네임서버 설치 및 설정 그리고 named-checkconf 와 named-checkzone 으로 제대로 설정이 되었는지 검증에 대해서 알아보자.
# yum -y install bind bind-libs bind-utils bind-chroot
/etc/named.conf (options 부분 원본)
options {
listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; };
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
};
/etc/named.conf (options 부분 수정)
options {
version "Unknown";
allow-transfer { none; };
allow-recursion { localhost; };
allow-query-cache { localhost; };
//listen-on port 53 { 127.0.0.1; };
listen-on port 53 { any; };
//listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
//allow-query { localhost; };
allow-query { any; };
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
옵션 설정은 여기까지 완료되었다.
named 서비스를 동작시켜보자.
[root@conoha ~]# systemctl start named
[root@conoha ~]# systemctl enable named
Created symlink from /etc/systemd/system/multi-user.target.wants/named.service to /usr/lib/systemd/system/named.service.
에러가 없다면 다음으로 넘어가자.
zone 파일을 연결시켜주자.
아래와 같이 실행하여 /etc/named.rfc1912.zones 에 추가할 수도 있고 직접 추가해주어도 된다.
cat >>/etc/named.rfc1912.zones<<EOF
zone "example.com" IN {
type master;
file "example.com.zone";
allow-update { none; };
};
EOF
example.com 대신에 자신의 도메인 주소에 맞게 설정하여야 한다.
zone 파일을 생성해주자.
# vi /var/named/example.com.zone
$TTL 3H
@ IN SOA ns.example.com. root (
160509 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
IN NS ns.example.com.
IN A 123.123.123.123
ns IN A 123.123.123.123
www IN A 123.123.123.123
소유권을 변경해주자.
# chown root.named /var/named/example.com.zone
이번엔 제대로 되었는지 검증을 해볼 차례다.
named-checkconf 확인
[root@conoha ~]# named-checkconf -z /etc/named.conf
zone localhost.localdomain/IN: loaded serial 0
zone localhost/IN: loaded serial 0
zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 0
zone 1.0.0.127.in-addr.arpa/IN: loaded serial 0
zone 0.in-addr.arpa/IN: loaded serial 0
zone example.com/IN: loaded serial 160509
named-checkzone 확인
[root@conoha named]# named-checkzone ns.example.com /var/named/example.com.zone zone ns.example.com/IN: loaded serial 160509
OK
[root@conoha named]# named-checkzone www.example.com /var/named/example.com.zone
zone www.example.com/IN: loaded serial 160509
OK
이상이 없다면
# systemctl restart named
그리고 방화벽에서 53 포트를 열어주어야 한다.
댓글목록
등록된 댓글이 없습니다.