์๊ฐ์์ ์ํด ์ค๋นํ ๊ธฐ์ฌ ๋ฒ์ญ
์ด ๊ธฐ์ฌ์์๋ RHEL 7 ๋๋ CentOS 7์์ DNS ์๋ฒ๋ฅผ ์ค์ ํ๋ ๋จ๊ณ๋ฅผ ์๋ดํฉ๋๋ค. ๋ฐ๋ชจ์๋ Red Hat Enterprise Linux 7.4๋ฅผ ์ฌ์ฉํ์ต๋๋ค. ์ฐ๋ฆฌ์ ๋ชฉํ๋ ์ ๋ฐฉํฅ ์กฐํ ์์ญ๊ณผ ์ญ๋ฐฉํฅ ์กฐํ ์์ญ์ ๋ํด ๊ฐ๊ฐ ํ๋์ A ๋ ์ฝ๋์ ํ๋์ PTR ๋ ์ฝ๋๋ฅผ ์์ฑํ๋ ๊ฒ์ ๋๋ค.
๋จผ์ DNS ์๋ฒ์ ํ์ํ rpm ํจํค์ง๋ฅผ ์ค์นํฉ๋๋ค.
์ฐธ๊ณ : RHEL์ ๊ฒฝ์ฐ ๋ค์์ด ํ์ํฉ๋๋ค.
# yum install bind bind-chroot caching-nameserver
๋ด ์ค์ :
# hostname
golinuxhub-client.example
ะะพะน IP-ะฐะดัะตั 192.168.1.7
# ip address | egrep 'inet.*enp0s3'
inet 192.168.1.7/24 brd 192.168.1.255 scope global dynamic enp0s3
์ฐ๋ฆฌ๋ chroot๋ฅผ ์ฌ์ฉํ ๊ฒ์ด๊ธฐ ๋๋ฌธ์ ์๋น์ค๋ฅผ ๋นํ์ฑํํด์ผ ํฉ๋๋ค.
# systemctl stop named
# systemctl disable named
๊ทธ๋ฐ ๋ค์ ํ์ํ ํ์ผ์ chroot ๋๋ ํฐ๋ฆฌ์ ๋ณต์ฌํฉ๋๋ค.
๋ฉ๋ชจ. ์ธ์ ์ฌ์ฉ -p ํ์์ cp ๊ถ๋ฆฌ์ ์์ ์๋ฅผ ๋ณดํธํฉ๋๋ค.
[root@golinuxhub-client ~]# cp -rpvf /usr/share/doc/bind-9.9.4/sample/etc/* /var/named/chroot/etc/
โ/usr/share/doc/bind-9.9.4/sample/etc/named.confโ -> โ/var/named/chroot/etc/named.confโ
โ/usr/share/doc/bind-9.9.4/sample/etc/named.rfc1912.zonesโ -> โ/var/named/chroot/etc/named.rfc1912.zonesโ
๊ทธ๋ฐ ๋ค์ ์์ญ๊ณผ ๊ด๋ จ๋ ํ์ผ์ ์ ์์น์ ๋ณต์ฌํฉ๋๋ค.
[root@golinuxhub-client ~]# cp -rpvf /usr/share/doc/bind-9.9.4/sample/var/named/* /var/named/chroot/var/named/
โ/usr/share/doc/bind-9.9.4/sample/var/named/dataโ -> โ/var/named/chroot/var/named/dataโ
โ/usr/share/doc/bind-9.9.4/sample/var/named/my.external.zone.dbโ -> โ/var/named/chroot/var/named/my.external.zone.dbโ
โ/usr/share/doc/bind-9.9.4/sample/var/named/my.internal.zone.dbโ -> โ/var/named/chroot/var/named/my.internal.zone.dbโ
โ/usr/share/doc/bind-9.9.4/sample/var/named/named.caโ -> โ/var/named/chroot/var/named/named.caโ
โ/usr/share/doc/bind-9.9.4/sample/var/named/named.emptyโ -> โ/var/named/chroot/var/named/named.emptyโ
โ/usr/share/doc/bind-9.9.4/sample/var/named/named.localhostโ -> โ/var/named/chroot/var/named/named.localhostโ
โ/usr/share/doc/bind-9.9.4/sample/var/named/named.loopbackโ -> โ/var/named/chroot/var/named/named.loopbackโ
โ/usr/share/doc/bind-9.9.4/sample/var/named/slavesโ -> โ/var/named/chroot/var/named/slavesโ
โ/usr/share/doc/bind-9.9.4/sample/var/named/slaves/my.ddns.internal.zone.dbโ -> โ/var/named/chroot/var/named/slaves/my.ddns.internal.zone.dbโ
โ/usr/share/doc/bind-9.9.4/sample/var/named/slaves/my.slave.internal.zone.dbโ -> โ/var/named/chroot/var/named/slaves/my.slave.internal.zone.dbโ
```bash
ะขะตะฟะตัั ะดะฐะฒะฐะนัะต ะฟะพัะผะพััะธะผ ะฝะฐ ะพัะฝะพะฒะฝะพะน ัะฐะนะป ะบะพะฝัะธะณััะฐัะธะธ.
```bash
# cd /var/named/chroot/etc/
๋ช ๋ช ๋.conf์ ๋ด์ฉ์ ์ง์ฐ๊ณ ๋ค์์ ๋ถ์ฌ๋ฃ์ต๋๋ค.
[root@golinuxhub-client etc]# vim named.conf
options {
listen-on port 53 { 127.0.0.1; any; };
# listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; any; };
allow-query-cache { localhost; any; };
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
view my_resolver {
match-clients { localhost; any; };
recursion yes;
include "/etc/named.rfc1912.zones";
};
๊ตฌ์ญ๋ณ ์ ๋ณด๋ฅผ ๋ค์์ ์ถ๊ฐํด์ผ ํฉ๋๋ค. /var/named/chroot/etc/named.rfc1912.zones. ์๋ ํญ๋ชฉ์ ์ถ๊ฐํ์ธ์. example.zone ํ์ผ์ ์ ๋ฐฉํฅ ์กฐํ ์์ญ ํ์ผ์ด๋ฉฐ, example.rzone โ ์ญ๋ฐฉํฅ ์์ญ ํ์ผ.
์ค์ ์ฐธ๊ณ ์ฌํญ: ๋ด IP ์ฃผ์๊ฐ 1.168.192์ด๊ธฐ ๋๋ฌธ์ ์ญ๋ฐฉํฅ ์กฐํ ์์ญ์๋ 192.168.1.7๊ฐ ํฌํจ๋ฉ๋๋ค.
zone "example" IN {
type master;
file "example.zone";
allow-update { none; };
};
zone "1.168.192.in-addr.arpa" IN {
type master;
file "example.rzone";
allow-update { none; };
};
์์ญ๊ณผ ๊ด๋ จ๋ ํ์ผ์ ๋ค์ ์์น์ ์์ต๋๋ค.
# cd /var/named/chroot/var/named/
๋ค์์ผ๋ก ์ ๋ฐฉํฅ ๋ฐ ์ญ๋ฐฉํฅ ์์ญ์ ๋ํ ํ์ผ์ ๋ง๋ญ๋๋ค. ํ์ผ ์ด๋ฆ์ ํ์ผ์์ ์์ ๋์ผํฉ๋๋ค. ๋ช ๋ช ๋.rfc1912.zones. ์ฌ์ฉํ ์ ์๋ ๊ธฐ๋ณธ ํ ํ๋ฆฟ์ด ์ด๋ฏธ ์ฌ๋ฌ ๊ฐ ์์ต๋๋ค.
# cp -p named.localhost example.zone
# cp -p named.loopback example.rzone
๋ณด์๋ค์ํผ ๋ชจ๋ ํ์ผ๊ณผ ๋๋ ํฐ๋ฆฌ์ ๋ํ ํ์ฌ ๊ถํ์ ๋ค์์ ์ํฉ๋๋ค. ๋ฟ๋ฆฌ.
[root@golinuxhub-client named]# ll
total 32
drwxr-xr-x. 2 root root 6 May 22 2017 data
-rw-r--r--. 1 root root 168 May 22 2017 example.rzone
-rw-r--r--. 1 root root 152 May 22 2017 example.zone
-rw-r--r--. 1 root root 56 May 22 2017 my.external.zone.db
-rw-r--r--. 1 root root 56 May 22 2017 my.internal.zone.db
-rw-r--r--. 1 root root 2281 May 22 2017 named.ca
-rw-r--r--. 1 root root 152 May 22 2017 named.empty
-rw-r--r--. 1 root root 152 May 22 2017 named.localhost
-rw-r--r--. 1 root root 168 May 22 2017 named.loopback
drwxr-xr-x. 2 root root 71 Feb 12 21:02 slaves
์ฌ์ฉ์๋ฅผ ์์ ์๋ก ๋ํ๋ด๋๋ก ๋ชจ๋ ํ์ผ์ ๊ถํ์ ๋ณ๊ฒฝํฉ๋๋ค. ๋ฟ๋ฆฌ ๊ทธ๋ฆฌ๊ณ ๊ทธ๋ฃน ์ด๋ฆ.
# chown root:named *
ํ์ง๋ง ๋ฐ์ดํฐ์ ๊ฒฝ์ฐ ์์ ์๋ ๋ค์๊ณผ ๊ฐ์์ผ ํฉ๋๋ค. ๋ช ๋ช : ๋ช ๋ช .
# chown -R named:named data
# ls -l
total 32
drwxr-xr-x. 2 named named 6 May 22 2017 data
-rw-r--r--. 1 root named 168 May 22 2017 example.rzone
-rw-r--r--. 1 root named 152 May 22 2017 example.zone
-rw-r--r--. 1 root named 56 May 22 2017 my.external.zone.db
-rw-r--r--. 1 root named 56 May 22 2017 my.internal.zone.db
-rw-r--r--. 1 root named 2281 May 22 2017 named.ca
-rw-r--r--. 1 root named 152 May 22 2017 named.empty
-rw-r--r--. 1 root named 152 May 22 2017 named.localhost
-rw-r--r--. 1 root named 168 May 22 2017 named.loopback
drwxr-xr-x. 2 root named 71 Feb 12 21:02 slaves
์ ๋ฐฉํฅ ์์ญ ํ์ผ์ ๋ค์ ์ฝํ ์ธ ๋ฅผ ์ถ๊ฐํฉ๋๋ค. ์ฌ๊ธฐ์๋ ๋ก์ปฌ ํธ์คํธ(golinuxhub-client)์ ๋ํ A ๋ ์ฝ๋์ ์๋ฒ(golinuxhub-server)์ ๋ํ A ๋ ์ฝ๋๋ฅผ ์์ฑํฉ๋๋ค.
# vim example.zone
$TTL 1D
@ IN SOA example. root (
1 ; serial
3H ; refresh
15M ; retry
1W ; expire
1D ) ; minimum
IN NS example.
IN A 192.168.1.7
golinuxhub-server IN A 192.168.1.5
golinuxhub-client IN A 192.169.1.7
๋ค์์ผ๋ก ์ญ๋ฐฉํฅ ์์ญ ํ์ผ์ ์ฝํ ์ธ ๋ฅผ ์ถ๊ฐํฉ๋๋ค. ์ฌ๊ธฐ์๋ golinuxhub-client ๋ฐ golinuxhub-server์ ๋ํ PTR ๋ ์ฝ๋๋ฅผ ์์ฑํฉ๋๋ค.
# vim example.rzone
$TTL 1D
@ IN SOA example. root.example. (
1997022700 ; serial
28800 ; refresh
14400 ; retry
3600000 ; expire
86400 ) ; minimum
IN NS example.
5 IN PTR golinuxhub-server.example.
7 IN PTR golinuxhub-client.example.
์๋น์ค๋ฅผ ์ถ์ํ๊ธฐ ์ ์ ๋ช ๋ช ๋ chroot, zone ํ์ผ์ ๊ตฌ์ฑ์ ํ์ธํด ๋ณด๊ฒ ์ต๋๋ค.
[root@golinuxhub-client named]# named-checkzone golinuxhub-client.example example.zone
zone golinuxhub-client.example/IN: loaded serial 1
OK
[root@golinuxhub-client named]# named-checkzone golinuxhub-client.example example.rzone
zone golinuxhub-client.example/IN: loaded serial 1997022700
OK
๋ชจ๋ ๊ฒ์ด ์ข์ ๋ณด์ ๋๋ค. ์ด์ ๋ค์ ๋ช ๋ น์ ์ฌ์ฉํ์ฌ ๊ตฌ์ฑ ํ์ผ์ ํ์ธํ์ญ์์ค.
[root@golinuxhub-client named]# named-checkconf -t /var/named/chroot/ /etc/named.conf
๊ทธ๋ฆฌํ์ฌ ๋ชจ๋ ๊ฒ์ด ์ฑ๊ณต์ ์ผ๋ก ์๋ฃ๋์์ต๋๋ค.
[root@golinuxhub-client named]# echo $?
0
์ค์ ์ฐธ๊ณ ์ฌํญ: SELinux๊ฐ ํ์ฉ ๋ชจ๋์ ์์ต๋๋ค.
# getenforce
Permissive
๋ชจ๋ ๊ฒ์ด ๊ด์ฐฎ์ ๋ณด์ ๋๋ค. ์ด์ ์๋น์ค๋ฅผ ์์ํ ์๊ฐ์ ๋๋ค. ๋ช ๋ช ๋ chroot .
[root@golinuxhub-client named]# systemctl restart named-chroot
[root@golinuxhub-client named]# systemctl status named-chroot
โ named-chroot.service - Berkeley Internet Name Domain (DNS)
Loaded: loaded (/usr/lib/systemd/system/named-chroot.service; disabled; vendor preset: disabled)
Active: active (running) since Mon 2018-02-12 21:53:23 IST; 19s ago
Process: 5236 ExecStop=/bin/sh -c /usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID (code=exited, status=0/SUCCESS)
Process: 5327 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS (code=exited, status=0/SUCCESS)
Process: 5325 ExecStartPre=/bin/bash -c if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -t /var/named/chroot -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi (code=exited, status=0/SUCCESS)
Main PID: 5330 (named)
CGroup: /system.slice/named-chroot.service
โโ5330 /usr/sbin/named -u named -c /etc/named.conf -t /var/named/chroot
Feb 12 21:53:23 golinuxhub-client.example named[5330]: managed-keys-zone/my_resolver: loaded serial 0
Feb 12 21:53:23 golinuxhub-client.example named[5330]: zone 0.in-addr.arpa/IN/my_resolver: loaded serial 0
Feb 12 21:53:23 golinuxhub-client.example named[5330]: zone 1.0.0.127.in-addr.arpa/IN/my_resolver: loaded serial 0
Feb 12 21:53:23 golinuxhub-client.example named[5330]: zone 1.168.192.in-addr.arpa/IN/my_resolver: loaded serial 1997022700
Feb 12 21:53:23 golinuxhub-client.example named[5330]: zone example/IN/my_resolver: loaded serial 1
Feb 12 21:53:23 golinuxhub-client.example named[5330]: zone localhost/IN/my_resolver: loaded serial 0
Feb 12 21:53:23 golinuxhub-client.example named[5330]: zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN/my_resolver: loaded serial 0
Feb 12 21:53:23 golinuxhub-client.example named[5330]: zone localhost.localdomain/IN/my_resolver: loaded serial 0
Feb 12 21:53:23 golinuxhub-client.example named[5330]: all zones loaded
Feb 12 21:53:23 golinuxhub-client.example named[5330]: running
```bash
ะฃะฑะตะดะธัะตัั, ััะพ resolv.conf ัะพะดะตัะถะธั ะฒะฐั IP-ะฐะดัะตั, ััะพะฑั ะพะฝ ะผะพะณ ัะฐะฑะพัะฐัั ะฒ ะบะฐัะตััะฒะต DNS-ัะตัะฒะตัะฐ.
```bash
# cat /etc/resolv.conf
search example
nameserver 192.168.1.7
```bash
ะะฐะฒะฐะนัะต ะฟัะพะฒะตัะธะผ ะฝะฐั DNS-ัะตัะฒะตั ะดะปั ะพะฑัะฐัะฝะพะน ะทะพะฝั, ะธัะฟะพะปัะทัั dig.
```bash
[root@golinuxhub-client named]# dig -x 192.168.1.5
; <<>> DiG 9.9.4-RedHat-9.9.4-50.el7 <<>> -x 192.168.1.5
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40331
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;5.1.168.192.in-addr.arpa. IN PTR
;; ANSWER SECTION:
5.1.168.192.in-addr.arpa. 86400 IN PTR golinuxhub-server.example.
;; AUTHORITY SECTION:
1.168.192.in-addr.arpa. 86400 IN NS example.
;; ADDITIONAL SECTION:
example. 86400 IN A 192.168.1.7
;; Query time: 1 msec
;; SERVER: 192.168.1.7#53(192.168.1.7)
;; WHEN: Mon Feb 12 22:13:17 IST 2018
;; MSG SIZE rcvd: 122
๋ณด์๋ค์ํผ, ์์ฒญ(QUERY)์ ๋ํด ๊ธ์ ์ ์ธ ์๋ต(ANSWER)์ ๋ฐ์์ต๋๋ค.
[root@golinuxhub-client named]# dig -x 192.168.1.7
; <<>> DiG 9.9.4-RedHat-9.9.4-50.el7 <<>> -x 192.168.1.7
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55804
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;7.1.168.192.in-addr.arpa. IN PTR
;; ANSWER SECTION:
7.1.168.192.in-addr.arpa. 86400 IN PTR golinuxhub-client.example.
;; AUTHORITY SECTION:
1.168.192.in-addr.arpa. 86400 IN NS example.
;; ADDITIONAL SECTION:
example. 86400 IN A 192.168.1.7
;; Query time: 1 msec
;; SERVER: 192.168.1.7#53(192.168.1.7)
;; WHEN: Mon Feb 12 22:12:54 IST 2018
;; MSG SIZE rcvd: 122
๊ฐ์ ๋ฐฉ๋ฒ์ผ๋ก ๋ค์ด๋ ํธ ์กด๋ ํ์ธํ ์ ์์ต๋๋ค.
[root@golinuxhub-client named]# nslookup golinuxhub-client.example
Server: 192.168.1.7
Address: 192.168.1.7#53
Name: golinuxhub-client.example
Address: 192.169.1.7
[root@golinuxhub-client named]# nslookup golinuxhub-server.example
Server: 192.168.1.7
Address: 192.168.1.7#53
Name: golinuxhub-server.example
Address: 192.168.1.5
RHEL 7์์๋ ๋ ์ด์ ๋ฐ์ธ๋ ๊ตฌ์ฑ ํ์ผ์ chroot์ ๋ณต์ฌํ ํ์๊ฐ ์์ผ๋ฏ๋ก ์ด ๋ฌธ์๋ ์ฝ๊ฐ ์ค๋๋ ๊ฒ์
๋๋ค.
์ถ์ฒ : habr.com