E杂苑

安装

yum -y install bind bind-chroot bind-utils

生成更新密钥

//采用HMAC-MD5
dnssec-keygen -a HMAC-MD5 -b 128 -n USER dnskey
//采用HMAC-SHA1，go-nsupdate不支持HMAC-MD5
dnssec-keygen -a HMAC-SHA1 -T KEY -b 128 -n USER dnskey

调整监听端口及密文

vi /etc/named.conf   
key "dnskey" {
    algorithm hmac-md5;
    //algorithm hmac-sha1;
    secret "secret_key";
}

添加域名

vi /etc/named.rfc1912.zones
zone "test.cn" IN {
    type master;
    file "named.test";
    allow-update { key dnskey; };
};

添加域名配置并修改信息

cp /var/named/named.localhost /var/named/named.test

重启named

systemctl restart named

客户端更新

nsupdate -y dnskey:secret_key
//nsupdate默认为hmac-md5，非该类型要指定加密方式
//nsupdate -y hmac-sha1: dnskey:secret_key
> server x.x.x.x
> update add test.cn 86400 A 3.3.3.3
> send
> quit
//go-nsupdate 更新
./go-nsupdate -i enp0s3  --server=x.x.x.x  --interface-family=ipv4 --tsig-algorithm=hmac-sha1 --tsig-name=dnskey --tsig-secret=secret_key --zone=test.cn a1.test.cn -v

核对记录

dig @X.X.X.X test.cn

查看日志

cat /var/named/data/named.run