我有一台服务器,其 DNS 设置指向 DNS Linux (.157),我需要将此服务器加入到由 Microsoft AD 托管的 AD 域。我需要将 ldap 的 SRV 查询从 DNS Linux 转发到另一个 DNS(Microsoft DNS,.149)。AD 域是 corp.dom;在我的 DNS Linux 上有以下配置:
options {
#listen-on port 53 { 172.23.133.157; 127.0.0.1; };
listen-on-v6 port 53 { none; };
allow-query { any; };
allow-recursion { any; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
version "REFUSED";
};
zone "corp.dom" {
type forward;
forward only;
forwarders {172.23.133.149; }; //this is the Microsoft DNS where corp.dom resides
};
我捕获了这个输出:
[root@predns named]# dig srv _ldap._tcp.dc._msdcs.corp.dom
; <<>> DiG 9.9.4-RedHat-9.9.4-18.el7_1.1 <<>> srv _ldap._tcp.dc._msdcs.corp.dom
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17251
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 1
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;_ldap._tcp.dc._msdcs.corp.dom. IN SRV
;; AUTHORITY SECTION:
. 518400 IN NS m.root-servers.net.
. 518400 IN NS e.root-servers.net.
. 518400 IN NS a.root-servers.net.
. 518400 IN NS f.root-servers.net.
. 518400 IN NS k.root-servers.net.
. 518400 IN NS g.root-servers.net.
. 518400 IN NS b.root-servers.net.
. 518400 IN NS c.root-servers.net.
. 518400 IN NS i.root-servers.net.
. 518400 IN NS d.root-servers.net.
. 518400 IN NS l.root-servers.net.
. 518400 IN NS h.root-servers.net.
. 518400 IN NS j.root-servers.net.
;; Query time: 0 msec
;; SERVER: 172.23.133.157#53(172.23.133.157)
;; WHEN: mar giu 19 16:55:52 CEST 2018
;; MSG SIZE rcvd: 269
任何帮助都将非常有帮助!
DNS linux 的完整配置:我省略了类型主区域,因为它们可以工作并且与 corp.dom 无关:
acl "ihd" { 127.0.0.1/32; 172.23.133.128/28; 172.23.133.144/28; };
include "/etc/rndc.key";
controls {
inet 127.0.0.1 allow { 127.0.0.1; } keys { "rndc-key"; };
};
options {
#listen-on port 53 { 172.23.133.157; 127.0.0.1; };
listen-on-v6 port 53 { none; };
forwarders { 172.23.133.149; };
allow-query { any; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
empty-zones-enable no;
version "REFUSED";
};
view "internal" {
match-clients { ihd; };
allow-query { ihd; };
# allow-recursion { ihd; };
recursion no;
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.root.key";
include "/etc/named.rfc1912.zones";
zone "133.23.172.in-addr.arpa" IN {
type master;
file "172.23.133.zone";
allow-transfer { 172.23.133.157; };
};
zone "corp.dom" {
type forward;
forward only;
forwarders {172.23.133.149; };
/*file "corp.dom.zone";
allow-transfer { 172.23.133.157; };*/
};
view "external" {
match-clients { any; };
allow-query { any; };
recursion no;
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
};
答案1
您已设置recursion no;
与内部“ihd” acl 匹配的查询。
所有 DNS 正向查询都是递归查询,您需要recursion yes;
至少将其设置为“内部”视图。
DNSSEC 还可能中断递归查询的通信。要确保 DNSSEC 不会导致问题,请使用 +cd 和 +dnssec 选项运行 dig
dig srv _ldap._tcp.dc._msdcs.corp.dom @linux_dns_server_ip +cd
dig srv _ldap._tcp.dc._msdcs.corp.dom @linux_dns_server_ip +dnssec
如果您使用 +cd 选项获得答案,而使用 +dnssec 却没有获得答案,则需要禁用 DNSSEC 验证dnssec-validation no;
答案2
配置没问题,但是你的 Bind DNS 服务器(Linux)能与 Microsoft AD DNS 服务器通信吗?你可以在 Linux DNS 服务器上运行 dig 命令来测试。
dig srv _ldap._tcp.dc._msdcs.corp.dom @ip_of_AD_DNS
如果输出正确,则仅检查 Linux DNS 服务器上的配置。