我正在我的家庭网络中实现这一点，所以如果我将角色从主服务器切换到从服务器[这台机器应该作为ns.insec和从属服务器不是.insec在机器 1以及机器 2从服务器到主服务器（主服务器不是.insec和从属服务器ns.insec] 这里出现了同样的问题，区域传输权限被拒绝。它的工作方式是机器 1但机器 2无法传输区域文件。到目前为止，我还没有找到任何解决方案，以应对交换 DNS 服务器角色的情况。我可以从中挖掘并进行反向查询机器 2但我无法执行任何 **dig not.insec -t axfr **。有人能建议我修复此问题吗？
所以我现在可以从机器 1 进行挖掘
dig ns.insec -t axfr
dig not.insec axfr
因此，通过这些，我验证了机器 1 将文件传输到机器 2 但是如果我从机器 2 挖掘这个，我会收到此错误消息。
这是来自 machine2 的日志文件
Mar 16 14:26:50 ip-172-31-31-48 named[6131]: zone not.insec/IN: sending notifies (serial 7)
Mar 16 14:26:50 ip-172-31-31-48 named[6131]: zone ns.insec/IN: sending notifies (serial 10)
Mar 16 14:26:50 ip-172-31-31-48 named[6131]: zone 31.31.172.in-addr.arpa/IN: refresh: non-authoritative answer from master 172.31.22.11#53 (source 0.0.0.0#0)
Mar 16 14:50:50 ip-172-31-31-48 dhclient: DHCPREQUEST of 172.31.31.48 on eth0 to 172.31.16.1 port 67 (xid=0x1a6b53e6)
Mar 16 14:50:50 ip-172-31-31-48 dhclient: DHCPACK of 172.31.31.48 from 172.31.16.1
Mar 16 14:50:50 ip-172-31-31-48 dhclient: bound to 172.31.31.48 -- renewal in 1698 seconds.
Mar 16 14:40:54 ip-172-31-31-48 named[6131]: message repeated 4 times: [ zone 31.31.172.in-addr.arpa/IN: refresh: non-authoritative answer from master 172.31.22.11#53 (source 0.0.0.0#0)]
Mar 16 14:54:47 ip-172-31-31-48 named[6131]: client 172.31.31.48#52792 (ns.insec): zone transfer 'ns.insec/AXFR/IN' denied
Mar 16 14:55:05 ip-172-31-31-48 named[6131]: zone 31.31.172.in-addr.arpa/IN: refresh: non-authoritative answer from master 172.31.22.11#53 (source 0.0.0.0#0)
Mar 16 14:55:22 ip-172-31-31-48 named[6131]: client 172.31.31.48#49102 (not.insec): zone transfer 'not.insec/AXFR/IN' denied
这是来自机器 2 的 named.conf.local
zone "not.insec" {
type master;
file "/etc/bind/zones/db.not.insec";
allow-transfer { 172.31.22.11; 127.0.0.1; };
also-notify { 172.31.22.11; };
};
zone "48-20.31.31.172.in-addr.arpa"{
type master;
file "/etc/bind/zones/db.172.31.31.20-48";
allow-transfer { 172.31.22.11; };
also-notify { 172.31.22.11; };
};
zone "ns.insec" {
type slave;
file "db.ns.insec";
masters { 172.31.22.11; };
};
zone "31.31.172.in-addr.arpa" {
type slave;
file "db.172.31.31";
masters { 172.31.22.11; };
};
这是来自机器 2 的 named.conf.options
acl "allowed" {
localhost;
172.31.0.0/20;
localnets;
};
options {
directory "/var/cache/bind";
// If there is a firewall between you and nameservers you want
// to talk to, you may need to fix the firewall to allow multiple
// ports to talk. See http://www.kb.cert.org/vuls/id/800113
// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.
forwarders {
8.8.8.8;
};
//========================================================================
// If BIND logs error messages about the root key being expired,
// you will need to update your keys. See https://www.isc.org/bind-keys
//========================================================================
dnssec-validation auto;
auth-nxdomain no; # conform to RFC1035
listen-on-v6 { any; };
forward only;
allow-query { allowed; };
allow-query-cache { allowed; };
allow-recursion { allowed; };
recursion yes;
allow-transfer { 172.31.22.11; 127.0.0.1; };
};
这是 machine2 中 /etc/bind/ 的文件权限
机器 1 中的 /etc/bind/ 也具有相同的权限
-rw-r--r-- 1 root root 2389 Mar 8 14:54 bind.keys
-rw-r--r-- 1 root root 237 Mar 8 14:54 db.0
-rw-r--r-- 1 root root 271 Mar 8 14:54 db.127
-rw-r--r-- 1 root root 237 Mar 8 14:54 db.255
-rw-r--r-- 1 root root 353 Mar 8 14:54 db.empty
-rw-r--r-- 1 root root 270 Mar 8 14:54 db.local
-rw-r--r-- 1 root root 3048 Mar 8 14:54 db.root
-rw-rw-r-- 1 bind bind 463 Mar 8 14:54 named.conf
-rw-rw-r-- 1 bind bind 490 Mar 8 14:54 named.conf.default-zones
-rw-rw-r-- 1 bind bind 724 Mar 16 14:20 named.conf.local
-rw-rw-r-- 1 bind bind 1113 Mar 16 14:26 named.conf.options
-rw-rw-r-- 1 bind bind 1112 Mar 16 06:03 named.conf.options.save
-rw-r----- 1 bind bind 77 Mar 15 21:21 rndc.key
drwxr-sr-x 2 bind bind 4096 Mar 16 05:07 zones
-rw-r--r-- 1 root root 1317 Mar 8 14:54 zones.rfc1918
机器 1 中的 named.conf.options
acl "trusted" {
localhost;
172.31.0.0/20;
localnets;
};
options {
directory "/var/cache/bind";
// If there is a firewall between you and nameservers you want
// to talk to, you may need to fix the firewall to allow multiple
// ports to talk. See http://www.kb.cert.org/vuls/id/800113
// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.
forwarders {
8.8.8.8;
};
//========================================================================
// If BIND logs error messages about the root key being expired,
// you will need to update your keys. See https://www.isc.org/bind-keys
//========================================================================
dnssec-validation auto;
auth-nxdomain no; # conform to RFC1035
listen-on-v6 { any; };
forward only;
allow-query-cache { trusted; };
allow-query { trusted; };
allow-recursion { trusted; };
recursion yes;
allow-transfer { 172.31.31.48; 127.0.0.1; };
//also-notify { trusted; };
};
这是机器 1 中的 named.conf.local
zone "ns.insec" {
type master;
file "/etc/bind/zones/db.ns.insec";
allow-transfer { 172.31.31.48; 127.0.0.1; };
also-notify { 172.31.31.48; };
};
zone "22.31.172.in-addr.arpa" {
type master;
file "/etc/bind/zones/db.172.31.22";
allow-transfer { 172.31.31.48; };
also-notify { 172.31.31.48; };
};
zone "not.insec" {
type slave;
file "db.not.insec";
masters { 172.31.31.48; };
};
zone "11-20.22.31.172" {
type slave ;
file "db.172.31.22.20-11";
masters { 172.31.31.48; };
};
我将感激你的努力。谢谢
答案1
这是来自服务器 #2 上的日志的错误：
3月16日 14:55:22 ip-172-31-31-48 命名[6131]:客户端172.31.31.48#49102（not.insec）：区域传输“not.insec/AXFR/IN”被拒绝
这是你的区域在服务器＃2上的配置方式：
zone "not.insec" {
type master;
file "/etc/bind/zones/db.not.insec";
allow-transfer { 172.31.22.11; 127.0.0.1; };
also-notify { 172.31.22.11; };
};
再仔细地读一遍这两段。提示以粗体显示。