$ vim /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
acl network {
192.168.0.0/24;
};
options {
listen-on port 53 { any; };
listen-on-v6 port 53 { none; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
allow-query { localhost; network; };
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
/* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
include "/etc/crypto-policies/back-ends/bind.config";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
zone "test.local" IN {
type master;
file "test.local";
allow-update { none; };
};
zone "196.180.10.in-addr.arpa" IN {
type master;
file "196.180.10.in-addr.arpa.rev";
allow-update { none; };
};
$
$TTL 86400
@ IN SOA dns.test.local. root.test.local. (
2020110601 ; serial
3600 ; refresh 1hr
1800 ; retry 15min
604800 ; expire 1w
86400 ; min 24hr
)
IN NS dns.test.local.
dns IN A 192.168.0.100
ntp IN A 192.168.0.101
dhcp IN A 192.168.0.102
逆引きゾーンファイル作成
逆引きゾーンファイルも正引きゾーンファイルと同じフォルダ内で作成します。
$ vim 0.168.192.in-addr.arpa.rev
逆引きゾーンファイルの設定内容は以下となります。
$TTL 86400
@ IN SOA dns.test.local. root.test.local. (
2020110601 ; serial
3600 ; refresh 1hr
1800 ; retry 15min
604800 ; expire 1w
86400 ; min 24hr
)
IN NS dns.test.local.
100 IN PTR dns.test.local.
101 IN PTR ntp.test.local.
102 IN PTR dhcp.test.local.
作成したゾーンファイルをチェック
上記でゾーンファイルを作成したら、設定内容が間違っていないか、以下コマンドで確認をします。
$ named-checkconf -z
zone localhost.localdomain/IN: loaded serial 0
zone localhost/IN: loaded serial 0
zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 0
zone 1.0.0.127.in-addr.arpa/IN: loaded serial 0
zone 0.in-addr.arpa/IN: loaded serial 0
zone test.local/IN: loaded serial 2020110601
zone 0.168.192.in-addr.arpa/IN: loaded serial 2020110601
をチェック
エンジニア必見！ 技術力を伸ばすVPS徹底比較
>>>
コメント