上一篇blog简单写了一下使用nsupdate动态更新DNS记录。今天再写一下在多个view的时候如何设置主备的自动同步。多个view的主备同步主要是是主备之间每个view都使用共享key进行消息的签名。master的配置和之前的稍微有点小的改动
include "/opt/bind/etc/rndc.key";
include "/opt/bind/etc/views.key";
//
controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1;
} keys { "rndc-key";
};
};
//
acl test1 {
10.201.0.0/16;
};
acl test2 {
192.0.0.0/8;
};
acl slavedns {
10.144.149.61;
127.0.0.1;
};
options {
listen-on port 53 { any;
};
listen-on-v6 { none;
};
directory "/opt/bind/etc/";
dump-file "/opt/bind/var/named/data/cache_dump.db";
statistics-file "/opt/bind/var/named/data/named_stats.txt";
memstatistics-file "/opt/bind/var/named/data/named_mem_stats.txt";
zone-statistics yes; allow-query { any; };
recursion config
recursion yes; max-ncache-ttl 60; recursive-clients 2000;
dnssec config
dnssec-enable yes; dnssec-validation yes; dnssec-lookaside auto;
rrt config
rate-limit { responses-per-second 20; qps-scale 1000; window 4; slip 2; ipv4-prefix-length 32; };
rpz config
response-policy { zone “rpz.zone” policy given; };
log query
querylog yes; #define version version “GNUer’s dns 2.0”;
transfer config
notify explicit; tcp-clients 2000; transfers-out 100; allow-transfer { slavedns; 127.0.0.1;}; also-notify { 10.144.149.61; }; /* Path to ISC DLV key */
#bindkeys-file "/opt/bind/etc/named.iscdlv.key";
};
logging {
channel default_syslog { file "/opt/bind/var/log/named.syslog" versions 5 size 100m;
severity dynamic;
print-time yes;
};
channel default_debug { file "/opt/bind/var/log/named.run" versions 5 size 100m;
severity dynamic;
print-time yes;
};
channel default_stderr { stderr;
severity info;
};
channel null { null; };
channel general_debug { file "/opt/bind/var/log/named.general" versions 3 size 100m;
severity dynamic;
print-time yes;
};
channel database_debug { file "/opt/bind/var/log/named.database" versions 3 size 100m;
severity dynamic;
print-time yes;
};
channel query_log { file "/opt/bind/var/log/named.query" versions 3 size 100m;
severity dynamic;
print-time yes;
print-severity yes;
print-category yes;
};
channel resolver_log { file "/opt/bind/var/log/named.resolver" versions 3 size 100m;
severity dynamic;
print-time yes;
};
channel security_log { file "/opt/bind/var/log/named.security" versions 3 size 100m;
severity dynamic;
print-time yes;
};
channel notify_log { file "/opt/bind/var/log/named.notify" versions 3 size 100m;
severity dynamic;
print-time yes;
};
channel rrt_log { file "/opt/bind/var/log/named.rrt" versions 3 size 100m;
severity dynamic;
print-time yes;
};
channel rpz_log { file "/opt/bind/var/log/named.rpz" versions 3 size 100m;
severity dynamic;
print-time yes;
};
category default {null; }; category queries { query_log; }; category resolver { resolver_log; }; category security { security_log; }; category notify { notify_log; }; category xfer-in { notify_log; }; category xfer-out { notify_log; }; category update { notify_log; }; category unmatched {default_syslog; }; category rate-limit {rrt_log;}; category rpz {rpz_log;}; }; view “test1” { recursion yes; allow-query { any; }; match-clients {test1; key test1;}; allow-update { key test1; }; server 10.144.149.61 {keys test1;}; // also-notify { 10.144.149.61; }; zone “test.org” { type master; file “master/test.org.view1”; }; zone “rpz.zone” { type master; file “master/rpz.zone”; allow-update {none;}; }; zone “.”{ type hint; file “named.root”; }; };
view “test2” { recursion yes; allow-query { any; }; server 10.144.149.61 {keys test2;}; match-clients {test2; key test2;}; allow-update { key test2; }; // also-notify { 10.144.149.61; }; zone “test.org” { type master; file “master/test.org.view2”; }; zone “rpz.zone” { type master; file “master/rpz.zone”; allow-update {none;}; }; zone “.”{ type hint; file “named.root”; }; }; view “default” { recursion yes; allow-query { any; }; server 10.144.149.61 {keys default;}; match-clients {any;key default; }; allow-update { key default; }; // also-notify { 10.144.149.61; }; zone “test.org” { type master; file “master/test.org.default”; }; zone “rpz.zone” { type master; file “master/rpz.zone”; allow-update {none;}; }; zone “.”{ type hint; file “named.root”; }; };
master中的注意事项是：1. also-notify 可以不用每个view都写一遍，在options里把slave都写全也行（也得跟进实际的安全需求来）2. 每个view内用allow-update设置只允许响应的key进行更新。3. 需要使用server来指定和对端机器通信的共享密钥。
slave的配置
include “/opt/bind/etc/rndc.key”; include “/opt/bind/etc/views.key”; // controls { inet 127.0.0.1 port 953 allow { 127.0.0.1; } keys { “rndc-key”; }; }; // acl test1 { 10.161.65.8; }; acl test2 { 192.0.0.0/8; };
options { listen-on port 53 { any; }; listen-on-v6 { none; }; directory “/opt/bind/etc/”;
dump-file "/opt/bind/var/named/data/cache_dump.db";
statistics-file "/opt/bind/var/named/data/named_stats.txt";
memstatistics-file "/opt/bind/var/named/data/named_mem_stats.txt";
masterfile-format text; zone-statistics yes; allow-query { any; };
recursion config
recursion yes; max-ncache-ttl 60; recursive-clients 2000;
dnssec config
dnssec-enable yes; dnssec-validation yes; dnssec-lookaside auto;
rrt config
rate-limit { responses-per-second 20; qps-scale 1000; window 4; slip 2; ipv4-prefix-length 32; };
rpz config
response-policy { zone “rpz.zone” policy given; };
log query
querylog yes; #define version version “GNUer’s dns 2.0”;
transfer config
notify explicit; tcp-clients 2000; transfers-out 100;
/* Path to ISC DLV key */
#bindkeys-file "/opt/bind/etc/named.iscdlv.key";
};
logging {
channel default_syslog { file "/opt/bind/var/log/named.syslog" versions 5 size 100m;
severity dynamic;
print-time yes;
};
channel default_debug { file "/opt/bind/var/log/named.run" versions 5 size 100m;
severity dynamic;
print-time yes;
};
channel default_stderr { stderr;
severity info;
};
channel null { null; };
channel general_debug { file "/opt/bind/var/log/named.general" versions 3 size 100m;
severity dynamic;
print-time yes;
};
channel database_debug { file "/opt/bind/var/log/named.database" versions 3 size 100m;
severity dynamic;
print-time yes;
};
channel query_log { file "/opt/bind/var/log/named.query" versions 3 size 100m;
severity dynamic;
print-time yes;
print-severity yes;
print-category yes;
};
channel resolver_log { file "/opt/bind/var/log/named.resolver" versions 3 size 100m;
severity dynamic;
print-time yes;
};
channel security_log { file "/opt/bind/var/log/named.security" versions 3 size 100m;
severity dynamic;
print-time yes;
};
channel notify_log { file "/opt/bind/var/log/named.notify" versions 3 size 100m;
severity dynamic;
print-time yes;
};
channel rrt_log { file "/opt/bind/var/log/named.rrt" versions 3 size 100m;
severity dynamic;
print-time yes;
};
channel rpz_log { file "/opt/bind/var/log/named.rpz" versions 3 size 100m;
severity dynamic;
print-time yes;
};
category default {null; }; category queries { query_log; }; category resolver { resolver_log; }; category security { security_log; }; category notify { notify_log; }; category xfer-in { notify_log; }; category xfer-out { notify_log; }; category update { notify_log; }; category unmatched {default_syslog; }; category rate-limit {rrt_log;}; category rpz {rpz_log;}; }; view “test1” { recursion yes; server 10.161.64.97 {keys test1; }; allow-query { any; }; match-clients {test1; key test1;}; allow-update { key test1; }; zone “test.org” { type slave; file “master/test.org.view1”; masters { 10.161.64.97; } ; }; zone “rpz.zone” { type master; file “master/rpz.zone”; allow-update {none;}; }; zone “.”{ type hint; file “named.root”; }; };
view “test2” { recursion yes; allow-query { any; }; match-clients {test2; key test2;}; server 10.161.64.97 {keys test2; }; allow-update { key test2; }; zone “test.org” { type slave; file “master/test.org.view2”; masters { 10.161.64.97; } ; }; zone “rpz.zone” { type master; file “master/rpz.zone”; allow-update {none;}; }; zone “.”{ type hint; file “named.root”; }; }; view “default” { recursion yes; allow-query { any; }; server 10.161.64.97 {keys default; }; match-clients {any;key default; }; allow-update { key default; }; zone “test.org” { type slave; file “master/test.org.default”; masters { 10.161.64.97; } ; }; zone “rpz.zone” { type master; file “master/rpz.zone”; allow-update {none;}; }; zone “.”{ type hint; file “named.root”; }; };
slave的配置注意项也是每个view要使用server定义master通信时使用的key，然后限制特定的key才能更新。另外需要注意的是slave和master的IP不要在任何的acl里。