bind配置中之DNS主从同步，区域安全传送

实现DNS的主从同步：
主DNS的bind版不能高于从DNS的版本
向区域中添加从服务器的关键两步：

a：在上级得到授权

b：在区域数据文件中为服务器添加一条NS记录和对应的A记录或PTR记录

1.为主DNS服务器添加一条NS记录和对应的A记录

# vim /var/named/mageedu.com.zone
$TTL 86400
@       IN      SOA     dsn.mageedu.com. admin.mageedu.com (
2014031901
1D
12H
1D
12H )
IN      NS      dns
IN      NS      ns
IN      MX 20mail
dns     IN      A       172.16.19.100
ns      IN      A       172.16.19.1
mail    IN      A       172.16.19.2
www     IN      A       172.16.19.3
pop     IN      CNAME   mail
ftp     IN      CNAME   www

2.为从DNS服务器添加一条NS记录和对应PTR记录

# vim /var/named/172.16.19.zone
$TTL 86400
@       IN      SOA     dsn.mageedu.com. admin.mageedu.com (
2014031902
1D
12H
1D
12H )
IN      NS      dns.mageedu.com.
IN      NS      ns.mageedu.com.
100IN      PTR     dns.mageedu.com.
1IN      PTR     ns.mageedu.com.
2IN      PTR     mail.mageedu.com.
3IN      PTR     www.mageedu.com.

3.并编辑配置文同上

4.在从服务器添加mageedu.com区域

zone "mageedu.com"IN {
type slave;
masters {172.16.19.100;};
file "slaves/mageedu.com.zone";
};

5.在从服务器添加19.16.172.in-addr.arpa区域

zone "19.16.172.in-addr.arpa"IN {
type slave;
masters {172.16.29.100;};
file "slaves/172.16.19.zone";
};

6.启动named服务

# named -u named

7.查看日志文件

# tail /var/log/messages
Mar 1705:44:18stu19 named[31977]: zone 19.16.172.in-addr.arpa/IN: Transfer started.
Mar 1705:44:18stu19 named[31977]: transfer of '19.16.172.in-addr.arpa/IN'from 172.16.19.100#53: connected using 172.16.19.1#47647
Mar 1705:44:18stu19 named[31977]: zone 19.16.172.in-addr.arpa/IN: transferred serial 2014031902
Mar 1705:44:18stu19 named[31977]: transfer of '19.16.172.in-addr.arpa/IN'from 172.16.19.100#53: Transfer completed: 1messages, 8records, 255bytes, 0.003secs (85000bytes/sec)
Mar 1705:44:18stu19 named[31977]: zone 19.16.172.in-addr.arpa/IN: sending notifies (serial 2014031902)
Mar 1705:44:18stu19 named[31977]: zone mageedu.com/IN: Transfer started.
Mar 1705:44:18stu19 named[31977]: transfer of 'mageedu.com/IN'from 172.16.19.100#53: connected using 172.16.19.1#40334
Mar 1705:44:18stu19 named[31977]: zone mageedu.com/IN: transferred serial 2014031901
Mar 1705:44:18stu19 named[31977]: transfer of 'mageedu.com/IN'from 172.16.19.100#53: Transfer completed: 1messages, 11records, 283bytes, 0.002secs (141500bytes/sec)
Mar 1705:44:18stu19 named[31977]: zone mageedu.com/IN: sending notifies (serial 2014031901)

8.查从服务器中/var/named/slave/目录

# ls /var/named/slaves/
172.16.19.zone  mageedu.com.zone

区域传送安全控制
提高DNS服务器的安全性

在主服务器的区域文件中添加allow-transfer{IP};
只允许127.0.0.1和172.16.19.1进行区域传送

zone "mageedu.com"IN {
type master;
file "mageedu.com.zone";
allow-transfer {127.0.0.1;172.16.19.1;};
};
zone "19.16.172.in-addr.arpa"IN {
type master;
file "172.16.19.zone";
allow-transfer {127.0.0.1;172.16.19.1;};
};

重启主服务器的DNS服务

# service named reload

成功配置区域传送安全控制

# dig -t axfr mageedu.com @172.16.19.100
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6 <<>> -t axfr mageedu.com @172.16.19.100
;; global options: +cmd
; Transfer failed.
# dig -t axfr mageedu.com @172.16.19.1
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6 <<>> -t axfr mageedu.com @172.16.19.1
;; global options: +cmd
mageedu.com.        86400IN  SOA dsn.mageedu.com. admin.mageedu.com.mageedu.com. 201403190186400432008640043200
mageedu.com.        86400IN  MX  20mail.mageedu.com.
mageedu.com.        86400IN  NS  dns.mageedu.com.
mageedu.com.        86400IN  NS  ns.mageedu.com.
dns.mageedu.com.    86400IN  A   172.16.19.100
ftp.mageedu.com.    86400IN  CNAME   www.mageedu.com.
mail.mageedu.com.   86400IN  A   172.16.19.2
ns.mageedu.com.     86400IN  A   172.16.19.1
pop.mageedu.com.    86400IN  CNAME   mail.mageedu.com.
www.mageedu.com.    86400IN  A   172.16.19.3
mageedu.com.        86400IN  SOA dsn.mageedu.com. admin.mageedu.com.mageedu.com. 201403190186400432008640043200
;; Query time: 5msec
;; SERVER: 172.16.19.1#53(172.16.19.1)
;; WHEN: Sun Mar 1616:29:232014
;; XFR size: 11records (messages 1, bytes 283)

对从服务配置区域安全传送控制：不允许任何人进行同步

zone "mageedu.com"IN {
type slave;
masters {172.16.19.100;};
file "slaves/mageedu.com.zone";
allow-transfer {none;};
};
zone "19.16.172.in-addr.arpa"IN {
type slave;
masters {172.16.19.100;};
file "slaves/172.16.19.zone";
allow-transfer {none;};
};

重启从服务器的DNS服务

# service named reload

测试区域传送安全控制配置成功

[root@stu19 ~]# dig -t axfr mageedu.com @127.0.0.1
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6 <<>> -t axfr mageedu.com @127.0.0.1
;; global options: +cmd
; Transfer failed.