使用unbound提供DNS域名解析服务

# 作者：Eric
# 微信：loveoracle11g


# 先配yum仓库
[root@server1 ~]# cd /etc/yum.repos.d/
[root@server1 yum.repos.d]# ls
[root@server1 yum.repos.d]# vim racooler.repo
[racooler]
name=rhel7
baseurl=file:///media/cdrom
enabled=1
gpgcheck=0


[root@server1 yum.repos.d]# mkdir -p /media/cdrom
[root@server1 yum.repos.d]# mount /dev/cdrom /media/cdrom/
mount: /dev/sr0 is write-protected, mounting read-only


[root@server1 yum.repos.d]# yum repolist all 
Loaded plugins: langpacks, product-id, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
racooler                                                           | 4.1 kB  00:00:00     
(1/2): racooler/group_gz                                           | 134 kB  00:00:00     
(2/2): racooler/primary_db                                         | 3.4 MB  00:00:00     
repo id                                repo name                            status
racooler                               rhel7                                enabled: 4,305
repolist: 4,305
[root@server1 yum.repos.d]#


[root@server1 yum.repos.d]# yum clean 
Loaded plugins: langpacks, product-id, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Error: clean requires an option: headers, packages, metadata, dbcache, plugins, expire-cache, rpmdb, all
[root@server1 yum.repos.d]#


[root@server1 yum.repos.d]# yum list all | wc -l
4405


# DNS的查询方式
迭代查询：服务器与服务器之间的查询。本地域名服务器向根域名服务器的查询通常是采用迭代查询(反复查询)。当根域名服务器收到本地域名服务器的迭代查询请求报文时，要么给出所要查询的IP地址，要么告诉本地域名服务器下一步应向那个域名服务器进行查询。然后让本地域名服务器进行后续的查询。
递归查询：客户端与服务器之间的查询。主机向本地域名服务器的查询一般都是采用递归查询。如果主机所询问的本地域名服务器不知道被查询域名的 IP 地址，那么本地域名服务器就以 DNS 客户的身份，向其他根域名服务器继续发出查询请求报文。最后会给客户端一个准确的返回结果，无论是成功与否。

# DNS解析类型
正向解析：由域名解析到IP地址。
反向解析：由IP地址解析到域名。

# 名称解析方式
hosts文件（etc/hosts）、dns、广播、解析缓存、dns、wins（windows中）等
DNS安装配置：
在RHEL5、6中dns都是用的是bind软件包，而在RHEL7用的是unbound安装包，配置文件也有了改变。


[root@server1 ~]# yum -y install unbound*

[root@server1 ~]# systemctl start unbound
[root@server1 ~]# systemctl enable unbound
ln -s ‘/usr/lib/systemd/system/unbound.service‘ ‘/etc/systemd/system/multi-user.target.wants/unbound.service‘


[root@server1 ~]# systemctl stop iptables
[root@server1 ~]# systemctl disable iptables
[root@server1 ~]# systemctl mask iptables
ln -s ‘/dev/null‘ ‘/etc/systemd/system/iptables.service‘


[root@server1 ~]# systemctl stop ebtables
[root@server1 ~]# systemctl disable ebtables
[root@server1 ~]# systemctl mask ebtables
ln -s ‘/dev/null‘ ‘/etc/systemd/system/ebtables.service‘


[root@server1 ~]# firewall-cmd --permanent --add-service=dns
success
[root@server1 ~]# firewall-cmd --reload
success
[root@server1 ~]# firewall-cmd --list-all
public (default, active)
  interfaces: eno16777728
  sources: 
  services: dhcpv6-client dns ssh
  ports: 
  masquerade: no
  forward-ports: 
  icmp-blocks: 
  rich rules: 

[root@server1 ~]#

# DNS服务器上firewall开放DNS访问OK
[root@server1 ~]# netstat -tunlp | grep unbound
tcp        0      0 127.0.0.1:8953          0.0.0.0:*               LISTEN      2114/unbound        
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      2114/unbound        
tcp6       0      0 ::1:8953                :::*                    LISTEN      2114/unbound        
tcp6       0      0 ::1:53                  :::*                    LISTEN      2114/unbound        
udp        0      0 127.0.0.1:53            0.0.0.0:*                           2114/unbound        
udp6       0      0 ::1:53                  :::*                                2114/unbound        
[root@server1 ~]#


[root@server1 ~]# ss -tunlp | grep unbound
tcp    UNCONN     0      0              127.0.0.1:53                    *:*      users:(("unbound",2114,5))
tcp    UNCONN     0      0                    ::1:53                   :::*      users:(("unbound",2114,3))
tcp    LISTEN     0      5              127.0.0.1:8953                  *:*      users:(("unbound",2114,8))
tcp    LISTEN     0      5              127.0.0.1:53                    *:*      users:(("unbound",2114,6))
tcp    LISTEN     0      5                    ::1:8953                 :::*      users:(("unbound",2114,7))
tcp    LISTEN     0      5                    ::1:53                   :::*      users:(("unbound",2114,4))
[root@server1 ~]#

# 默认监听本地回环地址，也就是现在只有自己能访问DNS服务，其它主机不能访问本机的DNS服务。


[root@server1 ~]# vim /etc/unbound/unbound.conf
# 修改监听地址
38         # interface: 0.0.0.0
39         interface: 0.0.0.0

# 让所有主机能够向本机查询DNS
177         # access-control: 0.0.0.0/0 refuse
178         access-control: 0.0.0.0/0 allow

# 禁用服务用户
# 每个服务都是有其专用的服务用户，DNS的服务用户为unbound，实际情况下服务用户的启用有可能有安全隐患，这里要即禁用服务用户。
213         # username: "unbound"
214         username: ""


[root@server1 ~]# systemctl restart unbound

[root@server1 ~]# netstat -tunlp | grep unbound
tcp        0      0 127.0.0.1:8953          0.0.0.0:*               LISTEN      2814/unbound        
tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN      2814/unbound        
tcp6       0      0 ::1:8953                :::*                    LISTEN      2814/unbound        
udp        0      0 0.0.0.0:53              0.0.0.0:*                           2814/unbound        
[root@server1 ~]#
# 现在53号端口监听的是0.0.0.0，即所有网段都监听。


# 创建解析文件
[root@server1 ~]# hostname
server1.example.com

[root@server1 ~]# vim /etc/unbound/local.d/example.conf
local-zone: "example.com." static
local-data: "example.com. 86400 IN SOA ns.example.com. root 1 1D 1H 1W 1H"
local-data: "ns.example.com. IN A 192.168.10.201"
local-data: "www.example.com. IN A 192.168.10.201"
local-data-ptr: "192.168.10.201 ns.example.com."
local-data-ptr: "192.168.10.201 www.example.com."


# 检查解析结果
[root@server1 ~]# unbound-checkconf 
unbound-checkconf: no errors in /etc/unbound/unbound.conf
[root@server1 ~]# systemctl restart unbound
[root@server1 ~]#


[root@server1 ~]# vim /etc/sysconfig/network-scripts/ifcfg-eno16777728
TYPE=Ethernet
BOOTPROTO=static
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
NAME=eno16777728
UUID=cbce3ee7-6d18-4fc1-9ad4-4d175aa4ddbc
ONBOOT=yes
IPADDR0=192.168.10.201
PREFIX0=24
GATEWAY0=192.168.10.1
DNS1=192.168.10.201
HWADDR=00:0C:29:FA:32:28
IPV6_PEERDNS=yes
IPV6_PEERROUTES=yes

[root@server1 ~]# systemctl restart network

[root@server1 ~]# nslookup 
> 192.168.10.201
Server:		192.168.10.201
Address:	192.168.10.201#53

201.10.168.192.in-addr.arpa	name = www.example.com.
201.10.168.192.in-addr.arpa	name = ns.example.com.
> www.example.com
Server:		192.168.10.201
Address:	192.168.10.201#53

Name:	www.example.com
Address: 192.168.10.201
> exit

[root@server1 ~]#