serverb

servera                           IN  A       192.168.0.10
serverb                           IN  A       192.168.0.11
serverc                           IN  A       192.168.0.12
serverd                           IN  A       192.168.0.13

servera                           IN  AAAA    fde2:6494:1e09:2::a
serverb                           IN  AAAA    fde2:6494:1e09:2::b
serverc                           IN  AAAA    fde2:6494:1e09:2::c
serverd                           IN  AAAA    fde2:6494:1e09:2::d

/var/named/192.168.0.zone

[root@serverb ~]# cat /var/named/192.168.0.zone
$TTL 300
@ IN SOA serverb.backend.lab.example.com. root.serverb.backend.lab.example.com. (
                    2020041805    ;serial number
                    1H            ;refresh secondary
                    5M            ;retry refresh
                    1W            ;expire zone
                    1M )          ;cache time-to-live for negative answers

; owner                   TTL   CL  type    RDATA
                          600   IN  NS      serverb.backend.lab.example.com.

10.0.168.192.IN-ADDR.ARPA.      IN  PTR     servera.backend.lab.example.com.
11                              IN  PTR     serverb.backend.lab.example.com.
12                              IN  PTR     serverc.backend.lab.example.com.
13                              IN  PTR     serverd.backend.lab.example.com.

/var/named/fde2.6494.1e09.2.zone

[root@serverb ~]# cat /var/named/fde2.6494.1e09.2.zone 
$TTL 300
@ IN SOA serverb.backend.lab.example.com. root.serverb.backend.lab.example.com. (
                    2020041805    ;serial number
                    1H            ;refresh secondary
                    5M            ;retry refresh
                    1W            ;expire zone
                    1M )          ;cache time-to-live for negative answers

; owner                   TTL     CL  type    RDATA
                          600     IN  NS      serverb.backend.lab.example.com.

A.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0   IN  PTR     servera.backend.lab.example.com.
B.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0   IN  PTR     serverb.backend.lab.example.com.
C.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0   IN  PTR     serverc.backend.lab.example.com.
D.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0   IN  PTR     serverd.backend.lab.example.com.

1.6 确保指定组可以读取而不是可写入区域文件。

[root@serverb <sub>]# chmod 640 /var/named/*.zone
[root@serverb </sub>]# chgrp named /var/named/*.zone

1.7 将防火墙配置为允许 DNS 流量，然后在 serverb 上启用并启动named服务。

[root@serverb <sub>]# firewall-cmd --add-service=dns --permanent 
success
[root@serverb </sub>]# firewall-cmd --reload
success
[root@serverb <sub>]# systemctl enable --now named
[root@serverb </sub>]# firewall-cmd --list-all | grep service
  services: cockpit dhcpv6-client dns ssh

2.配置满足以下要求的servera缓存名称服务器：

在servera上安装unbound软件包。
配置 unbound 以允许来自 172. 25.250.0/24 子网的查询，免除 example.com 区域的 DNSSEC 验证，并将所有查询转发到 172.25.250.254 。
启动并启用unbound并配置防火墙以允许服务器上的 DNS 流量。

2.1 在workstation上，使用 SSH以学生身份登录到 servera。使用 sudo -i 切换到 root。

[student@workstation <sub>]$ ssh servera
[student@servera </sub>]$ sudo -i
[sudo] password for student: student

2.2 安装unbound。

[root@servera ~]# yum install unbound -y

2.3 配置 unbound 以允许来自 172.25.250.8/24 子网、来自 DNSSEC 验证的 example.com 区域的查询，并将所有查询转发到 172.25.250.254。

在 /etc/unbound/conf.d/server.conf 中创建以下文件，权限为 0644，归用户 root 和 unbound 组所有。

[root@servera ~]# vim /etc/unbound/conf.d/server.conf

server:
  interface-automatic: yes
  access-control: 172.25.250.0/24 allow
  domain-insecure: "example.com"

forward-zone:
  name: "."
  forward-addr: 172.25.250.254

2.4 生成私钥和服务器证书。

[root@servera ~]# unbound-control-setup 
setup in directory /etc/unbound
generating unbound_server.key
Generating RSA private key, 3072 bit long modulus (2 primes)
..++++
........++++
e is 65537 (0x010001)
generating unbound_control.key
Generating RSA private key, 3072 bit long modulus (2 primes)
..................................++++
.................................++++
e is 65537 (0x010001)
create unbound_server.pem (self signed certificate)
create unbound_control.pem (signed client certificate)
Signature ok
subject=CN = unbound-control
Getting CA Private Key
Setup success. Certificates created. Enable in unbound.conf file to use

2.5 检查未绑定配置文件的语法。

[root@servera ~]# unbound-checkconf 
unbound-checkconf: no errors in /etc/unbound/unbound.conf

2.6 启动并启动unbound。

[root@servera ~]# systemctl enable --now unbound
Created symlink /etc/systemd/system/multi-user.target.wants/unbound.service → /usr/lib/systemd/system/unbound.service.

2.7 配置防火墙，允许servera的DNS流量。

[root@servera <sub>]# 
[root@servera </sub>]# firewall-cmd --permanent --add-service=dns
success
[root@servera <sub>]# firewall-cmd --reload
success
[root@servera </sub>]# firewall-cmd --list-all | grep service
  services: cockpit dhcpv6-client dns ssh

3.测试名称服务器的操作。

提交查询以确认来自servera上的缓存名称服务器和serverb上的权威主名称服务器的答案。

3.1 在 servera 上，从 lab.example.com 地址查询 localhost.localdomain。 dig 命令失败，因为 unbound 被配置为仅允许来自 172.25.250.0/24 网络的查询，而 (127.0.0.1) 不是其中的成员。

[student@servera ~]# dig localhost.localdomain @172.25.250.11

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el8 <<>> localhost.localdomain @172.25.250.11
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 53384
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: f4324ebe0d3e7dc59458019a628b9b10ae42aa0018f23c27 (good)
;; QUESTION SECTION:
;localhost.localdomain.   IN  A

;; Query time: 1 msec
;; SERVER: 172.25.250.11#53(172.25.250.11)
;; WHEN: Mon May 23 14:32:48 GMT 2022
;; MSG SIZE  rcvd: 78

3.2 从 backend.example.com 地址查询 localhost.localdomain。这会成功，因为 BIND允许来自该子网的所有查询。

[student@servera ~]# dig localhost.localdomain @192.168.0.11

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el8 <<>> localhost.localdomain @192.168.0.11
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44039
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 4081c2f5a37c99bb3ebf6e64628b9bd32b4e4b24bf8723b5 (good)
;; QUESTION SECTION:
;localhost.localdomain.   IN  A

;; ANSWER SECTION:
localhost.localdomain.  86400 IN  A 127.0.0.1

;; AUTHORITY SECTION:
localhost.localdomain.  86400 IN  NS  localhost.localdomain.

;; ADDITIONAL SECTION:
localhost.localdomain.  86400 IN  AAAA  ::1

;; Query time: 1 msec
;; SERVER: 192.168.0.11#53(192.168.0.11)
;; WHEN: Mon May 23 14:36:03 GMT 2022
;; MSG SIZE  rcvd: 136

3.3 使用serverb上的student，确认servera上的缓存名称服务器回答正向查找。servera上的缓存名称服务器缓存来自后端网络的条目，但仅回答来自classroom网络范围172.25.250.0/24 的查询。

查找 serverd.backend.lab.example.com 的 IP 地址。使用classroom网络内servera的地址 172.25.250.10。

[student@serverb ~]$ dig serverd.backend.lab.example.com @172.25.250.10

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el8 <<>> serverd.backend.lab.example.com @172.25.250.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21912
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;serverd.backend.lab.example.com. IN  A

;; ANSWER SECTION:
serverd.backend.lab.example.com. 300 IN A 192.168.0.13

;; Query time: 4 msec
;; SERVER: 172.25.250.10#53(172.25.250.10)
;; WHEN: Mon May 23 14:43:23 GMT 2022
;; MSG SIZE  rcvd: 76

[student@serverb ~]$ dig -x 192.168.0.13 @localhost

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el8 <<>> -x 192.168.0.13 @localhost
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38780
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 3
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: c0a3f62a0b4543594fb72455628b9e296ca3a7ed3664bd52 (good)
;; QUESTION SECTION:
;13.0.168.192.in-addr.arpa. IN  PTR

;; ANSWER SECTION:
13.0.168.192.in-addr.arpa. 300  IN  PTR serverd.backend.lab.example.com.

;; AUTHORITY SECTION:
0.168.192.in-addr.arpa. 600 IN  NS  serverb.backend.lab.example.com.

;; ADDITIONAL SECTION:
serverb.backend.lab.example.com. 300 IN AAAA  fde2:6494:1e09:2::b
serverb.backend.lab.example.com. 300 IN A 192.168.0.11

;; Query time: 1 msec
;; SERVER: ::1#53(::1)
;; WHEN: Mon May 23 14:46:01 GMT 2022
;; MSG SIZE  rcvd: 193

[student@serverb ~]$ dig -x fde2:6494:1e09:2::d @localhost

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el8 <<>> -x fde2:6494:1e09:2::d @localhost
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39808
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 3
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 16351321647818d15a115212628b9f0094c0042393c4ef4c (good)
;; QUESTION SECTION:
;d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.9.0.e.1.4.9.4.6.2.e.d.f.ip6.arpa. IN PTR

;; ANSWER SECTION:
D.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.9.0.E.1.4.9.4.6.2.E.D.F.ip6.arpa. 300 IN PTR serverd.backend.lab.example.com.

;; AUTHORITY SECTION:
2.0.0.0.9.0.E.1.4.9.4.6.2.E.D.F.ip6.arpa. 600 IN NS serverb.backend.lab.example.com.

;; ADDITIONAL SECTION:
serverb.backend.lab.example.com. 300 IN AAAA  fde2:6494:1e09:2::b
serverb.backend.lab.example.com. 300 IN A 192.168.0.11

;; Query time: 0 msec
;; SERVER: ::1#53(::1)
;; WHEN: Mon May 23 14:49:36 GMT 2022
;; MSG SIZE  rcvd: 304

管理服务器的DNS

继续阅读

1.6 Linux命令行使用

解决"T-SQL无法附加到进程"错误的补充,T-SQLcan not attach to process

【网络篇】第五篇——网络套接字编程(一)(socket详解)socket编程LINUX下socket程序的演示

网络空间安全中高职业院校职技能大赛——Telnet弱口令渗透测试

门户通专访月光博客：第一博客是如何打造成的

解读2008年网络技术热词之云计算

磁盘结构及在Linux中的命名

宝塔java项目部署日志路径

Centos 7 Apache配置虚拟主机

Ubunto 安装Apache2以后 httpd.conf文件找不到问题

Apache httpd 安装启动demo（Window版）

Apache配置文件中的deny和allow的使用

配置网页内容访问

艰难安装LDAP,SSL认证

Apache配置SSLApache配置SSL

Windows下配置Apache的SSL服务