BIND 在查询其权威域时返回 serverfail

BIND 在查询其权威域时返回 serverfail

大家好,Serverfault!

首先:抱歉,关于这个标题,我在想出一个合适的标题时遇到了一些问题。

我设置了一个小型家庭服务器,用于互联网共享、samba、基本 http、dlna 媒体服务器等等,而且我碰巧手头有一个域名,所以我想为什么不把它直接放到这台电脑上呢?

我已经安装了 BIND 9.8.0,并且 - 据我所知 - 已正确配置它。

几天来,公共视图都无法使用,但我并不在意,因为本地视图可以使用。但现在突然间,甚至本地视图也失效了。

如果我尝试向名称服务器查询我的域中的任何内容,它会返回以下错误:

$ nslookup andromeda.dafaces.com
;; Got SERVFAIL reply from ::1, trying next server
;; Got SERVFAIL reply from ::1, trying next server
Server:         127.0.0.1
Address:        127.0.0.1#53

** server can't find andromeda.dafaces.com.dafaces.com: SERVFAIL

另外,公众视图指向域名的旧ip地址,可能是由于同样的错误。

有关该系统的一些信息:

$ uname -a
Linux tressis 2.6.37-ARCH #1 SMP PREEMPT Tue Mar 15 09:21:17 CET 2011 x86_64 AMD Athlon(tm) 64 X2 Dual Core Processor 5000+ AuthenticAMD GNU/Linux

$ named -v
BIND 9.8.0

以及named.conf文件:

# cat /etc/named.conf
//
// /etc/named.conf
//

include "/etc/rndc.key";

#controls {
#       inet 127.0.0.1 allow {localhost; } keys { "dnskulcs"; };
#};

options {
        directory "/var/named";
        pid-file "/var/run/named/named.pid";
        auth-nxdomain yes;
        datasize default;
// Uncomment these to enable IPv6 connections support
// IPv4 will still work:
        listen-on-v6 { any; };
        listen-on { any; };
// Add this for no IPv4:
//      listen-on { none; };

// Default security settings.
//      allow-recursion { 127.0.0.1; ::1; 192.168.1.0/24; };
//      allow-recursion { any; };
        allow-query { any; };
        allow-transfer { 127.0.0.1; ::1; 92.243.14.172; 87.98.164.164; 88.191.64.64; };
        allow-update { key "dnskulcs"; };
        version none;
        hostname none;
        server-id none;
        zone-statistics yes;

        forwarders { 213.46.246.53; 213.26.246.54; 8.8.8.8; 8.8.4.4; 192.188.242.65; 193.227.196.3; 2001:470:20::2; };
};

view "local" {

        match-clients { 192.168.1.0/24; 127.0.0.1; ::1; fec0:0:0:ffff::/64; };
        recursion yes;

        zone "localhost" IN {
                type master;
                file "localhost.zone";
                allow-transfer { any; };
        };

        zone "0.0.127.in-addr.arpa" IN {
                type master;
                file "127.0.0.zone";
                allow-transfer { any; };
        };

        zone "." IN {
                type hint;
                file "root.hint";
        };

        zone "dafaces.com" IN {
                type master;
                file "internal/dafaces.com.fw";
                allow-update { key "dnskulcs"; };
        };

        zone "1.168.192.in-addr.arpa" IN {
                type master;
                file "internal/dafaces.com.rev";
                allow-update { key "dnskulcs"; };
        };
};

view "public" {
        match-clients { any;};
        recursion no;

        zone "dafaces.com" IN {
                type master;
                file "external/dafaces.com.fw";
                allow-transfer {
                        87.98.164.164; 195.234.42.1; 88.191.64.64;
                };
        };
};

//zone "example.org" IN {
//      type slave;
//      file "example.zone";
//      masters {
//              192.168.1.100;
//      };
//      allow-query { any; };
//      allow-transfer { any; };
//};

logging {
        channel xfer-log {
                file "/var/log/named.log";
                print-category yes;
                print-severity yes;
                print-time yes;
                severity info;
        };
        category xfer-in { xfer-log; };
        category xfer-out { xfer-log; };
        category notify { xfer-log; };
};

非常感谢您的帮助!

编辑:区域文件:

# cat /var/named/internal/dafaces.com.fw
$ORIGIN .
$TTL 3600       ; 1 hour
dafaces.com             IN SOA  tressis.dafaces.com. postmaster.dafaces.com. (
                                2011032201 ; serial
                                28800      ; refresh (8 hours)
                                7200       ; retry (2 hours)
                                2419200    ; expire (4 weeks)
                                3600       ; minimum (1 hour)
                                )
                        NS      tressis.dafaces.com.
                        A       192.168.1.1
                        MX      10 mail.dafaces.com.
$ORIGIN _tcp.dafaces.com.
_http                   SRV     0 5 80 www.dafaces.com.
_ssh                    SRV     0 5 22 tressis.dafaces.com.
$ORIGIN dafaces.com.
acrisius                A       192.168.1.230
andromeda               A       192.168.1.7
andromeda-win7          CNAME   andromeda
aspasia                 A       192.168.1.233
athena                  A       192.168.1.232
callisto                A       192.168.1.102
db                      A       192.168.1.1
management              A       192.168.1.1 ; web management for the router functions
haley                   A       192.168.1.5
hoth                    A       192.168.1.101
mail                    A       192.168.1.1
satelite                A       192.168.1.20
sony-player             A       192.168.1.103
                        TXT     "310f16de2d2712dfc4ae6e5c54f60f828e"
torrent                 A       192.168.1.1
tracker                 A       192.168.1.1
tressis                 A       192.168.1.1
www                     A       192.168.1.1
zeus                    A       192.168.1.231

# cat /var/named/external/dafaces.com.fw
$ORIGIN .
$TTL 3600
dafaces.com             IN SOA  ns.dafaces.com. postmaster.dafaces.com. (
                                        2011032405; serial
                                        28800; refresh
                                        7200; retry
                                        2419200; expire
                                        3600; minimum
                                        )

                        NS      ns.dafaces.com.
                        NS      ns0.xname.org.
                        NS      ns1.xname.org.
                        NS      ns2.xname.org.

                        A       89.135.129.37
                        MX      10 mail.dafaces.com.

$ORIGIN dafaces.com.
;Szolgaltatasok
_ssh._tcp               SRV     0 5 22 tressis
_http._tcp              SRV     0 5 80 www

ns                      A       89.135.129.37
hoth                    A       89.135.129.37
www                     A       89.135.129.37
mail                    A       89.135.129.37
db                      A       89.135.129.37

torrent                 A       89.135.129.37
tracker                 A       89.135.129.37

编辑:

哦,我差点忘了。由于节点通过住宅连接互联网,因此公共 ipv4 地址可能会发生变化(但谢天谢地,这种情况非常罕见),因此我每天都会用 shellscript 更新区域文件中的外部 IP 地址:

# cat /etc/cron.daily/dnsupdate
#!/bin/sh

FILE="/var/named/external/dafaces.com.fw"
SERIAL=$(date +%Y%m%d05)
PUBLIC_IP=$(ifconfig internet |sed -n "/inet addr:.*255.255.255.255/{s/.*inet addr://; s/ .*//; p}")

cat $FILE | sed --posix 's/^.* serial$/\t\t\t\t\t'$SERIAL'; serial/' | sed --posix 's/[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*/'$PUBLIC_IP'/'  > /tmp/ujzona
mv /tmp/ujzona $FILE
/etc/rc.d/named reload

答案1

尝试改变以下几行:

dafaces.com             IN SOA  tressis.dafaces.com. postmaster.dafaces.com. (

dafaces.com. IN SOA tressis.dafaces.com. postmaster.dafaces.com. (

答案2

常见的问题:“有什么变化吗?”您​​是否碰巧修改过 /etc/resolv.conf,可能试图稍微缩短超时时间?(或者运行 BIND 的机器负载可能比最初更重,速度也明显比最初慢?)

只有网络跟踪(wireshark?)才能确定,但​​在我看来,第一个请求的foo.bar.baz返回速度不够快,因此解析器超时然后尝试foo.bar.baz.bar.baz(将“域”附加到任何内容...即使它是一个愚蠢的重复)。第二个查询可能以前从未正常工作过(可能是因为另一个响应中提到的缺少尾随点),但在您的初始测试期间这并不重要,因为查询从未被发送过。

现在查询已发送,并触发了 BIND 配置中一直存在的错误行为。尝试将option timeout:N/etc/resolv.conf 中的选项调高,看看是否停止发生这种情况。(或者将选项调低,使其始终触发问题,然后修复根本问题,然后将选项调回合理值。)

相关内容