CentOS安装DNS双机

CentOS版本： CentOS 7.x 64bit

DNS版本：yum安装bind-chroot

生产环境需要搭建DNS服务，解析内部域名，外部域名则转发给外部DNS服务器

安装过程

主机

yum安装DNS服务和依赖

yum install bind-chroot

启动named-chroot服务

systemctl start named-chroot
systemctl enable named-chroot

修改/etc/named.conf配置

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

options {
        listen-on port 53 { any; };
        //listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { any; };

        /* 
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable 
           recursion. 
         - If your recursive DNS server has a public IP address, you MUST enable access 
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification 
           attacks. Implementing BCP38 within your network would greatly                          
           reduce such attack surface                                                             
        */
        
                                                                                                  
        recursion yes;                                                                            
        allow-recursion { 0.0.0.0/0; };                                                           
                                                                                                  
        forward first;                                                                            
        forwarders {                                                                              
            119.29.29.29;                                                                         
            114.114.114.114;                                                                      
        };                                                                                        
                                                                                                  
        dnssec-enable no;                                                                         
        dnssec-validation no;                                                                     
        dnssec-lookaside no;                                                                      
                                                                                                  
        /* Path to ISC DLV key */                                                                 
        bindkeys-file "/etc/named.iscdlv.key";                                                    
                                                                                                  
        managed-keys-directory "/var/named/dynamic";                                              
                                                                                                  
        pid-file "/run/named/named.pid";                                                          
        session-keyfile "/run/named/session.key";                                                 
}; 
logging {
        channel default_debug {
                file "data/named.run";                                                            
                severity dynamic;                                                                 
        };                                                                                        
};                                                                                                
                                                                                                  
zone "." IN {                                                                                     
        type hint;                                                                                
        file "named.ca";                                                                          
}; 

zone "linglongtech.local" IN {                                                                                     
        type master;                                                                                               
        file "linglongtech.local.zone";                                                                            
        allow-transfer { 192.168.1.6; };                                                                           
        allow-query { any; };                                                                                      

};                                                                                                
zone "linglongtech.com" IN {                                                                                       
        type master;                                                                                               
        file "linglongtech.com.zone";                                                                              
        allow-transfer { 192.168.1.6; };                                                                           
        allow-query { any; };                                                                                      

};

include "/etc/named.rfc1912.zones";                                                               
include "/etc/named.root.key";

修改/var/named/linglongtech.local.zone和/var/named/linglongtech.local.zone

$ORIGIN linglongtech.local.
$TTL 600

@      IN  SOA         dns1.linglongtech.local. root.linglongtech.local. (
                       20151009
                       3600
                       3600
                       604800
                       86400
)

@      IN  NS          vboxdns1.linglongtech.local.
       IN  NS          vboxdns2.linglongtech.local.

vboxdns1   IN  A       10.105.29.36
vboxdns2   IN  A       10.105.61.255

vboxdb IN  A           10.66.147.50

vboxhyperic IN A       10.143.52.85

$ORIGIN linglongtech.com.
$TTL 600

@      IN  SOA         dns1.linglongtech.com. root.linglongtech.com. (
                       20151009
                       3600
                       3600
                       604800
                       86400
)

@      IN  NS          vboxdns1.linglongtech.com.
       IN  NS          vboxdns2.linglongtech.com.

vboxdns1   IN  A       10.105.29.36
vboxdns2   IN  A       10.105.61.255

防火墙要求开通TCP和UDP的53端口

启动DNS服务

systemctl start named
systemctl enable named

备机

修改/etc/named.conf

zone "linglongtech.local" IN {
        type slave;
        file "slaves/linglongtech.local.zone";
        masters { 192.168.1.5; };
        allow-query { any; };
};

zone "linglongtech.com" IN {
        type slave;
        file "slaves/linglongtech.com.zone";
        masters { 192.168.1.5; };
        allow-query { any; };
};

其余配置同主机相同

配置修改

每次修改 DNS 配置之后，只需要修改主机的配置，一定要修改时间戳，否则会导致配置备机配置不生效。

配置修改完成后，重启服务

systemctl restart named

监控脚本

#!/usr/bin/python
#coding=utf-8

import dns.resolver
import sys

def query_domain(nameserverIP,domainName):

    resolver = dns.resolver.Resolver(configure=False)
    resolver.nameservers = [nameserverIP]

    try:
        answer = resolver.query(domainName, 'A')
        if len(answer) >= 1:
            return(True)
        else:
            return(False)
    except:
        return(False)
        
def main():

    nameserverIPs = ['192.168.1.5','192.168.1.6']

    domainNames = ['www.baidu.com',\                                                              
                   'api.weixin.qq.com','graph.qq.com','proxy-ling.jd.com','api.ximalaya.com',\    
                   'vboxmongodb1.linglongtech.com','logs.linglongtech.com',\                      
                   'vboxdb.linglongtech.local','vboxmem.linglongtech.local','vboxdns1.linglongtech.local','vboxdns2.
linglongtech.local']
                                                                                                  
    for x in nameserverIPs:                                                                       
        for y in domainNames:                                                                     
                                                                                                  
            #print(x,y)                                                                           
            #print(query_domain(x,y))                                                             
                                                                                                  
            if query_domain(x,y):                                                                 
                continue                                                                          
            else:                                                                                 
                print(1)                                                                          
                sys.exit(0)                                                                       
                                                                                                  
    print(0)
    
if __name__ == '__main__':                                                                        
    main()