我刚刚使用 Virtualbox 设置了一个 DNS 服务器和一个 Web 服务器。DNS 服务器的 IP 地址是 192.168.56.101，Web 服务器的 IP 地址是 192.168.56.102。
以下是我的 DNS 服务器配置文件：
命名的.conf：
[quan@localhost ~]$ sudo cat /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
//query-source address * port 53;
//forward first;
forwarders { 8.8.8.8; 8.8.4.4; };
listen-on port 53 { 127.0.0.1; 192.168.56.0/24; };
allow-query { localhost; 192.168.56.0/24; };
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
};
logging {
channel default_debug {
file "data/named.run";
severity debug 10;
print-category yes;
print-time yes;
print-severity yes;
};
};
zone "quantran.com" in {
type master;
file "named.quantran.com";
};
zone "56.168.192.in-addr.arpa" in {
type master;
file "named.192.168.56";
allow-update { none; };
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
named.quantran.com：
[quan@localhost ~]$ sudo cat /var/named/named.quantran.com
$TTL 86400
quantran.com. IN SOA dns1.quantran.com. root.quantran.com. (
100 ; serial
3600 ; refresh
600 ; retry
604800 ; expire
86400 )
IN NS dns1.quantran.com.
dns1.quantran.com. IN A 192.168.56.101
www.quantran.com. IN A 192.168.56.102
命名.192.168.56：
[quan@localhost ~]$ sudo cat /var/named/named.192.168.56
$TTL 86400
$ORIGIN 56.168.192.in-addr.arpa.
@ IN SOA dns1.quantran.com. root.quantran.com. (
100 ; serial
3600 ; refresh
600 ; retry
604800 ; expire
86400 ) ; minimum
IN NS dns1.quantran.com.
101.56.168.192.in-addr.arpa. IN PTR dns1.quantran.com.
102 IN PTR www.quantran.com.
当我尝试从主机进行正常查找时（我配置为主机使用的唯一名称服务器是 DNS 服务器 192.168.56.101）：
quan@quantran:~$ host www.quantran.com
www.quantran.com has address 192.168.56.102
quan@quantran:~$ host dns1.quantran.com
dns1.quantran.com has address 192.168.56.101
但是当我尝试反向查找时：
quan@quantran:~$ host -v 192.168.56.101 192.168.56.101
Trying "101.56.168.192.in-addr.arpa"
Using domain server:
Name: 192.168.56.101
Address: 192.168.56.101#53
Aliases:
Host 101.56.168.192.in-addr.arpa not found: 2(SERVFAIL)
Received 45 bytes from 192.168.56.101#53 in 0 ms
quan@quantran:~$ host -v 192.168.56.102 192.168.56.101
Trying "102.56.168.192.in-addr.arpa"
Using domain server:
Name: 192.168.56.101
Address: 192.168.56.101#53
Aliases:
Host 102.56.168.192.in-addr.arpa not found: 2(SERVFAIL)
Received 45 bytes from 192.168.56.101#53 in 0 ms
那么为什么我无法执行反向查找？区域配置文件有问题吗？
提前致谢 ：）
哦，这是我执行反向查找时日志文件 /var/named/data/named.run 的输出：
quan@quantran:~$ host 192.168.56.102 192.168.56.101
Using domain server:
Name: 192.168.56.101
Address: 192.168.56.101#53
Aliases:
Host 102.56.168.192.in-addr.arpa not found: 2(SERVFAIL)
/var/named/data/named.run：
02-Jun-2014 15:18:11.950 client: debug 3: client 192.168.56.1#51786: UDP request
02-Jun-2014 15:18:11.950 client: debug 5: client 192.168.56.1#51786: using view '_default'
02-Jun-2014 15:18:11.950 security: debug 3: client 192.168.56.1#51786: request is not signed
02-Jun-2014 15:18:11.950 security: debug 3: client 192.168.56.1#51786: recursion available
02-Jun-2014 15:18:11.950 client: debug 3: client 192.168.56.1#51786: query
02-Jun-2014 15:18:11.950 client: debug 10: client 192.168.56.1#51786: ns_client_attach: ref = 1
02-Jun-2014 15:18:11.950 query-errors: debug 1: client 192.168.56.1#51786: query failed (SERVFAIL) for 102.56.168.192.in-addr.arpa/IN/PTR at query.c:5428
02-Jun-2014 15:18:11.950 client: debug 3: client 192.168.56.1#51786: error
02-Jun-2014 15:18:11.950 client: debug 3: client 192.168.56.1#51786: send
02-Jun-2014 15:18:11.950 client: debug 3: client 192.168.56.1#51786: sendto
02-Jun-2014 15:18:11.951 client: debug 3: client 192.168.56.1#51786: senddone
02-Jun-2014 15:18:11.951 client: debug 3: client 192.168.56.1#51786: next
02-Jun-2014 15:18:11.951 client: debug 10: client 192.168.56.1#51786: ns_client_detach: ref = 0
02-Jun-2014 15:18:11.951 client: debug 3: client 192.168.56.1#51786: endrequest
02-Jun-2014 15:18:11.951 client: debug 3: client @0xb537e008: udprecv
另外，我对named.conf中的日志部分做了一些更改。
主机的 resolv.conf：
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
# DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 192.168.56.101
#nameserver 127.0.1.1
答案1
问题其实出在文件的权限设置上。以下是 /var/named 文件夹的内容：
[root@localhost quan]# ls -alZ /var/named/
drwxr-x---. root named system_u:object_r:named_zone_t:s0 .
drwxr-xr-x. root root system_u:object_r:var_t:s0 ..
drwxrwx---. named named system_u:object_r:named_cache_t:s0 data
drwxrwx---. named named system_u:object_r:named_cache_t:s0 dynamic
-rw-r-----. root root unconfined_u:object_r:named_zone_t:s0 named.192.168.56
-rw-r-----. root named system_u:object_r:named_conf_t:s0 named.ca
-rw-r-----. root named system_u:object_r:named_zone_t:s0 named.empty
-rw-r-----. root named system_u:object_r:named_zone_t:s0 named.localhost
-rw-r-----. root named system_u:object_r:named_zone_t:s0 named.loopback
-rw-r--r--. root root unconfined_u:object_r:named_zone_t:s0 named.quantran.com
drwxrwx---. named named system_u:object_r:named_cache_t:s0 slaves
如您所见，named.quantran.com 文件被 chmod 644，并且可由用户 named 读取。但是，named.192.168.56（反向区域配置文件）被 chmod 640，并且无法由用户 named 读取。因此我无法成功执行反向查找。不过，我不明白为什么它是 chmod 640，而 named.quantran.com 是 chmod 644 @@