bind多个view的主备同步

上一篇blog简单写了一下使用nsupdate动态更新DNS记录。今天再写一下在多个view的时候如何设置主备的自动同步。
多个view的主备同步主要是是主备之间每个view都使用共享key进行消息的签名。master的配置和之前的稍微有点小的改动

include "/opt/bind/etc/rndc.key";  
include "/opt/bind/etc/views.key";  
//  
controls {  
inet 127.0.0.1 port 953  
allow { 127.0.0.1; } keys { "rndc-key"; };  
};  
//  
acl test1 {  
10.201.0.0/16;  
};  
acl test2 {  
192.0.0.0/8;  
};  
acl slavedns {  
10.144.149.61;  
127.0.0.1;  
};  
options {  
listen-on port 53 { any; };  
listen-on-v6  { none; };  
directory      "/opt/bind/etc/";  
dump-file      "/opt/bind/var/named/data/cache_dump.db";  
statistics-file "/opt/bind/var/named/data/named_stats.txt";  
memstatistics-file "/opt/bind/var/named/data/named_mem_stats.txt";  
zone-statistics yes;  
allow-query     { any; };  
# recursion config  
recursion yes;  
max-ncache-ttl 60;  
recursive-clients 2000;  
# dnssec config  
dnssec-enable yes;  
dnssec-validation yes;  
dnssec-lookaside auto;  
# rrt config  
rate-limit {  
responses-per-second 20;  
qps-scale  1000;  
window 4;  
slip 2;  
ipv4-prefix-length 32;  
};  
# rpz config  
response-policy {  
zone "rpz.zone"  policy given;  
};  
# log query  
querylog yes;  
#define version  
version "GNUer's dns 2.0";  
## transfer config  
notify explicit;  
tcp-clients 2000;  
transfers-out 100;  
allow-transfer {  slavedns; 127.0.0.1;};  
also-notify { 10.144.149.61; };  
/* Path to ISC DLV key */  
#bindkeys-file "/opt/bind/etc/named.iscdlv.key";  
};  
  
logging {  
channel default_syslog { file "/opt/bind/var/log/named.syslog" versions 5 size 100m; severity dynamic; print-time yes;};  
channel default_debug { file "/opt/bind/var/log/named.run" versions 5 size 100m; severity dynamic; print-time yes;};  
channel default_stderr { stderr; severity info; };  
channel null { null; };  
channel general_debug { file "/opt/bind/var/log/named.general" versions 3 size 100m; severity dynamic; print-time yes;};  
channel database_debug { file "/opt/bind/var/log/named.database" versions 3 size 100m; severity dynamic; print-time yes;};  
channel query_log { file "/opt/bind/var/log/named.query" versions 3 size 100m; severity dynamic; print-time yes;print-severity yes; print-category yes;};  
channel resolver_log { file "/opt/bind/var/log/named.resolver" versions 3 size 100m; severity dynamic; print-time yes;};  
channel security_log { file "/opt/bind/var/log/named.security" versions 3 size 100m; severity dynamic; print-time yes;};  
channel notify_log { file "/opt/bind/var/log/named.notify" versions 3 size 100m; severity dynamic; print-time yes;};  
channel rrt_log { file "/opt/bind/var/log/named.rrt" versions 3 size 100m; severity dynamic; print-time yes;};  
channel rpz_log { file "/opt/bind/var/log/named.rpz" versions 3 size 100m; severity dynamic; print-time yes;};  
category default {null; };  
category queries { query_log; };  
category resolver { resolver_log; };  
category security { security_log; };  
category notify { notify_log; };  
category xfer-in { notify_log; };  
category xfer-out { notify_log; };  
category update { notify_log; };  
category unmatched {default_syslog; };  
category rate-limit {rrt_log;};  
category rpz {rpz_log;};  
};  
view "test1" {  
recursion yes;  
allow-query { any; };  
match-clients {test1; key test1;};  
allow-update { key test1; };  
server 10.144.149.61 {keys  test1;};  
//  also-notify { 10.144.149.61; };  
zone "test.org" {  
type master;  
file "master/test.org.view1";  
};  
zone "rpz.zone" {  
type master;  
file "master/rpz.zone";  
allow-update {none;};  
};  
zone "."{  
type hint;  
file "named.root";  
};  
};  
  
view "test2" {  
recursion yes;  
allow-query { any; };  
server 10.144.149.61 {keys  test2;};  
match-clients {test2; key test2;};  
allow-update { key test2; };  
// also-notify { 10.144.149.61; };  
zone "test.org" {  
type master;  
file "master/test.org.view2";  
};  
zone "rpz.zone" {  
type master;  
file "master/rpz.zone";  
allow-update {none;};  
};  
zone "."{  
type hint;  
file "named.root";  
};  
};  
view "default" {  
recursion yes;  
allow-query { any; };  
server 10.144.149.61 {keys  default;};  
match-clients {any;key default; };  
allow-update { key default; };  
// also-notify { 10.144.149.61; };  
zone "test.org" {  
type master;  
file "master/test.org.default";  
};  
zone "rpz.zone" {  
type master;  
file "master/rpz.zone";  
allow-update {none;};  
};  
zone "."{  
type hint;  
file "named.root";  
};  
};

master中的注意事项是：

1. also-notify 可以不用每个view都写一遍，在options里把slave都写全也行（也得跟进实际的安全需求来）
2. 每个view内用allow-update设置只允许响应的key进行更新。
3. 需要使用server来指定和对端机器通信的共享密钥。

slave的配置

include "/opt/bind/etc/rndc.key";  
include "/opt/bind/etc/views.key";  
//  
controls {  
inet 127.0.0.1 port 953  
allow { 127.0.0.1; } keys { "rndc-key"; };  
};  
//  
acl test1 {  
10.161.65.8;  
};  
acl test2 {  
192.0.0.0/8;  
};  
  
options {  
listen-on port 53 { any; };  
listen-on-v6  { none; };  
directory      "/opt/bind/etc/";  
dump-file      "/opt/bind/var/named/data/cache_dump.db";  
statistics-file "/opt/bind/var/named/data/named_stats.txt";  
memstatistics-file "/opt/bind/var/named/data/named_mem_stats.txt";  
masterfile-format text;  
zone-statistics yes;  
allow-query     { any; };  
# recursion config  
recursion yes;  
max-ncache-ttl 60;  
recursive-clients 2000;  
# dnssec config  
dnssec-enable yes;  
dnssec-validation yes;  
dnssec-lookaside auto;  
# rrt config  
rate-limit {  
responses-per-second 20;  
qps-scale  1000;  
window 4;  
slip 2;  
ipv4-prefix-length 32;  
};  
# rpz config  
response-policy {  
zone "rpz.zone"  policy given;  
};  
# log query  
querylog yes;  
#define version  
version "GNUer's dns 2.0";  
## transfer config  
notify explicit;  
tcp-clients 2000;  
transfers-out 100;  
  
/* Path to ISC DLV key */  
#bindkeys-file "/opt/bind/etc/named.iscdlv.key";  
};  
  
logging {  
channel default_syslog { file "/opt/bind/var/log/named.syslog" versions 5 size 100m; severity dynamic; print-time yes;};  
channel default_debug { file "/opt/bind/var/log/named.run" versions 5 size 100m; severity dynamic; print-time yes;};  
channel default_stderr { stderr; severity info; };  
channel null { null; };  
channel general_debug { file "/opt/bind/var/log/named.general" versions 3 size 100m; severity dynamic; print-time yes;};  
channel database_debug { file "/opt/bind/var/log/named.database" versions 3 size 100m; severity dynamic; print-time yes;};  
channel query_log { file "/opt/bind/var/log/named.query" versions 3 size 100m; severity dynamic; print-time yes;print-severity yes; print-category yes;};  
channel resolver_log { file "/opt/bind/var/log/named.resolver" versions 3 size 100m; severity dynamic; print-time yes;};  
channel security_log { file "/opt/bind/var/log/named.security" versions 3 size 100m; severity dynamic; print-time yes;};  
channel notify_log { file "/opt/bind/var/log/named.notify" versions 3 size 100m; severity dynamic; print-time yes;};  
channel rrt_log { file "/opt/bind/var/log/named.rrt" versions 3 size 100m; severity dynamic; print-time yes;};  
channel rpz_log { file "/opt/bind/var/log/named.rpz" versions 3 size 100m; severity dynamic; print-time yes;};  
category default {null; };  
category queries { query_log; };  
category resolver { resolver_log; };  
category security { security_log; };  
category notify { notify_log; };  
category xfer-in { notify_log; };  
category xfer-out { notify_log; };  
category update { notify_log; };  
category unmatched {default_syslog; };  
category rate-limit {rrt_log;};  
category rpz {rpz_log;};  
};  
view "test1" {  
recursion yes;  
server 10.161.64.97 {keys test1; };  
allow-query { any; };  
match-clients {test1; key test1;};  
allow-update { key test1; };  
zone "test.org" {  
type slave;  
file "master/test.org.view1";  
masters { 10.161.64.97; } ;  
};  
zone "rpz.zone" {  
type master;  
file "master/rpz.zone";  
allow-update {none;};  
};  
zone "."{  
type hint;  
file "named.root";  
};  
};  
  
view "test2" {  
recursion yes;  
allow-query { any; };  
match-clients {test2; key test2;};  
server 10.161.64.97 {keys test2; };  
allow-update { key test2; };  
zone "test.org" {  
type slave;  
file "master/test.org.view2";  
masters { 10.161.64.97; } ;  
};  
zone "rpz.zone" {  
type master;  
file "master/rpz.zone";  
allow-update {none;};  
};  
zone "."{  
type hint;  
file "named.root";  
};  
};  
view "default" {  
recursion yes;  
allow-query { any; };  
server 10.161.64.97 {keys default; };  
match-clients {any;key default; };  
allow-update { key default; };  
zone "test.org" {  
type slave;  
file "master/test.org.default";  
masters { 10.161.64.97; } ;  
};  
zone "rpz.zone" {  
type master;  
file "master/rpz.zone";  
allow-update {none;};  
};  
zone "."{  
type hint;  
file "named.root";  
};  
};

slave的配置注意项也是每个view要使用server定义master通信时使用的key，然后限制特定的key才能更新。另外需要注意的是slave和master的IP不要在任何的acl里。