服务器评测
本节中将介绍下如何构建一个本地的服务器，可以用来解析公网域名以及基本的正,反向区域的基本配置，这个之前也整理过，但总觉得好多地方都不够完善，毕竟这是最基础的网络服务，希望能在此有所补漏拾遗吧…
一：安装DNS服务器，实现基本的公网解析
[root@server1 ~]# yum grouplist |grep ‘DNS’ //使用包组方式安装DNS软件包
This system is not registered with RHN.
RHN support will be disabled.
DNS Name server
[root@server1 ~]# yum -y groupinstall “DNS Name server1”
Running Transaction
Installing : bind //DNS主程序软件包
Installing : bind-chroot //chroot软件包，安装上该软件包后DNS服务器的工作目录会自动切换为/var/named/chroot
[root@server1 named]# cat /etc/sysconfig/named |grep chroot |grep -v ‘^#’
ROOTDIR=/var/named/chroot
[root@server1 ~]# yum -y install caching-nameserver1 //缓存DNS服务器软件包，主要包含了一些配置文件
[root@server1 ~]# cd /var/named/chroot/etc/
[root@server1 etc]# cp named.caching-nameserver1.conf named.conf //将其复制为namd.conf，该文件即为DNS服务器主配置文件
[root@server1 etc]# ln -s /var/named/chroot/etc/named.conf /etc/ //将其软链接到/etc目录下
[root@server1 etc]# grep -v ‘^//’ named.conf |grep -v ‘//’ //修改配置文件如下
options {
listen-on port 53 { 192.168.100.254; }; //表示DNS服务器只监听在192.168.100.254这个网络接口上
directory “/var/named”; //DNS服务器工作目录，这里可不能写chroot下的目录哦
dump-file “/var/named/data/cache_dump.db”; //以下三行其实不重要，主要是定义一些缓存和静态文件的位置，可删除
statistics-file “/var/named/data/named_stats.txt”;
memstatistics-file “/var/named/data/named_mem_stats.txt”;
allow-query { any; }; //运行任何网段的IP进行查询，any是内置的访问对象，也可以指定具体的网段，可参考man
};
include “/etc/named.rfc1912.zones”; //include包含named.rfc1912.zones文件
[root@server1 etc]# head -20 named.rfc1912.zones |grep -v ‘^//’ //该文件主要定义根域，localhost等的信息
zone “.” IN {
type hint;
file “named.ca”;
};
zone “localdomain” IN {
type master;
file “localdomain.zone”;
allow-update { none; };
};
[root@server1 etc]# chown named.named named.conf //这步比较重要，DNS服务器默认是以named用户来启动的，若权限不对，启动服务将会出错
[root@server1 etc]# ping -c 2 www.6688.cc //测试网络连通性
PING www.6688.cc (203.208.37.104) 56(84) bytes of data.
64 bytes from bg-in-f104.1e100.net (203.208.37.104): icmp_seq=1 ttl=237 time=99.9 ms
64 bytes from bg-in-f104.1e100.net (203.208.37.104): icmp_seq=2 ttl=237 time=98.6 ms
[root@server1 etc]# service named start //试启动服务
Starting named: [ OK ]
[root@server1 ~]# tail -f /var/log/messages //监控日志
Mar 14 04:35:11 server1 named[8436]: starting BIND 9.3.6-P1-RedHat-9.3.6-4.P1.el5 -u named -t /var/named/chroot
Mar 14 04:35:11 server1 named[8436]: adjusted limit on open files from 1024 to 1048576
Mar 14 04:35:11 server1 named[8436]: found 2 CPUs, using 2 worker threads
Mar 14 04:35:11 server1 named[8436]: using up to 4096 sockets
Mar 14 04:35:11 server1 named[8436]: loading configuration from ‘/etc/named.conf’ //载入配置文件
Mar 14 04:35:12 server1 named[8436]: using default UDP/IPv4 port range: [1024, 65535]
Mar 14 04:35:12 server1 named[8436]: using default UDP/IPv6 port range: [1024, 65535]
Mar 14 04:35:12 server1 named[8436]: listening on IPv4 interface eth1, 192.168.100.254#53 //监听IPV4，eth1上的53端口
Mar 14 04:35:12 server1 named[8436]: command channel listening on 127.0.0.1#953 //IPV4的本地回环接口的953端口，953主要用于rndc
Mar 14 04:35:12 server1 named[8436]: command channel listening on ::1#953 //同上，IPV6
Mar 14 04:35:12 server1 named[8436]: zone 0.in-addr.arpa/IN: loaded serial 42
Mar 14 04:35:12 server1 named[8436]: zone 0.0.127.in-addr.arpa/IN: loaded serial 1997022700
Mar 14 04:35:12 server1 named[8436]: zone 255.in-addr.arpa/IN: loaded serial 42
Mar 14 04:35:12 server1 named[8436]: zone 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 1997022700
Mar 14 04:35:12 server1 named[8436]: zone localdomain/IN: loaded serial 42
Mar 14 04:35:12 server1 named[8436]: zone localhost/IN: loaded serial 42
Mar 14 04:35:12 server1 named[8436]: running //正常运行
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5 <<>> www.6688.cc @192.168.100.254
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45157
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 5, ADDITIONAL: 0
;; QUESTION SECTION:
;www.6688.cc. IN A
;; ANSWER SECTION:
www.6688.cc. 300 IN A 203.208.37.99
www.6688.cc. 300 IN A 203.208.37.104
;; AUTHORITY SECTION:
6688.cc. 21600 IN NS ns4.6688.cc.
6688.cc. 21600 IN NS ns1.6688.cc.
6688.cc. 21600 IN NS ns1.6688.cc.
6688.cc. 21600 IN NS ns2.6688.cc.
6688.cc. 21600 IN NS ns3.6688.cc.
;; Query time: 966 msec
;; server1: 192.168.100.254#53(192.168.100.254)
;; WHEN: Sun Mar 14 04:36:20 2010
;; MSG SIZE rcvd: 165
二：配置自己的正向和反向区域
[root@server1 etc]# tail -13 named.conf //在主配置文件中添加正，反向区域
include “/etc/named.rfc1912.zones”;
zone “666.com” IN {
type master;
file “666.zone”;
allow-update {none;};
};
zone “100.168.192.in-addr.arpa” IN {
type master;
file “192.168.100.zone”;
allow-update {none;};
};
[root@server1 etc]# cd ../var/named/ //编辑正，反向区域的区域文件
[root@server1 named]# pwd
/var/named/chroot/var/named
[root@server1 named]# cp localhost.zone 666.zone
[root@server1 named]# cp named.local 192.168.100.zone
[root@server1 named]# chown named.named 666.zone 192.168.100.zone //权限同样需要改
[root@server1 named]# cat 666.zone //正向区域配置
$TTL 86400 //DNS查询过期时间
@ IN SOA 666.com.//服务器名 root.666.com.//管理员邮件地址 (
42 ; serial (d. adams) //更新序列号，主要用于主从同步
3H ; refresh //主从同步刷新时间
15M ; retry //主从同步失败后的重试时间
1W ; expiry //从服务器记录过期时间
1D ) ; minimum //最小TTL值
@ IN NS 666.com. //ns记录
@ IN MX 10 666.com. //mx记录
www IN A 192.168.100.254 //A记录
ftp IN CNAME www //别名记录
[root@server1 named]# cat 192.168.100.zone //反向区域配置
$TTL 86400
@ IN SOA 666.com. root.666.com. (
1997022700 ; Serial
28800 ; Refresh
14400 ; Retry
3600000 ; Expire
86400 ) ; Minimum
@ IN NS 666.com.
254 IN PTR 666.com.
200 IN PTR www.666.com.
[root@server1 named]# service named restart //重启服务
Stopping named: [ OK ]
Starting named: [ OK ]
[root@server1 named]# dig www.666.com @192.168.100.254 //测试A记录
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5 <<>> www.666.com @192.168.100.254
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61297
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;www.666.com. IN A
;; ANSWER SECTION:
www.666.com. 86400 IN A 192.168.100.254
;; AUTHORITY SECTION:
666.com. 86400 IN NS 666.com.
;; Query time: 6 msec
;; server1: 192.168.100.254#53(192.168.100.254)
;; WHEN: Sun Mar 14 04:58:42 2010
[root@server1 named]# dig ftp.666.com @192.168.100.254 //测试别名记录
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5 <<>> ftp.666.com @192.168.100.254
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4178
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;ftp.666.com. IN A
;; ANSWER SECTION:
ftp.666.com. 86400 IN CNAME www.666.com.
www.666.com. 86400 IN A 192.168.100.254
;; AUTHORITY SECTION:
666.com. 86400 IN NS 666.com.
;; Query time: 4 msec
;; server1: 192.168.100.254#53(192.168.100.254)
;; WHEN: Sun Mar 14 04:59:30 2010
;; MSG SIZE rcvd: 77
[root@server1 named]# dig -x 192.168.100.254 @192.168.100.254 //测试反向域
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5 <<>> -x 192.168.100.254 @192.168.100.254
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53186
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;254.100.168.192.in-addr.arpa. IN PTR
;; ANSWER SECTION:
254.100.168.192.in-addr.arpa. 86400 IN PTR 666.com.
;; AUTHORITY SECTION:
100.168.192.in-addr.arpa. 86400 IN NS 666.com.
;; Query time: 2 msec
;; server1: 192.168.100.254#53(192.168.100.254)
;; WHEN: Sun Mar 14 04:57:04 2010
;; MSG SIZE rcvd: 81
[root@server1 named]# dig -t mx 666.com @192.168.100.254 //测试邮件交换记录
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5 <<>> -t mx 666.com @192.168.100.254
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41222
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;666.com. IN MX
;; ANSWER SECTION:
666.com. 86400 IN MX 10 666.com.
;; AUTHORITY SECTION:
666.com. 86400 IN NS 666.com.
;; Query time: 2 msec
;; server1: 192.168.100.254#53(192.168.100.254)
;; WHEN: Sun Mar 14 04:57:51 2010
;; MSG SIZE rcvd: 55
[root@server1 named]# dig -t ns 666.com. @192.168.100.254 //测试NS记录
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5 <<>> -t ns 666.com. @192.168.100.254
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20572
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;666.com. IN NS
;; ANSWER SECTION:
666.com. 86400 IN NS 666.com.
;; Query time: 2 msec
;; server1: 192.168.100.254#53(192.168.100.254)
;; WHEN: Sun Mar 14 05:31:58 2010
;; MSG SIZE rcvd: 39
[root@server1 named]# netstat -ntpl |grep 53
tcp 0 0 192.168.100.254:53 0.0.0.0:* LISTEN 8887/named
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 8887/named
tcp 0 0 ::1:953 :::* LISTEN 8887/named
[root@server1 named]# iptables -A INPUT -p tcp –dport 53 -j ACCEPT //若服务器部署了防火墙，则需要允许tcp,udp的53端口
[root@server1 named]# iptables -A INPUT -p udp –dport 53 -j ACCEPT
[root@server1 ~]# chkconfig named on
