前言、
课程需要（进入服务器综合配置使用阶段了），这里还是沿用桌面版的ubuntu来配置dhcp和dns，这里updated了新的版本。2024.5
| server端环境： Win11+VMS：192.168.105.1+192.168.105.128 （ubuntu2310）
Win11+VMS（centos8） |
关于配置DHCP
第一种、安装dhcpd组件,从官方文档vendor不再支持isc-dhcp-server，虽然目前任然可以使用其作为dhcp server。官方推荐使用kea代替。
|
| How to install and configure isc-dhcp-server Note: Although Ubuntu still supports isc-dhcp-server, this software is no longer supported by its vendor. It has been replaced by Kea. In this guide we show how to install and configure isc-dhcp-server, which installs the dynamic host configuration protocol daemon, dhcpd. For isc-kea instructions, refer to this guide instead. Install isc-dhcp-server At a terminal prompt, enter the following command to install isc-dhcp-server: sudo apt install isc-dhcp-server Note: You can find diagnostic messages from dhcpd in syslog. Configure isc-dhcp-server You will probably need to change the default configuration by editing /etc/dhcp/dhcpd.conf to suit your needs and particular configuration. Most commonly, what you want to do is assign an IP address randomly. This can be done with /etc/dhcp/dhcpd.conf settings as follows: # minimal sample /etc/dhcp/dhcpd.conf This will result in the DHCP server giving clients an IP address from the range 192.168.1.150 - 192.168.1.200. It will lease an IP address for 600 seconds if the client doesn’t ask for a specific time frame. Otherwise the maximum (allowed) lease will be 7200 seconds. The server will also “advise” the client to use 192.168.1.254 as the default-gateway and 192.168.1.1 and 192.168.1.2 as its DNS servers. You also may need to edit /etc/default/isc-dhcp-server to specify the interfaces dhcpd should listen to. INTERFACESv4="eth4" After changing the config files you need to restart the dhcpd service: sudo systemctl restart isc-dhcp-server.service 来自 <https://ubuntu.com/server/docs/how-to-install-and-configure-isc-dhcp-server> | ||
第二种、使用keaHow to setup Kea DHCPv4 Server with Ubuntu 23.10 | ||
| In this article I will show you how to install and configure Kea DHCPv4 server on Ubuntu 23.10. Kea DHCP server is the successor of ISC DHCP server which recently got obsolete and is no longer maintained by ISC consortium. S1、Install kea dhcpv4 server sudo apt update sudo apt install kea-dhcp4-server S2、rename /etc/kea/kea-dhcp4.conf to kea-dhcp4.conf.bak sudo mv /etc/kea/kea-dhcp4.conf /etc/kea/kea-dhcp4.conf.bak S3、Create a new, empty configfile by using your favorite texteditor sudo nano /etc/kea/kea-dhcp4.conf S4、Copy/paste the content below and adjust the italic options as required { “Dhcp4”: { “interfaces-config”: { “interfaces”: [ “ethx” ], “dhcp-socket-type”: “raw” },
“control-socket”: { “socket-type”: “unix”, “socket-name”: “/run/kea/kea4-ctrl-socket” },
“authoritative”: true,
“lease-database”: { “type”: “memfile”, “persist”: true, “name”: “/var/lib/kea/kea-leases4.csv”, “lfc-interval”: 3600 },
“renew-timer”: 15840, “rebind-timer”: 27720, “valid-lifetime”: 31680, “reservation-mode”: “out-of-pool”,
“dhcp-ddns”: { “enable-updates”: true },
“ddns-qualifying-suffix”: “smoky020.nl“, “ddns-override-client-update”: true, “ddns-override-no-update”: true, “ddns-replace-client-name”: “always”, “ddns-update-on-renew”: true,
“option-data”: [ { “name”: “domain-name-servers”, “data”: “ip address“ }, { “name”: “domain-search”, “data”: “smoky020.nl“ }, { “name”: “domain-name”, “data”: “smoky020.nl“ } ],
“loggers”: [ { “name”: “kea-dhcp4”, “output_options”: [ { “output”: “stdout” } ], “severity”: “DEBUG”, “debuglevel”: 0 } ], “subnet4”: [ { “id”: 1, “subnet”: “subnet/24“,
“option-data”: [ { “name”: “routers”, “data”: “ip address“ } ],
“pools”: [ { “pool”: “ip start – ip end“ } ],
“reservations”: [ { “hw-address”: “mac address“, “ip-address”: “ip address“, “hostname”: “hostname“ }, { “hw-address”: “mac address“, “ip-address”: “ip address“, “hostname”: “hostname“ } ] } ] } } S5、Save the .conf and restart kea dhcp4 server sudo systemctl restart kea-dhcp4-server 来自 <How to setup Kea DHCPv4 Server with Ubuntu 23.10 – smoky020.nl> | ||
第三种、ubuntu官方推荐的安装指导How to install and configure isc-kea In this guide we show how to install and configure isc-kea in Ubuntu 23.04 or greater. Kea is the DHCP server developed by ISC to replace isc-dhcp. It is newer and designed for more modern network environments. For isc-dhcp-server instructions, refer to this guide instead. 配置指南中告诉你如何在Ubuntu 23.04中安装和配置isc-kea或更大Kea是ISC开发的DHCP服务器，用于取代isc-dhcp。这次更新，专为更现代的网络环境而设计。 S1、安装isc-kea At a terminal prompt, enter the following command to install isc-kea: 在终端提示符下，输入以下命令安装isc-kea： sudo apt install kea 这也将安装一些二进制包，包括
由于kea-ctrl-agent服务对Kea具有一些管理权限服务，我们需要确保不允许普通用户使用没有许可API。Ubuntu通过要求用户身份验证来访问kea-ctrl-agent API服务（LP：#2007312有更多关于此的详细信息）。 因此，上述安装过程将获得一个debconf“高”优先级提示，有3个选项：
如果没有密码，kea-ctrl-agent将无法启动。 The password is expected to be in /etc/kea/kea-api-password, with ownership root:_kea and permissions 0640. To change it, run dpkg-reconfigure kea-ctrl-agent (which will present the same 3 options from above again), or just edit the file manually. 密码应该在/etc/kea/kea-api-password中，root具有_kea的权限（0640）。若要更改它，请运行dpkg-reconfigure kea-ctrl-agent（这将再次呈现上面相同的3个选项），或者只是手工编辑文件 S2、Configure kea-dhcp4 可以通过编辑/etc/kea/kea-dhcp4.conf 来配置kea-dhcp4服务。 Most commonly, what you want to do is let Kea assign an IP address from a pre-configured IP address pool. This can be done with settings as follows: 最常用情况是，让Kea预配置IP地址池。这可以通过如下代码设置来完成：
| ||
关于配置DNS
同样，这里直接copy来了ubuntu官方文档来让童鞋们参考。^V^
有任何看不懂的随时艾特我。
| Domain Name Service (DNS) Domain Name Service (DNS) is an Internet service that maps IP addresses and fully qualified domain names (FQDN) to one another. In this way, DNS alleviates the need to remember IP addresses. Computers that run DNS are called name servers. Ubuntu ships with the Berkley Internet Naming Daemon (BIND), the most common program used for maintaining a name server on Linux. Install DNS At a terminal prompt, run the following command to install the bind9 package: sudo apt install bind9 A useful package for testing and troubleshooting DNS issues is the dnsutils package. Very often these tools will be installed already, but to check and/or install dnsutils enter the following: sudo apt install dnsutils DNS configuration overview There are many ways to configure BIND9. Some of the most common configurations include a caching nameserver, primary server, and secondary server.
Configuration files The DNS configuration files are stored in the /etc/bind directory. The primary configuration file is /etc/bind/named.conf, which in the layout provided by the package just includes these files:
The root nameservers used to be described in the file /etc/bind/db.root. This is now provided instead by the /usr/share/dns/root.hints file shipped with the dns-root-data package, and is referenced in the named.conf.default-zones configuration file above. It is possible to configure the same server to be a caching name server, primary, and secondary: it all depends on the zones it is serving. A server can be the Start of Authority (SOA) for one zone, while providing secondary service for another zone. All the while providing caching services for hosts on the local LAN. Set up a caching nameserver The default configuration acts as a caching server. Simply uncomment and edit /etc/bind/named.conf.options to set the IP addresses of your ISP’s DNS servers: forwarders { Note: Replace 1.2.3.4 and 5.6.7.8 with the IP addresses of actual nameservers. To enable the new configuration, restart the DNS server. From a terminal prompt, run: sudo systemctl restart bind9.service See dig for information on testing a caching DNS server. Set up a primary server In this section BIND9 will be configured as the primary server for the domain example.com. You can replace example.com with your FQDN (Fully Qualified Domain Name). Forward zone file To add a DNS zone to BIND9, turning BIND9 into a primary server, first edit /etc/bind/named.conf.local: zone "example.com" { Note: If BIND will be receiving automatic updates to the file as with DDNS, then use /var/lib/bind/db.example.com rather than /etc/bind/db.example.com both here and in the copy command below. Now use an existing zone file as a template to create the /etc/bind/db.example.com file: sudo cp /etc/bind/db.local /etc/bind/db.example.com Edit the new zone file /etc/bind/db.example.com and change localhost. to the FQDN of your server, including the additional . at the end. Change 127.0.0.1 to the nameserver’s IP address and root.localhost to a valid email address, but with a . instead of the usual @ symbol, again including the . at the end. Change the comment to indicate the domain that this file is for. Create an A record for the base domain, example.com. Also, create an A record for ns.example.com, the name server in this example: ; @ IN NS ns.example.com. You must increment the Serial Number every time you make changes to the zone file. If you make multiple changes before restarting BIND9, only increment Serial once. Now, you can add DNS records to the bottom of the zone file. See Common Record Types for details. Note: Many admins like to use the “last edited” date as the Serial of a zone, such as 2020012100 which is yyyymmddss (where ss is the Serial Number) Once you have made changes to the zone file, BIND9 needs to be restarted for the changes to take effect: sudo systemctl restart bind9.service Reverse zone file Now that the zone is set up and resolving names to IP Addresses, a reverse zone needs to be added to allows DNS to resolve an address to a name. Edit /etc/bind/named.conf.local and add the following: zone "1.168.192.in-addr.arpa" { Note: Replace 1.168.192 with the first three octets of whatever network you are using. Also, name the zone file /etc/bind/db.192 appropriately. It should match the first octet of your network. Now create the /etc/bind/db.192 file: sudo cp /etc/bind/db.127 /etc/bind/db.192 Next edit /etc/bind/db.192, changing the same options as /etc/bind/db.example.com: ; The Serial Number in the reverse zone needs to be incremented on each change as well. For each A record you configure in /etc/bind/db.example.com that is for a different address, you will need to create a PTR record in /etc/bind/db.192. After creating the reverse zone file restart BIND9: sudo systemctl restart bind9.service Set up a secondary server Once a primary server has been configured, a secondary server is highly recommended. This will maintain the availability of the domain if the primary becomes unavailable. First, on the primary server, the zone transfer needs to be allowed. Add the allow-transfer option to the example Forward and Reverse zone definitions in /etc/bind/named.conf.local: zone "example.com" { Note: Replace 192.168.1.11 with the IP address of your secondary nameserver. Restart BIND9 on the primary server: sudo systemctl restart bind9.service Next, on the secondary server, install the bind9 package the same way as on the primary. Then edit the /etc/bind/named.conf.local and add the following declarations for the Forward and Reverse zones: zone "example.com" { Once again, replace 192.168.1.10 with the IP address of your primary nameserver, then restart BIND9 on the secondary server: sudo systemctl restart bind9.service In /var/log/syslog you should see something similar to the following (some lines have been split to fit the format of this document): client 192.168.1.10#39448: received notify for zone '1.168.192.in-addr.arpa' Note: A zone is only transferred if the Serial Number on the primary is larger than the one on the secondary. If you want to have your primary DNS notify other secondary DNS servers of zone changes, you can add also-notify { ipaddress; }; to /etc/bind/named.conf.local as shown in the example below: zone "example.com" { zone "1.168.192.in-addr.arpa" { Note: The default directory for non-authoritative zone files is /var/cache/bind/. This directory is also configured in AppArmor to allow the named daemon to write to it. See this page for more information on AppArmor. Testing your setup resolv.conf The first step in testing BIND9 is to add the nameserver’s IP address to a hosts resolver. The Primary nameserver should be configured as well as another host to double check things. Refer to DNS client configuration for details on adding nameserver addresses to your network clients. In the end your nameserver line in /etc/resolv.conf should be pointing at 127.0.0.53 and you should have a search parameter for your domain. Something like this: nameserver 127.0.0.53 To check which DNS server your local resolver is using, run: resolvectl status Note: You should also add the IP address of the secondary nameserver to your client configuration in case the primary becomes unavailable. dig If you installed the dnsutils package you can test your setup using the DNS lookup utility dig: After installing BIND9 use dig against the loopback interface to make sure it is listening on port 53. From a terminal prompt: dig -x 127.0.0.1 You should see lines similar to the following in the command output: ;; Query time: 1 msec If you have configured BIND9 as a caching nameserver, “dig” an outside domain to check the query time: dig ubuntu.com Note the query time toward the end of the command output: ;; Query time: 49 msec After a second dig there should be improvement: ;; Query time: 1 msec ping Now let’s demonstrate how applications make use of DNS to resolve a host name, by using the ping utility to send an ICMP echo request: ping example.com This tests if the nameserver can resolve the name ns.example.com to an IP address. The command output should resemble: PING ns.example.com (192.168.1.10) 56(84) bytes of data. named-checkzone A great way to test your zone files is by using the named-checkzone utility installed with the bind9 package. This utility allows you to make sure the configuration is correct before restarting BIND9 and making the changes live. To test our example forward zone file, enter the following from a command prompt: named-checkzone example.com /etc/bind/db.example.com If everything is configured correctly you should see output similar to: zone example.com/IN: loaded serial 6 Similarly, to test the reverse zone file enter the following: named-checkzone 1.168.192.in-addr.arpa /etc/bind/db.192 The output should be similar to: zone 1.168.192.in-addr.arpa/IN: loaded serial 3 Note: The Serial Number of your zone file will probably be different. Quick temporary query logging With the rndc tool, you can quickly turn query logging on and off, without restarting the service or changing the configuration file. To turn query logging on, run: sudo rndc querylog on Likewise, to turn it off, run: sudo rndc querylog off The logs will be sent to syslog and will show up in /var/log/syslog by default: Jan 20 19:40:50 new-n1 named[816]: received control channel command 'querylog on' Note: The amount of logs generated by enabling querylog could be huge! Logging BIND9 has a wide variety of logging configuration options available, but the two main ones are channel and category, which configure where logs go, and what information gets logged, respectively. If no logging options are configured the default configuration is: logging { Let’s instead configure BIND9 to send debug messages related to DNS queries to a separate file. We need to configure a channel to specify which file to send the messages to, and a category. In this example, the category will log all queries. Edit /etc/bind/named.conf.local and add the following: logging { Note: The debug option can be set from 1 to 3. If a level isn’t specified, level 1 is the default. Since the named daemon runs as the bind user, the /var/log/named directory must be created and the ownership changed: sudo mkdir /var/log/named Now restart BIND9 for the changes to take effect: sudo systemctl restart bind9.service You should see the file /var/log/named/query.log fill with query information. This is a simple example of the BIND9 logging options. For coverage of advanced options see the “Further Reading” section at the bottom of this page. Common record types This section covers some of the most common DNS record types.
来自 <https://ubuntu.com/server/docs/domain-name-service-dns> |
