DNS是一种将域名解析为IP地址的服务.如:www.turbolinux.com.cn通过DNS解析,可以
得到210.77.38.126.
bind是linux的DNS服务器程序.bind-chroot是bind的一个功能,使bind可以在一个
chroot的模式下运行.也就是说,bind运行时的/(根)目录,并不是系统真正的/(根)目录,只是
系统中的一个子目录而已.这样做的目的是为了提高安全性.因为在chroot的模式下,bind可以
访问的范围仅限于这个子目录的范围里,无法进一步提升,进入到系统的其他目录中.
在GTES10,10.5,11中,都已包含有bind-chroot包,可以直接安装相应rpm包.
# rpm -ivh bind-chroot.xxx.rpm
源码下载地址:
http://www.isc.org/index.pl
以bind-9.4.1-P1版本为例.
# tar zxvf bind-9.4.1-P1.tar.gz
# cd bind-9.4.1-P1
# ./configure
# make
# make install
在GTES 11上,如果已经安装了bind-chroot的包,则bind的默认启动方式就是chroot方式.
# /etc/init.d/named start
# ps -ef | grep named
named 2090 2613 1 0 07:49 ? 00:00:00 /usr/sbin/named -u named -t /var/named/chroot
使用源码包安装完成bind后,使用下面步骤进行配置:
建立named用户
# useradd named
建立chroot后所需的目录和文件
# mkdir -p /var/named/chroot/etc
# mkdir /var/named/chroot/dev
# mkdir -p /var/named/chroot/var/named/data
# mkdir -p /var/named/chroot/var/run
# cp /var/named/* /var/named/chroot/var/named/
# cp /etc/rndc.key /var/named/chroot/etc/
建立chroot后,所需的设备文件
# cd /var/named/chroot/dev
# mknod null c 1 3
# mknod random c 1 8
# mknod zero c 1 5
# chmod 666 null random
# chown -R named.named /var/named /var/run
建立named.conf配置文件
# vi /var/named/chroot/etc/named.conf
options {
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
// query-source address * port 53;
};
controls {
inet 127.0.0.1 allow { 127.0.0.1; } keys { rndckey; };
};
zone "." IN {
type hint;
file "named.ca";
};
zone "localdomain" IN {
type master;
file "localdomain.zone";
allow-update { none; };
};
zone "localhost" IN {
type master;
file "localhost.zone";
allow-update { 127.0.0.1 ; };
};
zone "0.0.127.in-addr.arpa" IN {
type master;
file "named.local";
allow-update { none; };
};
zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
type master;
file "named.ip6.local";
allow-update { none; };
};
zone "255.in-addr.arpa" IN {
type master;
file "named.broadcast";
allow-update { none; };
};
zone "0.in-addr.arpa" IN {
type master;
file "named.zero";
allow-update { none; };
};
include "/etc/rndc.key";
启动bind
# /usr/local/sbin/named -u named -t /var/named/chroot
# ps -ef | grep named
named 15739 1 0 08:27 ? 00:00:00 /usr/local/sbin/named -u named -t /var/named/chroot
现在bind已经运行在chroot模式下了.
评论