RHEL5.2下DNS与DHCP的互动更新-51CTO.COM

RHEL5.2下DNS与DHCP的互动更新

一、实验目标

在Linux平台下实现DHCP与DNS互动更新的功能。

二、实验环境

一台Linux服务器版本为Red Hat Enterprise Linux Server release 5.2 (Tikanga)，内核版本号2.6.18-92.el5；两台客户端：一台为Windows XP Professional SP3；一台为Linux主机，版本同服务器。

三、搭建DNS服务（bind）

1．安装bind相关软件包

放入安装光盘，并切换到软件包所在目录，执行下列命令安装相应软件包：

rpm -ivh bind-9.3.4-6.P1.el5.i386.rpm

rpm -ivh bind-chroot-9.3.4-6.P1.el5.i386.rpm

rpm -ivh bind-devel-9.3.4-6.P1.el5.i386.rpm

rpm -ivh bind-libbind-devel-9.3.4-6.P1.el5.i386.rpm

rpm -ivh bind-libs-9.3.4-6.P1.el5.i386.rpm

rpm -ivh bind-sdb-9.3.4-6.P1.el5.i386.rpm

rpm -ihv bind-utils-9.3.4-6.P1.el5.i386.rpm

rpm -ivh caching-nameserver-9.3.4-6.P1.el5.i386.rpm

2．创建密钥

要实现DNS的动态更新，首先要考虑的是怎样保证安全地实现DDNS。由ISC给出的方法是创建进行动态更新的密钥，在进行更新时通过该密钥加以验证。为了实现这一功能，需要以root身份运行以下命令：

[root@server etc]# dnssec-keygen -a HMAC-MD5 -b 128 -n USER administrator

上述dnssec-keygen命令的功能就是生成更新密钥，其中参数-a HMAC-MD5是指密钥的生成算法采用HMAC-MD5；参数-b 128是指密钥的位数为128位；参数-n USER administrator是指密钥的用户为administrator。

该命令生成的一对密钥文件如下：

-rw------- 1 named named 55 Jun 20 00:54 Kadministrator.+157+49362.key

-rw------- 1 named named 81 Jun 20 00:54 Kadministrator.+157+49362.private

可以查看刚生成的密钥文件内容：

[root@server etc]# cat Kadministrator.+157+49362.key

administrator. IN KEY 0 3 157 txOBJNpI39770VEkbPQQ6w==

[root@server etc]# cat Kadministrator.+157+49362.private

Private-key-format: v1.2

Algorithm: 157 (HMAC_MD5)

Key: txOBJNpI39770VEkbPQQ6w==

仔细阅读该密钥文件就会发现，这两个文件中包含的密钥是一样的，该密钥就是DHCP对DNS进行安全动态更新时的凭据。后面需要将该密钥分别添加到DNS和DHCP的配置文件中。

3．配置主配置文件。这里有两种方法：

1）去除掉/var/named/chroot/etc/named.caching-nameserver.conf文件中以下几行内容：

listen-on port 53 { 127.0.0.1; };

listen-on-v6 port 53 { ::1; };

allow-query { localhost; };

match-clients { localhost; };

match-destinations { localhost; };

修改后的如下：

[root@server etc]# cat named.caching-nameserver.conf

// named.caching-nameserver.conf

// Provided by Red Hat caching-nameserver package to configure the

// ISC BIND named(8) DNS server as a caching only nameserver

// (as a localhost DNS resolver only).

// See /usr/share/doc/bind*/sample/ for example named configuration files.

// DO NOT EDIT THIS FILE - use system-config-bind or an editor

// to create named.conf - edits to this file will be lost on

// caching-nameserver package upgrade.

options {

directory "/var/named";

dump-file "/var/named/data/cache_dump.db";

statistics-file "/var/named/data/named_stats.txt";

memstatistics-file "/var/named/data/named_mem_stats.txt";

query-source port 53;

query-source-v6 port 53;

};

logging {

channel default_debug {

file "data/named.run";

severity dynamic;

};

view localhost_resolver {

recursion yes;

include "/etc/named.rfc1912.zones";

};

在文件/var/named/chroot/etc/ named.rfc1912.zones中添加新的解析域，结果如下：

[root@server etc]# cat named.rfc1912.zones

// named.rfc1912.zones:

// Provided by Red Hat caching-nameserver package

// ISC BIND named zone configuration for zones recommended by

// RFC 1912 section 4.1 : localhost TLDs and address zones

// See /usr/share/doc/bind*/sample/ for example named configuration files.

key administrator {

algorithm HMAC-MD5.SIG-ALG.REG.INT;

secret txOBJNpI39770VEkbPQQ6w==;

};

zone "." IN {

type hint;

file "named.ca";

};

zone "localdomain" IN {

type master;

file "localdomain.zone";

allow-update { none; };

};

zone "localhost" IN {

type master;

file "localhost.zone";

allow-update { none; };

};

zone "0.0.127.in-addr.arpa" IN {

type master;

file "named.local";

allow-update { none; };

};

zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {

type master;

file "named.ip6.local";

allow-update { none; };

};

zone "255.in-addr.arpa" IN {

type master;

file "named.broadcast";

allow-update { none; };

};

zone "0.in-addr.arpa" IN {

type master;

file "named.zero";

allow-update { none; };

};

zone "china.test" IN {

type master;

file "china.test.zone";

allow-update { key administrator; };

};

zone "13.168.192.in-addr.arpa" IN {

type master;

file "china.test.arpa";

allow-update { key administrator; };

};

#p#

2）切换到/var/named/chroot/etc/目录，将named.rfc1912.zones追加到named.caching-nameserver.conf中，合两为一，按照***种方法删除、添加相应内容，并删除view localhost_resolver项所有内容。

4．在/var/named/chroot/var/named目录下添加域配置文件，文件如下：

[root@server named]# cat china.test.zone

$TTL 86400

@ IN SOA server.china.test. root.china.test. (

2009062000

28800

14400

360000

86400

)

@ IN NS server.china.test.

server IN A 192.168.13.11

client IN A 192.168.13.24

[root@server named]# cat china.test.arpa

$TTL 86400

@ IN SOA server.china.test. root.server.china.test. (

2009062000 ; Serial

28800 ; Refresh

14400 ; Retry

3600000 ; Expire

86400 ) ; Minimum

@ IN NS server.china.test.

11 IN PTR server.china.test.

5．用chkconfig --level 3 named on命令设置开机自动开启DNS服务。

6．启用DNS服务service named start

7．在客户端主机的/etc/resolv.conf文件中指定DNS服务器：nameserver 192.168.13.11

四、搭建DHCP服务

1. dhcp相关软件包

rpm -ivh dhcp-3.0.5-13.el5.i386.rpm

rpm -ivh dhcp-devel-3.0.5-13.el5.i386.rpm

2. 修改配置文件。修改后的配置文件如下：

[root@server ~]# cat /etc/dhcpd.conf

ddns-update-style interim;

allow client-updates;

key administrator {

algorithm HMAC-MD5;

secret txOBJNpI39770VEkbPQQ6w==;

};

zone china.test. {

primary 192.168.13.11;

key administrator;

}

zone 13.168.192.in-addr.arpa. {

primary 192.168.13.11;

key administrator;

}

subnet 192.168.13.0 netmask 255.255.255.0 {

# --- default gateway

option routers 192.168.13.13;

option subnet-mask 255.255.255.0;

option nis-domain "china.test";

option domain-name "china.test";

option domain-name-servers 192.168.13.11;

# option time-offset -18000; # Eastern Standard Time

# option ntp-servers 192.168.1.1;

# option netbios-name-servers 192.168.1.1;

# --- Selects point-to-point node (default is hybrid). Don't change this unless

# -- you understand Netbios very well

# option netbios-node-type 2;

range dynamic-bootp 192.168.13.1 192.168.13.23;

default-lease-time 180;

max-lease-time 300;

}

3. 用chkconfig --level 3 dhcpd on命令设置开机自动开启DNS服务。

4. 启用DNS服务service dhcpd start

5. 在客户端主机上添加DHCP客户端配置文件/etc/dhclient.conf，内容如下：

[root@client ~]# cat /etc/dhclient.conf

send fqdn.fqdn "client";

send fqdn.encoded on;

#p#

6. 在服务器上查DHCP分配文件/var/lib/dhcpd/dhcpd.leases：

[root@server ~]# cat /var/lib/dhcpd/dhcpd.leases

# All times in this file are in UTC (GMT), not your local timezone. This is

# not a bug, so please don't ask about it. There is no portable way to

# store leases in the local timezone, so please don't request this as a

# feature. If this is inconvenient or confusing to you, we sincerely

# apologize. Seriously, though - don't ask.

# The format of this file is documented in the dhcpd.leases(5) manual page.

# This lease file was written by isc-dhcp-V3.0.5-RedHat

lease 192.168.13.23 {

starts 6 2009/06/20 08:20:53;

ends 6 2009/06/20 08:25:53;

binding state active;

next binding state free;

hardware ethernet 00:0c:29:71:c6:09;

set ddns-rev-name = "23.13.168.192.in-addr.arpa.";

set ddns-txt = "0003680744ede9faf3e6e8bd78563f6857";

set ddns-fwd-name = "client.china.test";

}

7. 查看/var/named/chroot/var/named目录，自动生成如下两个文件，用于DNS更新。

-rw-r--r-- 1 named named 1980 Jun 20 16:20 china.test.arpa.jnl

-rw-r--r-- 1 named named 1825 Jun 20 16:20 china.test.zone.jnl

8. 查看域文件内容如下：

[root@server named]# cat china.test.zone

$ORIGIN .

$TTL 86400 ; 1 day

china.test IN SOA server.china.test. root.china.test. (

2009062021 ; serial

28800 ; refresh (8 hours)

14400 ; retry (4 hours)

360000 ; expire (4 days 4 hours)

86400 ; minimum (1 day)

)

NS server.china.test.

$ORIGIN china.test.

$TTL 150 ; 2 minutes 30 seconds

client A 192.168.13.23

TXT "0003680744ede9faf3e6e8bd78563f6857"

$TTL 86400 ; 1 day

server A 192.168.13.11

[root@server named]# cat china.test.arpa

$ORIGIN .

$TTL 86400 ; 1 day

13.168.192.in-addr.arpa IN SOA server.china.test. root.server.china.test. (

2009062017 ; serial

28800 ; refresh (8 hours)

14400 ; retry (4 hours)

3600000 ; expire (5 weeks 6 days 16 hours)

86400 ; minimum (1 day)

)

NS server.china.test.

$ORIGIN 13.168.192.in-addr.arpa.

11 PTR server.china.test.

$TTL 150 ; 2 minutes 30 seconds

23 PTR client.china.test.

五、结论

1、表面现象：

1）更新比较慢，甚至需要手动重启DNS服务才能更新成功。

2）反向解析没有清除旧的记录，如下：

[root@server ~]# cat /var/named/chroot/var/named/china.test.arpa

$ORIGIN .

$TTL 86400 ; 1 day

13.168.192.in-addr.arpa IN SOA server.china.test. root.server.china.test. (

2009062019 ; serial

28800 ; refresh (8 hours)

14400 ; retry (4 hours)

3600000 ; expire (5 weeks 6 days 16 hours)

86400 ; minimum (1 day)

)

NS server.china.test.

$ORIGIN 13.168.192.in-addr.arpa.

11 PTR server.china.test.

$TTL 150 ; 2 minutes 30 seconds

12 PTR WWW-2E8A24A84C2.china.test.

20 PTR client.china.test.

23 PTR client.china.test.

24 PTR client.china.test.

2、更新日志：

Jun 20 22:35:25 server named[2719]: starting BIND 9.3.4-P1 -u named -c /etc/named.caching-nameserver.conf -t /var/named/chroot

Jun 20 22:35:25 server named[2719]: found 1 CPU, using 1 worker thread

Jun 20 22:35:25 server named[2719]: loading configuration from '/etc/named.caching-nameserver.conf'

Jun 20 22:35:25 server named[2719]: listening on IPv4 interface lo, 127.0.0.1#53

Jun 20 22:35:25 server named[2719]: listening on IPv4 interface eth0, 192.168.13.11#53

Jun 20 22:35:25 server named[2719]: command channel listening on 127.0.0.1#953

Jun 20 22:35:25 server named[2719]: command channel listening on ::1#953

Jun 20 22:35:25 server named[2719]: zone 0.in-addr.arpa/IN/localhost_resolver: loaded serial 42

Jun 20 22:35:25 server named[2719]: zone 0.0.127.in-addr.arpa/IN/localhost_resolver: loaded serial 1997022700

Jun 20 22:35:25 server named[2719]: zone 13.168.192.in-addr.arpa/IN/localhost_resolver: loaded serial 2009062027

Jun 20 22:35:25 server named[2719]: zone 255.in-addr.arpa/IN/localhost_resolver: loaded serial 42

Jun 20 22:35:25 server named[2719]: zone 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN/localhost_resolver: loaded serial 1997022700

Jun 20 22:35:25 server named[2719]: zone localdomain/IN/localhost_resolver: loaded serial 42

Jun 20 22:35:25 server named[2719]: zone localhost/IN/localhost_resolver: loaded serial 42

Jun 20 22:35:25 server named[2719]: zone china.test/IN/localhost_resolver: loaded serial 2009062035

Jun 20 22:35:25 server named[2719]: running

Jun 20 22:35:25 server dhcpd: Internet Systems Consortium DHCP Server V3.0.5-RedHat

Jun 20 22:35:25 server dhcpd: For info, please visit http://www.isc.org/sw/dhcp/

Jun 20 22:35:25 server dhcpd: lease 192.168.13.22: no subnet.

Jun 20 22:35:25 server last message repeated 3 times

Jun 20 22:35:25 server dhcpd: Wrote 1 leases to leases file.

Jun 20 22:35:25 server dhcpd: Listening on LPF/eth0/00:0c:29:64:e2:df/192.168.13/24

Jun 20 22:35:25 server dhcpd: Sending on LPF/eth0/00:0c:29:64:e2:df/192.168.13/24

Jun 20 22:35:25 server dhcpd: Sending on Socket/fallback/fallback-net

Jun 20 22:35:33 server dhcpd: DHCPREQUEST for 192.168.13.22 from 00:0c:29:71:c6:09 via eth0: unknown lease 192.168.13.22.

Jun 20 22:35:37 server dhcpd: DHCPREQUEST for 192.168.13.22 from 00:0c:29:71:c6:09 via eth0: unknown lease 192.168.13.22.

Jun 20 22:35:49 server dhcpd: DHCPDISCOVER from 00:0c:29:71:c6:09 via eth0

Jun 20 22:35:50 server dhcpd: DHCPOFFER on 192.168.13.24 to 00:0c:29:71:c6:09 via eth0

Jun 20 22:35:50 server named[2719]: client 192.168.13.11#32772: view localhost_resolver: updating zone 'china.test/IN': update unsuccessful: client.china.test: 'name not in use' prerequisite not satisfied (YXDOMAIN)

Jun 20 22:35:50 server named[2719]: client 192.168.13.11#32772: view localhost_resolver: updating zone 'china.test/IN': deleting rrset at 'client.china.test' A

Jun 20 22:35:50 server named[2719]: client 192.168.13.11#32772: view localhost_resolver: updating zone 'china.test/IN': adding an RR at 'client.china.test' A

Jun 20 22:35:50 server dhcpd: Added new forward map from client.china.test to 192.168.13.24

Jun 20 22:35:50 server named[2719]: client 192.168.13.11#32772: view localhost_resolver: updating zone '13.168.192.in-addr.arpa/IN': deleting rrset at '24.13.168.192.in-addr.arpa' PTR

Jun 20 22:35:50 server named[2719]: client 192.168.13.11#32772: view localhost_resolver: updating zone '13.168.192.in-addr.arpa/IN': adding an RR at '24.13.168.192.in-addr.arpa' PTR

Jun 20 22:35:50 server dhcpd: added reverse map from 24.13.168.192.in-addr.arpa. to client.china.test

3、客户端解析如下：

C:\>nslookup

Default Server: server.china.test

Address: 192.168.13.11

> client.china.test

Server: server.china.test

Address: 192.168.13.11

Name: client.china.test

Address: 192.168.13.24

> 192.168.13.23

Server: server.china.test

Address: 192.168.13.11

Name: WWW-2E8A24A84C2.china.test

Address: 192.168.13.23

> 192.168.13.24

Server: server.china.test

Address: 192.168.13.11

Name: client.china.test

Address: 192.168.13.24

> WWW-2E8A24A84C2.china.test

Server: server.china.test

Address: 192.168.13.11

Name: WWW-2E8A24A84C2.china.test

Address: 192.168.13.23

4、最终结论：

实现了DNS与DHCP的互动更新功能。工作过程使用域文件为：china.test.arpa.jnl和 china.test.zone.jnl，而不在是传统的china.test.arpa和china.test.zone文件。

【编辑推荐】