CentOS 7部署DNS服务器BIND

BIND（Berkeley internet Name Daemon)也叫做NAMED，是现今互联网上使用最为广泛的DNS 服务器程序。这篇文章将要讲述如何在 chroot 监牢中运行 BIND，这样它就无法访问文件系统中除“监牢”以外的其它部分。

例如，在这篇文章中，我会将BIND的运行根目录改为 /var/named/chroot/。当然，对于BIND来说，这个目录就是 /（根目录）。 “jail”（监牢，下同）是一个软件机制，其功能是使得某个程序无法访问规定区域之外的资源，同样也为了增强安全性（LCTT 译注：chroot “监牢”，所谓“监牢”就是指通过chroot机制来更改某个进程所能看到的根目录，即将某进程限制在指定目录中，保证该进程只能对该目录及其子目录的文件进行操作，从而保证整个服务器的安全）。Bind Chroot DNS 服务器的默认“监牢”为 /var/named/chroot。

## 在CentOS上搭建Chroot 的Bind DNS服务器
你可以按照下列步骤，在CentOS 7.0 上部署 Bind Chroot DNS 服务器。
服务器本机ip：172.16.0.55

1、安装Bind Chroot DNS 服务器
```
[root@centos7 ~]# /bin/chattr -i /etc/fstab /etc/passwd /etc/group /etc/shadow /etc/sudoers /etc/services
[root@centos7 ~]# yum install bind-chroot bind -y
# 我要启用chroot，并且需要更改named的目录到/data/named/chroot
# 因此需要拷贝文件
mkdir -p /data/named
cp -ar /var/named/* /data/named/

# 创建存放日志的目录
mkdir -p /data/named/chroot/data/log/named/

### 在bind chroot 的目录中创建相关文件
touch /data/named/chroot/var/named/data/cache_dump.db
touch /data/named/chroot/var/named/data/named_stats.txt
touch /data/named/chroot/var/named/data/named_mem_stats.txt
touch /data/named/chroot/var/named/data/named.run
mkdir /data/named/chroot/var/named/dynamic
touch /data/named/chroot/var/named/dynamic/managed-keys.bind

# 到linux系统的/data/目录下，更改named目录的属主和数组为named
cd /data/
chown named.named -R named
```

编辑主named.conf文件
```
$ cat /data/named/chroot/etc/named.conf

acl telecom {
  172.17.10.0/24;
  172.17.100.101;  # host1
};

acl unicom {
  172.17.20.0/24;
};

acl mobile {
  172.17.30.0/24;
};

acl trusted {
  10.0.0.0/8;
};

options {
 listen-on port 53 { 127.0.0.1; 172.16.0.55;};
 directory  "/var/named";
 dump-file  "/data/named/data/cache_dump.db";
 statistics-file "/data/named/data/named_stats.txt";
 memstatistics-file "/data/named/data/named_mem_stats.txt";
  // 允许查询的主机；白名单 
 allow-query     { any; };
  allow-query-cache  { any; };
  // 我这里买的是阿里云的ECS服务器，因此这里使用阿里的DNS
  forwarders { 223.5.5.5; 223.6.6.6; };
  recursive-clients  200000;
  check-names master warn;
  max-cache-ttl      60;
  max-ncache-ttl    0;

//recursion yes;
 //dnssec-enable yes;
 //dnssec-validation yes;
 //managed-keys-directory "/var/named/dynamic";
 pid-file "/run/named/named.pid";
 //session-keyfile "/run/named/session.key";

};

logging {
       channel query_log {
               file "/data/log/named/query.log" versions 10 size 300m;
               severity info;
               print-category yes;
               print-time yes;
               print-severity yes;
               };
       channel client_log {
               file "/data/log/named/client.log" versions 3 size 200m;
               severity info;
               print-category yes;
               print-time yes;
               print-severity yes;
               };
       channel config {
               file "/data/log/named/config.log" versions 3 size 100m;
               severity info;
               print-category yes;
               print-time yes;
               print-severity yes;
               };
       channel default_log {
               file "/data/log/named/default.log" versions 3 size 100m;
               severity debug;
               print-category yes;
               print-time yes;
               print-severity yes;
               };
       channel general_log {
               file "/data/log/named/general.log" versions 3 size 200m;
               severity debug;
               print-category yes;
               print-time yes;
               print-severity yes;
               };
       category queries {
               query_log;
               };
       category client {
               client_log;
               };
       category general {
               general_log;
               };
       category config {
               config;
               };
       category default {
               default_log;
               };
};

view telcom_view {
  match-clients { telcom; };
  match-destinations { any; };
  recursion yes;
  include "/etc/named-telcome.zones";
};

view unicom_view {
  match-clients { unicom; };
  match-destinations { any; };
  recursion yes;
  include "/etc/named-unicome.zones";
};

view  mobile_view {
  match-clients      { any; };
  match-destinations { any; };
  recursion yes;
  include "/etc/named-mobile.zones";
};
```
注意：需要提醒大家的是：第一，启用了named-chroot服务以后，就必须关闭named服务，两者取其一。第二，如果启用了named-chroot，那么目录就都是相对目录，都是相对于/var/named/chroot而言的。

使用acl+view
上面已经定义好了三个acl和三个view。一般来说我们的acl都会放在最开头，也就是options的前面，也建议这样放。

接下来就需要生成三个view下面的include包含进来的区域文件了。这里只演示正向解析区域，一般内网bind9很少需要反向解析。

生成区域文件
```
$ vi /var/named/chroot/etc/named-telcome.zones
zone "ayunw.cn" IN {
        type master;
        file "ayunw.cn.zone";
        allow-update { none; };
        masterfile-format text;
        allow-transfer { 172.16.0.56; };
};

$ vi /var/named/chroot/etc/named-unicom.zones
zone "iyunw.cn" IN {
        type master;
        file "iyunw.cn.zone";
        allow-update { none; };
        masterfile-format text;
        allow-transfer { 172.16.0.56; };
};

$ vi /var/named/chroot/etc/named-mobile.zones
zone "allenjol.cn" IN {
        type master;
        file "allenjol.cn.zone";
        allow-update { none; };
        masterfile-format text;
        allow-transfer { 172.16.0.56; };
};
```

生成区域解析库文件
```
$ cd /var/named/chroot/var

$ vi ayunw.cn.zone
$TTL    86400
@       IN      SOA     ayunw.cn.       root.iyunw.cn.  (
                                        202111011       ; serial (d. adams)
                                        1H              ; refresh
                                        15M             ; retry
                                        1W              ; expiry
                                        1D )            ; minimum

IN      NS              ns1.ayunw.cn.
                IN      NS              ns2.ayunw.cn.

ns1             IN      A 172.16.0.55
ns2             IN      A 172.16.0.56
www           IN      A 172.16.0.58

$ vi iyunw.cn.zone
$TTL    86400
@       IN      SOA     iyunw.cn.       root.iyunw.cn.  (
                                        202111011       ; serial (d. adams)
                                        1H              ; refresh
                                        15M             ; retry
                                        1W              ; expiry
                                        1D )            ; minimum

IN      NS              ns1.iyunw.cn.
                IN      NS              ns2.iyunw.cn.

ns1             IN      A 172.16.0.55
ns2             IN      A 172.16.0.56
web            IN      A 172.16.0.59

$ vi allenjol.cn.zone
$TTL    86400
@       IN      SOA     allenjol.cn.       root.allenjol.cn.  (
                                        202111011       ; serial (d. adams)
                                        1H              ; refresh
                                        15M             ; retry
                                        1W              ; expiry
                                        1D )            ; minimum

IN      NS              ns1.allenjol.cn.
                IN      NS              ns2.allenjol.cn.

ns1             IN      A 172.16.0.55
ns2             IN      A 172.16.0.56
allen           IN      A 172.16.0.60
```

修改本地解析文件
cat /etc/resolv.conf
nameserver 172.16.0.55

启动服务并设置开机自启
```
/usr/libexec/setup-named-chroot.sh /var/named/chroot on
systemctl stop named
systemctl disable named
systemctl start named-chroot
systemctl enable named-chroot
```

### 从节点

```
zone "threatbook-inc.cn" IN {
    type slave;
    masters { 172.16.0.5; };
    file "slaves/threatbook-inc.cn.zone";
};
```
修改本地解析文件
cat /etc/resolv.conf
nameserver 172.16.0.56

### 主从配置区别
vim /var/named/chroot/etc/named.conf

主节点配置
```
zone "moviebook.cn" IN {
        //hint master slave forward
        allow-update { none; };
        allow-transfer { 172.16.0.56; };
        also-notify { 172.16.0.56; };
        check-names ignore;
        type master;
        file "moviebook.cn.zone";
};

```

从节点配置
```
zone "moviebook.cn" IN {
        //hint master slave forward
        type slave;
        file "moviebook.cn.zone";
        masters { 172.16.0.55; };
        check-names ignore;
};

```

参考：

在CentOS上搭建Chroot 的Bind DNS服务器
http://www.nndssk.com/xtwt/205335yBDvD8.html

内网主从智能DNS从此不再烦恼
https://zhuanlan.zhihu.com/p/438351855

centos7 部署 DNS 主从
https://www.cnblogs.com/lixinliang/p/16035611.html

CentOS 7如何配置BIND为私网DNS服务器
https://devpress.csdn.net/centos/62ece98889d9027116a118c2.html