Umlando Wesistimu Yegama Lesizinda: Amaseva Wokuqala we-DNS

Okokugcina thina waqala ukukhuluma indaba ye-DNS - sikhumbule ukuthi iphrojekthi iqale kanjani, nokuthi yiziphi izinkinga okwakuhloswe ukuzixazulula kunethiwekhi ye-ARPANET. Namuhla sizokhuluma ngeseva yokuqala ye-BIND DNS.

--Ото - UJohn Markos O'Neill - CC BY-SA

Amaseva okuqala e-DNS

Ngemuva kukaPaul Mockapetris noJon Postel uhlongoze umqondo amagama wesizinda senethiwekhi ye-ARPANET, yathola ngokushesha ukuvunyelwa emphakathini we-IT. Onjiniyela abavela eNyuvesi yaseBerkeley babephakathi kwabokuqala ukukusebenzisa. Ngo-1984, abafundi abane bethula iseva yokuqala ye-DNS, i-Berkeley Internet Name Domain (BIND). Basebenze ngaphansi kwesibonelelo esivela ku-Defence Advanced Research Projects Agency (DARPA).

Uhlelo, olwakhiwe ngabafundi basenyuvesi, luguqule ngokuzenzakalelayo igama le-DNS laba ikheli le-IP futhi ngokuphambene nalokho. Kuyathakazelisa ukuthi ngenkathi ikhodi yakhe ilayishwe ku BSD (uhlelo lokusabalalisa isofthiwe), imithombo yokuqala isivele inenombolo yenguqulo 4.3. Ekuqaleni, iseva ye-DNS yayisetshenziswa izisebenzi zaselabhorethri zasenyuvesi. Kuze kube yinguqulo 4.8.3, amalungu e-University of Berkeley's Computer Systems Research Group (CSRG) ayenomthwalo wemfanelo wokuthuthukiswa kwe-BIND, kodwa engxenyeni yesibili yawo-1980, iseva ye-DNS yagqashuka enyuvesi futhi yadluliselwa esikhungweni semfundo ephakeme. izandla zikaPaul Vixie ezivela enkampanini DEC. U-Paul ukhiphe izibuyekezo 4.9 kanye ne-4.9.1, wabe esesungula i-Internet Software Consortium (ISC), ebinomthwalo wemfanelo wokugcina i-BIND kusukela ngaleso sikhathi. NgokukaPaul, zonke izinguqulo zangaphambilini zithembele kukhodi evela kubafundi baseBerkeley, futhi kule minyaka eyishumi nanhlanu edlule iwaqedele ngokuphelele amathuba ayo okwenza isimanjemanje. Ngakho ngo-2000, i-BIND yabhalwa kabusha kusukela ekuqaleni.

Iseva ye-BIND ihlanganisa amalabhulali ambalwa kanye nezingxenye ezisebenzisa ukwakheka kwe-DNS “yeseva yeklayenti” futhi inesibopho sokumisa imisebenzi yeseva ye-DNS. I-BIND isabalele, ikakhulukazi ku-Linux, futhi isalokhu isetshenziswa iseva ye-DNS edumile. Lokhu isinqumo efakwe kumaseva ahlinzeka ngosekelo indawo yezimpande.

Kukhona ezinye izindlela zokuthi BIND. Isibonelo, i-PowerDNS, eza nokusatshalaliswa kweLinux. Ibhalwe nguBert Hubert ovela enkampanini yamaDashi i-PowerDNS.COM futhi igcinwa ngumphakathi womthombo ovulekile. Ngo-2005, i-PowerDNS yasetshenziswa kumaseva e-Wikimedia Foundation. Isixazululo sisetshenziswa nabahlinzeki bamafu abakhulu, izinkampani zezokuxhumana zase-Europe kanye nezinhlangano ze-Fortune 500.

I-BIND ne-PowerDNS ezinye ezivame kakhulu, kodwa akuzona kuphela amaseva e-DNS. Futhi kufanele kuphawulwe itho olukhululekile, djbdns и dnsmasq.

Ukuthuthukiswa Kwesistimu Yegama Lesizinda

Kuwo wonke umlando we-DNS, izinguquko eziningi zenziwe ekucacisweni kwayo. Njengenye yezibuyekezo zokuqala nezinkulu kwengezwe NOTIFY kanye nezindlela ze-IXFR ngo-1996. Bakwenze kwaba lula ukuphindaphinda imininingo egciniwe Yesistimu Yegama Lesizinda phakathi kwamaseva ayinhloko nawesibili. Isixazululo esisha senze kwaba nokwenzeka ukumisa izaziso mayelana nezinguquko kumarekhodi e-DNS. Le ndlela iqinisekisa ubunikazi bezindawo ze-DNS zesibili neziyinhloko, futhi yalondoloza ithrafikhi - ukuvumelanisa kwenzeka kuphela lapho kudingekile, futhi hhayi ngezikhathi ezimisiwe.

--Ото - Richard Mason - CC BY-SA

Ekuqaleni, inethiwekhi ye-DNS yayingafinyeleleki emphakathini jikelele futhi izinkinga ezingase zibe khona ngokuvikeleka kolwazi kwakungeyona into ehamba phambili lapho kwakhiwa uhlelo, kodwa le ndlela yazenza yazizwa kamuva. Ngokuthuthuka kwe-inthanethi, ubungozi besistimu baqala ukuxhashazwa - ngokwesibonelo, ukuhlaselwa okufana ne-DNS spoofing kwavela. Kulesi simo, inqolobane yamaseva e-DNS igcwaliswa ngedatha engenawo umthombo ogunyaziwe, futhi izicelo ziqondiswa kabusha kumaseva abahlaseli.

Ukuxazulula inkinga, ku-DNS kwenziwe amasiginesha e-crypto yezimpendulo ze-DNS (DNSSEC) - indlela ekuvumela ukuthi wakhe uchungechunge lokuthembela kwesizinda kusuka endaweni yezimpande. Qaphela ukuthi indlela efanayo yengezwe ukuze kuqinisekiswe umsingathi lapho kudluliswa indawo ye-DNS - yayibizwa nge-TSIG.


Ukulungiswa okwenza kube lula ukuphindwaphindwa kwemininingwane yolwazi ye-DNS kanye nezinkinga zokuphepha ezifanele zamukelwe ngokuqinile umphakathi we-IT. Kodwa kube nezinguquko umphakathi ongazithathanga kahle. Ikakhulukazi, inguquko kusuka khulula amagama domain ikhokhwe. Futhi lesi isibonelo senye nje "yezimpi" emlandweni we-DNS. Sizokhuluma okwengeziwe ngalokhu esihlokweni esilandelayo.

Thina kwa-1cloud sinikeza insizakalo “Iseva ebonakalayo" Ngosizo lwayo, ungakwazi ukuqasha futhi ulungiselele iseva ekude ye-VDS/VPS emizuzwini embalwa.
Futhi ube uhlelo lobulungu kubo bonke abasebenzisi. Beka izixhumanisi zokudlulisela kusevisi yethu futhi uthole imiklomelo yamakhasimende athunyelwe.

Source: www.habr.com