環境：
1、master： 192.168.1.13， freebsd 10
2、slave： 192.168.1.153， freesbsd 10
實驗目標：
1、配置主從，實現多臺dns服務器自動同步
2、找出排除故障工具
3、在不重啓named服務時，如何觸發dns記錄更新。
步驟一：
在主從服務器上都安裝bind軟件。我的是bind99. 具體操作略。提示，通過ports安裝或通過pkg install bind99安裝。並確保兩臺服務器之間網絡連通性，並關閉防火牆。本機的dns服務器IP地址設置爲本地IP。
步驟二：配置master
配置內容如下：
$ cat /usr/local/etc/namedb/named.conf
options { directory "/usr/local/etc/namedb/working";
pid-file "/var/run/named/pid";
dump-file "/var/dump/named_dump.db";
statistics-file "/var/stats/named.stats";
allow-query { any; };
notify yes;
allow-transfer { any; };
listen-on { 192.168.1.13; };
also-notify { 192.168.1.153; };
forwarders {
114.114.114.114;
};
};
logging {
channel error_log {
file "/var/log/named/error.log" versions 10 size 32m;
severity info;
print-time yes;
print-severity yes;
print-category yes;
};
channel query_log {
file "/var/log/named/query.log" versions 10 size 32m;
severity info;
print-time yes;
print-severity yes;
print-category yes;
};
channel update_debug {
file "/var/log/named/update-debug.log" versions 10 size 32m;
severity debug 3;
print-category yes;
print-severity yes;
print-time yes;
};
channel security_info {
file "/var/log/named/named-auth.log" versions 10 size 32m;
severity info;
print-category yes;
print-severity yes;
print-time yes;
};
channel notify_log {
file "/var/log/named/notify.log" versions 10 size 32m;
severity info;
print-category yes;
print-severity yes;
print-time yes;
};
channel xfer-out_log {
file "/var/log/named/xfer-out.log" versions 10 size 32m;
severity info;
print-category yes;
print-severity yes;
print-time yes;
};
category update { update_debug; };
category security { security_info; };
category default { error_log; };
category queries { query_log; };
category notify { notify_log; };
category xfer-out { xfer-out_log; };
};
zone "umg.com.cn" {
type master;
file "/usr/local/etc/namedb/master/umg.com.cn";
};
備註：把不需要的內容刪除吧。
隨便添加幾個記錄吧，已測試同步過程。
$ cat /usr/local/etc/namedb/master/umg.com.cn
$TTL 1h ; 1 hours
@ IN SOA ns1.umg.com.cn. hostmaster.umg.com.cn. (
2015031907 ; serial
3H ; refresh
15 ; retry
1w ; expire
600 ; minimum
)
IN NS ns1.umg.com.cn.
ns1 IN A 192.168.1.13
file IN A 192.168.1.13
TESTSER IN A 192.168.1.11
umg-dc-vcenter IN A 192.168.1.31
zhaoxw1 IN A 192.168.0.221
liangsc IN A 192.168.0.222
chenqh IN A 192.168.0.223
shenp IN A 192.168.0.224
liyong IN A 192.168.0.225
步驟三，配置slave
# cat /usr/local/etc/namedb/named.conf
options {
directory "/usr/local/etc/namedb/working";
pid-file "/var/run/named/pid";
dump-file "/var/dump/named_dump.db";
statistics-file "/var/stats/named.stats";
listen-on { 192.168.1.153; };
forwarders {
114.114.114.114;
};
};
logging {
channel error_log {
file "/var/log/named/error.log" versions 10 size 32m;
severity info;
print-time yes;
print-severity yes;
print-category yes;
};
channel query_log {
file "/var/log/named/query.log" versions 10 size 32m;
severity info;
print-time yes;
print-severity yes;
print-category yes;
};
channel update_debug {
file "/var/log/named/update-debug.log" versions 10 size 32m;
severity debug 3;
print-category yes;
print-severity yes;
print-time yes;
};
channel security_info {
file "/var/log/named/named-auth.log" versions 10 size 32m;
severity info;
print-category yes;
print-severity yes;
print-time yes;
};
channel notify_log {
file "/var/log/named/notify.log" versions 10 size 32m;
severity info;
print-category yes;
print-severity yes;
print-time yes;
};
channel xfer-out_log {
file "/var/log/named/xfer-out.log" versions 10 size 32m;
severity info;
print-category yes;
print-severity yes;
print-time yes;
};
category update { update_debug; };
category security { security_info; };
category default { error_log; };
category queries { query_log; };
category notify { notify_log; };
category xfer-out { xfer-out_log; };
};
zone "umg.com.cn" {
type slave;
file "/usr/local/etc/namedb/slave/umg.com.cn.slave";
masters {
192.168.1.13;
};
notify no;
};
步驟四，準備啓動named服務進行測試。
master和slave服務器的rc.conf文件中，都添加如下內容：
named_enable="YES"
在兩臺服務器上創建目錄,並賦權限：
mkdir /var/log/named
chmod 777 /var/log/named
在兩臺服務器上都啓動named服務：
service named start
在master上測試dns記錄。
$ dig file.umg.com.cn
; <<>> DiG 9.9.6-P1 <<>> file.umg.com.cn
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4032
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;file.umg.com.cn. IN A
;; ANSWER SECTION:
file.umg.com.cn. 3600 IN A 192.168.1.13
;; AUTHORITY SECTION:
umg.com.cn. 3600 IN NS ns1.umg.com.cn.
;; ADDITIONAL SECTION:
ns1.umg.com.cn. 3600 IN A 192.168.1.13
;; Query time: 0 msec
;; SERVER: 192.168.1.13#53(192.168.1.13)
;; WHEN: Tue May 19 08:36:53 CST 2015
;; MSG SIZE rcvd: 94
在slave服務器上，查看是否已經同步dns記錄了。
# ls -l /usr/local/etc/namedb/slave/
total 5
-rw-r--r-- 1 bind bind 577 May 19 07:18 umg.com.cn.slave
可以發現，slave已經同步dns記錄到本地了。能使用cat命令查看umg.com.cn.slave文件嗎？
# file /usr/local/etc/namedb/slave/umg.com.cn.slave
/usr/local/etc/namedb/slave/umg.com.cn.slave: data
原來該文件是個data類型的文件。無法使用cat命令查看。那如何查看呢？其實方法和上面一樣。使用dig命令查看。
# dig zhaoxw1.umg.com.cn
; <<>> DiG 9.9.7 <<>> zhaoxw1.umg.com.cn
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6142
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;zhaoxw1.umg.com.cn. IN A
;; ANSWER SECTION:
zhaoxw1.umg.com.cn. 3600 IN A 192.168.0.221
;; AUTHORITY SECTION:
umg.com.cn. 3600 IN NS ns1.umg.com.cn.
;; ADDITIONAL SECTION:
ns1.umg.com.cn. 3600 IN A 192.168.1.13
;; Query time: 0 msec
;; SERVER: 192.168.1.153#53(192.168.1.153)
;; WHEN: Tue May 19 09:36:18 CST 2015
;; MSG SIZE rcvd: 97
使用本地的DNS可以解析A記錄。
步驟五，故障排除
我們經常會遇到這種情況，master端修改了記錄，可客戶端並沒有同步記錄。爲啥？
一般有幾個原因。
1、修改記錄後，要把master中的serial number數字增大，一般以日期進行編號，比如第一次是2015031901，修改後的編號名稱可以爲2015031902或2015031903等等。編輯好後，重啓named服務或者執行rndc reload. 觸發dns同步。
2、修改記錄時，格式有錯誤，比如把IP地址寫成218.4.2.3，1. 其中一個實心圓點寫成了逗號。
3、修改serialnumber時，把後面的封號刪除了。
如果上述問題都沒有發生，還是無法同步。測試，我們必須要通過log來查看到底問題出現在什麼地方。其實上面的配置中，已經啓用了log功能。可以清晰的看到同步過程。根據上面的配置，log都放在了/var/log/named目錄下。
我們在master上查看同步記錄：
$ cat /var/log/named/notify.log
18-May-2015 16:52:43.193 notify: info: zone umg.com.cn/IN: sending notifies (serial 2015031905)
18-May-2015 16:53:48.598 notify: info: zone umg.com.cn/IN: sending notifies (serial 2015031906)
18-May-2015 17:12:23.703 notify: info: zone umg.com.cn/IN: sending notifies (serial 2015031907)
其中可以清楚的看到同步時間和serial 2015031907。
在slave上查看：
# cat /var/log/named/notify.log
18-May-2015 17:47:46.902 notify: info: client 192.168.1.13#54628: received notify for zone 'umg.com.cn'
18-May-2015 17:48:52.305 notify: info: client 192.168.1.13#53931: received notify for zone 'umg.com.cn'
18-May-2015 18:07:27.395 notify: info: client 192.168.1.13#58539: received notify for zone 'umg.com.cn
也可以看到同步記錄，但這裏沒有serial。
我們還可以查看error日誌，看看問題在哪裏：
$ tail /var/log/named/error.log