CentOS7源码安装最新版本bind9(一)

一、环境准备

1、CentOS7最小化安装后使用yum完成以下软件安装。

yum -y install net-tools
yum -y install iptables-services
yum -y install vim
yum -y install gcc*
yum -y install tcpdump
yum -y install cmake
yum -y install bind-utils
yum -y install zlib-devel bzip2-devel openssl-devel ncurses-devel sqlite-devel readline-devel tk-devel gdbm-devel db4-devel libpcap-devel xz-devel
yum -y install libffi-devel -y
yum -y install libxml*
yum -y install git
yum -y install wget
yum -y install libtool

2、在https://www.isc.org/downl系统/运维oad/ 下载最新stable版本bind,本文以bind-9.17.22.tar.xz为例。将软件传到/usr/src目录下。

3、执行​​pip install ply​​安装ply,安装前要确保此时setuptools和pip已经安装,如果未安装则需要单独安装。如果不安装ply模块,bind在编译时会报错如下。

configure: error: Python >= 2.7 or >= 3.2 and the PLY package are required for dnssec-keymgr and other Python-based tools. 
PLY may be available from your OS package manager as python-ply or python3-ply; it can also be installed via

4、执行以下命令安装libuv。最新版本要求安装libuv>服务器内存条和普通内存条区别;=1.x.x版本。

​yum install -y epel-release​

​yum install libulinux系统v*​

如果不安装libuv则在bind编译时会报错如下:

checking for libuv... checking for libuv >= 1.0.0... no
configure: error: libuv not found

5、执行以下命令安装ibnghttp2

​yum insta服务器的作用ll libnghtt系统运维工程师p2*​

如果不安装libnghttp2,则编译bind时会报错如下:

checking for libnghttp2 >= 1.6.0... no
configure: error: DoH requested, but libnghttp2 not found

6、如果bind编译过服务器怎么搭建程中出现以下报错,说明libtool没有安装,请用yum安装libtool。

​yum install libcap*​

configure: error: sys/capability.h header is required for Linux capabilities support. Either install libcap or use --disable-linux-caps.
二、bind安装

1、解压

[root@DNS-XUEXI-xuexiji ~]# cd /usr/src/
[root@dns-xuexi-xuexiji src]# tar -xvf bind-9.17.22.tar.xz

2、安装

[root@dns-xuexi-xuexiji src]# cd bind-9.17.22/
[root@dns-xuexi-xuexiji bind-9.17.22]# ./configure --prefix=/usr/local/bind9
[root@dns-xuexi-xuexiji bind-9.17.22]# make -j5 && make install
--prefix=/opt/data/bind9:指定编译存放的路径
--sysconfdir=/etc/named:指定配置文件存放路径
注:–enable-threads enable multithreading参数已经在9.14及后续不再单独设置,9.11之前需要指定。9.14版本开始默认使用了SO_REUSEPORT特性(后期文档详细介绍)
三、bind初始化配置

编译安装named什么都得自己创建、用户也没有的、所以我们得给他创建一个用户先、而且用户是系统用户、要加-r系统运维工程师、系服务器统用户不会给他创建家目录的:

1、先创建用户组:

[root@DNS-XUEXI-xuexiji ~]# groupadd -g 53 -r named
[root@DNS-XUEXI-xuexiji ~]# useradd -g named -r named

2、​先去创建named的工作目录、然后创建named.ca这个文件:

[root@DNS-XUEXI-xuexiji ~]# mkdir /usr/local/bind9/var/named

3、这里@后面的IP是能访问互联网的服务器、生成的数据存在到/usr/local/bind9/var/named/named.ca中去(使用"yum -y install binlinux重启命令d-utils"命令安装dig命令)linux常用命令

[root@DNS-XUEXI-xuexiji ~]# dig -t NS . @8.8.8.8 > /usr/local/bind9/var/named/named.ca   ////这一步很关键,一定要保证能解析,否则无法forward转发那些NS(223.5.5.5或者8.8.8.8等)的解析,比如最后无法ping通www.baidu.com
[root@DNS-XUEXI-xuexiji ~]# cat /var/named/named.ca ////确保named.ca文件里有"...IN NS"解析记录
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.8 <<>> -t NS . @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12348
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;. IN NS

;; ANSWER SECTION:
. 49439 IN NS m.root-servers.net.
. 49439 IN NS b.root-servers.net.
. 49439 IN NS c.root-servers.net.
. 49439 IN NS d.root-servers.net.
. 49439 IN NS e.root-servers.net.
. 49439 IN NS f.root-servers.net.
. 49439 IN NS g.root-servers.net.
. 49439 IN NS h.root-servers.net.
. 49439 IN NS a.root-servers.net.
. 49439 IN NS i.root-servers.net.
. 49439 IN NS j.root-servers.net.
. 49439 IN NS k.root-servers.net.
. 49439 IN NS l.root-servers.net.

;; Query time: 66 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: 二 2月 22 15:18:24 CST 2022
;; MSG SIZE rcvd: 239

4、rndc是一个远程管理bind的工具,通过这个工具linux操作系统基础知识可以在本地或者远程了解当前服务器的运行状况,也可以对系统运维工作内容服务器进行关闭、重载、刷新缓linux存、增加删除zone等操作,后期文档详细介绍

[root@DNS-XUEXI-xuexiji ~]# /usr/local/bind9/sbin/rndc-confgen >  /usr/local/bind9/etc/rndc.conf
[root@DNS-XUEXI-xuexiji ~]# more /usr/local/bind9/etc/rndc.conf
# Start of rndc.conf
key "rndc-key" {
algorithm hmac-sha256;
secret "cXFW/OVHdGXhA/88/hdyjXgR4Yu8mVCzt5d591dp91c=";
};

options {
default-key "rndc-key";
default-server 127.0.0.1;
default-port 953;
};
# End of rndc.conf

# Use with the following in named.conf, adjusting the allow list as needed:
# key "rndc-key" {
# algorithm hmac-sha256;
# secret "cXFW/OVHdGXhA/88/hdyjXgR4Yu8mVCzt5d591dp91c=";
# };
#
# controls {
# inet 127.0.0.1 port 953
# allow { 127.0.0.1; } keys { "rndc-key"; };
# };
# End of named.conf
--------------------------------------------------------------------
[root@DNS-XUEXI-xuexiji etc]# cd /usr/local/bind9/etc/
[root@DNS-XUEXI-xuexiji etc]# tail -10 rndc.conf | head -9 | sed s/#\ //g > named.conf
[root@DNS-XUEXI-xuexiji etc]# more named.conf
key "rndc-key" {
algorithm hmac-sha256;
secret "cXFW/OVHdGXhA/88/hdyjXgR4Yu8mVCzt5d591dp91c=";
};

controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { "rndc-key"; };
};

4、然后再去编辑/usr/local/bind9/etc/named.conf的配置文件,在当前文件的最后增加全局options配置如下:

[root@DNS-XUEXI-xuexiji ~]# vim /etc/named/named.conf
key "rndc-key" {
algorithm hmac-sha256;
secret "DQoZGxai0+VCE9RKnFnAekSBCEDhXb11NVZef0tDOTM=";
};

controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { "rndc-key"; };
};

options {
listen-on port 53 { any; }; //默认是any,表示允许所有网段的主机。可以改成自己所在的内网网段
listen-on-v6 port 53 { ::1; };
directory "/var/named"; //定义named的固定工作路径
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; }; //表示接收所有网段
recursion yes;
forward first; //下面这两行配置很重要,这个配置后,当客户端采用我们自己配置的内网DNS的NS服务器后,当访问别的网站,内网NS解析不了的就转发给8.8.8.8的DS服务器解析,保证能正常上网。
forwarders {
223.5.5.5; //阿里云的DNS服务器
223.6.6.6;
8.8.8.8;
8.8.4.4;
};
};

logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};

zone "." {
type hint;
file "named.ca";
};

zone "wangshibo.cn" { //定义一个统一的域名后缀。正向解析的区域。此处可以加后面IN,也可以不加IN
type master; //类型属于master、属于自己的
file "wangshibo.cn_zone"; //指定正向解析的文件
allow-transfer {192.168.1.28;}; //允许192.168.1.28(从DNS服务器)传送
};
zone "1.168.192.in-addr.arpa" { //定义反向解析的区域,注意写法。此处可以在后面加IN,也可以不加IN
type master;
file "192.168.1.zone"; //指定正向解析的文件
allow-transfer {192.168.1.28;};

zone "33.168.192.in-addr.arpa" {
type master;
file "192.168.33.zone";
allow-transfer {192.168.1.28;};
};
zone "34.168.192.in-addr.arpa" {
type master;
file "192.168.34.zone";
allow-transfer {192.168.1.28;};
};
zone "64.168.192.in-addr.arpa" {
type master;
file "192.168.64.zone";
allow-transfer {192.168.1.28;};
};


这里注意一下:
如果是多个网段的反向解析,这里就定义多个反向解析区域。

5、​给namelinux命令d.conf和rndc.conf修改linux是什么操作系统属主属组和权限:

[root@DNS-XUEXI-xuexiji etc]# chown -R named:named /usr/local/bind9/
四、运行bind

1、执行如下命令启linux常用命令动bind

[root@DNS-XUEXI-xuexiji etc]# /usr/local/bind9/sbin/named -u named -c /usr/local/bind9/etc/named.conf

2、服务器是什么测试能正常解析

[root@DNS-XUEXI-xuexiji etc]# ps -ef|grep named
named 32292 1 0 17:53 ? 00:00:00 /usr/local/bind9/sbin/named -u named -c /usr/local/bind9/etc/named.conf
root 32296 7543 0 17:53 pts/0 00:00:00 grep --color=auto named
[root@DNS-XUEXI-xuexiji etc]# netstat -anp|grep 53
tcp 0 0 10.0.0.101:53 0.0.0.0:* LISTEN 32292/named
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 32292/named
tcp 0 0 192.168.122.1:53 0.0.0.0:* LISTEN 7405/dnsmasq
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 32292/named
tcp6 0 0 ::1:53 :::* LISTEN 32292/named
tcp6 0 0 fe80::3a60:77cc:54ff:53 :::* LISTEN 32292/named
udp 0 0 192.168.122.1:53 0.0.0.0:* 32292/named
udp 0 0 10.0.0.101:53 0.0.0.0:* 32292/named
udp 0 0 127.0.0.1:53 0.0.0.0:* 32292/named
udp 0 0 192.168.122.1:53 0.0.0.0:* 7405/dnsmasq
udp 0 0 0.0.0.0:5353 0.0.0.0:* 6684/avahi-daemon:
udp6 0 0 ::1:53 :::* 32292/named
udp6 0 0 fe80::3a60:77cc:54ff:53 :::* 32292/named
unix 2 [ ] DGRAM 45380 7405/dnsmasq
unix 3 [ ] STREAM CONNECTED 45153 7350/master
unix 3 [ ] DGRAM 22753 2948/systemd-udevd
[root@DNS-XUEXI-xuexiji etc]# dig @127.0.0.1 www.baidu.com

; <<>> DiG 9.9.4-RedHat-9.9.4-72.el7 <<>> @127.0.0.1 www.baidu.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22009
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;www.baidu.com. IN A

;; ANSWER SECTION:
www.baidu.com. 1200 IN CNAME www.a.shifen.com.
www.a.shifen.com. 300 IN A 39.156.66.14
www.a.shifen.com. 300 IN A 39.156.66.18

;; Query time: 1758 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: 二 2月 22 17:56:45 CST 2022
;; MSG SIZE rcvd: 104