CENTOS 7にDNSサーバーを設定する方法

安装BIND软件包；2. 配置named.conf文件以允许查询和递归；3. 创建正向区域文件并定义A记录；4. （可选）创建反向区域文件以支持PTR记录；5. 设置正确的文件权限和SELinux上下文；6. 启用并启动named服务；7. 配置防火墙允许DNS流量；8. 使用named-checkzone、named-checkconf和dig测试配置；9. 将客户端DNS指向该服务器；每次修改区域文件需递增序列号，生产环境建议配置从DNS服务器并禁用公共递归以确保安全，所有步骤完成后DNS服务器即可正常运行。

Setting up a DNS server on CentOS 7 involves installing and configuring BIND (Berkeley Internet Name Domain), which is the most widely used DNS server on Unix-like systems. Below is a step-by-step guide to help you set up a basic authoritative DNS server for a domain.

1. Install BIND (named)

First, install the BIND package using yum:

sudo yum install bind bind-utils -y

• bind: The DNS server daemon (named).
• bind-utils: Includes tools like dig, nslookup, and host for testing DNS.

2. Configure the Main BIND File (named.conf)

Edit the main configuration file:

sudo vi /etc/named.conf

Make sure the following options are set (especially for allowing queries and zone transfers):

options {
    listen-on port 53 { any; };
    directory       "/var/named";
    dump-file       "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";

    // Allow queries from your network
    allow-query     { localhost; 192.168.1.0/24; };  // Adjust to your network

    // Enable recursion only if needed (for internal DNS)
    recursion yes;

    // Optional: Restrict recursion to internal clients
    allow-recursion { localhost; 192.168.1.0/24; };

    dnssec-validation no;  // Disable if not using DNSSEC (simpler for beginners)
};

Also, ensure zone files are loaded by confirming this line exists:

include "/etc/named.rfc1912.zones";

3. Create Forward Zone (example: example.com)

a. Add the zone in /etc/named.conf

Add the following to the end of /etc/named.conf or in /etc/named.rfc1912.zones:

zone "example.com" IN {
    type master;
    file "example.com.zone";
    allow-update { none; };
};

Replace example.com with your actual domain.

b. Create the zone file

Create the forward zone file:

sudo vi /var/named/example.com.zone

Add content like this:

$TTL 86400
@       IN  SOA     ns1.example.com. admin.example.com. (
                    2024040101  ; Serial (YYMMDDNN)
                    3600        ; Refresh
                    1800        ; Retry
                    604800      ; Expire
                    86400 )     ; Minimum TTL

; Name Servers
@       IN  NS      ns1.example.com.
@       IN  NS      ns2.example.com.

; A Records
ns1     IN  A       192.168.1.10
ns2     IN  A       192.168.1.11
www     IN  A       192.168.1.20
mail    IN  A       192.168.1.25
@       IN  A       192.168.1.20  ; example.com

Replace IPs and names with your actual values.

4. Create Reverse Zone (Optional, for PTR records)

a. Add reverse zone in /etc/named.conf

For network 192.168.1.0/24:

zone "1.168.192.in-addr.arpa" IN {
    type master;
    file "192.168.1.rev";
    allow-update { none; };
};

b. Create reverse zone file

sudo vi /var/named/192.168.1.rev

Content:

$TTL 86400
@       IN  SOA     ns1.example.com. admin.example.com. (
                    2024040101
                    3600
                    1800
                    604800
                    86400 )

; Name Servers
@       IN  NS      ns1.example.com.
@       IN  NS      ns2.example.com.

; PTR Records
10      IN  PTR     ns1.example.com.
11      IN  PTR     ns2.example.com.
20      IN  PTR     www.example.com.
25      IN  PTR     mail.example.com.

5. Set Proper Permissions and SELinux Context

Ensure the zone files are readable by named:

sudo chown root:named /var/named/*.zone /var/named/*.rev
sudo chmod 640 /var/named/*.zone /var/named/*.rev

Fix SELinux context (if enabled):

sudo restorecon -R /var/named

6. Enable and Start the DNS Service

sudo systemctl enable named
sudo systemctl start named

Check status:

sudo systemctl status named

7. Configure Firewall

Allow DNS traffic:

sudo firewall-cmd --permanent --add-service=dns
sudo firewall-cmd --reload

8. Test the DNS Server

a. Check zone file syntax

sudo named-checkzone example.com /var/named/example.com.zone
sudo named-checkzone 1.168.192.in-addr.arpa /var/named/192.168.1.rev

b. Check main config

sudo named-checkconf

c. Use dig to test

On the server or a client:

dig @localhost example.com
dig @192.168.1.10 www.example.com
dig -x 192.168.1.20  ; Reverse lookup

You should see the correct A or PTR records in the answer section.

9. Point Clients to Your DNS Server

On client machines, set their DNS to use:

192.168.1.10   # Your DNS server IP

Edit /etc/resolv.conf:

nameserver 192.168.1.10

Final Notes

• Increment the Serial number each time you update a zone file.
• Use rndc reload to reload zones without restarting:

  sudo rndc reload example.com

• For production, consider setting up a slave (secondary) DNS server for redundancy.
• Secure your DNS server: disable recursion for public access if it's authoritative only.

---

Setting up a DNS server on CentOS 7 with BIND isn't complex once you understand the zone structure and configuration layout. Just double-check file permissions, syntax, and firewall settings—most issues come from those areas.

Basically, get the config right, test thoroughly, and keep it secure.

以上がCENTOS 7にDNSサーバーを設定する方法の詳細内容です。詳細については、PHP 中国語 Web サイトの他の関連記事を参照してください。