Dock-comper-DNS SERVER

admin — Sun, 22 Jan 2023 17:30:03 +0000

#dns
#https://www.youtube.com/watch?v=syzwLwE3Xq4&t=1290s

vim named.conf

#允許LAN
acl internal {
10.10.0.0/16;
10.11.0.0/16;
10.20.0.0/16;
};

options {
forwarders {
1.1.1.1;
};
allow-query { internal; }
}’

zone "demo.clcreative.de" in {
type master;
file "/etc/bind/demo-clcreative=de.zone";
};

#如果出現 ERROR: for bind9 can not start service bind9: driver failed programming external connectivitry on endpoint or starting userland proxy: listen tcp4 0.0.0.:53 bind:Aandress already in use
#vim /etc/systemd/resolved.conf
#DNSStubListener=no
systemctl restart systemd-resolved

vi demo-clcreative-de.zone
$TTL 2d

$ORIGIN demo.clcreative.de.

@ IN SOA ns.demo.clcreative.de. info.clcreative.de (
2022122800 ;serial
12h ;refresh
15m ;retry
3w ;expire
2h ;minimum ttl
)

IN NS ns.demo.clcreative.de.
ns IN A 10.20.3.4
;

srv-prod-1 IN 10.20.0.2
srv-prod-1 IN 10.20.0.3

dns 被當跳板查詢

admin — Sat, 10 Dec 2016 14:15:59 +0000

步驟2-4.安全性設定–限制所有查詢要求 allow-recursion
就是允許哪些來源可以使用 DNS 主機進行遞迴查詢動作。簡單說就是透過這台 DNS 來查詢任何資料，包含不是該 DNS 主機負責的 zone 也代為查詢，你不想讓別人用你的 DNS 去探查別人的 DNS 主機資訊吧？
在 options 加入 allow-recursion { 127.0.0.1/32; 192.168.1.0/24; };
options {
allow-recursion { 127.0.0.1/32; 192.168.1.0/24; };
};

之後再 /var/log/message 會發現
message repeated 8 times
client 94.129.115.38#4444: query (cache) ‘cpsc.gov/ANY/IN’ denied
可以看到他一次查詢次數和查詢的name
—————————————————————————————-
起因是發現named 佔 cpu loading 太高,去查詢發現 /var/log/message 一堆之類訊息
May 25 10:46:13 ns1 named: client 192.168.16.149#64416: view tech: no more recursive clients: quota reached

UI 網站 » dns

Dock-comper-DNS SERVER

dns 被當跳板查詢