上一节我们演示了根节点的dnssec配置，下面我们配置dev节点的dnssec。
dev服务器：192.168.110.71
一、配置dev服务器
1.生成签名密钥对
# cd /var/named
首先为区（zone）文件生成密钥签名密钥KSK：
#~/bind/sbin/dnssec-keygen -f KSK -a RSASHA1 -b 512 -n ZONE dev.
将生成文件Kdev.+005+44248.key公钥和Kdev.+005+44248.private私钥
然后生成区签名密钥ZSK：
#~/bind/sbin/dnssec-keygen -a RSASHA1 -b 512 -n ZONE dev.
将生成文件Kdev.+005+41787.key公钥和Kdev.+005+44248.private私钥
2.签名zone
a.签名之前将前面生成的两个公钥添加到区域配置文件末尾
$TTL 86400
@ IN SOA @ root.dev (
2
1m
1m
1m
1m)
dev. IN NS ns.dev.
ns.dev. IN A 192.168.110.71
abc.dev. IN A 192.168.100.90
$INCLUDE "Kdev.+005+41787.key"
$INCLUDE "Kdev.+005+44248.key"
b.执行签名操作
#~/bind/sbin/dnssec-signzone -o dev. dev.zone
生成dev.zone.signed签名zone
3.修改主配置文件name.conf
key "rndc-key" {
algorithm hmac-md5;
secret "etMaaS+O06WFFUHxKAaTXA==";
};
controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { "rndc-key"; };
};
options{
listen-on port 53{
192.168.110.71;
};
version "vdns3.0";
directory "/var/named";
pid-file "/var/run/named.pid";
session-keyfile "/var/run/session.key";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
rrset-order {
order cyclic;
};
recursion no;
allow-query{
any;
};
allow-query-cache{
any;
};
allow-transfer{
none;
};
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
};
logging {
channel default_debug {
file "/var/named/data/named.run";
severity dynamic;
};
channel queries_info {
file "/var/named/log/query.log" versions 1 size 100m;
severity info;
print-category yes;
print-severity yes;
print-time yes;
};
category queries {
queries_info;
default_debug;
};
channel notify_info {
file "/var/named/log/notify.log" versions 8 size 128m;
severity info;
print-category yes;
print-severity yes;
print-time yes;
};
category notify {
notify_info;
default_debug;
};
channel dnssec_debug {
file "/var/named/log/dnssec.log" versions 1 size 100m;
print-time yes;
print-category yes;
print-severity yes;
severity debug 3;
};
category dnssec {
dnssec_debug;
};
};
zone "." in {
type hint;
file "root.zone";
};
zone "dev." IN {
type master;
file "dev.zone.signed";
};
检查配置是否正确：
/home/slim/bind/sbin/named-checkconf -t /home/slim/chroot/ /etc/named.conf
4.启动服务
/home/slim/bind/sbin/named -u slim -t /home/slim/chroot/ -c /etc/named.conf
二、配置根服务器
1.将生成的dsset-dev.发给根服务器，在192.168.110.71上执行
# cd /var/named
# scp dsset-dev. slim@192.168.13.103:/home/slim/chroot/var/named/
2.在192.168.13.103上执行
# cd /var/named
# vi root.zone
3.在该文件末尾添加 $INCLUDE "dsset-dev."
$TTL 86400
@ IN SOA @ root (
12169
1m
1m
1m
1m )
. IN NS root.ns.
root.ns. IN A 192.168.13.103
dev. IN NS ns.dev.
ns.dev. IN A 192.168.110.71
$INCLUDE "K.+005+62541.key"
$INCLUDE "K.+005+62317.key"
$INCLUDE "dsset-dev."
4.然后在根服务器上重新对区文件进行签名
# mv root.zone.signed root.zone.signed.bak
# /home/slim/bind/sbin/dnssec-signzone -o . root.zone
5.重启根服务
三、测试
在递归解析服务执行：
dig @192.168.13.45 +dnssec dev. NS
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6_6.2 <<>> @192.168.13.45 +dnssec dev. NS
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49047
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;dev. IN NS
;; ANSWER SECTION:
dev. 80410 IN NS ns.dev.
dev. 86386 IN RRSIG NS 5 1 86400 20150517074758 20150417074758 41787 dev. x3QO8JsFscxB7t9SQjtjdZCXyjUkdWNbCfOSUxPyZZPb3jRt/DOYN0lR hKJqgl8VT2T2D1P3kmr8O7ptGlTKpg==
;; ADDITIONAL SECTION:
ns.dev. 80410 IN A 192.168.110.71
ns.dev. 86386 IN RRSIG A 5 2 86400 20150517074758 20150417074758 41787 dev. a9f04XI5VUvgoDdJa5BoN3GEhA2Po+Iqo9GLgcw0S5Sts7Hw/dIm/EOF lj8oCXUniBgQdRzWw+0QzYvUavGYxg==
;; Query time: 0 msec
;; SERVER: 192.168.13.45#53(192.168.13.45)
;; WHEN: Fri Apr 17 02:05:49 2015
;; MSG SIZE rcvd: 263
dig @192.168.13.45 +dnssec abc.dev. A
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6_6.2 <<>> @192.168.13.45 +dnssec abc.dev. A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20230
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;abc.dev. IN A
;; ANSWER SECTION:
abc.dev. 86375 IN A 192.168.100.90
abc.dev. 86375 IN RRSIG A 5 2 86400 20150517074758 20150417074758 41787 dev. aSP+yVyu83pPlwZ8iSoyFydzSOugMLnNV5ZcbObJ+U6qWj8j9AF4Baxy zxqKiSkTDkx16yjgnzdGINwfgFt1EA==
;; AUTHORITY SECTION:
dev. 80152 IN NS ns.dev.
dev. 86128 IN RRSIG NS 5 1 86400 20150517074758 20150417074758 41787 dev. x3QO8JsFscxB7t9SQjtjdZCXyjUkdWNbCfOSUxPyZZPb3jRt/DOYN0lR hKJqgl8VT2T2D1P3kmr8O7ptGlTKpg==
;; ADDITIONAL SECTION:
ns.dev. 80152 IN A 192.168.110.71
ns.dev. 86375 IN RRSIG A 5 2 86400 20150517074758 20150417074758 41787 dev. a9f04XI5VUvgoDdJa5BoN3GEhA2Po+Iqo9GLgcw0S5Sts7Hw/dIm/EOF lj8oCXUniBgQdRzWw+0QzYvUavGYxg==
;; Query time: 0 msec
;; SERVER: 192.168.13.45#53(192.168.13.45)
;; WHEN: Fri Apr 17 02:10:07 2015
;; MSG SIZE rcvd: 382
注：配置具体域名的dnssec也是类型，生成zone签名，将dsset-*添加到上一节点zone中，并重新签名。
————————————————
版权声明：本文为CSDN博主「slimina」的原创文章，遵循CC 4.0 BY-SA版权协议，转载请附上原文出处链接及本声明。
原文链接：https://blog.csdn.net/zhu_tianwei/article/details/45098047
阅读(1252) | 评论(0) | 转发(0) |
