建立内部动态DNS服务器

因为各种不同的原因，企业内部往往会有多台DHCP服务器，负责分发IP地址，给内部网络管理带来不便。本文将介绍如何在企业内部用BIND9建立内部DDNS服务，解决网络管理不便的问题。

假设企业内部有三台DHCP服务器负责为三个子域分发IP地址，三个子域分别是rd.lswin.cn(192.168.230.0/24)、ga.lswin.cn(192.168.231.0/24)和sm.lswin.cn(192.168.232.0/24)。

示例中，DDNS服务器的名称为ddns.lswin.cn。

安装 /配置BIND9

安装 BIND9

 root@ddns:~# apt-get update && apt-get install bind9

配置BIND9

修改/etc/bind/named.conf.local 文件

//
// Do any local configuration here
//// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";//
// ___***___ Own DynDNS
//
include "/etc/bind/ddns-keys.conf";//
// rd.lswin.cn zone 配置
//
zone "rd.lswin.cn" {type master;file "/var/lib/bind/rd.lswin.cn.zone";allow-update { key rd-lswin-cn.;};notify no;
};// Reverse DNS 的定义. 用您的子域地址替代 230.168.192
zone "230.168.192.in-addr.arpa" {type master;file "/var/lib/bind/rd.lswin.cn.rev.zone";allow-update { key rd-lswin-cn.; };
};//
// ga.lswin.cn zone 配置
//
zone "ga.lswin.cn" {type master;file "/var/lib/bind/ga.lswin.cn.zone";allow-update { key ga-lswin-cn.;};notify no;
};// Reverse DNS 的定义. 用您的子域地址替代 231.168.192
zone "231.168.192.in-addr.arpa" {type master;file "/var/lib/bind/ga.lswin.cn.rev.zone";allow-update { key ga-lswin-cn.; };
};//
// sm.lswin.cn zone 配置
//
zone "sm.lswin.cn" {type master;file "/var/lib/bind/sm.lswin.cn.zone";allow-update { key sm-lswin-cn.;};notify no;
};// Reverse DNS 的定义. 用您的子域地址替代 232.168.192
zone "232.168.192.in-addr.arpa" {type master;file "/var/lib/bind/sm.lswin.cn.rev.zone";allow-update { key sm-lswin-cn.; };
};

为子域配置库文件

/var/lib/bind/rd.lswin.cn.zone

$ORIGIN .
$TTL 907200     ; 1 week 3 days 12 hours
rd.lswin.cn             IN SOA  ns1.rd.lswin.cn. (2014071478 ; serial28800      ; refresh (8 hours)3600       ; retry (1 hour)604800     ; expire (1 week)38400      ; minimum (10 hours 40 minutes))NS      ns1.rd.lswin.cn.
$ORIGIN rd.lswin.cn.
ns1                     A       192.168.230.1

/var/lib/bind/rd.lswin.cn.rev.zone

$ORIGIN .
$TTL 907200     ; 1 week 3 days 12 hours
230.168.192.in-addr.arpa IN SOA ns1.rd.lswin.cn. (2014071452 ; serial28800      ; refresh (8 hours)604800     ; retry (1 week)604800     ; expire (1 week)86400      ; minimum (1 day))NS      ns1.rd.lswin.cn.
$ORIGIN 230.168.192.in-addr.arpa.
1                       PTR     rd.lswin.cn.PTR     ns1.rd.lswin.cn.PTR     admin.rd.lswin.cn.

其他二个zone的和这个配置基本一致，只需修改IP地址和子域名即可。

为子域配置生成密匙
首先为三个子域生成不同的密匙，然后将生成的密匙放入密匙文件 /etc/bind/ddns-keys.conf

root@ddns:~# tsig-keygen -a hmac-sha512 rd-lswin-cn.
root@ddns:~# tsig-keygen -a hmac-sha512 rd-lswin-cn.
root@ddns:~# tsig-keygen -a hmac-sha512 rd-lswin-cn.

key "rd-lswin-cn." {algorithm hmac-sha512;secret "dWZM3Go6hz7AL/VX3ihaQpTgwyigx27hIoKgxVooYblnFkgKTPjBiUhScM+eOpO4PrD1EgYwCIc/zb3WzoUadg==";
};
key "ga-lswin-cn." {algorithm hmac-sha512;secret "0avlbJzkK0DWB0XZbYDjK5Q7gAjmbTCPliHaV19di0KnH7lKitclqOF/l/S8SP5BFSUbpDQTen0OY/9mvcfGbA==";
};
key "sm-lswin-cn." {algorithm hmac-sha512;secret "HxyVoX1/i5293TD3fXUxRLyuyjofdnKUy3fsvamB4myAAva4etoa+4rQliXb2+PoVpLxOyOkwN8ksY5ypioG1A==";
};

检查配置/重启BIND9

检查配置

root@ddns:~# named-checkconf
root@ddns:~# named-checkzone rd.lswin.cn /var/lib/bind/rd.lswin.cn.zone
zone rd.lswin.cn/IN: loaded serial 2014071478
OK
root@ddns:~# named-checkzone ga.lswin.cn /var/lib/bind/ga.lswin.cn.zone
zone ga.lswin.cn/IN: loaded serial 2014071478
OK
root@ddns:~# named-checkzone sm.lswin.cn /var/lib/bind/sm.lswin.cn.zone
zone sm.lswin.cn/IN: loaded serial 2014071478
OK
root@ddns:~#

如没问题，就可以重启BIND9。

root@ddns:~# service bind9 restart
root@ddns:~#

测试动态更新功能

三组配置完全相似，我们只测试一组配置。

建立key文件 ga-lswin-cn.key
从现有配置中，将ga.lswin.cn的key复制过来。

key "ga-lswin-cn." {algorithm hmac-sha512;secret "0avlbJzkK0DWB0XZbYDjK5Q7gAjmbTCPliHaV19di0KnH7lKitclqOF/l/S8SP5BFSUbpDQTen0OY/9mvcfGbA==";
};

测试正向DDNS添加

root@ddns:~# nslookup test.ga.lswin.cn ddns.lswin.cn
Server:     ddns.lswin.cn
Address:    192.168.220.109#53** server can't find test.ga.lswin.cn: NXDOMAIN
root@ddns:~# nsupdate -k ./ga-lswin-cn.key
> server ddns.lswin.cn
> zone ga.lswin.cn
> update add test.ga.lswin.cn 7200 IN A 192.168.231.123
> show
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; ZONE SECTION:
;ga.lswin.cn.           IN  SOA;; UPDATE SECTION:
test.ga.lswin.cn.   7200    IN  A   192.168.231.123> send
> quit
root@ddns:~# nslookup test.ga.lswin.cn ddns.lswin.cn
Server:     ddns.lswin.cn
Address:    192.168.220.109#53Name: test.ga.lswin.cn
Address: 192.168.231.123root@ddns:~#

记录 test.ga.lswin.cn 已成功加入DDNS。

测试正向DDNS删除

root@ddns:~#
root@ddns:~# nslookup test.ga.lswin.cn ddns.lswin.cn
Server:     ddns.lswin.cn
Address:    192.168.220.109#53Name: test.ga.lswin.cn
Address: 192.168.231.123root@ddns:~# nsupdate -k ./ga-lswin-cn.key
> server ddns.lswin.cn
> zone ga.lswin.cn
> update delete test.ga.lswin.cn A
> send
> quit
root@ddns:~# nslookup test.ga.lswin.cn ddns.lswin.cn
Server:     ddns.lswin.cn
Address:    192.168.220.109#53** server can't find test.ga.lswin.cn: NXDOMAINroot@ddns:~#

记录test.ga.lswin.cn已从DDNS中成功删除。

**测试逆向DDNS添加**

root@ddns:~#
root@ddns:~# nslookup 192.168.231.123 ddns.lswin.cn
** server can't find 123.231.168.192.in-addr.arpa: NXDOMAINroot@ddns:~# nsupdate -k ./ga-lswin-cn.key
> server ddns.lswin.cn
> update add 123.231.168.192.in-addr.arpa. 7200 PTR test.ga.lswin.cn
> send
> quit
root@ddns:~# nslookup 192.168.231.123 ddns.lswin.cn
123.231.168.192.in-addr.arpa    name = test.ga.lswin.cn.root@ddns:~#

192.168.231.123已成功添加。

**测试逆向DDNS删除**

root@ddns:~# nslookup 192.168.231.123 ddns.lswin.cn
123.231.168.192.in-addr.arpa    name = test.ga.lswin.cn.root@ddns:~# nsupdate -k ./ga-lswin-cn.key
> server ddns.lswin.cn
> update delete 123.231.168.192.in-addr.arpa. PTR
> send
> quit
root@ddns:~# nslookup 192.168.231.123 ddns.lswin.cn
** server can't find 123.231.168.192.in-addr.arpa: NXDOMAINroot@ddns:~#

192.168.231.123已成功删除。

配置DHCP服务器推送更新

在我们的系统中，只有下列二种DHCPD，所以只有以下二种示例。

假设：ddns.lswin.cn的IP地址是192.168.220.109。

ISC DHCPD

如子网 ga.lswin.cn子网上的DHCPD是ISC的DHCPD，在dhcpd.conf中加上下列内容即可：

# Turn on DDNS
ddns-updates on;
update-static-leases on;
# The ddns-updates-style parameter controls whether or not the server will
# attempt to do a DNS update when a lease is confirmed. We default to the
# behavior of the version 2 packages ('none', since DHCP v2 didn't
# have support for DDNS.)
ddns-update-style standard;
update-static-leases on;
key "ga-lswin-cn." {algorithm hmac-sha512;secret "0avlbJzkK0DWB0XZbYDjK5Q7gAjmbTCPliHaV19di0KnH7lKitclqOF/l/S8SP5BFSUbpDQTen0OY/9mvcfGbA==";
};
#
# update ga.lswin.cn DNS zones and its reverse zone
zone ga.lswin.cn. {primary 192.168.220.109;key ga-lswin-cn.;
}
zone 231.168.192.in-addr.arpa. {primary 192.168.220.109;key ga-lswin-cn.;
}

OPNSense

如子网 ga.lswin.cn子网上的DHCPD是来自OPNSense，在dhcpd.conf中加上下列内容即可：

pfSense的配置方式一样。

示例中BIND9的options配置文件：
/etc/bind/named.conf.options

/
// for security, only in acl can inquery this DNS
//
// --------------------- ACLs -------------------------
// 允许使用该DNS的IP列表
acl internal {// 本地127.0.0.1;// CIDR of 192.168.0.0 - 192.168.255.255192.168.0.0/16;// CIDR of 10.10.0.0 - 10.10.0.25510.10.0.0/24;
};// ------------------- Options -------------------------
options {directory "/var/cache/bind";// 使用114.114.114.114 和 阿里公共DNS做外部DNSforwarders {// 114 DNS114.114.114.114;// Ali's DNS223.5.5.5;};// 安全设置，只允许ACL中的IP访问allow-query {internal;};allow-query-cache {internal;};// enables recursive queries but on from our local nets and local hosts// Do not allow externals to do recursive queries.recursion yes;allow-recursion {internal;};allow-transfer {internal;};//========================================================================// If BIND logs error messages about the root key being expired,// you will need to update your keys.  See https://www.isc.org/bind-keys//========================================================================// turn off zone encryption. The auto flag still generates// warnings in the log filednssec-enable no;//dnssec-enable yes;//dnssec-validation auto;auth-nxdomain no;    # conform to RFC1035listen-on-v6 { none; };
};

内部DDNS服务器已经建立完成，DHCP服务器只要将内部主DNS服务器指向ddns.lswin.cn即可。采用内部DDNS服务，可以给内网的管理带来很大方便，如服务器的备份、迁移等等。