У меня проблемы с настройкой обратного DNS.
Я владею упомянутыми общедоступными IP-адресами.
После внесения изменений в named.conf (добавлена зона "1.198.193.in-addr.arpa")
options {
directory "/var/cache/bind";
auth-nxdomain no; # conform to RFC1035
listen-on { 193.198.1.6; };
listen-on-v6 { "none"; };
recursion no;
allow-transfer { 193.198.1.9; };
also-notify { 193.198.1.9; };
};
controls {
inet 127.0.0.1 allow { localhost; };
};
zone "gkr.hr" {
type master;
file "/etc/bind/zones/gkr.hr.db";
};
zone "gkri.hr" {
type master;
file "/etc/bind/zones/gkri.hr.db";
};
zone "1.198.193.in-addr.arpa" in {
type master;
file "/etc/bind/193.198.1.gkri.rev";
allow-transfer {
193.198.1.9;
};
allow-query { any; };
};
и создание нового файла .rev
Содержание /etc/bind/193.198.1.gkri.rev
$TTL 1D
@ SOA a.ns.gkr.hr. admin.gkr.hr. (
2016091201 ; Serial
10800 ; Refresh
3600 ; Retry
2419200 ; Expire
14400) ; Minimum
@ NS a.ns.gkr.hr.
@ NS b.ns.gkr.hr.
11 PTR mail.gkri.hr.
И после этой конфигурации при запуске:
корень @ a: / home / admin # nslookup 193.198.1.11
я получил
;; Got SERVFAIL reply from 161.53.123.3, trying next server
;; Got SERVFAIL reply from 161.53.160.3, trying next server
;; connection timed out; no servers could be reached
но когда я бегу
корень @ a: / home / admin # nslookup mail.gkri.hr
mail.gkri.hr находится на 193.198.1.11
Server: 161.53.123.3
Address: 161.53.123.3#53
Non-authoritative answer:
Name: mail.gkri.hr
Address: 193.198.1.11
Также немного другой ценной информации
корень @ a: / home / admin # named-checkzone 1.198.193.in-addr.arpa /etc/bind/193.198.1.gkri.rev
zone 1.198.193.in-addr.arpa/IN: loaded serial 2016091201
OK
root@a:/home/admin# named-checkconf -z
zone gkr.hr/IN: loaded serial 2016091201
zone gkri.hr/IN: loaded serial 2016091203
zone 11.1.198.193.in-addr.arpa/IN: loaded serial 2016091201
root @ a: / home / admin # host -t any 11.1.198.193.in-addr.arpa a.ns.gkr.hr
Using domain server:
Name: a.ns.gkr.hr
Address: 193.198.1.6#53
Aliases:
11.1.198.193.in-addr.arpa has SOA record a.ns.gkr.hr. admin.gkr.hr. 2016091201 10800 3600 2419200 14400
11.1.198.193.in-addr.arpa name server a.ns.gkr.hr.
11.1.198.193.in-addr.arpa name server b.ns.gkr.hr.
При запуске копать я получаю
корень @ a: / etc / bind # dig -x 193.198.1.11
; <<>> DiG 9.7.3 <<>> -x 193.198.1.11
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 11421
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;11.1.198.193.in-addr.arpa. IN PTR
;; ANSWER SECTION:
11.1.198.193.in-addr.arpa. 14400 IN CNAME 11.0/27.1.198.193.in-addr.arpa.
;; Query time: 33 msec
;; SERVER: 161.53.123.3#53(161.53.123.3)
;; WHEN: Tue Sep 13 11:56:47 2016
;; MSG SIZE rcvd: 65
корень @ a: / home / admin # dig -x 193.198.1.11 + трассировка
; <<>> DiG 9.7.3 <<>> -x 193.198.1.11 +trace
;; global options: +cmd
. 3599800 IN NS e.root-servers.net.
. 3599800 IN NS k.root-servers.net.
. 3599800 IN NS j.root-servers.net.
. 3599800 IN NS i.root-servers.net.
. 3599800 IN NS c.root-servers.net.
. 3599800 IN NS m.root-servers.net.
. 3599800 IN NS b.root-servers.net.
. 3599800 IN NS l.root-servers.net.
. 3599800 IN NS a.root-servers.net.
. 3599800 IN NS f.root-servers.net.
. 3599800 IN NS g.root-servers.net.
. 3599800 IN NS d.root-servers.net.
. 3599800 IN NS h.root-servers.net.
;; Received 241 bytes from 161.53.123.3#53(161.53.123.3) in 15 ms
in-addr.arpa. 172800 IN NS e.in-addr-servers.arpa.
in-addr.arpa. 172800 IN NS f.in-addr-servers.arpa.
in-addr.arpa. 172800 IN NS d.in-addr-servers.arpa.
in-addr.arpa. 172800 IN NS c.in-addr-servers.arpa.
in-addr.arpa. 172800 IN NS b.in-addr-servers.arpa.
in-addr.arpa. 172800 IN NS a.in-addr-servers.arpa.
;; Received 419 bytes from 198.41.0.4#53(a.root-servers.net) in 35 ms
193.in-addr.arpa. 86400 IN NS tinnie.arin.net.
193.in-addr.arpa. 86400 IN NS pri.authdns.ripe.net.
193.in-addr.arpa. 86400 IN NS sns-pb.isc.org.
193.in-addr.arpa. 86400 IN NS sec3.apnic.net.
;; Received 156 bytes from 193.0.9.1#53(f.in-addr-servers.arpa) in 30 ms
198.193.in-addr.arpa. 172800 IN NS dns1.carnet.hr.
198.193.in-addr.arpa. 172800 IN NS dns2.carnet.hr.
198.193.in-addr.arpa. 172800 IN NS ns.ripe.net.
;; Received 159 bytes from 202.12.28.140#53(sec3.apnic.net) in 238 ms
11.1.198.193.in-addr.arpa. 14400 IN CNAME 11.0/27.1.198.193.in-addr.arpa.
0/27.1.198.193.in-addr.arpa. 14400 IN NS ns.ri.carnet.hr.
0/27.1.198.193.in-addr.arpa. 14400 IN NS ns.gkri.hr.
;; Received 116 bytes from 161.53.160.2#53(dns2.carnet.hr) in 3 ms
Вот мой системный журнал после перезапуска /etc/init.d/bind9
корень @ a: / var / log # cat / var / log / syslog | grep по имени
Sep 13 10:12:37 a named[934]: received control channel command 'stop -p'
Sep 13 10:12:37 a named[934]: shutting down: flushing changes
Sep 13 10:12:37 a named[934]: stopping command channel on 127.0.0.1#953
Sep 13 10:12:37 a named[934]: no longer listening on 193.198.1.6#53
Sep 13 10:12:37 a named[934]: exiting
Sep 13 10:12:38 a named[1187]: starting BIND 9.7.3 -4 -u bind
Sep 13 10:12:38 a named[1187]: built with '--prefix=/usr' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--sysconfdir=/etc/bind' '--localstatedir=/var' '--enable-threads' '--enable-largefile' '--with-libtool' '--enable-shared' '--enable-static' '--with-openssl=/usr' '--with-gssapi=/usr' '--with-gnu-ld' '--with-dlz-postgres=no' '--with-dlz-mysql=no' '--with-dlz-bdb=yes' '--with-dlz-filesystem=yes' '--with-dlz-ldap=yes' '--with-dlz-stub=yes' '--with-geoip=/usr' '--enable-ipv6' 'CFLAGS=-fno-strict-aliasing -DDIG_SIGCHASE -O2' 'LDFLAGS=' 'CPPFLAGS='
Sep 13 10:12:38 a named[1187]: adjusted limit on open files from 1024 to 1048576
Sep 13 10:12:38 a named[1187]: found 1 CPU, using 1 worker thread
Sep 13 10:12:38 a named[1187]: using up to 4096 sockets
Sep 13 10:12:38 a named[1187]: loading configuration from '/etc/bind/named.conf'
Sep 13 10:12:38 a named[1187]: using default UDP/IPv4 port range: [1024, 65535]
Sep 13 10:12:38 a named[1187]: using default UDP/IPv6 port range: [1024, 65535]
Sep 13 10:12:38 a named[1187]: no IPv6 interfaces found
Sep 13 10:12:38 a named[1187]: listening on IPv4 interface eth0, 193.198.1.6#53
Sep 13 10:12:38 a named[1187]: generating session key for dynamic DNS
Sep 13 10:12:38 a named[1187]: set up managed keys zone for view _default, file 'managed-keys.bind'
Sep 13 10:12:38 a named[1187]: command channel listening on 127.0.0.1#953
Sep 13 10:12:38 a named[1187]: zone 11.1.198.193.in-addr.arpa/IN: loaded serial 2016091201
Sep 13 10:12:38 a named[1187]: zone gkr.hr/IN: loaded serial 2016091201
Sep 13 10:12:38 a named[1187]: zone gkri.hr/IN: loaded serial 2016091203
Sep 13 10:12:38 a named[1187]: managed-keys-zone ./IN: loading from master file managed-keys.bind failed: file not found
Sep 13 10:12:38 a named[1187]: managed-keys-zone ./IN: loaded serial 0
Sep 13 10:12:38 a named[1187]: running
Sep 13 10:12:38 a named[1187]: zone 11.1.198.193.in-addr.arpa/IN: sending notifies (serial 2016091201)
Sep 13 10:12:38 a named[1187]: zone gkr.hr/IN: sending notifies (serial 2016091201)
Sep 13 10:12:38 a named[1187]: zone gkri.hr/IN: sending notifies (serial 2016091203)
Кто-нибудь знает, что не так?
Может ли это быть Ключевая информация DNSSEC для Bind 9 ?
* упоминается в системном журнале (managed-keys.bind)
Ваша зона - "0 / 27.1.198.193.in-addr.arpa", поэтому измените свою зону в named.conf на:
zone "0/27.1.198.193.in-addr.arpa" in {
Перезапустите BIND.