[네임서버] bind를 사용한 마스터-슬레이브 dns 구성하기

bind를 사용한 마스터-슬레이브 dns 구성하기

테스트 환경

호스트 이름	아이피	운영체제 버전	네임서버 역할	비고
node2	192.168.0.62	centos 7	마스터(master)
node3	192.168.0.63	ubuntu 22.04	슬레이브(slave)

- 데스트 도메인 : mocha.sangchul.kr

bind(named) 패키지 설치 및 유틸리티 설치

- node2 마스트 서버 설치 : centos에 bind 설치하기
- node3 슬레이브 서버 설치 : ubuntu에 bind 설치하기

 

마스터 서버

dns 서버 구성(named.conf)

vim /etc/named.conf

// named.conf
options {
        listen-on port 53 { any; };
        directory "/var/named";
        dump-file "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file "/var/named/data/named.recursing";
        secroots-file "/var/named/data/named.secroots";
        allow-query { any; };
        allow-query-cache { any; };
        allow-transfer {
                127.0.0.1;
                192.168.0.62;
                192.168.0.63;
        };
        notify yes;
        also-notify { 192.168.0.63; };

        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.root.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
include "/etc/named.logging.conf";

zone "." IN {
        type hint;
        file "named.ca";
};

zone "mocha.sangchul.kr" IN {
        type master;
        file "mocha.sangchul.kr.zone";
        allow-transfer { 192.168.0.63; };
        allow-update { 192.168.0.63; };
};

zone "0.168.192.in-addr.arpa" IN {
        type master;
        file "192_168_0.zone";
        allow-transfer { 192.168.0.63; };
        allow-update { 192.168.0.63; };
};

vim /etc/named.rfc1912.zones

// named.rfc1912.zones:
// See /usr/share/doc/bind*/sample/ for example named configuration files.

zone "localhost" IN {
        type master;
        file "named.localhost";
        allow-update { none; };
};

zone "1.0.0.127.in-addr.arpa" IN {
        type master;
        file "named.loopback";
        allow-update { none; };
};

마스터 서버에 mocha.sangchul.kr 도메인 구성

- 마스터 서버에서 정방향 영역 파일 구성(forward zone file)

vim /var/named/mocha.sangchul.kr.zone

$TTL 60 
@                       IN      SOA     mocha.sangchul.kr. root (
                                        2023011602      ; serial
                                                1D      ; refresh
                                                1H      ; retry
                                                1W      ; expire
                                                3H )    ; minimum
;
                        IN      NS      ns.mocha.sangchul.kr.
                        IN      NS      ns2.mocha.sangchul.kr.
ns                      IN      A       192.168.0.62
ns2                     IN      A       192.168.0.63
;
;
@                       IN      A       192.168.0.61
www                     IN      CNAME   @

마스터 서버에 0.168.192.in-addr.arpa 도메인 구성

- 마스터 서버에서 역방향 영역 파일 구성(reverse zone file)

vim /var/named/192_168_0.zone

$TTL 60 
@                       IN      SOA     mocha.sangchul.kr. root (
                                        2023011602      ; serial
                                                1D      ; refresh
                                                1H      ; retry
                                                1W      ; expire
                                                3H )    ; minimum
;
                        IN      NS      ns.mocha.sangchul.kr.
                        IN      NS      ns2.mocha.sangchul.kr.
ns                      IN      A       192.168.0.62
ns2                     IN      A       192.168.0.63
;
;
62                      IN      PTR     ns.mocha.sangchul.kr.
63                      IN      PTR     ns2.mocha.sangchul.kr.

61                      IN      PTR     mocha.sangchul.kr.
61                      IN      PTR     www.mocha.sangchul.kr.

마스터 서버에서 DNS 구성 확인

named-checkconf

named-checkconf -z

$ named-checkconf -z
zone localhost/IN: loaded serial 0
zone 1.0.0.127.in-addr.arpa/IN: loaded serial 0
zone mocha.sangchul.kr/IN: loaded serial 2023011602
zone 0.168.192.in-addr.arpa/IN: loaded serial 2023011602

named-checkzone mocha.sangchul.kr mocha.sangchul.kr.zone

$ named-checkzone mocha.sangchul.kr mocha.sangchul.kr.zone 
zone mocha.sangchul.kr/IN: loaded serial 2023011601
OK

named 재시작(reload)

systemctl restart named

(또는)

rndc reload

슬레이브 서버

dns 서버 구성(named.conf)

vim /etc/bind/named.conf

// named.conf
options {
        listen-on port 53 { any; };
        directory "/var/cache/bind";
        dump-file "/var/cache/bind/data/cache_dump.db";
        statistics-file "/var/cache/bind/data/named_stats.txt";
        memstatistics-file "/var/cache/bind/data/named_mem_stats.txt";
        recursing-file "/var/cache/bind/data/named.recursing";
        secroots-file "/var/cache/bind/data/named.secroots";
        version "UNKNOWN";
        allow-query { any; };
        allow-query-cache { any; };
        allow-transfer {
                127.0.0.1;
                192.168.0.63;
        };

        recursion yes;

        // forwarders {
        //      0.0.0.0;
        // };

        dnssec-validation auto;

};

//include "/etc/bind/named.conf.options";
//include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
include "/etc/bind/named.logging.conf";

zone "mocha.sangchul.kr" IN {
        type slave;
        file "slaves/mocha.sangchul.kr.zone";
        masters { 192.168.0.62; };
};

zone "0.168.192.in-addr.arpa" IN {
        type slave;
        file "slaves/192_168_0.zone";
        masters { 192.168.0.62; };
};

슬레이브 zone file 디렉토리 생성

mkdir /var/cache/bind/slaves

chown bind.bind /var/cache/bind/slaves

슬레이브 서버에서 DNS 구성 확인

named-checkconf

named-checkconf -z

$ named-checkconf -z
zone localhost/IN: loaded serial 2
zone 127.in-addr.arpa/IN: loaded serial 1

named 재시작(reload)

systemctl restart named

(또는)

rndc reload

슬레이브 zone file 확인

$ ls -l /var/cache/bind/slaves/
total 8
-rw-r--r-- 1 bind bind 523 Jan 16 12:25 192_168_0.zone
-rw-r--r-- 1 bind bind 436 Jan 16 12:25 mocha.sangchul.kr.zone

$ cat /var/cache/bind/slaves/mocha.sangchul.kr.zone
$ORIGIN .
$TTL 60 ; 1 minute
mocha.sangchul.kr       IN SOA  mocha.sangchul.kr. root.mocha.sangchul.kr. (
                                2023011602 ; serial
                                86400      ; refresh (1 day)
                                3600       ; retry (1 hour)
                                604800     ; expire (1 week)
                                10800      ; minimum (3 hours)
                                )
                        NS      ns.mocha.sangchul.kr.
                        NS      ns2.mocha.sangchul.kr.
                        A       192.168.0.61
$ORIGIN mocha.sangchul.kr.
ns                      A       192.168.0.62
ns2                     A       192.168.0.63
www                     CNAME   mocha.sangchul.kr.

$ cat /var/cache/bind/slaves/192_168_0.zone
$ORIGIN .
$TTL 60 ; 1 minute
0.168.192.in-addr.arpa  IN SOA  mocha.sangchul.kr. root.0.168.192.in-addr.arpa. (
                                2023011602 ; serial
                                86400      ; refresh (1 day)
                                3600       ; retry (1 hour)
                                604800     ; expire (1 week)
                                10800      ; minimum (3 hours)
                                )
                        NS      ns.mocha.sangchul.kr.
                        NS      ns2.mocha.sangchul.kr.
$ORIGIN 0.168.192.in-addr.arpa.
61                      PTR     www.mocha.sangchul.kr.
                        PTR     mocha.sangchul.kr.
62                      PTR     ns.mocha.sangchul.kr.
63                      PTR     ns2.mocha.sangchul.kr.
ns                      A       192.168.0.62
ns2                     A       192.168.0.63

 

---

dns 영역 전송(dns zone transfer) 점검

master와 slave 간에 zone file 동기화(복제)

- zone file 시리얼 번호 확인(soa 레코드 확인)

- master 서버와 slave 서버에서 각각 실행하여 일련번호가 같은지 확인합니다.

;; ANSWER SECTION:
mocha.sangchul.kr.      60      IN      SOA     mocha.sangchul.kr. root.mocha.sangchul.kr. 2023011602 86400 3600 604800 10800

dig @127.0.0.1 mocha.sangchul.kr soa

$ dig @127.0.0.1 mocha.sangchul.kr soa +noquestion +noedns +noednsopt +noadditional +noauthority +nomultiline 

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.10 <<>> @127.0.0.1 mocha.sangchul.kr soa +noquestion +noedns +noednsopt +noadditional +noauthority +nomultiline
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15931
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; ANSWER SECTION:
mocha.sangchul.kr.      60      IN      SOA     mocha.sangchul.kr. root.mocha.sangchul.kr. 2023011602 86400 3600 604800 10800

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Jan 16 12:53:03 KST 2023
;; MSG SIZE  rcvd: 143

dig 명령으로 dns 영역 전송(dns zone transfer) 확인

- 슬레이브 서버에서 실행합니다.

$ dig @192.168.0.62 mocha.sangchul.kr axfr

$ dig @192.168.0.62 mocha.sangchul.kr axfr

; <<>> DiG 9.18.1-1ubuntu1.2-Ubuntu <<>> @192.168.0.62 mocha.sangchul.kr axfr
; (1 server found)
;; global options: +cmd
mocha.sangchul.kr.      60      IN      SOA     mocha.sangchul.kr. root.mocha.sangchul.kr. 2023011602 86400 3600 604800 10800
mocha.sangchul.kr.      60      IN      NS      ns.mocha.sangchul.kr.
mocha.sangchul.kr.      60      IN      NS      ns2.mocha.sangchul.kr.
mocha.sangchul.kr.      60      IN      A       192.168.0.61
ns.mocha.sangchul.kr.   60      IN      A       192.168.0.62
ns2.mocha.sangchul.kr.  60      IN      A       192.168.0.63
www.mocha.sangchul.kr.  60      IN      CNAME   mocha.sangchul.kr.
mocha.sangchul.kr.      60      IN      SOA     mocha.sangchul.kr. root.mocha.sangchul.kr. 2023011602 86400 3600 604800 10800
;; Query time: 4 msec
;; SERVER: 192.168.0.62#53(192.168.0.62) (TCP)
;; WHEN: Mon Jan 16 12:55:59 KST 2023
;; XFR size: 8 records (messages 1, bytes 252)

강제로 dns 영역 전송(dns zone transfer) 하기

rndc retransfer mocha.sangchul.kr

 

참고URL

- ubuntu에 bind 설치하기 : https://scbyun.com/1474

- centos에 bind 설치하기 : https://scbyun.com/1475

- bind logging 설정 : https://scbyun.com/619

- rndc 명령어 : https://scbyun.com/630