DNSサーバ(Debian11.0.0)

2021/8/20

インストール

apt-get install bind9 bind9utils -y

ポリシー

1. 実験室内の各マシンについてIPアドレスとニックネームを対応付ける
2. アクセスは実験室内に限定
3. 外部からのアクセスは認めない

設定

1. /etc/default/named　　設定ファイル
2. /etc/bind/named.conf　　設定ファイル(各ファイルをインクルードする)
3. /etc/bind/named.conf.options　　named.confがインクルードするファイル
4. /etc/bind/named.conf.internal-zones　　内部向け設定ファイル
5. /etc/bind/takahashi.lab.zone　正引きファイル
6. /etc/bind/192.168.xxx.rev　逆引きファイル

#
# run resolvconf?
RESOLVCONF=no

# startup options for the server
#OPTIONS="-u bind"   #IPv4のみ使用
OPTIONS="-u bind -4"

// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the 
// structure of BIND configuration files in Debian, *BEFORE* you customize 
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
#include "/etc/bind/named.conf.default-zones";

#このnamed.conf.internal-zonesを追記
include "/etc/bind/named.conf.internal-zones";
#include "/etc/bind/named.conf.external-zones";

options {
	directory "/var/cache/bind";

	// If there is a firewall between you and nameservers you want
	// to talk to, you may need to fix the firewall to allow multiple
	// ports to talk.  See http://www.kb.cert.org/vuls/id/800113

	// If your ISP provided one or more IP addresses for stable 
	// nameservers, you probably want to use them as forwarders.  
	// Uncomment the following block, and insert the addresses replacing 
	// the all-0's placeholder.

	// forwarders {
	// 	0.0.0.0;
	// };

	//========================================================================
	// If BIND logs error messages about the root key being expired,
	// you will need to update your keys.  See https://www.isc.org/bind-keys
	//========================================================================
//	dnssec-validation auto;

//	auth-nxdomain no;    # conform to RFC1035
//	listen-on-v6 { any; };


# 問い合わせを許可する範囲
allow-query { localhost; 192.168.xxx.0/24; };

# ゾーン情報の転送を許可する範囲 ( セカンダリDNSがいる場合は、その場所/範囲 )
#allow-transfer { localhost; 10.0.0.0/24; };

# 再帰検索を許可する範囲

allow-recursion { localhost; 192.168.xxx.0/24; };
//dnssec-validation auto;

auth-nxdomain no; # conform to RFC1035

# IPV6を使わないならば変更
#listen-on-v6 { none; };
#statusをIPv6で名前解決できていない旨のエラーが出る。
use-v6-udp-ports{};
};

# 内部向けの定義を記述
view "internal" {
# 指定範囲内のホストが内部向けの定義を参照

        match-clients {
                localhost;
                192.168.xxx.0/24;
        };

# 内部向け正引き情報を定義

        zone "takahashi.lab" {
                type master;
                file "/etc/bind/takahashi.lab.zone";
                allow-update { none; };
        };

# 内部向け逆引き情報を定義

        zone "xxx.168.192.in-addr.arpa" {
                type master;
                file "/etc/bind/192.168.xxx.rev";
                allow-update { none; };
        };
        include "/etc/bind/named.conf.default-zones";
};

$TTL	86400
@       IN      SOA     He.takahashi.lab. takahasi.hakodate-ct.ac.jp.  (
				12   ; Serial  2021/08/20 15:00 サーバ交換  
				28800      ; Refresh
				14400      ; Retry
				3600000    ; Expire
				86400 )    ; Minimum

        IN      NS	He.takahashi.lab.

dns	IN	CNAME	He	; 192.168.xxx.2

H	IN	A	192.168.xxx.1
He	IN	A	192.168.xxx.2
;以下省略

$TTL	86400
@	IN      SOA     He.takahashi.lab. takahasi.hakodate-ct.ac.jp.  (
				12   ; Serial  2021/08/20 15:00 サーバ交換  
				28800      ; Refresh
				14400      ; Retry
				3600000    ; Expire
				86400 )    ; Minimum

	IN	NS	He.takahashi.lab.

1	IN	PTR	H.takahashi.lab.	; 192.168.xxx.1
2	IN	PTR	He.takahashi.lab.
3	IN	PTR	Li.takahashi.lab.
4	IN	PTR	Be.takahashi.lab.
5	IN	PTR	B.takahashi.lab.
6	IN	PTR	C.takahashi.lab.
7	IN	PTR	N.takahashi.lab.
8	IN	PTR	O.takahashi.lab.
9	IN	PTR	F.takahashi.lab.
10	IN	PTR	Ne.takahashi.lab.
11	IN	PTR	Na.takahashi.lab.
;以下省略

確認

$ cat /etc/resolv.conf 
# Generated by NetworkManager
search takahashi.lab
nameserver 192.168.70.2

systemctl restart bind9;systemctl status bind9;

# systemctl status bind9
● named.service - BIND Domain Name Server
     Loaded: loaded (/lib/systemd/system/named.service; enabled; vendor preset: enabled)
     Active: active (running) since Fri 2021-08-20 13:57:21 JST; 28ms ago
       Docs: man:named(8)
   Main PID: 6965 (named)
      Tasks: 1 (limit: 8823)
     Memory: 960.0K
        CPU: 17ms
     CGroup: /system.slice/named.service
             └─6965 /usr/sbin/named -f -u bind

 8月 20 13:57:21 He systemd[1]: Started BIND Domain Name Server.
# 

# dig H.takahashi.lab

; <<>> DiG 9.16.15-Debian <<>> H.takahashi.lab
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49161
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;H.takahashi.lab.		IN	A

;; ANSWER SECTION:
H.takahashi.lab.	86400	IN	A	192.168.70.1

;; AUTHORITY SECTION:
takahashi.lab.		86400	IN	NS	He.takahashi.lab.

;; ADDITIONAL SECTION:
He.takahashi.lab.	86400	IN	A	192.168.70.2

;; Query time: 0 msec
;; SERVER: 192.168.70.2#53(192.168.70.2)
;; WHEN: 金  8月 20 14:01:59 JST 2021
;; MSG SIZE  rcvd: 93