TurboLinux11dns » bind-chroot功能

 

 

DNS是一种将域名解析为IP地址的服务.如:通过DNS解析,可以
得到210.77.38.126.
bind是linux的DNS服务器程序.bind-chroot是bind的一个功能,使bind可以在一个
chroot的模式下运行.也就是说,bind运行时的/(根)目录,并不是系统真正的/(根)目录,只是
系统中的一个子目录而已.这样做的目的是为了提高安全性.因为在chroot的模式下,bind可以
访问的范围仅限于这个子目录的范围里,无法进一步提升,进入到系统的其他目录中.

在GTES10,10.5,11中,都已包含有bind-chroot包,可以直接安装相应rpm包.

# rpm -ivh bind-chroot.xxx.rpm

源码下载地址:

以bind-9.4.1-P1版本为例.
# tar zxvf bind-9.4.1-P1.tar.gz
# cd bind-9.4.1-P1
# ./configure
# make
# make install

在GTES 11上,如果已经安装了bind-chroot的包,则bind的默认启动方式就是chroot方式.

# /etc/init.d/named start
# ps -ef | grep named
named 2090 2613 1   0   07:49  ?   00:00:00  /usr/sbin/named -u named -t /var/named/chroot

使用源码包安装完成bind后,使用下面步骤进行配置:
建立named用户

# useradd named

建立chroot后所需的目录和文件

# mkdir -p /var/named/chroot/etc
# mkdir /var/named/chroot/dev
# mkdir -p /var/named/chroot/var/named/data
# mkdir -p /var/named/chroot/var/run
# cp /var/named/* /var/named/chroot/var/named/
# cp /etc/rndc.key /var/named/chroot/etc/

建立chroot后,所需的设备文件

# cd /var/named/chroot/dev
# mknod null c 1 3
# mknod random c 1 8
# mknod zero c 1 5
# chmod 666 null random
# chown -R named.named /var/named /var/run

建立named.conf配置文件
# vi /var/named/chroot/etc/named.conf

options {
        directory "/var/named";
        dump-file "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
         // query-source address * port 53;
};

controls {
        inet 127.0.0.1 allow { 127.0.0.1; } keys { rndckey; };
};

zone "." IN {
        type hint;
        file "named.ca";
};

zone "localdomain" IN {
        type master;
        file "localdomain.zone";
        allow-update { none; };
};

zone "localhost" IN {
        type master;
        file "localhost.zone";
        allow-update { 127.0.0.1 ; };
};

zone "0.0.127.in-addr.arpa" IN {
        type master;
        file "named.local";
        allow-update { none; };
};

zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
        type master;
        file "named.ip6.local";
        allow-update { none; };
};

zone "255.in-addr.arpa" IN {
        type master;
        file "named.broadcast";
        allow-update { none; };
};

zone "0.in-addr.arpa" IN {
        type master;
        file "named.zero";
        allow-update { none; };
};


include "/etc/rndc.key";

启动bind

# /usr/local/sbin/named -u named -t /var/named/chroot
# ps -ef | grep named
named  15739   1  0    08:27  ?     00:00:00   /usr/local/sbin/named -u named -t /var/named/chroot

现在bind已经运行在chroot模式下了.