內(nèi)網(wǎng)主從智能 DNS 從此不再煩惱
文末本文轉(zhuǎn)載自微信公眾號「運維開發(fā)故事」,作者小姜。轉(zhuǎn)載本文請聯(lián)系運維開發(fā)故事公眾號。
大家好,我是小姜。
寫在前面
隨著云原生時代的快速發(fā)展,各行各業(yè)紛紛進(jìn)軍k8s,短短兩三年,招聘上面就要求“至少有一年k8s實戰(zhàn)經(jīng)驗”。以至于好多傳統(tǒng)的、行業(yè)初期用的人非常多的一些技術(shù)被飛快的甩在后頭。亦或者說技術(shù)更新迭代層出不窮,老技術(shù)會被很快代替,新技術(shù)會備受寵愛。而在域名解析領(lǐng)域,大家最熟悉的常用的云解析DNSPod、Godaddy、CloudFlare、阿里云的域名解析等,當(dāng)然還有dnsmasq、powerdns以及在k8s中用的coreDNS。但是今天我這里就聊聊bind9。
可能目前的中小型公司都不會使用bind9,而且網(wǎng)上你去搜索,大多都是直接使用named服務(wù),不會使用named-chroot。而且更少的是使用acl+view的。要么排版不夠好,新手可能看懵逼,配置錯誤。要么就是沒有說的很詳細(xì)的。當(dāng)然也有,可能我沒有好好花時間搜索或者搜索能力有限。這里我就記錄一下bind9使用chroot以及使用acl+view試圖實現(xiàn)智能DNS過程。
環(huán)境說明
CentOS Linux release 8.4.2105
BIND Version:9.11.26
總網(wǎng)段:172.16.128.0/17
bind9主從所在網(wǎng)段:172.16.0.0/24
Host
IP
Role
named-srv1
172.16.0.55
named master
named-srv2
172.16.0.56
named slave
bind9 master節(jié)點部署
- /bin/chattr -i /etc/fstab /etc/passwd /etc/group /etc/shadow /etc/sudoers /etc/services
- dnf -y install bind-chroot bind-utils
- # 我要啟用chroot,并且需要更改named的目錄到/data/named/chroot
- # 因此需要拷貝文件
- mkdir -p /data/named
- cp -ar /var/named/* /data/named/
- # 創(chuàng)建存放日志的目錄
- mkdir -p /data/named/chroot/data/log/named/
- ### 在bind chroot 的目錄中創(chuàng)建相關(guān)文件
- touch /data/named/chroot/var/named/data/cache_dump.db
- touch /data/named/chroot/var/named/data/named_stats.txt
- touch /data/named/chroot/var/named/data/named_mem_stats.txt
- touch /data/named/chroot/var/named/data/named.run
- mkdir /data/named/chroot/var/named/dynamic
- touch /data/named/chroot/var/named/dynamic/managed-keys.bind
- # 到linux系統(tǒng)的/data/目錄下,更改named目錄的屬主和數(shù)組為named
- cd /data/
- chown named.named -R named
編輯主named.conf文件
- $ cat /data/named/chroot/etc/named.conf
- acl telecom {
- 172.17.10.0/24;
- };
- acl unicom {
- 172.17.20.0/24;
- };
- acl mobile {
- 172.17.30.0/24;
- };
- options {
- listen-on port 53 { 127.0.0.1; 172.16.0.55;};
- directory "/var/named";
- dump-file "/data/named/data/cache_dump.db";
- statistics-file "/data/named/data/named_stats.txt";
- memstatistics-file "/data/named/data/named_mem_stats.txt";
- // 允許查詢的主機(jī);白名單
- allow-query { any; };
- allow-query-cache { any; };
- // 我這里買的是阿里云的ECS服務(wù)器,因此這里使用阿里的DNS
- forwarders { 223.5.5.5; 223.6.6.6; };
- recursive-clients 200000;
- check-names master warn;
- max-cache-ttl 60;
- max-ncache-ttl 0;
- //recursion yes;
- //dnssec-enable yes;
- //dnssec-validation yes;
- //managed-keys-directory "/var/named/dynamic";
- pid-file "/run/named/named.pid";
- //session-keyfile "/run/named/session.key";
- };
- logging {
- channel query_log {
- file "/data/log/named/query.log" versions 10 size 300m;
- severity info;
- print-category yes;
- print-time yes;
- print-severity yes;
- };
- channel client_log {
- file "/data/log/named/client.log" versions 3 size 200m;
- severity info;
- print-category yes;
- print-time yes;
- print-severity yes;
- };
- channel config {
- file "/data/log/named/config.log" versions 3 size 100m;
- severity info;
- print-category yes;
- print-time yes;
- print-severity yes;
- };
- channel default_log {
- file "/data/log/named/default.log" versions 3 size 100m;
- severity debug;
- print-category yes;
- print-time yes;
- print-severity yes;
- };
- channel general_log {
- file "/data/log/named/general.log" versions 3 size 200m;
- severity debug;
- print-category yes;
- print-time yes;
- print-severity yes;
- };
- category queries {
- query_log;
- };
- category client {
- client_log;
- };
- category general {
- general_log;
- };
- category config {
- config;
- };
- category default {
- default_log;
- };
- };
- view telcom_view {
- match-clients { telcom; };
- match-destinations { any; };
- recursion yes;
- include "/etc/named-telcome.zones";
- };
- view unicom_view {
- match-clients { unicom; };
- match-destinations { any; };
- recursion yes;
- include "/etc/named-unicome.zones";
- };
- view mobile_view {
- match-clients { any; };
- match-destinations { any; };
- recursion yes;
- include "/etc/named-mobile.zones";
- };
注意:需要提醒大家的是:第一,啟用了named-chroot服務(wù)以后,就必須關(guān)閉named服務(wù),兩者取其一。第二,如果啟用了named-chroot,那么目錄就都是相對目錄,都是相對于/var/named/chroot而言的。
使用acl+view
上面已經(jīng)定義好了三個acl和三個view。一般來說我們的acl都會放在最開頭,也就是options的前面,也建議這樣放。
接下來就需要生成三個view下面的include包含進(jìn)來的區(qū)域文件了。這里只演示正向解析區(qū)域,一般內(nèi)網(wǎng)bind9很少需要反向解析。
生成區(qū)域文件
- $ vi /var/named/chroot/etc/named-telcome.zones
- zone "ayunw.cn" IN {
- type master;
- file "ayunw.cn.zone";
- allow-update { none; };
- masterfile-format text;
- allow-transfer { 172.16.0.56; };
- };
- $ vi /var/named/chroot/etc/named-unicom.zones
- zone "iyunw.cn" IN {
- type master;
- file "iyunw.cn.zone";
- allow-update { none; };
- masterfile-format text;
- allow-transfer { 172.16.0.56; };
- };
- $ vi /var/named/chroot/etc/named-mobile.zones
- zone "allenjol.cn" IN {
- type master;
- file "allenjol.cn.zone";
- allow-update { none; };
- masterfile-format text;
- allow-transfer { 172.16.0.56; };
- };
生成區(qū)域解析庫文件
- $ cd /var/named/chroot/var
- $ vi ayunw.cn.zone
- $TTL 86400
- @ IN SOA ayunw.cn. root.iyunw.cn. (
- 202111011 ; serial (d. adams)
- 1H ; refresh
- 15M ; retry
- 1W ; expiry
- 1D ) ; minimum
- IN NS ns1.ayunw.cn.
- IN NS ns2.ayunw.cn.
- ns1 IN A 172.16.0.55
- ns2 IN A 172.16.0.56
- www IN A 172.16.0.58
- $ vi iyunw.cn.zone
- $TTL 86400
- @ IN SOA iyunw.cn. root.iyunw.cn. (
- 202111011 ; serial (d. adams)
- 1H ; refresh
- 15M ; retry
- 1W ; expiry
- 1D ) ; minimum
- IN NS ns1.iyunw.cn.
- IN NS ns2.iyunw.cn.
- ns1 IN A 172.16.0.55
- ns2 IN A 172.16.0.56
- web IN A 172.16.0.59
- $ vi allenjol.cn.zone
- $TTL 86400
- @ IN SOA allenjol.cn. root.allenjol.cn. (
- 202111011 ; serial (d. adams)
- 1H ; refresh
- 15M ; retry
- 1W ; expiry
- 1D ) ; minimum
- IN NS ns1.allenjol.cn.
- IN NS ns2.allenjol.cn.
- ns1 IN A 172.16.0.55
- ns2 IN A 172.16.0.56
- allen IN A 172.16.0.60
啟動服務(wù)并設(shè)置開機(jī)自啟
- /usr/libexec/setup-named-chroot.sh /var/named/chroot on
- systemctl stop named
- systemctl disable named
- systemctl start named-chroot
- systemctl enable named-chroot
bind9 slave節(jié)點部署
- /bin/chattr -i /etc/fstab /etc/passwd /etc/group /etc/shadow /etc/sudoers /etc/services
- dnf -y install bind-chroot bind-utils
- # 我要啟用chroot,并且需要更改named的目錄到/data/named/chroot
- # 因此需要拷貝文件
- mkdir -p /data/named
- cp -ar /var/named/* /data/named/
- # 創(chuàng)建存放日志的目錄
- mkdir -p /data/named/chroot/data/log/named/
- ### 在bind chroot 的目錄中創(chuàng)建相關(guān)文件
- touch /data/named/chroot/var/named/data/cache_dump.db
- touch /data/named/chroot/var/named/data/named_stats.txt
- touch /data/named/chroot/var/named/data/named_mem_stats.txt
- touch /data/named/chroot/var/named/data/named.run
- mkdir /data/named/chroot/var/named/dynamic
- touch /data/named/chroot/var/named/dynamic/managed-keys.bind
- # 到linux系統(tǒng)的/data/目錄下,更改named目錄的屬主和數(shù)組為named
- cd /data/
- chown named.named -R named
編輯從named.conf文件
- $ cat /data/named/chroot/etc/named.conf
- $ cat /data/named/chroot/etc/named.conf
- acl telecom {
- 172.17.10.0/24;
- };
- acl unicom {
- 172.17.20.0/24;
- };
- acl mobile {
- 172.17.30.0/24;
- };
- options {
- listen-on port 53 { 127.0.0.1; 172.16.0.55;};
- directory "/var/named";
- dump-file "/data/named/data/cache_dump.db";
- statistics-file "/data/named/data/named_stats.txt";
- memstatistics-file "/data/named/data/named_mem_stats.txt";
- // 允許查詢的主機(jī);白名單
- allow-query { any; };
- allow-query-cache { any; };
- // 我這里買的是阿里云的ECS服務(wù)器,因此這里使用阿里的DNS
- forwarders { 223.5.5.5; 223.6.6.6; };
- recursive-clients 200000;
- check-names master warn;
- max-cache-ttl 60;
- max-ncache-ttl 0;
- //recursion yes;
- //dnssec-enable yes;
- //dnssec-validation yes;
- //managed-keys-directory "/var/named/dynamic";
- pid-file "/run/named/named.pid";
- //session-keyfile "/run/named/session.key";
- };
- logging {
- channel query_log {
- file "/data/log/named/query.log" versions 10 size 300m;
- severity info;
- print-category yes;
- print-time yes;
- print-severity yes;
- };
- channel client_log {
- file "/data/log/named/client.log" versions 3 size 200m;
- severity info;
- print-category yes;
- print-time yes;
- print-severity yes;
- };
- channel config {
- file "/data/log/named/config.log" versions 3 size 100m;
- severity info;
- print-category yes;
- print-time yes;
- print-severity yes;
- };
- channel default_log {
- file "/data/log/named/default.log" versions 3 size 100m;
- severity debug;
- print-category yes;
- print-time yes;
- print-severity yes;
- };
- channel general_log {
- file "/data/log/named/general.log" versions 3 size 200m;
- severity debug;
- print-category yes;
- print-time yes;
- print-severity yes;
- };
- category queries {
- query_log;
- };
- category client {
- client_log;
- };
- category general {
- general_log;
- };
- category config {
- config;
- };
- category default {
- default_log;
- };
- };
- view telcom_view {
- match-clients { telcom; };
- match-destinations { any };
- recursion yes;
- include "/etc/named-telcome.zones";
- };
- view unicom_view {
- match-clients { unicom; };
- match-destinations { any; };
- recursion yes;
- include "/etc/named-unicome.zones";
- };
- view mobile_view {
- match-clients { any; };
- match-destinations { any; };
- recursion yes;
- include "/etc/named-mobile.zones";
- };
生成區(qū)域文件
- $ vi /var/named/chroot/etc/named-telcome.zones
- zone "ayunw.cn" IN {
- type master;
- file "ayunw.cn.zone";
- allow-update { none; };
- masterfile-format text;
- allow-transfer { 172.16.0.56; };
- };
- $ vi /var/named/chroot/etc/named-unicom.zones
- zone "iyunw.cn" IN {
- type master;
- file "iyunw.cn.zone";
- allow-update { none; };
- masterfile-format text;
- allow-transfer { 172.16.0.56; };
- };
- $ vi /var/named/chroot/etc/named-mobile.zones
- zone "allenjol.cn" IN {
- type master;
- file "allenjol.cn.zone";
- allow-update { none; };
- masterfile-format text;
- allow-transfer { 172.16.0.56; };
- };
啟動服務(wù)并設(shè)置開機(jī)自啟
- /usr/libexec/setup-named-chroot.sh /var/named/chroot on
- systemctl stop named
- systemctl disable named
- systemctl start named-chroot
- systemctl enable named-chroot
注意:從節(jié)點無需創(chuàng)建區(qū)域解析庫文件,當(dāng)主節(jié)點重啟named-chroot服務(wù)的時候會自動同步解析庫文件到從節(jié)點
測試解析
找了三臺機(jī)器,內(nèi)網(wǎng)ip分別為:172.16.10.1、172.16.20.1、172.16.30.1,分別解析www.ayunw.cn、web.iyunw.cn以及allen.allenjol.cn,都是能正常解析的。
- $ dig -t A www.ayunw.cn
- ; <<>> DiG 9.11.26-RedHat-9.11.26-4.el8_4 <<>> -t A allen.ptcloud.t.home
- ;; global options: +cmd
- ;; Got answer:
- ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40756
- ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
- ;; OPT PSEUDOSECTION:
- ; EDNS: version: 0, flags:; udp: 1232
- ; COOKIE: e48c8996a6469b8d51d96afb61775ef045fa019e7ef2c4d6 (good)
- ;; QUESTION SECTION:
- ;www.ayunw.cn. IN A
- ;; ANSWER SECTION:
- www.ayunw.cn. 86400 IN A 172.16.0.58
- ;; AUTHORITY SECTION:
- ayunw.cn. 86400 IN NS ns2.ayunw.cn.
- ayunw.cn. 86400 IN NS ns1.ayunw.cn.
- ;; ADDITIONAL SECTION:
- ns1.ayunw.cn. 86400 IN A 172.16.0.55
- ns2.ayunw.cn. 86400 IN A 172.16.0.56
- ;; Query time: 0 msec
- ;; SERVER: 172.16.0.55#53(172.16.0.55)
- ;; WHEN: Tue Oct 26 09:50:40 CST 2021
- ;; MSG SIZE rcvd: 161
- $ dig -t A web.iyunw.cn
- ; <<>> DiG 9.11.26-RedHat-9.11.26-4.el8_4 <<>> -t A allen.ptcloud.t.home
- ;; global options: +cmd
- ;; Got answer:
- ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40756
- ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
- ;; OPT PSEUDOSECTION:
- ; EDNS: version: 0, flags:; udp: 1232
- ; COOKIE: e48c8996a6469b8d51d96afb61775ef045fa019e7ef2c4d6 (good)
- ;; QUESTION SECTION:
- ;web.iyunw.cn. IN A
- ;; ANSWER SECTION:
- web.iyunw.cn. 86400 IN A 172.16.0.59
- ;; AUTHORITY SECTION:
- iyunw.cn. 86400 IN NS ns2.iyunw.cn.
- iyunw.cn. 86400 IN NS ns1.iyunw.cn.
- ;; ADDITIONAL SECTION:
- ns1.iyunw.cn. 86400 IN A 172.16.0.55
- ns2.iyunw.cn. 86400 IN A 172.16.0.56
- ;; Query time: 0 msec
- ;; SERVER: 172.16.0.55#53(172.16.0.55)
- ;; WHEN: Tue Oct 26 09:50:40 CST 2021
- ;; MSG SIZE rcvd: 161
- $ dig -t A allen.allenjol.cn
- ; <<>> DiG 9.11.26-RedHat-9.11.26-4.el8_4 <<>> -t A allen.ptcloud.t.home
- ;; global options: +cmd
- ;; Got answer:
- ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40756
- ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
- ;; OPT PSEUDOSECTION:
- ; EDNS: version: 0, flags:; udp: 1232
- ; COOKIE: e48c8996a6469b8d51d96afb61775ef045fa019e7ef2c4d6 (good)
- ;; QUESTION SECTION:
- ;allen.allenjol.cn. IN A
- ;; ANSWER SECTION:
- allen.allenjol.cn. 86400 IN A 172.16.0.60
- ;; AUTHORITY SECTION:
- allenjol.cn. 86400 IN NS ns2.allenjol.cn.
- allenjol.cn. 86400 IN NS ns1.allenjol.cn.
- ;; ADDITIONAL SECTION:
- ns1.allenjol.cn. 86400 IN A 172.16.0.55
- ns2.allenjol.cn. 86400 IN A 172.16.0.56
- ;; Query time: 0 msec
- ;; SERVER: 172.16.0.55#53(172.16.0.55)
- ;; WHEN: Tue Oct 26 09:50:40 CST 2021
- ;; MSG SIZE rcvd: 161
如果你有足夠的機(jī)器,那么你換一臺不在172.16.10.0/24、172.16.20.0/24、172.16.30.0/24這三個網(wǎng)段的機(jī)器,然后去任意解析 這三個zone文件中的域名,你會發(fā)現(xiàn)最終都是沒有正常的A記錄返回的。
或者如果你用172.16.10.1去解析web.iyunw.cn或者是allen.allenjol.cn,那么就無法正常解析了。這就是acl+view實現(xiàn)的智能DNS的效果。