DNS主从+视图+密钥
- 格式：pdf
- 大小：286.95 KB
- 文档页数：7
高级DNS：主从+视图+密钥YASS硬件要求：两台/两台以上机器/虚拟机OS：REHL 5.0、5.5、5.9、6.4.. 可以互相通信 （ping的通）时间不可以差很多所需软件：bind、bind-chroot。
BIND服务器的软件包是bind，为了加强BIND的安全，最好安装bind-chroot软件包。
使用了chroot机制之后，BIND会将“/var/named/chroot”认作是根目录。
这样，即使BIND出现漏洞被非法入侵，入侵者获得的目录只是“/var/named/chroot”目录，而无法进入到系统的其它目录，从而加强了BIND的安全性。
主master从slave概况：在master上面配置好一切，slave上只需配主配置（named.conf）。
主master： 192.168.1.46从slave: 192.168.1.47详细配置：<1>.配置主master①安装软件（系统默认是没有这两个软件的）YUM安装：//使用YUM安装很方便，替我们解决了依赖关系，只需输入要安装的软件名即可# yum -y install bind bind-chrootRPM安装：# rpm -ivh /iso/Server/bind-9.3.6-4.P1.el5_4.2.i386.rpm# rpm -ivh /iso/Server/bind-chroot-9.3.6-4.P1.el5_4.2.i386.rpm②生成密钥# cd /var/named/chroot/etc///要在这个目录下生成密钥# dnssec-keygen--help//相关帮助Usage:dnssec-keygen -a alg -b bits -n type [options] nameVersion: 9.3.6-P1-RedHat-9.3.6-4.P1.el5_4.2Required options:-a algorithm: RSA | RSAMD5 | DH | DSA | RSASHA1 | HMAC-MD5-b key size, in bits:RSAMD5: [512..4096]RSASHA1: [512..4096]DH: [128..4096]DSA: [512..1024] and divisible by 64HMAC-MD5: [1..512]-n nametype: ZONE | HOST | ENTITY | USER | OTHERname: owner of the keyOther options:-c <class> (default: IN)-e use large exponent (RSAMD5/RSASHA1 only)-f keyflag: KSK-g <generator> use specified generator (DH only)-t <type>: AUTHCONF | NOAUTHCONF | NOAUTH | NOCONF (default: AUTHCONF)-p <protocol>: default: 3 [dnssec]-s <strength> strength value this key signs DNS records with (default: 0)-r <randomdev>: a file containing random data-v <verbose level>-k : generate a TYPE=KEY keyOutput:K<name>+<alg>+<id>.key, K<name>+<alg>+<id>.private# dnssec-keygen -a hmac-md5 -b 128 -n host 7k//生成密钥K7k.+157+29709# lsK7k.+157+29709.key K7k.+157+29709.private localtime rndc.key//K7k.+157+29709.key--> 公钥（我们要用的）K7k.+157+29709.private（私钥）# cat K7k.+157+29709.key7k. IN KEY 512 3 157 DnNjNXxpHlNg8csb6V4dYA==//记好或复制密钥“DnNjNXxpHlNg8csb6V4dYA==”③开始配置配置named.conf：# pwd/var/named/chroot/etc# vim named.confoptions {directory "/var/named";};key 7k {algorithm hmac-md5;secret "DnNjNXxpHlNg8csb6V4dYA==";};acl ab_client {192.168.1.41;192.168.2.0/24;};view "ab" {match-clients { ab_client; };recursion yes;zone ".zone" {type master;file ".zone";allow-transfer { key 7k; };};};view "all" {match-clients { any; };recursion yes;zone "" {type master;file ".all";allow-transfer { key 7k; };};};图示:区配置：# pwd/var/named/chroot/var/named# cp /usr/share/doc/bind-9.3.6/sample/var/named/localhost.zone .zone # cp .zone .all# vim .zone$TTL 86400@ IN SOA . root (42 ; serial (d. adams)3H ; refresh15M ; retry1W ; expiry1D ) ; minimumns IN A 192.168.1.46//服务器的IP；ns即nameserverwww IN A 192.168.1.48// 的IP地址为192.168.1.48 study IN A 192.168.1.49// 的IP地址为 192.168.1.49 # vim .all$TTL 86400@ IN SOA . root (42 ; serial (d. adams)3H ; refresh15M ; retry1W ; expiry1D ) ; minimumIN NS .ns IN A 192.168.1.46www IN A 192.168.1.100study IN A 192.168.1.200开启服务:# /etc/init.d/named startStarting named: [ OK ]<2>配置从slave①安装软件---> 同上②配主配置# pwd/var/named/chroot/etc# vim named.confoptions {directory "/var/named/slaves";};key 7k {algorithm hmac-md5;secret "DnNjNXxpHlNg8csb6V4dYA==";};acl ab_client {192.168.1.41;192.168.2.0/24;};view "ab" {match-clients { ab_client; };recursion yes;zone ".zone" {type slave;masters { 192.168.1.46 key 7k; };};};view "all" {match-clients { any; };recursion yes;zone ".all" {type slave;file ".all";masters { 192.168.1.46 key 7k; };};};图示:③测试主从# pwd/var/named/chroot/var/named/slaves# /etc/init.d/named startStarting named: [ OK ]# ls.all .zone//看到主的区配置文件，成功<3>客户端测试客户端IP192.168.1.41①指定主DNS服务器# vim /etc/resolv.confsearch nameserver 192.168.1.46//亦可是从的IP 即 192.168.1.47②测试# nslookup Server: 192.168.1.46Address: 192.168.1.46#53Name: Address: 192.168.1.48# nslookup Server: 192.168.1.46Address: 192.168.1.46#53Name: Address: 192.168.1.49图示:其它客户端测试//192.168.1.0 网段的，下面实验中的客户端IP为192.168.1.42 1指定DNS服务器# vim /etc/resolv.confsearch nameserver 192.168.1.46//亦可是从的IP 即 192.168.1.472测试# nslookup Server: 192.168.1.46Address: 192.168.1.46#53Name: Address: 192.168.1.100# nslookup Server: 192.168.1.46Address: 192.168.1.46#53 Name: Address: 192.168.1.200。
