CentOS 6.5 BIND DNS 服務器從零構建：配置腳本、區域檔案與驗證實戰

實驗環境與拓撲

完整配置腳本化部署

1. 安裝 BIND 套件

yum list bind*
yum install bind bind-utils bind-libs
# 驗證安裝
rpm -qa bind*
# 輸出：bind-utils-9.8.2..., bind-libs-9.8.2..., bind-9.8.2...

2. 備份並重寫主配置 /etc/named.conf

mv /etc/named.conf /etc/named.conf.ori
cat > /etc/named.conf <<'EOF'
options {
    directory "/var/named";
};

zone "." IN {
    type hint;
    file "named.ca";
};

zone "localhost" IN {
    type master;
    file "localhost.zone";
};

zone "0.0.127.in-addr.arpa" IN {
    type master;
    file "named.local";
};

zone "stephenzhou.net" IN {
    type master;
    file "stephenzhou.net.zone";
};
EOF

# 修正配置檔屬組（named 進程以 named 用戶/群組運行）
chown :named /etc/named.conf

3. 更新根提示檔 named.ca

cd /var/named
mv named.ca named.ca.ori
dig -t NS . > named.ca
chown :named named.ca

4. 建立 localhost 正向區域檔 /var/named/localhost.zone

cat > /var/named/localhost.zone <<'EOF'
$TTL 600
@ IN SOA localhost. admin.localhost. (
    2014071001 ; Serial
    1H         ; Refresh
    10M        ; Retry
    1W         ; Expire
    1D )       ; Minimum
  IN NS localhost.
localhost. IN A 127.0.0.1
EOF

5. 建立 localhost 反向區域檔 /var/named/named.local

cat > /var/named/named.local <<'EOF'
$TTL 600
@ IN SOA localhost. admin.localhost. (
    2014071101 ; Serial
    1H         ; Refresh
    10M        ; Retry
    1W         ; Expire
    1D )       ; Minimum
  IN NS localhost.
1 IN PTR localhost.
EOF

6. 建立業務域正向區域檔 /var/named/stephenzhou.net.zone

cat > /var/named/stephenzhou.net.zone <<'EOF'
$TTL 600
$ORIGIN stephenzhou.net.
@ IN SOA ns1.stephenzhou.net. administrator.stephenzhou.net. (
    2014071101 ; Serial
    1H         ; Refresh
    10M        ; Retry
    1W         ; Expire
    1D )       ; Minimum
  IN NS ns1
  IN MX 1 mail
ns1 IN A 192.168.2.41
mail IN A 192.168.2.31
www IN A 192.168.2.18
autodiscover IN A 192.168.2.31
EOF

chown :named /var/named/stephenzhou.net.zone

7. 語法檢查、產生 rndc 金鑰、啟動服務

named-checkconf
named-checkzone "stephenzhou.net" /var/named/stephenzhou.net.zone
# 輸出：zone stephenzhou.net/IN: loaded serial 2014071101 OK

rndc-confgen -r /dev/urandom -a  # CentOS 6 必須單獨產生 /etc/rndc.key
service named start

# 驗證監聽埠
netstat -tunlp | grep :53
# 預期：TCP/UDP 53 監聽於 192.168.2.41、127.0.0.1

8. 功能驗證指令集

# 本機正向解析測試
dig -t NS localhost
dig mail.stephenzhou.net
dig -t A www.stephenzhou.net
host -t A www.stephenzhou.net
host -t A mail.stephenzhou.net
host -t NS stephenzhou.net
host -t MX stephenzhou.net

# 本機反向解析測試
dig -x 127.0.0.1

9. 客戶端驗證 (Windows 遠端)

修改客戶端 DNS 指向 192.168.2.41，使用 nslookup 驗證各記錄類型解析正確。

10. 防火牆開放 DNS 埠

# /etc/sysconfig/iptables 新增規則
-A INPUT -p tcp --dport 53 -j ACCEPT
-A INPUT -p udp --dport 53 -j ACCEPT
service iptables restart

關鍵檔案權限與安全加固

• 區域檔屬主 root:named，權限 640（chown :named ...; chmod 640 ...）
• /etc/named.conf 同樣 root:named 640
• 關閉開放遞迴：allow-recursion { 192.168.2.0/24; };
• 限制查詢來源：allow-query { 192.168.2.0/24; };
• 隱藏版本號：version "None";
• 生產環境啟用 bind-chroot 與 DNSSEC

常見問題排查