Authoritative DNS 伺服器的設定

Authoritative DNS server 為提供註冊 DNS 資源記錄所在的伺服器。

以下顯示 nthu.edu.tw 的 Authoritative DNS server 有 4 筆 (共有 4 個 IPv4 地址與 4 個 IPv6 地 址 )

# dig @140.114.64.1 nthu.edu.tw ns
; <<>> DiG 9.6-ESV-R8 <<>> @140.114.64.1 nthu.edu.tw ns
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56108
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 8
;; QUESTION SECTION:
;nthu.edu.tw. IN NS
;; ANSWER SECTION:
nthu.edu.tw. 127 IN NS dns1.nthu.edu.tw.
nthu.edu.tw. 127 IN NS dns3.twaren.net.
nthu.edu.tw. 127 IN NS dns2.nthu.edu.tw.
nthu.edu.tw. 127 IN NS dns3.nthu.edu.tw.
;; ADDITIONAL SECTION:
dns1.nthu.edu.tw. 69389 IN A 140.114.64.10
dns2.nthu.edu.tw. 14 IN A 140.114.63.10
dns3.nthu.edu.tw. 3113 IN A 140.114.63.20
dns3.twaren.net. 204 IN A 211.79.61.47
dns1.nthu.edu.tw. 69389 IN AAAA 2001:288:e001:64::10
dns2.nthu.edu.tw. 14 IN AAAA 2001:288:e001:63::10
dns3.nthu.edu.tw. 3113 IN AAAA 2001:288:e001:63::20
dns3.twaren.net. 204 IN AAAA 2001:e10:5c00:1::47
;; Query time: 2 msec
;; SERVER: 140.114.64.1#53(140.114.64.1)
;; WHEN: Wed Aug 8 16:26:41 2018
;; MSG SIZE rcvd: 291

BIND 取消 recurion 設定

以下例子為設定 DNS 伺服器 140.114.XX.YY 的 named.conf 設定檔，取消使用遞迴查詢權限，以免造成 open DNS resolver 問題，讓有心人士利用。

設定參數 recursion no ，取消使用遞迴查詢權限。

設定參數 allow-query-cache { none; } ，不允許讀取 cache 暫存資料。

設定參數 allow-query { any; }，允許任何人查詢註冊資料

options {
//(其他參數略...)
// Authoritative-only Name Server
recursion no;
allow-query-cache { none; };
allow-query { any; };
};

修改完上述設定並重新啟動 named 後，再以指令測試，若查詢為所轄註冊資料，則可獲得正確回應資料(status: NOERROR)；若非所轄註冊資料，則拒絕回應(status: REFUSED)。

查詢為所轄註冊資料

# dig @140.114.64.10 www.nthu.edu.tw a
; <<>> DiG 9.6-ESV-R7-P2 <<>> @140.114.64.10 www.nthu.edu.tw a
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57004
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 6
;; WARNING: recursion requested but not available
;; QUESTION SECTION:
;www.nthu.edu.tw. IN A
;; ANSWER SECTION:
www.nthu.edu.tw. 86400 IN A 140.114.69.135
;; AUTHORITY SECTION:
nthu.edu.tw. 86400 IN NS dns1.nthu.edu.tw.
nthu.edu.tw. 86400 IN NS dns3.twaren.net.
nthu.edu.tw. 86400 IN NS dns2.nthu.edu.tw.
nthu.edu.tw. 86400 IN NS dns3.nthu.edu.tw.
;; ADDITIONAL SECTION:
dns1.nthu.edu.tw. 86400 IN A 140.114.64.10
dns1.nthu.edu.tw. 86400 IN AAAA 2001:288:e001:64::10
dns2.nthu.edu.tw. 86400 IN A 140.114.63.10
dns2.nthu.edu.tw. 86400 IN AAAA 2001:288:e001:63::10
dns3.nthu.edu.tw. 86400 IN A 140.114.63.20
dns3.nthu.edu.tw. 86400 IN AAAA 2001:288:e001:63::20
;; Query time: 1 msec
;; SERVER: 140.114.64.10#53(140.114.64.10)
;; WHEN: Tue Sep 24 10:40:09 2013
;; MSG SIZE rcvd: 267

查詢為非所轄註冊資料

# dig @140.114.64.10 gmail.com any
; <<>> DiG 9.6-ESV-R7-P2 <<>> @140.114.64.10 gmail.com any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 20592
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available
;; QUESTION SECTION:
;gmail.com. IN ANY
;; Query time: 1 msec
;; SERVER: 140.114.64.10#53(140.114.64.10)
;; WHEN: Tue Sep 24 10:39:58 2013
;; MSG SIZE rcvd: 27

Authoritative-only DNS 伺服器

master DNS 伺服器

做為網域 nthu.edu.tw 的 master DNS 伺服器 named.conf 參考設定

options {
// Working directory
directory "/etc/namedb";
// Do not allow access to cache
allow-query-cache { none; };
// This is the default
allow-query { any; };
// Do not provide recursive service
recursion no;
// Notify slave
notify yes;
// Hidden version
version none;
};
// Provide a reverse mapping for the loopback
// address 127.0.0.1
zone "0.0.127.in-addr.arpa" {
type master;
file "localhost.rev";
notify no;
};
// master server for nthu.edu.tw
zone "nthu.edu.tw" {
type master;
file "example.com.db";
// IP addresses of slave servers allowed to
// transfer example.com
allow-transfer { 140.114.63.10; };
};

slave DNS 伺服器

做為網域 nthu.edu.tw 的 slave DNS 伺服器 named.conf 參考設定

options {
// Working directory
directory "/etc/namedb";
// Do not allow access to cache
allow-query-cache { none; };
// This is the default
allow-query { any; };
// Do not provide recursive service
recursion no;
// Hidden version
version none;
};
// We are a slave server for nthu.edu.tw
zone "nthu.edu.tw" {
type slave;
file "nthu.edu.tw.bk";
// IP address of eng.example.com master server
masters { 140.114.64.10; };
};

參考資料

BIND documentation