设计原则
在张家口地区的ECS优先读本地缓存（利用Dnsmasq）然后读张家口的dns最后读杭州的dns，同理在杭州的ECS相反，并且非张家口和杭州的如果需要读取到自建DNS服务的话。可以提供给张家口或者杭州的DNS 使得他们可以解析到default的view以提供访问。
所以后续在添加A记录的逻辑上是如果在张家口region添加一条A记录则对应只在张家口的dns的default的region上添加一条一样的A记录，同理，在杭州则相反。这样的话2边的default的区域是不同的A记录，更有利于其他第三方的客户端来解析域名。
实验环境
- 创建私网VPC
从最初设计开始在阿里云控制台选择：
专有网络 -》 创建专有网络 -》推荐网段选择 "10.0.0.0/8"
规划如下：
张家口可用区A 10.1.0.0/16
张家口可用区B 10.2.0.0/16
杭州可用区H 10.3.0.0/16
杭州可用区F 10.4.0.0/16
- 添加路由条目并创建高速通道
添加路由条目 10.3.0.0/16 10.4.0.0/16 为目标网段
专有网络 -》路由表 -》添加路由条目 -》下一跳类型 -》路由器接口（专有网络接方向）-》专有网络 -》创建VPC互联
选择本端地域（杭州），对端地域（张家口）选择带宽值，点击购买
- DNS服务器规划
DNS服务器地址：
10.1.0.100
10.2.0.100
10.3.0.100
10.4.0.100
通过IP（网段）来判断区域来最终实现解析到对应的记录值。
安装
本文通过编译安装，主要原因如下：
- CentOS7的repo里面的bind服务版本较低，有个别安全隐患。
- 后续需要通过bind_exporter进行监控的话需要libxml2。
- 目录结构优化
#!/usr/bin/env bash
yum install libxml2-devel python-ply -y
wget -c ftp://ftp.isc.org/isc/bind9/9.11.9/bind-9.11.9.tar.gz -O bind.tar.gz; tar xf bind.tar.gz
cd bind-9.11.9
./configure --prefix=/opt/soft/named --sbindir=/opt/soft/named/sbin/ --bindir=/opt/soft/named/bin/ CFLAGS="-g -fPIC" --enable-threads --with-openssl=yes --with-libjson=no --with-libxml2=yes
make && make install
# 文件目录自定义
## 配置文件目录包括区域配置文件，访问控制文件，加密通讯文件
mkdir -p /etc/named/{acls,conf,data,keys,managed_keys,logs}
## 数据目录
mkdir -p /var/named/{acls,data}
## 基础配置文件目录
mkdir -p /opt/soft/named/conf
## 启动命令
/usr/sbin/named -c /etc/named/named.conf -u named
## 请大家自行修改文件以适应现在的目录结构，本实验为了方便把所有文件都放在/etc/named/
/usr/lib/systemd/system/named.service
groupadd named -g 1000
useradd named -g named -u 1000
chown named.named /etc/named -R
chown named.named /var/named -R
chown named.named /opt/soft/named -R编辑所有配置文件
编辑主配置文件 vim /etc/named/named.conf
// For dns.sre.so
// 整个受控ip地址段
include "/var/named/acls/acl_sre_idc.conf";
// all keyssre
include "/etc/named/keys/transfer.key";
include "/opt/soft/named/etc/rndc.key";
controls {
inet 10.1.0.100 port 953
allow { 10.0.0.0/8; } keys { "rndc-key"; };
};
// 参数配置文件
include "/opt/soft/named/conf/options.conf";
// 引用所有的acl文件
include "/etc/named/conf/all_acls.conf";
// 日志配置文件
include "/opt/soft/named/etc/dns_logs.conf";
view "view_hangzhou-cloud"{
match-clients {
key key_sreso_hangzhou-cloud;
acl_hangzhou-cloud;
};
include "/etc/named/conf/hangzhou-cloud.conf";
};
view "view_zhangjiakou-cloud"{
match-clients {
key key_sreso_zhangjiakou-cloud;
acl_zhangjiakou-cloud;
};
include "/etc/named/conf/zhangjiakou-cloud.conf";
};
view "view_default"{
match-clients {
key key_sreso_default;
acl_default;
any;
};
include "/etc/named/conf/default.conf";
};编辑named服务参数文件
cat >> /opt/soft/named/conf/options.conf << EOF
options {
directory "/etc/named";
minimal-responses yes;
allow-recursion { idcnet; };
allow-query { idcnet; };
allow-transfer { 10.0.0.0/8;};
dnssec-enable yes;
dnssec-validation yes;
empty-zones-enable no;
notify yes;
managed-keys-directory "/etc/named/managed_keys";
};区域控制文件-张家口
cat >> /etc/named/acls/acl_zhangjiakou-cloud << EOF
acl acl_zhangjiakou-cloud {
10.1.0.0/16;
10.2.0.0/16;
!10.3.0.0/16;
!10.4.0.0/16;
!10.1.0.100/32;
!10.2.0.100/32;
!10.3.0.100/32;
!10.4.0.100/32;
};
EOF区域控制文件-杭州
cat >> /etc/named/acls/acl_hangzhou-cloud << EOF
acl acl_hangzhou-cloud {
10.3.0.0/16;
10.4.0.0/16;
!10.1.0.0/16;
!10.2.0.0/16;
!10.1.0.100/32;
!10.2.0.100/32;
!10.3.0.100/32;
!10.4.0.100/32;
};
EOF默认区域控制文件-default，该区域给其他第三方节点如果有请求需要的话，默认连到该DNS-view上面。通过控制第三方的dns下游服务器来选择是解析给张家口还是杭州。
cat >> /etc/named/acls/acl_default << EOF
acl acl_default {
!10.1.0.100/32;
!10.2.0.100/32;
!10.3.0.100/32;
!10.4.0.100/32;
};
EOF引用所有ACL配置文件
cat >> /etc/named/conf/all_acls.conf << EOF
include "/etc/named/acls/acl_hangzhou-cloud";
include "/etc/named/acls/acl_zhangjiakou-cloud";
include "/etc/named/acls/acl_default";
EOF编辑各区域配置文件
- 张家口区域
cat >> /etc/named/conf/zhangjiakou-cloud.conf << EOF
zone "." in {
type hint;
file "/etc/named/data/named.root";
};
zone "sre.so." in {
type master ;
allow-update { key key_sreso_zhangjiakou-cloud; };
file "/var/named/data/zone_sre.so_zhangjiakou-cloud";
};
EOF- 第三方区域
cat >> /etc/named/conf/default.conf << EOF
zone "." in {
type hint;
file "/etc/named/data/named.root";
};
zone "sre.so." in {
type master ;
allow-update { key key_sreso_default; };
file "/var/named/data/zone_sre.so_default";
};
EOF- 杭州区域
cat >> /etc/named/conf/hangzhou-cloud.conf <<EOF
zone "." in {
type hint;
file "/etc/named/data/named.root";
};
zone "sre.so." in {
type master ;
allow-update { key key_sreso_hangzhou-cloud; };
file "/var/named/data/zone_sre.so_hangzhou-cloud";
};
EOF- 配置基础数据 基础域名sre.so
cat >> /var/named/data/zone_sre.so << EOF
sre.so. 600 IN SOA sre.so. root.sre.so. 2019012805 28800 14400 3600000 86400
sre.so. 600 IN NS ns1.sre.so.
ns1.sre.so. 600 IN A 10.1.0.100
EOF
cat >> /var/named/data/zone_sre.so_default << EOF
\$INCLUDE /var/named/data/zone_sre.so
EOF
cat >> /var/named/data/zone_sre.so_zhangjiekou-cloud << EOF
\$INCLUDE /var/named/data/zone_sre.so
EOF
cat >> /var/named/data/zone_sre.so_hangzhou-cloud << EOF
\$INCLUDE /var/named/data/zone_sre.so
EOF定义允许通过named解析的ip范围
cat >> /var/named/acls/acl_sre_idc.conf << EOF
acl idcnet {
127.0.0.1/32;
10.0.0.0/8;
100.64.0.0/10;
};
EOF关于named.root
配置根服务器地址以及自定义区域数据文件
named.root为namd服务定义了一个根域，它是一个非常重要的文件，包含了Internet根服务器的名字和IP地址。当Bind接到客户端的查询请求时，如果本地不能解析，也不能在Cache中找到相应的数据，就会通过根服务器进行逐级查询。由于Internet根服务器的地址经常会发生变化，因此named.root也应该要随之更新。
根服务器列表可以从named.root下载，文件名也是named.root，它包含了国际互联网络信息中心（InterNIC）提供的数据。
wget ftp://ftp.rs.internic.net/domain/named.root -O /etc/named/data/named.root配置加密文件
mkdir -p /etc/named/keys/keys
cd /etc/named/keys/keys
/opt/soft/named/sbin/dnssec-keygen -a hmac-md5 -b 512 -n HOST key_sreso_hangzhou-cloud
/opt/soft/named/sbin/dnssec-keygen -a hmac-md5 -b 512 -n HOST key_sreso_zhangjiakou-cloud
/opt/soft/named/sbin/dnssec-keygen -a hmac-md5 -b 512 -n HOST key_sreso_default
-rw------- 1 named named 126 Sep 16 12:06 Kkey_sreso_default.+157+19049.key
-rw------- 1 named named 229 Sep 16 12:06 Kkey_sreso_default.+157+19049.private
-rw------- 1 named named 133 Sep 16 12:05 Kkey_sreso_hangzhou-cloud.+157+57601.key
-rw------- 1 named named 229 Sep 16 12:05 Kkey_sreso_hangzhou-cloud.+157+57601.private
-rw------- 1 named named 136 Sep 16 12:12 Kkey_sreso_zhangjiakou-cloud.+157+34623.key
-rw------- 1 named named 229 Sep 16 12:12 Kkey_sreso_zhangjiakou-cloud.+157+34623.private
编辑key配置文件 transfer.key
将生成的 .key文件里的加密串 添加到transfer.key的secret字段内。
cat *.key|awk '{print $1,$7$8}'
sreso_default. pmQxnGDDZofmZvL99m98XW15XEmo4BXpMxmJ+ofHwR+4tZYTSCki9lSBtocG4WAxSMHdA4+sZQJ9OJK2gZl4lw==
sreso_hangzhou-cloud. bhfhzRSQ7/zm7QfEUCWL/Dz0seOikzO9hEPfkAFExvof3y3NrHgYp3tA9aSBHeubo/6DmrN7JYbCviJLaKzGQQ==
sreso_zhangjiakou-cloud. Hptbq3F+4/QJtXhgh781Wdjw/piAiQco+x6gogkKCRPQCTcizhcEwdJqnU+2J2MzMhNYaGszx1sYxA5WI55/8w==
cat >> /etc/named/keys/transfer.key << EOF
key "key_sreso_zhangjiakou-cloud" {
algorithm hmac-md5;
secret "mspmOPCmYFQuDWJYoauzIT8rPXCP+RTUHW0sDwM++IzLt/syidjSrQ5SjsOqeO+LJNGKhR3g+hO7FDzN04b2gQ==";
};
key "key_sreso_hangzhou-cloud" {
algorithm hmac-md5;
secret "mu+qLSESeR4AHbFdEiUs73xx1ODWeb9WzhfcNPSO0r/8OqTTNrnahHpe/4peySKMbhnJCnqsZxAzPjiVOPNHlg==";
};
key "key_sreso_default" {
algorithm hmac-md5;
secret "rkUWa/RQB+Rnil5kWvP/vBMEmEETx3NPmuuxSWbWLHsCp+fI93HqMdpqIm/zSKcvNsts1NYsnzulNW7nqyIVtg==";
};
EOF编辑rndc配置文件
rndc的作用只在服务器本地，并且服务器系统防火墙必须开放953端口。rndc主要用来重新加载named.conf文件，一般更改主配置文件或者正逆向文件后需要重启named服务，现在可以使用rndc reload命令来重新加载配置文件，而无需再重启named服务。
/opt/soft/named/sbin/rndc-confgen > /opt/soft/named/etc/rndc.key
#删除里面
options {
default-key "rndc-key";
default-server 127.0.0.1;
default-port 953;
};
内容
由named.conf里面如下配置进行控制
controls {
inet 10.1.0.100 port 953
allow { 10.0.0.0/8; } keys { "rndc-key"; };
};特别注意该文件必须是640且被进程owner只读
日志配置文件详解可参照 (https://kb.isc.org/docs/aa-01526)
#相关的日志配置文件
cat >> /opt/soft/named/etc/dns_logs.conf << EOF
logging {
channel "named_log" {
file "/etc/named/logs/named.log"
versions 3 size 30M;
print-category yes;
print-time yes;
severity info;
};
channel "client_log" {
file "/etc/named/logs/client.log"
versions 3 size 20M;
print-category yes;
print-time yes;
severity info;
};
channel "update_log" {
file "/etc/named/logs/update.log"
versions 5 size 1G;
print-category yes;
print-time yes;
severity info;
};
category default {named_log;};
category queries {client_log;};
category client {client_log;};
category update {update_log;};
};
EOF编辑启动文件
vim /etc/rc.d/init.d/named
#!/bin/sh
#
# Startup script for the DNS naming server
#
# chkconfig: - 49 50
# description: This script starts your DNS naming server
# processname: named
# Source function library.
. /etc/rc.d/init.d/functions
# Check that networking is up.
[ ${NETWORKING} = "no" ] && exit 0
named=/opt/soft/named/sbin/named
[ -f $named ] || exit 0
OPTIONS="-c /etc/named/named.conf -u named"
RETVAL=0
# See how we were called.
case "$1" in
start)
if [ $UID -ne 0 ] ; then
echo "User has insufficient privilege."
exit 4
fi
echo -n "Starting named: "
daemon $named $OPTIONS
RETVAL=$?
echo
[ $RETVAL -eq 0 ]
;;
stop)
if test "x`pgrep named`" != x; then
echo -n "Shutting down named: "
killproc named
fi
RETVAL=$?
echo
[ $RETVAL -eq 0 ]
;;
status)
/opt/soft/named/sbin/rndc -k /opt/soft/named/etc/rndc.key status
RETVAL=$?
;;
reload)
if test "x`pgrep named`" != x; then
echo -n "Reloading named: "
killproc named -HUP
fi
RETVAL=$?
echo
;;
restart)
$0 stop
$0 start
RETVAL=$?
;;
*)
echo "Usage: $0 {start|stop|restart|reload|status}"
exit 2
esac
exit $RETVAL
EOFQ&A
如何调试named
/opt/soft/named/sbin/named -c /etc/named/named.conf -g -d 3如何添加自启动
chkconfig --add named
chkconfig named on
service named start
systemctl status named验证
dig ns1.sre.so @10.1.0.100
; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> ns1.sre.so @10.1.0.100
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 44432
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;ns1.sre.so. IN A
;; Query time: 0 msec
;; SERVER: 10.1.0.100#53(10.1.0.100)
;; WHEN: Thu Sep 12 15:15:12 CST 2019
;; MSG SIZE rcvd: 39