Cache dns — различия между версиями

[root@vm-01 ~]# yum install -y bind

[root@vm-01 ~]# systemctl enable named.service 
Created symlink from /etc/systemd/system/multi-user.target.wants/named.service to /usr/lib/systemd/system/named.service.
[root@vm-01 ~]#

[root@vm-01 ~]# cat /etc/named.conf 
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

acl net { 192.168.1.0/24; };

options {
	listen-on port 53 { 127.0.0.1; net; };
	//listen-on-v6 port 53 { ::1; };
	directory 	"/var/named";
	dump-file 	"/var/named/data/cache_dump.db";
	statistics-file "/var/named/data/named_stats.txt";
	memstatistics-file "/var/named/data/named_mem_stats.txt";
	allow-query     { localhost; net; };
	allow-query-on	{ 192.168.1.1/24; };

	/* 
	 - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
	 - If you are building a RECURSIVE (caching) DNS server, you need to enable 
	   recursion. 
	 - If your recursive DNS server has a public IP address, you MUST enable access 
	   control to limit queries to your legitimate users. Failing to do so will
	   cause your server to become part of large scale DNS amplification 
	   attacks. Implementing BCP38 within your network would greatly
	   reduce such attack surface 
	*/
	recursion yes;

	allow-recursion { 127.0.0.1; net; };
	allow-recursion-on { 192.168.1.1/24; };

	forwarders { 8.8.8.8; 8.8.4.4; };
	forward only;

	dnssec-enable yes;
	dnssec-validation yes;

	/* Path to ISC DLV key */
	bindkeys-file "/etc/named.iscdlv.key";

	managed-keys-directory "/var/named/dynamic";

	pid-file "/run/named/named.pid";
	session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
	type hint;
	file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

[root@vm-01 ~]# named-checkconf -z /etc/named.conf
zone localhost.localdomain/IN: loaded serial 0
zone localhost/IN: loaded serial 0
zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 0
zone 1.0.0.127.in-addr.arpa/IN: loaded serial 0
zone 0.in-addr.arpa/IN: loaded serial 0
[root@vm-01 ~]#

# BIND named process options
# ~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# OPTIONS="whatever"     --  These additional options will be passed to named
#                            at startup. Don't add -t here, enable proper
#                            -chroot.service unit file.
#
# DISABLE_ZONE_CHECKING  --  By default, service file calls named-checkzone
#                            utility for every zone to ensure all zones are
#                            valid before named starts. If you set this option
#                            to 'yes' then service file doesn't perform those
#                            checks.

OPTIONS="-4"

[root@vm-01 ~]# systemctl start named
[root@vm-01 ~]# systemctl status named
● named.service - Berkeley Internet Name Domain (DNS)
   Loaded: loaded (/usr/lib/systemd/system/named.service; enabled; vendor preset: disabled)
   Active: active (running) since Tue 2017-12-12 14:45:52 MSK; 4s ago
  Process: 3200 ExecStart=/usr/sbin/named -u named $OPTIONS (code=exited, status=0/SUCCESS)
  Process: 3197 ExecStartPre=/bin/bash -c if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z /etc/named.conf; else echo "Checking of zone files is disabled"; fi (code=exited, status=0/SUCCESS)
 Main PID: 3203 (named)
   CGroup: /system.slice/named.service
           └─3203 /usr/sbin/named -u named -4

Dec 12 14:45:52 vm-01 named[3203]: managed-keys-zone: loaded serial 0
Dec 12 14:45:52 vm-01 named[3203]: zone 0.in-addr.arpa/IN: loaded serial 0
Dec 12 14:45:52 vm-01 named[3203]: zone localhost.localdomain/IN: loaded serial 0
Dec 12 14:45:52 vm-01 named[3203]: zone localhost/IN: loaded serial 0
Dec 12 14:45:52 vm-01 named[3203]: zone 1.0.0.127.in-addr.arpa/IN: loaded serial 0
Dec 12 14:45:52 vm-01 named[3203]: zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 0
Dec 12 14:45:52 vm-01 named[3203]: all zones loaded
Dec 12 14:45:52 vm-01 named[3203]: running
Dec 12 14:45:52 vm-01 systemd[1]: Started Berkeley Internet Name Domain (DNS).
Dec 12 14:45:52 vm-01 named[3203]: managed-keys-zone: Initializing automatic trust anchor management for zone '.'; DNSKEY ID 20326 is now trusted, waiving the normal 30-day waiting period.
[root@vm-01 ~]#

[root@vm-01 ~]# ss -tulpn | grep "53"
udp    UNCONN     0      0      192.168.1.1:53                    *:*                   users:(("named",pid=3342,fd=515),("named",pid=3342,fd=514))
udp    UNCONN     0      0      127.0.0.1:53                    *:*                   users:(("named",pid=3342,fd=513),("named",pid=3342,fd=512))
tcp    LISTEN     0      10     192.168.1.1:53                    *:*                   users:(("named",pid=3342,fd=22))
tcp    LISTEN     0      10     127.0.0.1:53                    *:*                   users:(("named",pid=3342,fd=21))
tcp    LISTEN     0      128    127.0.0.1:953                   *:*                   users:(("named",pid=3342,fd=23))
[root@vm-01 ~]#

[root@vm-01 ~]# firewall-cmd --add-service=dns --permanent 
success
[root@vm-01 ~]# firewall-cmd --reload 
success
[root@vm-01 ~]# firewall-cmd --list-services 
dhcpv6-client ssh dns
[root@vm-01 ~]#