☰

BIND DNS Linux - 将查询转发到另一个 DNS

tag-icon • tag-icon bind
BIND DNS Linux - 将查询转发到另一个 DNS

我有一台服务器，其 DNS 设置指向 DNS Linux (.157)，我需要将此服务器加入到由 Microsoft AD 托管的 AD 域。我需要将 ldap 的 SRV 查询从 DNS Linux 转发到另一个 DNS（Microsoft DNS，.149）。AD 域是 corp.dom；在我的 DNS Linux 上有以下配置：

  options {
    #listen-on port 53 { 172.23.133.157; 127.0.0.1; };
    listen-on-v6 port 53 { none; };
    allow-query { any; };
    allow-recursion { any; };
    directory       "/var/named";
    dump-file       "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";
    recursion yes;
    dnssec-enable yes;
    dnssec-validation yes;
    dnssec-lookaside auto;
    /* Path to ISC DLV key */
    bindkeys-file "/etc/named.iscdlv.key";
    managed-keys-directory "/var/named/dynamic";

    version "REFUSED";
};

zone "corp.dom" {
      type forward;
      forward only;
      forwarders {172.23.133.149; };  //this is the Microsoft DNS where corp.dom resides
 };

我捕获了这个输出：

 [root@predns named]# dig srv _ldap._tcp.dc._msdcs.corp.dom

 ; <<>> DiG 9.9.4-RedHat-9.9.4-18.el7_1.1 <<>> srv _ldap._tcp.dc._msdcs.corp.dom
 ;; global options: +cmd
 ;; Got answer:
 ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17251
 ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 1
 ;; WARNING: recursion requested but not available

 ;; OPT PSEUDOSECTION:
 ; EDNS: version: 0, flags:; udp: 4096
 ;; QUESTION SECTION:
 ;_ldap._tcp.dc._msdcs.corp.dom. IN      SRV

 ;; AUTHORITY SECTION:
 .                       518400  IN      NS      m.root-servers.net.
 .                       518400  IN      NS      e.root-servers.net.
 .                       518400  IN      NS      a.root-servers.net.
 .                       518400  IN      NS      f.root-servers.net.
 .                       518400  IN      NS      k.root-servers.net.
 .                       518400  IN      NS      g.root-servers.net.
 .                       518400  IN      NS      b.root-servers.net.
 .                       518400  IN      NS      c.root-servers.net.
 .                       518400  IN      NS      i.root-servers.net.
 .                       518400  IN      NS      d.root-servers.net.
 .                       518400  IN      NS      l.root-servers.net.
 .                       518400  IN      NS      h.root-servers.net.
 .                       518400  IN      NS      j.root-servers.net.

 ;; Query time: 0 msec
 ;; SERVER: 172.23.133.157#53(172.23.133.157)
 ;; WHEN: mar giu 19 16:55:52 CEST 2018
 ;; MSG SIZE  rcvd: 269

任何帮助都将非常有帮助！

DNS linux 的完整配置：我省略了类型主区域，因为它们可以工作并且与 corp.dom 无关：

acl "ihd" { 127.0.0.1/32; 172.23.133.128/28; 172.23.133.144/28; };
include "/etc/rndc.key";
controls {
     inet 127.0.0.1 allow { 127.0.0.1; } keys { "rndc-key"; };
};

options {
    #listen-on port 53 { 172.23.133.157; 127.0.0.1; };
    listen-on-v6 port 53 { none; };
    forwarders { 172.23.133.149; };
    allow-query { any; };
    directory       "/var/named";
    dump-file       "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";
    recursion yes;
    dnssec-enable yes;
    dnssec-validation yes;
    dnssec-lookaside auto;
    /* Path to ISC DLV key */
    bindkeys-file "/etc/named.iscdlv.key";
    managed-keys-directory "/var/named/dynamic";
    empty-zones-enable no;
    version "REFUSED";
};

view "internal" {
 match-clients { ihd; };
 allow-query { ihd; };
 # allow-recursion { ihd; };
 recursion no;


 zone "." IN {
      type hint;
      file "named.ca";
 };

 include "/etc/named.root.key";
 include "/etc/named.rfc1912.zones";

 zone "133.23.172.in-addr.arpa" IN {
      type master;
      file "172.23.133.zone";
      allow-transfer { 172.23.133.157; };
 };
 zone "corp.dom" {
      type forward;
      forward only;
      forwarders {172.23.133.149; };
      /*file "corp.dom.zone";
      allow-transfer { 172.23.133.157; };*/
 };

 view "external" {
 match-clients { any; };
 allow-query { any; };
 recursion no;

 zone "." IN {
    type hint;
    file "named.ca";
 };

 include "/etc/named.rfc1912.zones";


 };

答案1

您已设置recursion no;与内部“ihd” acl 匹配的查询。
所有 DNS 正向查询都是递归查询，您需要recursion yes;至少将其设置为“内部”视图。

DNSSEC 还可能中断递归查询的通信。要确保 DNSSEC 不会导致问题，请使用 +cd 和 +dnssec 选项运行 dig

dig srv _ldap._tcp.dc._msdcs.corp.dom @linux_dns_server_ip +cd
dig srv _ldap._tcp.dc._msdcs.corp.dom @linux_dns_server_ip +dnssec

如果您使用 +cd 选项获得答案，而使用 +dnssec 却没有获得答案，则需要禁用 DNSSEC 验证dnssec-validation no;

答案2

配置没问题，但是你的 Bind DNS 服务器（Linux）能与 Microsoft AD DNS 服务器通信吗？你可以在 Linux DNS 服务器上运行 dig 命令来测试。

dig srv _ldap._tcp.dc._msdcs.corp.dom @ip_of_AD_DNS

如果输出正确，则仅检查 Linux DNS 服务器上的配置。

相关内容