From d64adef0e96fc9b0f19e602cfd26fc1d4d58eec9 Mon Sep 17 00:00:00 2001 From: DoubleC <450760206@qq.com> Date: Tue, 16 Dec 2014 19:57:08 +0800 Subject: [PATCH 1/4] delete source file --- ...backup plan for Debian with backupninja.md | 248 ------------------ 1 file changed, 248 deletions(-) delete mode 100644 sources/tech/20141205 How to create a custom backup plan for Debian with backupninja.md diff --git a/sources/tech/20141205 How to create a custom backup plan for Debian with backupninja.md b/sources/tech/20141205 How to create a custom backup plan for Debian with backupninja.md deleted file mode 100644 index a705c44b3b..0000000000 --- a/sources/tech/20141205 How to create a custom backup plan for Debian with backupninja.md +++ /dev/null @@ -1,248 +0,0 @@ -SPccman translating -How to create a custom backup plan for Debian with backupninja -================================================================================ -Backupninja is a powerful and highly-configurable backup tool for Debian based distributions. In the [previous tutorial][1], we explored how to install backupninja and how to set up two backup actions for the program to perform. However, we should note that those examples were only "the tip of the iceberg," so to speak. In this post we will discuss how to leverage custom handlers and helpers that allow this program to be customized in order to accomplish almost any backup need that you can think of. - -And believe me - that is not an overstatement, so let's begin. - -### A Quick Review of Backupninja ### - -One of backupninja's distinguishing features is the fact that you can just drop plain text configuration or action files in /etc/backup.d, and the program will take care of the rest. In addition, we can write custom scripts (aka "handlers") and place them in /usr/share/backupninja to handle each type of backup action. Furthermore, we can have these scripts be executed via ninjahelper's ncurses-based interactive menus (aka "helpers") to guide us to create the configuration files we mentioned earlier, minimizing the chances of human error. - -### Creating a Custom Handler and Helper ### - -Our goal in this case is to create a script to handle the backup of chosen home directories into a tarball with either **gzip** or **bzip2** compression, excluding music and video files. We will simply name this script home, and place it under /usr/backup/ninja. - -Although you could achieve the same objective with the default tar handler (refer to /usr/share/backupninja/tar and /usr/share/backupninja/tar.helper), we will use this approach to show how to create a useful handler script and ncurses-based helper from scratch. You can then decide how to apply the same principles depending on your specific needs. - -Note that since handlers are sourced from the main script, there is no need to start with #!/bin/bash at the top. - -Our proposed handler (/usr/share/backupninja/home) is as follows. It is heavily commented for clarification. The getconf function is used to read the backup action's configuration file. If you specify a value for a variable here, it will override the corresponding value present in the configuration file: - - # home handler script for backupninja - - # Every backup file will identify the host by its FQDN - getconf backupname - - # Directory to store backups - getconf backupdir - - # Default compression - getconf compress - - # Include /home directory - getconf includes - - # Exclude files with *.mp3 and *.mp4 extensions - getconf excludes - - # Default extension for the packaged backup file - getconf EXTENSION - - # Absolute path to date binary - getconf TAR `which tar` - - # Absolute path to date binary - getconf DATE `which date` - - # Chosen date format - DATEFORMAT="%Y-%m-%d" - - # If backupdir does not exist, exit with fatal error - if [ ! -d "$backupdir" ] - then - mkdir -p "$backupdir" || fatal "Can not make directory $backupdir" - fi - - # If backupdir is not writeable, exit with fatal error as well - if [ ! -w "$backupdir" ] - then - fatal "Directory $backupdir is not writable" - fi - - # Set the right tar option as per the chosen compression format - case $compress in - "gzip") - compress_option="-z" - EXTENSION="tar.gz" - ;; - "bzip") - compress_option="-j" - EXTENSION="tar.bz2" - ;; - "none") - compress_option="" - ;; - *) - warning "Unknown compress filter ($tar_compress)" - compress_option="" - EXTENSION="tar.gz" - ;; - esac - - # Exclude the following file types / directories - exclude_options="" - for i in $excludes - do - exclude_options="$exclude_options --exclude $i" - done - - # Debugging messages, performing backup - debug "Running backup: " $TAR -c -p -v $compress_option $exclude_options \ - -f "$backupdir/$backupname-"`$DATE "+$DATEFORMAT"`".$EXTENSION" \ - $includes - - # Redirect standard output to a file with .list extension - # and standard error to a file with .err extension - $TAR -c -p -v $compress_option $exclude_options \ - -f "$backupdir/$backupname-"`$DATE "+$DATEFORMAT"`".$EXTENSION" \ - $includes \ - > "$backupdir/$backupname-"`$DATE "+$DATEFORMAT"`.list \ - 2> "$backupdir/$backupname-"`$DATE "+$DATEFORMAT"`.err - - [ $? -ne 0 ] && fatal "Tar backup failed" - -Next, we will create our helper file (/usr/share/backupninja/home.helper) so that our handlers shows up as a menu in **ninjahelper**: - - # Backup action's description. Separate words with underscores. - HELPERS="$HELPERS home:backup_of_home_directories" - - home_wizard() { - home_title="Home action wizard" - - backupname=`hostname --fqdn` - - # Specify default value for the time when this backup actions is supposed to run - inputBox "$home_title" "When to run this action?" "everyday at 01" - [ $? = 1 ] && return - home_when_run="when = $REPLY" - - # Specify default value for backup file name - inputBox "$home_title" "\"Name\" of backups" "$backupname" - [ $? = 1 ] && return - home_backupname="backupname = $REPLY" - backupname="$REPLY" - - # Specify default directory to store the backups - inputBox "$home_title" "Directory where to store the backups" "/var/backups/home" - [ $? = 1 ] && return - home_backupdir="backupdir = $REPLY" - - # Specify default values for the radiobox - radioBox "$home_title" "Compression" \ - "none" "No compression" off \ - "gzip" "Compress with gzip" on \ - "bzip" "Compress with bzip" off - [ $? = 1 ] && return; - result="$REPLY" - home_compress="compress = $REPLY " - - REPLY= - while [ -z "$REPLY" ]; do - formBegin "$home_title: Includes" - formItem "Include:" /home/gacanepa - formDisplay - [ $? = 0 ] || return 1 - home_includes="includes = " - for i in $REPLY; do - [ -n "$i" ] && home_includes="$home_includes $i" - done - done - - REPLY= - while [ -z "$REPLY" ]; do - formBegin "$home_title: Excludes" - formItem "Exclude:" *.mp3 - formItem "Exclude:" *.mp4 - # Add as many “Exclude” text boxes as needed to specify other exclude options - formItem "Exclude:" - formItem "Exclude:" - formDisplay - [ $? = 0 ] || return 1 - home_excludes="excludes = " - for i in $REPLY; do - [ -n "$i" ] && home_excludes="$home_excludes $i" - done - done - - # Save the config - get_next_filename $configdirectory/10.home - cat > $next_filename < Date: Tue, 16 Dec 2014 19:57:43 +0800 Subject: [PATCH 2/4] delete source file MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 删除原文 --- ...ind Chroot DNS Server on CentOS 7.0 VPS.md | 198 ------------------ 1 file changed, 198 deletions(-) delete mode 100644 sources/tech/20141211 How to Setup Bind Chroot DNS Server on CentOS 7.0 VPS.md diff --git a/sources/tech/20141211 How to Setup Bind Chroot DNS Server on CentOS 7.0 VPS.md b/sources/tech/20141211 How to Setup Bind Chroot DNS Server on CentOS 7.0 VPS.md deleted file mode 100644 index 02cde70e74..0000000000 --- a/sources/tech/20141211 How to Setup Bind Chroot DNS Server on CentOS 7.0 VPS.md +++ /dev/null @@ -1,198 +0,0 @@ -spccman translating -How to Setup Bind Chroot DNS Server on CentOS 7.0 VPS -================================================================================ -BIND (Berkeley Internet Name Daemon) also known as NAMED is the most widely used DNS server in the internet. This tutorial will descibes how we can run BIND in a chroot jail, the process is simply unable to see any part of the filesystem outside the jail. For example, in this post, i will setting up BIND to run chrooted to the directory /var/named/chroot/. Well, to BIND, the contents of this directory will appear to be /, the root directory. A “jail” is a software mechanism for limiting the ability of a process to access resources outside a very limited area, and it’s purposely to enhance the security. Bind Chroot DNS server was by default configured to /var/named/chroot. You may follow this complete steps to implement Bind Chroot DNS Server on CentOS 7.0 virtual private server (VPS). - -1. Install Bind Chroot DNS server : - - [root@centos7 ~]# yum install bind-chroot bind -y - -2. Copy all bind related files to prepare bind chrooted environments : - - [root@centos7 ~]# cp -R /usr/share/doc/bind-*/sample/var/named/* /var/named/chroot/var/named/ - -3. Create bind related files into chrooted directory : - - [root@centos7 ~]# touch /var/named/chroot/var/named/data/cache_dump.db - [root@centos7 ~]# touch /var/named/chroot/var/named/data/named_stats.txt - [root@centos7 ~]# touch /var/named/chroot/var/named/data/named_mem_stats.txt - [root@centos7 ~]# touch /var/named/chroot/var/named/data/named.run - [root@centos7 ~]# mkdir /var/named/chroot/var/named/dynamic - [root@centos7 ~]# touch /var/named/chroot/var/named/dynamic/managed-keys.bind - -4. Bind lock file should be writeable, therefore set the permission to make it writable as below : - - [root@centos7 ~]# chmod -R 777 /var/named/chroot/var/named/data - [root@centos7 ~]# chmod -R 777 /var/named/chroot/var/named/dynamic - -5. Copy /etc/named.conf chrooted bind config folder : - - [root@centos7 ~]# cp -p /etc/named.conf /var/named/chroot/etc/named.conf - -6.Configure main bind configuration in /etc/named.conf. Append the example.local zone information to the file : - - [root@centos7 ~]# vi /var/named/chroot/etc/named.conf - -Create forward and reverse zone into named.conf: - - .. - .. - zone "example.local" { - type master; - file "example.local.zone"; - }; - - zone "0.168.192.in-addr.arpa" IN { - type master; - file "192.168.0.zone"; - }; - .. - .. - -Full named.conf configuration : - - // - // named.conf - // - // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS - // server as a caching only nameserver (as a localhost DNS resolver only). - // - // See /usr/share/doc/bind*/sample/ for example named configuration files. - // - - options { - listen-on port 53 { any; }; - listen-on-v6 port 53 { ::1; }; - directory "/var/named"; - dump-file "/var/named/data/cache_dump.db"; - statistics-file "/var/named/data/named_stats.txt"; - memstatistics-file "/var/named/data/named_mem_stats.txt"; - allow-query { any; }; - - /* - - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. - - If you are building a RECURSIVE (caching) DNS server, you need to enable - recursion. - - If your recursive DNS server has a public IP address, you MUST enable access - control to limit queries to your legitimate users. Failing to do so will - cause your server to become part of large scale DNS amplification - attacks. Implementing BCP38 within your network would greatly - reduce such attack surface - */ - recursion yes; - - dnssec-enable yes; - dnssec-validation yes; - dnssec-lookaside auto; - - /* Path to ISC DLV key */ - bindkeys-file "/etc/named.iscdlv.key"; - - managed-keys-directory "/var/named/dynamic"; - - pid-file "/run/named/named.pid"; - session-keyfile "/run/named/session.key"; - }; - - logging { - channel default_debug { - file "data/named.run"; - severity dynamic; - }; - }; - - zone "." IN { - type hint; - file "named.ca"; - }; - - zone "example.local" { - type master; - file "example.local.zone"; - }; - - zone "0.168.192.in-addr.arpa" IN { - type master; - file "192.168.0.zone"; - }; - - include "/etc/named.rfc1912.zones"; - include "/etc/named.root.key"; - -7. Create Forward and Reverse zone files for domain example.local. - -a) Create Forward Zone : - - [root@centos7 ~]# vi /var/named/chroot/var/named/example.local.zone - -Add the following and save : - - ; - ; Addresses and other host information. - ; - $TTL 86400 - @ IN SOA example.local. hostmaster.example.local. ( - 2014101901 ; Serial - 43200 ; Refresh - 3600 ; Retry - 3600000 ; Expire - 2592000 ) ; Minimum - - ; Define the nameservers and the mail servers - - IN NS ns1.example.local. - IN NS ns2.example.local. - IN A 192.168.0.70 - IN MX 10 mx.example.local. - - centos7 IN A 192.168.0.70 - mx IN A 192.168.0.50 - ns1 IN A 192.168.0.70 - ns2 IN A 192.168.0.80 - -b) Create Reverse Zone : - - [root@centos7 ~]# vi /var/named/chroot/var/named/192.168.0.zone - ----------- - - ; - ; Addresses and other host information. - ; - $TTL 86400 - @ IN SOA example.local. hostmaster.example.local. ( - 2014101901 ; Serial - 43200 ; Refresh - 3600 ; Retry - 3600000 ; Expire - 2592000 ) ; Minimum - - 0.168.192.in-addr.arpa. IN NS centos7.example.local. - - 70.0.168.192.in-addr.arpa. IN PTR mx.example.local. - 70.0.168.192.in-addr.arpa. IN PTR ns1.example.local. - 80.0.168.192.in-addr.arpa. IN PTR ns2.example.local. - -8. Stop and disable named service. Start and enable bind-chroot service at boot : - - [root@centos7 ~]# /usr/libexec/setup-named-chroot.sh /var/named/chroot on - [root@centos7 ~]# systemctl stop named - [root@centos7 ~]# systemctl disable named - [root@centos7 ~]# systemctl start named-chroot - [root@centos7 ~]# systemctl enable named-chroot - ln -s '/usr/lib/systemd/system/named-chroot.service' '/etc/systemd/system/multi-user.target.wants/named-chroot.service' - -As always if you need any help you can reach us on twitter @ehowstuff or drop us a comment below. [Jumping through archives page to read more articles..][1] - --------------------------------------------------------------------------------- - -via: http://www.ehowstuff.com/how-to-setup-bind-chroot-dns-server-on-centos-7-0-vps/ - -作者：[skytech][a] -译者：[译者ID](https://github.com/译者ID) -校对：[校对者ID](https://github.com/校对者ID) - -本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](http://linux.cn/) 荣誉推出 - -[a]:http://www.ehowstuff.com/author/mhstar/ -[1]:http://www.ehowstuff.com/archives/ From 246b2f862eb854f5c93f7b691cab9c73f90b8652 Mon Sep 17 00:00:00 2001 From: DoubleC <450760206@qq.com> Date: Tue, 16 Dec 2014 20:00:45 +0800 Subject: [PATCH 3/4] =?UTF-8?q?=E7=BF=BB=E8=AF=91=E5=AE=8C=E6=88=90?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 这篇文章，之前应该还有一篇，本来要一起发上来的，群里面催了一下，就算了，这篇先发 --- ...backup plan for Debian with backupninja.md | 246 ++++++++++++++++++ 1 file changed, 246 insertions(+) create mode 100644 translated/tech/How to create a custom backup plan for Debian with backupninja.md diff --git a/translated/tech/How to create a custom backup plan for Debian with backupninja.md b/translated/tech/How to create a custom backup plan for Debian with backupninja.md new file mode 100644 index 0000000000..50cd15c6ce --- /dev/null +++ b/translated/tech/How to create a custom backup plan for Debian with backupninja.md @@ -0,0 +1,246 @@ +使用backupninja为Debian定制备份计划 +======= + +backupninja是Debian系统（以及基于Debian的发行版）中一个强大的、高度可配置的备份软件。在[前一篇文章][1]中，我们探讨了如何安装backupninja以及如何设置两个备份操作并执行。然而，那些只是冰山一角。这一次，我们要讨论如何利用Helper与辅助功能，可以使用这些功能定制策略以完成任何备份需要。 + +###回顾 backupninja + +backupninja的特点是它完全抛弃纯文本的配置文件/etc/backup.d,软件自己会搞定。另外，我们可以编写自定义脚本（又叫 “handlers”）放在/usr/share/backupninja 目录下来完成不同类型的备份操作。此外，可以通过ninjahelper的基于ncurses的交互式菜单（又叫”helpers"）来指导我们创建一些配置文件，使得人工错误率降到最低。 + +###创建定制的Handler与Helper + +这一节的目标是创建一个脚本，将home目录以**gzip**或**bzip2**压缩包的形式备份起来，不包括音乐与视频文件。我们将这个文件命名为home，将它放在/usr/backup/ninja目录下。 + +尽管你可以使用默认的tar handler（参考 /usr/share/backupninja/tar 与 /usr/share/backupninja/tar.helper）来达到这个效果,但是我们使用这种方法来展示如何创建实用的 handler 脚本与基于 ncurses 的 helper。你可以根据你的需求来决定如何运用同样的原则。 + +由于 handlers 来源与主脚本，所以无需以#!/bin/bash开始。 + +我们推荐的 handler （/usr/share/backupninja/home）如下所示。它带有非常多的注释说明。getconf 功能用来读取备份操作的配置文件。如果你指定了一个变量的值，那么它会覆盖配置文件中对应变量的值： + + #/home 目录 handler 脚本 + + # 每个备份文件会通过 FQDN 来鉴别主机 + getconf backupname + + # 备份文件的保存目录 + getconf backupdir + + # 默认压缩 + getconf compress + + # 包含 /home 目录 + getconf includes + + #不包含 *.mp3 与 *.mp4 文件 + getconf excludes + + # 默认扩展一打包的备份文件 + getconf EXTENSION + + # Absolute path to date binary + getconf TAR `which tar` + + # Absolute path to date binary + getconf DATE `which date` + + # 日期格式 + DATEFORMAT="%Y-%m-%d" + + # 如果备份目录不存在,以致命错误退出 + if [ ! -d "$backupdir" ] + then + mkdir -p "$backupdir" || fatal "Can not make directory $backupdir" + fi + + # 如果备份目录不可写, 同样以致命错误退出 + if [ ! -w "$backupdir" ] + then + fatal "Directory $backupdir is not writable" + fi + + # 根据压缩格式选择对应的tar选项 + case $compress in + "gzip") + compress_option="-z" + EXTENSION="tar.gz" + ;; + "bzip") + compress_option="-j" + EXTENSION="tar.bz2" + ;; + "none") + compress_option="" + ;; + *) + warning "Unknown compress filter ($tar_compress)" + compress_option="" + EXTENSION="tar.gz" + ;; + esac + + # 不包含一些文件类型/目录 + exclude_options="" + for i in $excludes + do + exclude_options="$exclude_options --exclude $i" + done + + # 调试信息, 执行备份操作 + debug "Running backup: " $TAR -c -p -v $compress_option $exclude_options \ + -f "$backupdir/$backupname-"`$DATE "+$DATEFORMAT"`".$EXTENSION" \ + $includes + + # 将标准输出重定向到以.list为扩展的文件 + # 将标准错误输出重定向到以.err为扩展的文件 + $TAR -c -p -v $compress_option $exclude_options \ + -f "$backupdir/$backupname-"`$DATE "+$DATEFORMAT"`".$EXTENSION" \ + $includes \ + > "$backupdir/$backupname-"`$DATE "+$DATEFORMAT"`.list \ + 2> "$backupdir/$backupname-"`$DATE "+$DATEFORMAT"`.err + + [ $? -ne 0 ] && fatal "Tar backup failed" + +接下来我们将要创建helper文件 (/usr/share/backupninja/home.helper)这样，hendlers将会以菜单的形式在**ninjahelper**中显示: + + # 备份操作描述. 以下划线分割单词. + HELPERS="$HELPERS home:backup_of_home_directories" + + home_wizard() { + home_title="Home action wizard" + + backupname=`hostname --fqdn` + + # 指定备份操作的时间 + inputBox "$home_title" "When to run this action?" "everyday at 01" + [ $? = 1 ] && return + home_when_run="when = $REPLY" + + # 指定备份文件名 + inputBox "$home_title" "\"Name\" of backups" "$backupname" + [ $? = 1 ] && return + home_backupname="backupname = $REPLY" + backupname="$REPLY" + + # 指定保存备份文件的默认路径 + inputBox "$home_title" "Directory where to store the backups" "/var/backups/home" + [ $? = 1 ] && return + home_backupdir="backupdir = $REPLY" + + # 指定复选框的默认值 + radioBox "$home_title" "Compression" \ + "none" "No compression" off \ + "gzip" "Compress with gzip" on \ + "bzip" "Compress with bzip" off + [ $? = 1 ] && return; + result="$REPLY" + home_compress="compress = $REPLY " + + REPLY= + while [ -z "$REPLY" ]; do + formBegin "$home_title: Includes" + formItem "Include:" /home/gacanepa + formDisplay + [ $? = 0 ] || return 1 + home_includes="includes = " + for i in $REPLY; do + [ -n "$i" ] && home_includes="$home_includes $i" + done + done + + REPLY= + while [ -z "$REPLY" ]; do + formBegin "$home_title: Excludes" + formItem "Exclude:" *.mp3 + formItem "Exclude:" *.mp4 + # 按需增加多个“Exclude”文本框指定其他不须包含的内容 + formItem "Exclude:" + formItem "Exclude:" + formDisplay + [ $? = 0 ] || return 1 + home_excludes="excludes = " + for i in $REPLY; do + [ -n "$i" ] && home_excludes="$home_excludes $i" + done + done + + # 保存配置 + get_next_filename $configdirectory/10.home + cat > $next_filename < Date: Tue, 16 Dec 2014 20:01:34 +0800 Subject: [PATCH 4/4] =?UTF-8?q?=E7=BF=BB=E8=AF=91=E5=AE=8C=E6=88=90?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ...ind Chroot DNS Server on CentOS 7.0 VPS.md | 201 ++++++++++++++++++ 1 file changed, 201 insertions(+) create mode 100644 translated/tech/How to Setup Bind Chroot DNS Server on CentOS 7.0 VPS.md diff --git a/translated/tech/How to Setup Bind Chroot DNS Server on CentOS 7.0 VPS.md b/translated/tech/How to Setup Bind Chroot DNS Server on CentOS 7.0 VPS.md new file mode 100644 index 0000000000..0df194fe17 --- /dev/null +++ b/translated/tech/How to Setup Bind Chroot DNS Server on CentOS 7.0 VPS.md @@ -0,0 +1,201 @@ +在CentOS7.0 VPS上搭建 Bind Chroot DNS 服务器 +==================== + +BIND（Berkeley internet Name Daemon)也叫做NAMED是现今互联网上使用最为广泛的DNS 服务器程序。这篇文章将要讲述如何在 chroot jail （chroot “监牢”，所谓“监牢”就是指通过chroot机制来更改某个进程所能看到的根目录，即将某进程限制在指定目录中，保证该进程只能对该目录及其子目录的文件有所动作，从而保证整个服务器的安全）中运行 BIND，这样它就无法访问文件系统中除“jail”以外的其它部分。例如，在这篇文章中，我会将BIND的运行根目录改为/var/named/chroot/。当然，对于BIND来说，这个目录就是/（根目录）。 “jail”（监牢，下同）是一个软件机制，其功能是使得某个程序无法访问规定区域之外的资源，同样也为了增强安全性。Bind Chroot DNS 服务器的默认“jail”为/var/named/chroot。你可以按照下列步骤，在CentOS 7.0 虚拟专用服务器（VPS）上部署 Bind Chroot DNS 服务器。 + + 1. 安装Bind Chroot DNS 服务器： + + [root@centos7 ~]# yum install bind-chroot bind -y + + 2. 拷贝bind相关文件,准备bind chroot 环境 + + [root@centos7 ~]# cp -R /usr/share/doc/bind-*/sample/var/named/* /var/named/chroot/var/named/ + + 3. 在bind chroot 的目录中创建相关文件 + + [root@centos7 ~]# touch /var/named/chroot/var/named/data/cache_dump.db + + [root@centos7 ~]# touch /var/named/chroot/var/named/data/named_stats.txt + + [root@centos7 ~]# touch /var/named/chroot/var/named/data/named_mem_stats.txt + + [root@centos7 ~]# touch /var/named/chroot/var/named/data/named.run + + [root@centos7 ~]# mkdir /var/named/chroot/var/named/dynamic + + [root@centos7 ~]# touch /var/named/chroot/var/named/dynamic/managed-keys.bind + + + 4. 将 Bind 锁定文件设置为可写： + + [root@centos7 ~]# chmod -R 777 /var/named/chroot/var/named/data + [root@centos7 ~]# chmod -R 777 /var/named/chroot/var/named/dynamic + + 5. 将 /etc/named.conf 拷贝到 bind chroot目录 + + [root@centos7 ~]# cp -p /etc/named.conf /var/named/chroot/etc/named.conf + + 6. 在/etc/named.conf中对 bind 进行配置。在文件尾添加 example.local 域信息： + + [root@centos7 ~]# vi /var/named/chroot/etc/named.conf + +在 named.conf 中创建转发域（Forward Zone）与反向域（Reverse Zone）： + + + .. + .. + zone "example.local" { + type master; + file "example.local.zone"; + }; + + zone "0.168.192.in-addr.arpa" IN { + type master; + file "192.168.0.zone"; + }; + .. + .. + +named.conf 完全配置 + + // + // named.conf + // + // 由Red Hat提供，将 ISC BIND named(8) DNS服务器 + // 配置为暂存域名服务器 (用来做本地DNS解析). + // + // See /usr/share/doc/bind*/sample/ for example named configuration files. + // + + options { + listen-on port 53 { any; }; + listen-on-v6 port 53 { ::1; }; + directory "/var/named"; + dump-file "/var/named/data/cache_dump.db"; + statistics-file "/var/named/data/named_stats.txt"; + memstatistics-file "/var/named/data/named_mem_stats.txt"; + allow-query { any; }; + + /* + - 如果你要建立一个 授权域名服务器 服务器, 那么不要开启 recursion（递归） 功能。 + - 如果你要建立一个 递归 DNS 服务器, 那么需要开启recursion 功能。 + - 如果你的递归DNS服务器有公网IP地址, 你必须开启访问控制功能， + 只有那些合法用户才可以发询问. 如果不这么做的话，那么你的服 + 服务就会受到DNS 放大攻击。实现BCP38将有效抵御这类攻击。 + */ + recursion yes; + + dnssec-enable yes; + dnssec-validation yes; + dnssec-lookaside auto; + + /* Path to ISC DLV key */ + bindkeys-file "/etc/named.iscdlv.key"; + + managed-keys-directory "/var/named/dynamic"; + + pid-file "/run/named/named.pid"; + session-keyfile "/run/named/session.key"; + }; + + logging { + channel default_debug { + file "data/named.run"; + severity dynamic; + }; + }; + + zone "." IN { + type hint; + file "named.ca"; + }; + + zone "example.local" { + type master; + file "example.local.zone"; + }; + + zone "0.168.192.in-addr.arpa" IN { + type master; + file "192.168.0.zone"; + }; + + include "/etc/named.rfc1912.zones"; + include "/etc/named.root.key"; + + 7. 为 example.local 域名创建转发域与反向域文件 + +a)创建转发域 + + [root@centos7 ~]# vi /var/named/chroot/var/named/example.local.zone + +添加如下内容并保存： + + ; + ; Addresses and other host information. + ; + $TTL 86400 + @ IN SOA example.local. hostmaster.example.local. ( + 2014101901 ; Serial + 43200 ; Refresh + 3600 ; Retry + 3600000 ; Expire + 2592000 ) ; Minimum + + ; Define the nameservers and the mail servers + + IN NS ns1.example.local. + IN NS ns2.example.local. + IN A 192.168.0.70 + IN MX 10 mx.example.local. + + centos7 IN A 192.168.0.70 + mx IN A 192.168.0.50 + ns1 IN A 192.168.0.70 + ns2 IN A 192.168.0.80 + +b)创建反向域 + + [root@centos7 ~]# vi /var/named/chroot/var/named/192.168.0.zone + +---- + + ; + ; Addresses and other host information. + ; + $TTL 86400 + @ IN SOA example.local. hostmaster.example.local. ( + 2014101901 ; Serial + 43200 ; Refresh + 3600 ; Retry + 3600000 ; Expire + 2592000 ) ; Minimum + + 0.168.192.in-addr.arpa. IN NS centos7.example.local. + + 70.0.168.192.in-addr.arpa. IN PTR mx.example.local. + 70.0.168.192.in-addr.arpa. IN PTR ns1.example.local. + 80.0.168.192.in-addr.arpa. IN PTR ns2.example.local.。开机自启动 bind-chroot 服务： + + [root@centos7 ~]# /usr/libexec/setup-named-chroot.sh /var/named/chroot on + [root@centos7 ~]# systemctl stop named + [root@centos7 ~]# systemctl disable named + [root@centos7 ~]# systemctl start named-chroot + [root@centos7 ~]# systemctl enable named-chroot + ln -s '/usr/lib/systemd/system/named-chroot.service' '/etc/systemd/system/multi-user.target.wants/named-chroot.service' + +[跳转到档案页，阅读更多文章][1] + +------------------ + +via: http://www.ehowstuff.com/how-to-setup-bind-chroot-dns-server-on-centos-7-0-vps/ + +作者：[skytech][a] +译者：[SPccman](https://github.com/译者ID) +校对：[校对者ID](https://github.com/校对者ID) + +本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](http://linux.cn/) 荣誉推出 + +[a]:http://www.ehowstuff.com/author/mhstar/ +[1]:http://www.ehowstuff.com/archives/ +