6/18~19 CentOS / 네임서버 설정파일 / 네임서버 설치 / Mater - Slave

2014-06-18 오전 9:14  

 

------------------------------------------------ 

 

*네임서버 설정파일들 

 

Resolver 

 

1) /etc/host.conf        해석 및 순서지정 

2) /etc/resolv.conf 도메인네임서버 지정 

 

 

 

Name Daemon 

 

1) /var/named/etc 

2) /var/named/chroot/var/named/etc    

3) /var/named/chroot/var/named/도메인.zone 

4) /var/named/chroot/var/named/named.ca      캐시서버전용 

5) /var/named/chroot/var/named/도메인.rev 

6) /var/named/chroot/var/named/named.local   루프백용 

 

 

Bind Syslog 

 

1) /var/named/named_dump.db 

2) /var/named/name_stats 

 

 

---------------------------------------------- 

 

 

 

네임서버 소스설치 

 

yum remove -y bind* 

 

 

홈페이지 : http://www.isc.org 

 

 

wget ftp://ftp.isc.org/isc/bind9/9.6.1b1/bind-9.6.1b1.tar.gz 

 

 

tar xvfz bind-9.6.1b1.tar.gz 

 

cd bind-9.6.1b1 

 

./configure --with-libtool  

                --with-openssl=/usr 

                --localstatedir=/var 

                --enable-threads 

 

make && make install 

 

 

 

----------------------------------------------- 

[Master - Slave] 

 

 

/var/named/chroot/etc/named.rfc1912.zones 

 

*Master의 경우 

zone "pinkscreen.com" IN { 

type master; 

file "pinkscreen.zone"; 

allow-update { slave아이피입력; }; 

}; 

 

 

*Slave의 경우 

zone "pinkscreen.com" IN { 

type slave; 

file "slaves/pinkscreen.zone"; 

masters { master아이피입력; }; 

}; 

 

/var/named/chroot/var/named/slave 디렉토리에 마스터의 

존파일이 트랜스퍼되서 넘어오는것을 확인한다. 

2014-06-19 오전 9:52  

 

 

1. acl          엑세스리스트(접근허용할 아이피 주소) 

 

예) 

acl       "blue" { 

           192.168.0.100/24 

 

2. rndc로 네임서버 데몬 관리하기 

슬레이브서버는 마스터서버에서 데몬 재시작이 안되었을 경우 무한정 기다린다. 

 

vi /etc/named.conf 

 

controls { 

            inet 127.0.0.1 allow { localhost; } <-아이피주소 또는 any 

            keys { 키이름; }; 

}; 

key 키이름 { 

                algorithm "hmac-md5"; 

                secret      "2398347tirjte5rw9wre"; 

}; 

 

include : 지시자(명령을 지정하는것) 포함하다 

include "/etc/rndc.key"; 

 

단, rndc.key 파일의 그룹권한을 named로 수정해주어야 한다. (소유자: root/그룹: named) 

 

3. rndc.key 생성하기 

rndc-confgen 도구를 이용하여 생성한다. 

 

rndc-confgen -a -k 키이름 

==> 

[root@localhost named]# rndc-confgen -a -k altf4 

wrote key file "/etc/rndc.key" 

*퍼미션 부여 

mv /etc/rndc.key /var/named/chroot/etc/ 

ln -s /var/named/chroot/etc/rndc.key /etc/rndc.key 

chmod 640 /var/named/chroot/etc/rndc.key 

chown root.named /var/named/chroot/etc/rndc.key 

 

3-2.  dnssec-keygen 도구를 사용한 공유키생성 

 

       dnssec-keygen -a hmac-md5 -b 256 -n HOST 키이름  

 

예) 

       dnssec-keygen -a hmac-md5 -b 256 -n HOST ctrlf4 

Kctrlf4.+157+54601.key 

ctrlf4. IN KEY 512 3 157 V7w0AhsqHVsdhGt5vz1O1c+z1PqhBKUszgJ/HSUQF0g= 

 

Kctrlf4.+157+54601.private 

Private-key-format: v1.2 

Algorithm: 157 (HMAC_MD5) 

Key: V7w0AhsqHVsdhGt5vz1O1c+z1PqhBKUszgJ/HSUQF0g= 

Bits: AAA=