我在尝试将 PowerDNS 服务器的完整区域传输到 Bind9 服务器时遇到问题。奇怪的是,在充当隐藏主服务器(带有 MySQL 后端)的 PowerDNS 服务器上有多个区域,但只有一个区域无法传输到 Bind9 服务器。
两台服务器均运行 Ubuntu 16.04 LTS。使用:
- Bind9 版本 = 9.10.3.dfsg.P4-8ubuntu1
- PowerDNS 版本 = 4.0.0~alpha2-3build1
Bind9 从属区域配置如下:
zone "example.net" {
type slave;
file "/var/lib/bind/slaves/db.example.net";
masters {
10.0.0.1;
};
};
PowerDNS 的 DNS 区域是:
% sudo pdnsutil show-zone example.net
This is a Master zone
Last SOA serial number we notified: 2016050801 == 2016050801 (serial in the database)
Zone is not actively secured
Metadata items: None
No keys for zone 'example.net.'.
% sudo pdnsutil list-zone example.net
example.net. 10800 IN MX 10 mx1.example.org.
example.net. 10800 IN MX 50 mx2.example.org.
example.net. 10800 IN NS ns1.example.org.
example.net. 10800 IN NS ns2.example.org.
example.net. 86400 IN SOA ns1.example.org. hostmaster.example.org. 2016050801 28800 7200 604800 86400
...
注意。网和.org在此输出中。以下是尝试向 Bind 提供区域时日志中的 PowerDNS 输出。
May 9 00:44:14 hdns01 pdns[40494]: AXFR of domain 'example.net.' initiated by 10.0.0.2
May 9 00:44:14 hdns01 pdns[40494]: AXFR of domain 'example.net.' allowed: client IP 10.0.0.2 is in allow-axfr-ips
May 9 00:44:14 hdns01 pdns[40494]: AXFR of domain 'example.net.' failed: not authoritative
以及Bind给出的相应日志。
May 9 00:44:14 rdns01 named[32973]: zone example.net/IN: refresh: unexpected rcode (REFUSED) from master 10.0.0.1#53 (source 0.0.0.0#0)
May 9 00:44:14 rdns01 named[32973]: zone example.net/IN: Transfer started.
May 9 00:44:14 rdns01 named[32973]: transfer of 'example.net/IN' from 10.0.0.1#53: connected using 10.0.0.2#55376
May 9 00:44:14 rdns01 named[32973]: transfer of 'example.net/IN' from 10.0.0.1#53: failed while receiving responses: NOTAUTH
May 9 00:44:14 rdns01 named[32973]: transfer of 'example.net/IN' from 10.0.0.1#53: Transfer status: NOTAUTH
May 9 00:44:14 rdns01 named[32973]: transfer of 'example.net/IN' from 10.0.0.1#53: Transfer completed: 0 messages, 0 records, 0 bytes, 0.004 secs (0 bytes/sec)
因此 Bind9 表示服务器不具有权威性。这很奇怪。因此让我们使用挖让事情变得更清楚一点。
% dig @10.0.0.1 example.net. SOA
; <<>> DiG 9.10.3-P4-Ubuntu <<>> @10.0.0.1 example.net. SOA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47002
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1680
;; QUESTION SECTION:
;example.net. IN SOA
;; ANSWER SECTION:
example.net. 86400 IN SOA ns1.example.org. hostmaster.example.org. 2016050801 28800 7200 604800 86400
;; Query time: 2 msec
;; SERVER: 10.0.0.1#53(10.0.0.1)
;; WHEN: Mon May 09 00:53:51 CEST 2016
;; MSG SIZE rcvd: 104
我觉得这很权威。所以之后我尝试用 dig 做 AXFR。令人惊讶的是它成功了...
% dig -t axfr example.net @10.0.0.1
; <<>> DiG 9.10.3-P4-Ubuntu <<>> -t axfr example.net @10.0.0.1
;; global options: +cmd
example.net. 86400 IN SOA ns1.example.org. hostmaster.example.org. 2016050801 28800 7200 604800 86400
...
;; Query time: 73 msec
;; SERVER: 10.0.0.1#53(10.0.0.1)
;; WHEN: Mon May 09 00:56:42 CEST 2016
;; XFR size: 58 records (messages 3, bytes 1952)
我不知道该往哪儿看。
感谢您的帮助。
更新:
数据包捕获的日志:
1 0.000000 10.0.0.2 10.0.0.1 DNS 82 Standard query 0xe0dd SOA example.net OPT
2 0.002902 10.0.0.1 10.0.0.2 DNS 82 Standard query response 0xe0dd Refused SOA example.net OPT
6 0.004506 10.0.0.2 10.0.0.1 DNS 97 Standard query 0x205c AXFR example.net
8 0.006432 10.0.0.1 10.0.0.2 DNS 97 Standard query response 0x205c Not authoritative AXFR example.net
PowerDNS 从成功的手动 AXFR 中记录:
May 9 08:19:51 hdns01 pdns[40494]: AXFR of domain 'example.net.' initiated by 10.0.0.2
May 9 08:19:51 hdns01 pdns[40494]: AXFR of domain 'example.net.' allowed: client IP 10.0.0.2 is in allow-axfr-ips
May 9 08:19:52 hdns01 pdns[40494]: AXFR of domain 'example.net.' to 10.0.0.2 finished
PowerDNS配置文件:
#################################
# allow-axfr-ips Allow zonetransfers only to these subnets
#
allow-axfr-ips=127.0.0.0/8,::1,10.0.0.2
#################################
# also-notify When notifying a domain, also notify these nameservers
#
also-notify=10.20.1.78,10.0.0.2
#################################
# daemon Operate as a daemon
#
daemon=yes
#################################
# include-dir Include *.conf files from this directory
#
# include-dir=
include-dir=/etc/powerdns/pdns.d
#################################
# launch Which backends to launch and order to query them in
#
# launch=
launch=
#################################
# master Act as a master
#
master=yes
#################################
# setgid If set, change group id to this gid for more security
#
setgid=pdns
#################################
# setuid If set, change user id to this uid for more security
#
setuid=pdns
MySQL 后端配置部分/etc/powerdns/pdns.d/目录。
# MySQL Configuration
#
# Launch gmysql backend
launch+=gmysql
# gmysql parameters
gmysql-host=127.0.0.1
gmysql-port=
gmysql-dbname=pdns
gmysql-user=MYUSER
gmysql-password=MYPASSWORD
gmysql-dnssec=yes
# gmysql-socket=
答案1
在我的要求下,发帖人来到了我们的 #powerdns IRC 频道,我们很快发现,主域名和从域名之间实际上是拼写错误 - 被为了在此提问而进行的混淆所隐藏。
答案2
我猜是这样的,因为你基本上把所有有用的东西都藏起来了。你是故意让人难以帮助你吗?
看起来您example.net
的表中有一个条目domains
,但是domain_id
在records
表的该条目下,您放置了example.org
记录。pdnsutil check-all-zones
(或者pdnssec
如果您使用的是 3.x)可能会注意到这一点。