UBUNTU в Воронежской области

Эта страница только для чтения. Вы можете посмотреть её исходный текст, но не можете его изменить. Сообщите администратору, если считаете, что это неправильно.
====== Сервер Доменных Имен- Domain Name Service (DNS) ======


Чтобы установить DNS сервер, надо установить два пакета.
Находясь в терминале выполните две команды, первая- установка пакета самого сервера:

<code>sudo apt-get install bind9</code>

Вторая пакет с утилитами для проверки и тестирования работы сервера DNS:

<code>sudo apt-get install dnsutils</code>

====== Конфигурирование сервера ======


Как Вы можете настроить свой BIND9.
Имеется несколько вариантов, это кэширующий сервер доменных имен, первичный мастер (primary master), вторичный мастер (secondary master).

    *      When configured as a caching nameserver BIND9 will find the answer to name queries and remember the answer when the domain is queried again.
    *      As a primary master server BIND9 reads the data for a zone from a file on it's host and is authoritative for that zone.
    *      In a secondary master configuration BIND9 gets the zone data from another nameserver authoritative for the zone.

===== Overview =====


The DNS configuration files are stored in the /etc/bind directory. The primary configuration file is /etc/bind/named.conf.

The include line specifies the filename which contains the DNS options. The directory line in the /etc/bind/named.conf.options file tells DNS where to look for files. All files BIND uses will be relative to this directory.

The file named /etc/bind/db.root describes the root nameservers in the world. The servers change over time, so the /etc/bind/db.root file must be maintained now and then. This is usually done as updates to the bind9 package. The zone section defines a master server, and it is stored in a file mentioned in the file option.

It is possible to configure the same server to be a caching name server, primary master, and secondary master. A server can be the Start of Authority (SOA) for one zone, while providing secondary service for another zone. All the while providing caching services for hosts on the local LAN.

===== Сервер кэширования доменных имен =====


По умолчанию первичные настройки предполагаю использование DNS сервера, как сервера для кэширования доменных имен. Вам надо для этого надо знать IP адреса первичного и вторичного DNS серверов Вашего провайдера. Эти IP адреса необходимо поместить в файл /etc/bind/named.conf.options:

<code>forwarders {
                1.2.3.4;
                5.6.7.8;
           };</code>

{{:note.png|}}Замените 1.2.3.4 и 5.6.7.8 на IP адреса вашего провайдера. У меня это например: 80.82.32.9 и 80.82.33.65 


Перезагрузите ваш DNS сервер, чтобы изменения в конфигурации были применены. Для этого наберите в терминале следующую команду:

<code>sudo /etc/init.d/bind9 restart</code>

Смотрите раздел “dig”, чтобы проверить работу Вашего вновь созданного сервера кэширования доменных имен.

===== Первичный DNS сервер (Primary Master) =====


В этом разделе настроим BIND9, как Primary Master. В качестве примера будем использовать в качестве примера имя example.com. Вы можете заменить его на то которое у Вас есть.
Работаем с файлом Forward Zone

To add a DNS zone to BIND9, turning BIND9 into a Primary Master server, the first step is to edit /etc/bind/named.conf.local:

<code>zone "example.com" {
	type master;
        file "/etc/bind/db.example.com";
};</code>

Now use an existing zone file as a template to create the /etc/bind/db.example.com file:

<code>sudo cp /etc/bind/db.local /etc/bind/db.example.com</code>

Edit the new zone file /etc/bind/db.example.com change localhost. to the FQDN of your server, leaving the additional "." at the end. Change 127.0.0.1 to the nameserver's IP Address and root.localhost to a valid email address, but with a "." instead of the usual "@" symbol, again leaving the "." at the end.

Also, create an A record for ns.example.com. The name server in this example:
<code>
;
; BIND data file for local loopback interface
;
$TTL    604800
@       IN      SOA     ns.example.com. root.example.com. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      ns.example.com.
@       IN      A       127.0.0.1
@       IN      AAAA    ::1
ns      IN      A       192.168.1.10</code>

You must increment the Serial Number every time you make changes to the zone file. If you make multiple changes before restarting BIND9, simply increment the Serial once.

Now, you can add DNS records to the bottom of the zone file. See the section called “Common Record Types” for details.

{{:note.png|}} Many admins like to use the last date edited as the serial of a zone, such as 2007010100 which is yyyymmddss (where ss is the Serial Number)

Once you have made a change to the zone file BIND9 will need to be restarted for the changes to take effect:

<code>sudo /etc/init.d/bind9 restart</code>

===== Reverse Zone File =====


Now that the zone is setup and resolving names to IP Adresses a Reverse zone is also required. A Reverse zone allows DNS to resolve an address to a name.

Edit /etc/bind/named.conf.local and add the following:

<code>zone "1.168.192.in-addr.arpa" {
        type master;
        notify no;
        file "/etc/bind/db.192";
};</code>

{{:note.png|}} 	Replace 1.168.192 with the first three octets of whatever network you are using. Also, name the zone file /etc/bind/db.192 appropriately. It should match the first octet of your network.

Now create the /etc/bind/db.192 file:

sudo cp /etc/bind/db.127 /etc/bind/db.192

Next edit /etc/bind/db.192 changing the basically the same options as /etc/bind/db.example.com:

;
; BIND reverse data file for local loopback interface
;
$TTL    604800
@       IN      SOA     ns.example.com. root.example.com. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      ns.
10      IN      PTR     ns.example.com.

The Serial Number in the Reverse zone needs to be incremented on each changes as well. For each A record you configure in /etc/bind/db.example.com you need to create a PTR record in /etc/bind/db.192.

After creating the reverse zone file restart BIND9:

sudo /etc/init.d/bind9 restart

===== Secondary Master =====


Once a Primary Master has been configured a Secondary Master is needed in order to maintain the availability of the domain should the Primary become unavailable.

First, on the Primary Master server, the zone transfer needs to be allowed. Add the allow-transfer option to the example Forward and Reverse zone definitions in /etc/bind/named.conf.local:

zone "example.com" {
        type master;
	file "/etc/bind/db.example.com";
        allow-transfer { 192.168.1.11; };
};

zone "1.168.192.in-addr.arpa" {
        type master;
        notify no;
        file "/etc/bind/db.192";
	allow-transfer { 192.168.1.11; };
};

FIXME

Replace 192.168.1.11 with the IP Address of your Secondary nameserver.

Next, on the Secondary Master, install the bind9 package the same way as on the Primary. Then edit the /etc/bind/named.conf.local and add the following declarations for the Forward and Reverse zones:

zone "example.com" {
	type slave;
        file "/var/cache/bind/db.example.com";
        masters { 192.168.1.10; };
};        
      
zone "1.168.192.in-addr.arpa" {
	type slave;
        file "/var/cache/bind/db.192";
        masters { 192.168.1.10; };
};

[Note] 	

Replace 192.168.1.10 with the IP Address of your Primary nameserver.

Restart BIND9 on the Secondary Master:

sudo /etc/init.d/bind9 restart

In /var/log/syslog you should see something similar to:

slave zone "example.com" (IN) loaded (serial 6)
slave zone "100.18.172.in-addr.arpa" (IN) loaded (serial 3)

[Note] 	

Note: A zone is only transferred if the Serial Number on the Primary is larger than the one on the Secondary.
[Note] 	

The default directory for non-authoritative zone files is /var/cache/bind/. This directory is also configured in AppArmor to allow the named daemon to write to. For more information on AppArmor see the section called “AppArmor”. 

===== Troubleshooting =====


This section covers ways to help determine the cause when problems happen with DNS and BIND9.
Testing
resolv.conf

The first step in testing BIND9 is to add the nameserver's IP Address to a hosts resolver. The Primary nameserver should be configured as well as another host to double check things. Simply edit /etc/resolv.conf and add the following:

nameserver	192.168.1.10
nameserver	192.168.1.11

[Note] :!:	

You should also add the IP Address of the Secondary nameserver in case the Primary becomes unavailable.
dig

If you installed the dnsutils package you can test your setup using the DNS lookup utility dig:

    *

      After installing BIND9 use dig against the loopback interface to make sure it is listening on port 53. From a terminal prompt:

      dig -x 127.0.0.1

      You should see lines similar to the following in the command output:

      ;; Query time: 1 msec
      ;; SERVER: 192.168.1.10#53(192.168.1.10)

    *

      If you have configured BIND9 as a Caching nameserver "dig" an outside domain to check the query time:

      dig ubuntu.com

      Note the query time toward the end of the command output:

      ;; Query time: 49 msec

      After a second dig there should be improvement:

      ;; Query time: 1 msec

ping

Now to demonstrate how applications make use of DNS to resolve a host name use the ping utility to send an ICMP echo request. From a terminal prompt enter:

ping example.com

This tests if the nameserver can resolve the name ns.example.com to an IP Address. The command output should resemble:

PING ns.example.com (192.168.1.10) 56(84) bytes of data.
64 bytes from 192.168.1.10: icmp_seq=1 ttl=64 time=0.800 ms
64 bytes from 192.168.1.10: icmp_seq=2 ttl=64 time=0.813 ms

named-checkzone

A great way to test your zone files is by using the named-checkzone utility installed with the bind9 package. This utility allows you to make sure the configuration is correct before restarting BIND9 and making the changes live.

    *

      To test our example Forward zone file enter the following from a command prompt:

      named-checkzone example.com /etc/bind/db.example.com

      If everything is configured correctly you should see output similar to:

      zone example.com/IN: loaded serial 6
      OK

    *

      Similarly, to test the Reverse zone file enter the following:

      named-checkzone example.com /etc/bind/db.192

      The output should be similar to:

      zone example.com/IN: loaded serial 3
      OK

[Note] 	

The Serial Number of your zone file will probably be different.
Logging

BIND9 has a wide variety of logging configuration options available. There are two main options. The channel option configures where logs go, and the category option determines what information to log.

If no logging option is configured the default option is:

logging {
     category default { default_syslog; default_debug; };
     category unmatched { null; };
};

This section covers configuring BIND9 to send debug messages related to DNS queries to a separate file.

    *

      First, we need to configure a channel to specify which file to send the messages to. Edit /etc/bind/named.conf.local and add the following:

      logging {
          channel query.log {      
              file "/var/log/query.log";
              severity debug 3; 
          }; 
      };

    *

      Next, configure a category to send all DNS queries to the query file:

      logging {
          channel query.log {      
              file "/var/log/query.log"; 
              severity debug 3; 
          }; 
          category queries { query.log; }; 
      };

[Note] 	

Note: the debug option can be set from 1 to 3. If a level isn't specified level 1 is the default.

    *

      Since the named daemon runs as the bind user the /var/log/query.log file must be created and the ownership changed:

      sudo touch /var/log/query.log
      sudo chown bind /var/log/query.log

    *

      Before named daemon can write to the new log file the AppArmor profile must be updated. First, edit /etc/apparmor.d/usr.sbin.named and add:

      /var/log/query.log w,

      Next, reload the profile:

      cat /etc/apparmor.d/usr.sbin.named | sudo apparmor_parser -r

      For more information on AppArmor see the section called “AppArmor”
    *

      Now restart BIND9 for the changes to take effect:

      sudo /etc/init.d/bind9 restart

You should see the file /var/log/query.log fill with query information. This is a simple example of the BIND9 logging options. For coverage of advanced options see the section called “More Information”.

===== References =====

**Common Record Types**

This section covers some of the most common DNS record types.

    *

      A record: This record maps an IP Address to a hostname.

      www      IN    A      192.168.1.12

    *

      CNAME record: Used to create an alias to an existing A record. You cannot create a CNAME record pointing to another CNAME record.

      web     IN    CNAME  www

    *

      MX record: Used to define where email should be sent to. Must point to an A record, not a CNAME.

              IN    MX  1   mail.example.com.
      mail    IN    A       192.168.1.13

    *

      NS record: Used to define which servers serve copies of a zone. It must point to an A record, not a CNAME. This is where Primary and Secondary servers are defined.

              IN    NS     ns.example.com.
      	IN    NS     ns2.example.com.
      ns      IN    A      192.168.1.10
      ns2	IN    A	     192.168.1.11
      

===== More Information =====

    *

      The DNS HOWTO explains more advanced options for configuring BIND9.
    *

      For in depth coverage of DNS and BIND9 see Bind9.net.
    *

      DNS and BIND is a popular book now in it's fifth edition.
    *

      A great place to ask for BIND9 assistance, and get involved with the Ubuntu Server community, is the #ubuntu-server IRC channel on freenode.
    *

      Also, see the BIND9 Server HOWTO in the Ubuntu Wiki.
UBUNTU в Воронежской области

Инструменты пользователя

Инструменты сайта

Инструменты страницы
