RHEL5.2下DNS與DHCP的互動(dòng)更新

作者：ChinaUnix博客 2009-09-03 15:12:47

一臺(tái)Linux服務(wù)器版本為Red Hat Enterprise Linux Server release 5.2 (Tikanga)，內(nèi)核版本號(hào)2.6.18-92.el5；兩臺(tái)客戶端：一臺(tái)為Windows XP Professional SP3；一臺(tái)為Linux主機(jī)，版本同服務(wù)器。

一、實(shí)驗(yàn)?zāi)繕?biāo)

在Linux平臺(tái)下實(shí)現(xiàn)DHCP與DNS互動(dòng)更新的功能。

二、實(shí)驗(yàn)環(huán)境

三、搭建DNS服務(wù)（bind）

1．安裝bind相關(guān)軟件包

放入安裝光盤，并切換到軟件包所在目錄，執(zhí)行下列命令安裝相應(yīng)軟件包：

rpm -ivh bind-9.3.4-6.P1.el5.i386.rpm

rpm -ivh bind-chroot-9.3.4-6.P1.el5.i386.rpm

rpm -ivh bind-devel-9.3.4-6.P1.el5.i386.rpm

rpm -ivh bind-libbind-devel-9.3.4-6.P1.el5.i386.rpm

rpm -ivh bind-libs-9.3.4-6.P1.el5.i386.rpm

rpm -ivh bind-sdb-9.3.4-6.P1.el5.i386.rpm

rpm -ihv bind-utils-9.3.4-6.P1.el5.i386.rpm

rpm -ivh caching-nameserver-9.3.4-6.P1.el5.i386.rpm

2．創(chuàng)建密鑰

要實(shí)現(xiàn)DNS的動(dòng)態(tài)更新，首先要考慮的是怎樣保證安全地實(shí)現(xiàn)DDNS。由ISC給出的方法是創(chuàng)建進(jìn)行動(dòng)態(tài)更新的密鑰，在進(jìn)行更新時(shí)通過該密鑰加以驗(yàn)證。為了實(shí)現(xiàn)這一功能，需要以root身份運(yùn)行以下命令：

[root@server etc]# dnssec-keygen -a HMAC-MD5 -b 128 -n USER administrator

上述dnssec-keygen命令的功能就是生成更新密鑰，其中參數(shù)-a HMAC-MD5是指密鑰的生成算法采用HMAC-MD5；參數(shù)-b 128是指密鑰的位數(shù)為128位；參數(shù)-n USER administrator是指密鑰的用戶為administrator。

該命令生成的一對(duì)密鑰文件如下：

-rw------- 1 named named 55 Jun 20 00:54 Kadministrator.+157+49362.key

-rw------- 1 named named 81 Jun 20 00:54 Kadministrator.+157+49362.private

可以查看剛生成的密鑰文件內(nèi)容：

[root@server etc]# cat Kadministrator.+157+49362.key

administrator. IN KEY 0 3 157 txOBJNpI39770VEkbPQQ6w==

[root@server etc]# cat Kadministrator.+157+49362.private

Private-key-format: v1.2

Algorithm: 157 (HMAC_MD5)

Key: txOBJNpI39770VEkbPQQ6w==

仔細(xì)閱讀該密鑰文件就會(huì)發(fā)現(xiàn)，這兩個(gè)文件中包含的密鑰是一樣的，該密鑰就是DHCP對(duì)DNS進(jìn)行安全動(dòng)態(tài)更新時(shí)的憑據(jù)。后面需要將該密鑰分別添加到DNS和DHCP的配置文件中。

3．配置主配置文件。這里有兩種方法：

1）去除掉/var/named/chroot/etc/named.caching-nameserver.conf文件中以下幾行內(nèi)容：

listen-on port 53 { 127.0.0.1; };

listen-on-v6 port 53 { ::1; };

allow-query { localhost; };

match-clients { localhost; };

match-destinations { localhost; };

修改后的如下：

[root@server etc]# cat named.caching-nameserver.conf

// named.caching-nameserver.conf

// Provided by Red Hat caching-nameserver package to configure the

// ISC BIND named(8) DNS server as a caching only nameserver

// (as a localhost DNS resolver only).

// See /usr/share/doc/bind*/sample/ for example named configuration files.

// DO NOT EDIT THIS FILE - use system-config-bind or an editor

// to create named.conf - edits to this file will be lost on

// caching-nameserver package upgrade.

options {

directory "/var/named";

dump-file "/var/named/data/cache_dump.db";

statistics-file "/var/named/data/named_stats.txt";

memstatistics-file "/var/named/data/named_mem_stats.txt";

query-source port 53;

query-source-v6 port 53;

};

logging {

channel default_debug {

file "data/named.run";

severity dynamic;

};

view localhost_resolver {

recursion yes;

include "/etc/named.rfc1912.zones";

};

在文件/var/named/chroot/etc/ named.rfc1912.zones中添加新的解析域，結(jié)果如下：

[root@server etc]# cat named.rfc1912.zones

// named.rfc1912.zones:

// Provided by Red Hat caching-nameserver package

// ISC BIND named zone configuration for zones recommended by

// RFC 1912 section 4.1 : localhost TLDs and address zones

// See /usr/share/doc/bind*/sample/ for example named configuration files.

key administrator {

algorithm HMAC-MD5.SIG-ALG.REG.INT;

secret txOBJNpI39770VEkbPQQ6w==;

};

zone "." IN {

type hint;

file "named.ca";

};

zone "localdomain" IN {

type master;

file "localdomain.zone";

allow-update { none; };

};

zone "localhost" IN {

type master;

file "localhost.zone";

allow-update { none; };

};

zone "0.0.127.in-addr.arpa" IN {

type master;

file "named.local";

allow-update { none; };

};

zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {

type master;

file "named.ip6.local";

allow-update { none; };

};

zone "255.in-addr.arpa" IN {

type master;

file "named.broadcast";

allow-update { none; };

};

zone "0.in-addr.arpa" IN {

type master;

file "named.zero";

allow-update { none; };

};

zone "china.test" IN {

type master;

file "china.test.zone";

allow-update { key administrator; };

};

zone "13.168.192.in-addr.arpa" IN {

type master;

file "china.test.arpa";

allow-update { key administrator; };

};

#p#

2）切換到/var/named/chroot/etc/目錄，將named.rfc1912.zones追加到named.caching-nameserver.conf中，合兩為一，按照***種方法刪除、添加相應(yīng)內(nèi)容，并刪除view localhost_resolver項(xiàng)所有內(nèi)容。

4．在/var/named/chroot/var/named目錄下添加域配置文件，文件如下：

[root@server named]# cat china.test.zone

$TTL 86400

@ IN SOA server.china.test. root.china.test. (

2009062000

28800

14400

360000

86400

)

@ IN NS server.china.test.

server IN A 192.168.13.11

client IN A 192.168.13.24

[root@server named]# cat china.test.arpa

$TTL 86400

@ IN SOA server.china.test. root.server.china.test. (

2009062000 ; Serial

28800 ; Refresh

14400 ; Retry

3600000 ; Expire

86400 ) ; Minimum

@ IN NS server.china.test.

11 IN PTR server.china.test.

5．用chkconfig --level 3 named on命令設(shè)置開機(jī)自動(dòng)開啟DNS服務(wù)。

6．啟用DNS服務(wù)service named start

7．在客戶端主機(jī)的/etc/resolv.conf文件中指定DNS服務(wù)器：nameserver 192.168.13.11

四、搭建DHCP服務(wù)

1. dhcp相關(guān)軟件包

rpm -ivh dhcp-3.0.5-13.el5.i386.rpm

rpm -ivh dhcp-devel-3.0.5-13.el5.i386.rpm

2. 修改配置文件。修改后的配置文件如下：

[root@server ~]# cat /etc/dhcpd.conf

ddns-update-style interim;

allow client-updates;

key administrator {

algorithm HMAC-MD5;

secret txOBJNpI39770VEkbPQQ6w==;

};

zone china.test. {

primary 192.168.13.11;

key administrator;

}

zone 13.168.192.in-addr.arpa. {

primary 192.168.13.11;

key administrator;

}

subnet 192.168.13.0 netmask 255.255.255.0 {

# --- default gateway

option routers 192.168.13.13;

option subnet-mask 255.255.255.0;

option nis-domain "china.test";

option domain-name "china.test";

option domain-name-servers 192.168.13.11;

# option time-offset -18000; # Eastern Standard Time

# option ntp-servers 192.168.1.1;

# option netbios-name-servers 192.168.1.1;

# --- Selects point-to-point node (default is hybrid). Don't change this unless

# -- you understand Netbios very well

# option netbios-node-type 2;

range dynamic-bootp 192.168.13.1 192.168.13.23;

default-lease-time 180;

max-lease-time 300;

}

3. 用chkconfig --level 3 dhcpd on命令設(shè)置開機(jī)自動(dòng)開啟DNS服務(wù)。

4. 啟用DNS服務(wù)service dhcpd start

5. 在客戶端主機(jī)上添加DHCP客戶端配置文件/etc/dhclient.conf，內(nèi)容如下：

[root@client ~]# cat /etc/dhclient.conf

send fqdn.fqdn "client";

send fqdn.encoded on;

#p#

6. 在服務(wù)器上查DHCP分配文件/var/lib/dhcpd/dhcpd.leases：

[root@server ~]# cat /var/lib/dhcpd/dhcpd.leases

# All times in this file are in UTC (GMT), not your local timezone. This is

# not a bug, so please don't ask about it. There is no portable way to

# store leases in the local timezone, so please don't request this as a

# feature. If this is inconvenient or confusing to you, we sincerely

# apologize. Seriously, though - don't ask.

# The format of this file is documented in the dhcpd.leases(5) manual page.

# This lease file was written by isc-dhcp-V3.0.5-RedHat

lease 192.168.13.23 {

starts 6 2009/06/20 08:20:53;

ends 6 2009/06/20 08:25:53;

binding state active;

next binding state free;

hardware ethernet 00:0c:29:71:c6:09;

set ddns-rev-name = "23.13.168.192.in-addr.arpa.";

set ddns-txt = "0003680744ede9faf3e6e8bd78563f6857";

set ddns-fwd-name = "client.china.test";

}

7. 查看/var/named/chroot/var/named目錄，自動(dòng)生成如下兩個(gè)文件，用于DNS更新。

-rw-r--r-- 1 named named 1980 Jun 20 16:20 china.test.arpa.jnl

-rw-r--r-- 1 named named 1825 Jun 20 16:20 china.test.zone.jnl

8. 查看域文件內(nèi)容如下：

[root@server named]# cat china.test.zone

$ORIGIN .

$TTL 86400 ; 1 day

china.test IN SOA server.china.test. root.china.test. (

2009062021 ; serial

28800 ; refresh (8 hours)

14400 ; retry (4 hours)

360000 ; expire (4 days 4 hours)

86400 ; minimum (1 day)

)

NS server.china.test.

$ORIGIN china.test.

$TTL 150 ; 2 minutes 30 seconds

client A 192.168.13.23

TXT "0003680744ede9faf3e6e8bd78563f6857"

$TTL 86400 ; 1 day

server A 192.168.13.11

[root@server named]# cat china.test.arpa

$ORIGIN .

$TTL 86400 ; 1 day

13.168.192.in-addr.arpa IN SOA server.china.test. root.server.china.test. (

2009062017 ; serial

28800 ; refresh (8 hours)

14400 ; retry (4 hours)

3600000 ; expire (5 weeks 6 days 16 hours)

86400 ; minimum (1 day)

)

NS server.china.test.

$ORIGIN 13.168.192.in-addr.arpa.

11 PTR server.china.test.

$TTL 150 ; 2 minutes 30 seconds

23 PTR client.china.test.

五、結(jié)論

1、表面現(xiàn)象：

1）更新比較慢，甚至需要手動(dòng)重啟DNS服務(wù)才能更新成功。

2）反向解析沒有清除舊的記錄，如下：

[root@server ~]# cat /var/named/chroot/var/named/china.test.arpa

$ORIGIN .

$TTL 86400 ; 1 day

13.168.192.in-addr.arpa IN SOA server.china.test. root.server.china.test. (

2009062019 ; serial

28800 ; refresh (8 hours)

14400 ; retry (4 hours)

3600000 ; expire (5 weeks 6 days 16 hours)

86400 ; minimum (1 day)

)

NS server.china.test.

$ORIGIN 13.168.192.in-addr.arpa.

11 PTR server.china.test.

$TTL 150 ; 2 minutes 30 seconds

12 PTR WWW-2E8A24A84C2.china.test.

20 PTR client.china.test.

23 PTR client.china.test.

24 PTR client.china.test.

2、更新日志：

Jun 20 22:35:25 server named[2719]: starting BIND 9.3.4-P1 -u named -c /etc/named.caching-nameserver.conf -t /var/named/chroot

Jun 20 22:35:25 server named[2719]: found 1 CPU, using 1 worker thread

Jun 20 22:35:25 server named[2719]: loading configuration from '/etc/named.caching-nameserver.conf'

Jun 20 22:35:25 server named[2719]: listening on IPv4 interface lo, 127.0.0.1#53

Jun 20 22:35:25 server named[2719]: listening on IPv4 interface eth0, 192.168.13.11#53

Jun 20 22:35:25 server named[2719]: command channel listening on 127.0.0.1#953

Jun 20 22:35:25 server named[2719]: command channel listening on ::1#953

Jun 20 22:35:25 server named[2719]: zone 0.in-addr.arpa/IN/localhost_resolver: loaded serial 42

Jun 20 22:35:25 server named[2719]: zone 0.0.127.in-addr.arpa/IN/localhost_resolver: loaded serial 1997022700

Jun 20 22:35:25 server named[2719]: zone 13.168.192.in-addr.arpa/IN/localhost_resolver: loaded serial 2009062027

Jun 20 22:35:25 server named[2719]: zone 255.in-addr.arpa/IN/localhost_resolver: loaded serial 42

Jun 20 22:35:25 server named[2719]: zone 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN/localhost_resolver: loaded serial 1997022700

Jun 20 22:35:25 server named[2719]: zone localdomain/IN/localhost_resolver: loaded serial 42

Jun 20 22:35:25 server named[2719]: zone localhost/IN/localhost_resolver: loaded serial 42

Jun 20 22:35:25 server named[2719]: zone china.test/IN/localhost_resolver: loaded serial 2009062035

Jun 20 22:35:25 server named[2719]: running

Jun 20 22:35:25 server dhcpd: Internet Systems Consortium DHCP Server V3.0.5-RedHat

Jun 20 22:35:25 server dhcpd: For info, please visit http://www.isc.org/sw/dhcp/

Jun 20 22:35:25 server dhcpd: lease 192.168.13.22: no subnet.

Jun 20 22:35:25 server last message repeated 3 times

Jun 20 22:35:25 server dhcpd: Wrote 1 leases to leases file.

Jun 20 22:35:25 server dhcpd: Listening on LPF/eth0/00:0c:29:64:e2:df/192.168.13/24

Jun 20 22:35:25 server dhcpd: Sending on LPF/eth0/00:0c:29:64:e2:df/192.168.13/24

Jun 20 22:35:25 server dhcpd: Sending on Socket/fallback/fallback-net

Jun 20 22:35:33 server dhcpd: DHCPREQUEST for 192.168.13.22 from 00:0c:29:71:c6:09 via eth0: unknown lease 192.168.13.22.

Jun 20 22:35:37 server dhcpd: DHCPREQUEST for 192.168.13.22 from 00:0c:29:71:c6:09 via eth0: unknown lease 192.168.13.22.

Jun 20 22:35:49 server dhcpd: DHCPDISCOVER from 00:0c:29:71:c6:09 via eth0

Jun 20 22:35:50 server dhcpd: DHCPOFFER on 192.168.13.24 to 00:0c:29:71:c6:09 via eth0

Jun 20 22:35:50 server named[2719]: client 192.168.13.11#32772: view localhost_resolver: updating zone 'china.test/IN': update unsuccessful: client.china.test: 'name not in use' prerequisite not satisfied (YXDOMAIN)

Jun 20 22:35:50 server named[2719]: client 192.168.13.11#32772: view localhost_resolver: updating zone 'china.test/IN': deleting rrset at 'client.china.test' A

Jun 20 22:35:50 server named[2719]: client 192.168.13.11#32772: view localhost_resolver: updating zone 'china.test/IN': adding an RR at 'client.china.test' A

Jun 20 22:35:50 server dhcpd: Added new forward map from client.china.test to 192.168.13.24

Jun 20 22:35:50 server named[2719]: client 192.168.13.11#32772: view localhost_resolver: updating zone '13.168.192.in-addr.arpa/IN': deleting rrset at '24.13.168.192.in-addr.arpa' PTR

Jun 20 22:35:50 server named[2719]: client 192.168.13.11#32772: view localhost_resolver: updating zone '13.168.192.in-addr.arpa/IN': adding an RR at '24.13.168.192.in-addr.arpa' PTR

Jun 20 22:35:50 server dhcpd: added reverse map from 24.13.168.192.in-addr.arpa. to client.china.test

3、客戶端解析如下：

C:\>nslookup

Default Server: server.china.test

Address: 192.168.13.11

> client.china.test

Server: server.china.test

Address: 192.168.13.11

Name: client.china.test

Address: 192.168.13.24

> 192.168.13.23

Server: server.china.test