bind view

bind view

bind中基础的安全相关的配置：
acl: 把一个或多个地址归并为一个集合，并通过一个统一的名称调用

格式：
acl acl_name {
            ip;
            net/prelen; 
            ……
};
 示例：
acl mynet {
            172.16.0.0/16;
            10.10.10.10;
};

bind有四个内置的acl:

            none: 没有一个主机
            any: 任意主机
            localhost: 本机
            localnet: 本机的IP同掩码运算后得到的网络地址
注意：只能先定义，后使用；因此一般定义在配置文件中，处于options的前面

访问控制的指令：
            allow-query {}： 允许查询的主机；白名单 
            allow-transfer {}：允许区域传送的主机；白名单 
            allow-recursion {}: 允许递归的主机,建议全局使用 
            allow-update {}: 允许更新区域数据库中的内容

view:视图，一个bind服务器可定义多个view，每个view中可 定义一个或多个zone
每个view用来匹配一组客户端
多个view内可能需要对同一个区域进行解析，但使用不同的 区域解析库文件

 格式：
        view VIEW_NAME {
                    match-clients { testacl;  }; 
                    zone “magedu.com” {
                                type master;
                                file “magedu.com.zone”; };
                    include “/etc/named.rfc1912.zones”;
};
注意：
(1) 一旦启用了view，所有的zone都只能定义在view中
(2) 仅在允许递归请求的客户端所在view中定义根区域
(3) 客户端请求到达时，是自上而下检查每个view所服务 的客户端列表

实验实现bind view
实验环境及目标：有A、B、C三台主机，A主机作为DNS服务器，B主机作为beijing区域的DNS客户端，C主机作为zhengzhou区域的DNS客户端，实现访问同一个区域（如：www.xmj.com）但返回的地址不一样
A DNS服务器 192.168.227.130
B beijing 192.168.227.132
C zhengzhou 192.168.227.137
实验步骤：
1、实验前准备
安装bind包，开启服务，关闭防火墙和SELinux安全策略
2、在A主机上定义ACL和view
vim /etc/named.conf
在options前
acl beijing { 192.168.227.132;};
acl zhegzhou { 192.168.227.137;};
acl other { any;};
在定义zone的地方
view beijingview {
match-clients {beijing;};
include "/etc/named.beijingview.zones";
};
view zhengzhouview {
match-clients {zhengzhou;};
include "/etc/named.zhengzhouview.zones";
};
view otherview {
match-clients {other;};
include "/etc/named.rfc1912.zones";
};

移走根区域信息到/etc/named.rfc1912.zones
3、在A主机上创建相应的区域信息数据文件
vim /etc/named.beijingview.zones
zone "xmj.com" {
type master;
file "xmj.com.zone.bj";
};
vim /etc/named.zhengzhouview.zones
zone "xmj.com" {
type master;
file "xmj.com.zone.zz";
};
4、创建对应的数据库文件
vim /var/named/xmj.com.zone.bj

[root@centos named]#vim /var/named/xmj.com.zone.bj
$TTL 86400      ; 1 day
@                       IN SOA  dns1 dnsadmin (
                                3          ; serial
                                86400      ; refresh (1 day)
                                3600       ; retry (1 hour)
                                604800     ; expire (1 week)
                                10800      ; minimum (3 hours)
                                )
                        NS      dns1.xmj.com.
dns1                    A       192.168.227.130
websrv                  A       1.1.1.1
www                     CNAME   websrv

/var/named/xmj.com.zone.zz

[root@centos named]#vim /var/named/xmj.com.zone.zz
$TTL 86400      ; 1 day
@                       IN SOA  dns1 dnsadmin (
                                3          ; serial
                                86400      ; refresh (1 day)
                                3600       ; retry (1 hour)
                                604800     ; expire (1 week)
                                10800      ; minimum (3 hours)
                                )
                        NS      dns1.xmj.com.
dns1                    A       192.168.227.130
websrv                  A       2.2.2.2
www                     CNAME   websrv

named-checkconf 检查相关配置文件是否存在语法问题
named-checkzone xmj.xom /var/named/xmj.com.zone.bj检查区域数据库文件是否存在问题
rndc reload 加载配置
systemctl restart named 重启DNS服务
systemctl restart network 重启网络服务
5、测试：
先自测看是否存在问题
A dig www.xmj.com @192.168.227.130

[root@centos named]#dig www.xmj.com @192.168.227.130

; <<>> DiG 9.9.4-RedHat-9.9.4-37.el7 <<>> www.xmj.com @192.168.227.130
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10881
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 2
  
▽; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.xmj.com.                   IN      A

;; ANSWER SECTION:
www.xmj.com.            86400   IN      CNAME   websrv.xmj.com.
websrv.xmj.com.         86400   IN      A       1.1.1.1

;; AUTHORITY SECTION:
xmj.com.                86400   IN      NS      dns1.xmj.com.

;; ADDITIONAL SECTION:
dns1.xmj.com.           86400   IN      A       192.168.227.130

;; Query time: 0 msec
;; SERVER: 192.168.227.130#53(192.168.227.130)
;; WHEN: Mon Jul 31 16:35:49 CST 2017
;; MSG SIZE  rcvd: 112

B dig www.xmj.com @192.168.227.130

[root@centos selinux]#dig www.xmj.com @192.168.227.130

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6 <<>> www.xmj.com @192.168.227.130
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57968
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;www.xmj.com.                   IN      A

;; ANSWER SECTION:
www.xmj.com.            86400   IN      CNAME   websrv.xmj.com.
websrv.xmj.com.         86400   IN      A       1.1.1.1

;; AUTHORITY SECTION:
xmj.com.                86400   IN      NS      dns1.xmj.com.

;; ADDITIONAL SECTION:
dns1.xmj.com.           86400   IN      A       192.168.227.130

;; Query time: 1 msec
;; SERVER: 192.168.227.130#53(192.168.227.130)
;; WHEN: Mon Jul 31 16:36:06 2017
;; MSG SIZE  rcvd: 101

C dig www.xmj.com @192.168.227.130

[root@rhel ~]# dig www.xmj.com @192.168.227.130

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5 <<>> www.xmj.com @192.168.227.130
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58814
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;www.xmj.com.                   IN      A

;; ANSWER SECTION:
www.xmj.com.            86400   IN      CNAME   websrv.xmj.com.
websrv.xmj.com.         86400   IN      A       2.2.2.2

;; AUTHORITY SECTION:
xmj.com.                86400   IN      NS      dns1.xmj.com.

;; ADDITIONAL SECTION:
dns1.xmj.com.           86400   IN      A       192.168.227.130

;; Query time: 38 msec
;; SERVER: 192.168.227.130#53(192.168.227.130)
;; WHEN: Tue Aug  1 00:36:23 2017
;; MSG SIZE  rcvd: 101

注意：ACL中建议小地址放在前面，大范围地址放在后面，不要造成上面大的地址范围包含下面的地址，不然会一旦上面匹配忽略下面的ACL