4. 纯缓存域名服务器
192.168.102.48 为我们的dns 缓存服务器，首先, 在在192.168.102.48 机器上安全bind9, 在配置前我们用dig 进行测试
tonybox2:/etc/bind# dig @192.168.102.48 www.mydebian.org
; <<>> DiG 9.3.2 <<>> @192.168.102.48 www.mydebian.org
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 34137
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;www.mydebian.org. IN A
;; Query time: 1844 msec
;; SERVER: 192.168.102.48#53(192.168.102.48)
;; WHEN: Tue Aug 8 12:05:17 2006
;; MSG SIZE rcvd: 34
修改named.conf.options文件
tonybox2:/etc/bind# cat named.conf.options
options {
directory "/var/cache/bind";
// If there is a firewall between you and nameservers you want
// to talk to, you might need to uncomment the query-source
// directive below. Previous versions of BIND always asked
// questions using port 53, but BIND 8.1 and later use an unprivileged
// port by default.
// query-source address * port 53;
// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.
forwarders {
192.168.102.47; //主域名服务器的IP地址
};
auth-nxdomain no; # conform to RFC1035
};
然后再进行测试
tonybox2:/etc/bind# dig @192.168.102.48 www.mydebian.org
; <<>> DiG 9.3.2 <<>> @192.168.102.48 www.mydebian.org
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54332
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
;; QUESTION SECTION:
;www.mydebian.org. IN A
;; ANSWER SECTION:
www.mydebian.org. 604800 IN A 192.168.102.47
;; AUTHORITY SECTION:
mydebian.org. 604800 IN NS mydebian.org.
;; ADDITIONAL SECTION:
mydebian.org. 604800 IN A 192.168.102.47
;; Query time: 44 msec
;; SERVER: 192.168.102.48#53(192.168.102.48)
;; WHEN: Tue Aug 8 12:05:47 2006
;; MSG SIZE rcvd: 80
所谓的 forwarder，就是当某一台 NS 主机遇到非本机负责的 zone ( slave zone 也属于本机负责的范围) 查询请求的时候，将不直接向 "." zone 查询而把请求转交给指定的 forwarder (一台或多台) 主机代为查询。
我们知道，当DNS服务器接到客户端主机的查询请求时，首先会检查这个查询是否属于本机管辖，否则将转向 "." zone 再逐级的查询下去，最后再把查询结果告诉客户端。
在这个过程之中，DNS服务器还会将查询到的结果存放到缓存中。只要缓存中的 TTL 没过期，在下次遇到同样查询的时候，就可以直接将结果响应给客户端，而无需再重复上次的查询流程。
如果DNS服务器上指定了forwarder，那这个DNS发现缓存中没有记录时，将不向 "." 查询，而是向 forwarder 送出同样的请求（转发），然后等待查询结果，即把逐级往下查询这个耗费精力的动作，交给 forwarder 负责。但无论这个结果是自己直接查询得来的，还是 forwarder 送回来的，DNS服务器都会保存一份数据在缓存中。
这样，以后的相同查询就快多了，这对于DNS所服务的 客户端而言查询效率会提高很多。
/var/named/named.ca
dig @a.root-servers.net . ns > /var/named/named.ca
5. 辅助域名服务器
a. 192.168.102.49 为我们的dns 缓存服务器，首先, 在在192.168.102.49 机器上安全bind9,
b. 在主配置文件/etc/named.conf中加入如下内容：
zone "mydebian.org" {
type slave;
file "/etc/bind/slaves/db.mydebian";
masters {192.168.102.47;};
};
zone "102.168.192.in-addr.arpa" {
type slave;
file "/etc/bind/slaves/db.192";
masters {192.168.102.47;};
};
type后面的值已经成为slave; 表示定义的是辅助域名服务器。
file 后面也可以是别的文件名不必与主域DNS服务器的设置一样。
masters 后为主域DNS服务器的IP地址， 可以是多个IP，型如 masters {ip1;ip2;ip3;};
c. 创建/etc/bind/slaves/目录
d. 重启dns服务
named进程第一次启动时，辅助域名服务器就下载主域名服务器的信息；辅助域名服务器根据主域名服务器的对应SOA记录规定的刷新时间间隔，去主域名服务器查询相关信息。
tonybox2:/etc/bind/slaves# ls -l
total 8
-rw-r--r-- 1 bind bind 410 2006-08-08 12:23 db.192
-rw-r--r-- 1 bind bind 430 2006-08-08 12:23 db.mydebian
查看 /etc/bind/slaves 目录，我门会发现已经从主域名服务器获取了相应的资源文件
如果用户bind对于/etc/bind/slaves目录没有写权限， 则查看 /var/log/syslog 会出现如下类似错误：
tonybox:~# tail /var/log/syslog
Aug 8 12:30:09 tonybox2 named[3849]: zone mydebian.org/IN: Transfer started.
Aug 8 12:30:09 tonybox2 named[3849]: transfer of 'mydebian.org/IN' from 192.168.102.47#53: connected using 192.168.102.15#1075
Aug 8 12:30:09 tonybox2 named[3849]: dumping master file: /etc/bind/tmp-VHTxU6CT5n: open: permission denied
Aug 8 12:30:09 tonybox2 named[3849]: transfer of 'mydebian.org/IN' from 192.168.102.47#53: failed while receiving responses: permission denied
Aug 8 12:30:09 tonybox2 named[3849]: transfer of 'mydebian.org/IN' from 192.168.102.47#53: end of transfer
Aug 8 12:30:10 tonybox2 named[3849]: zone 102.168.192.in-addr.arpa/IN: Transfer started.
Aug 8 12:30:10 tonybox2 named[3849]: transfer of '102.168.192.in-addr.arpa/IN' from 192.168.102.47#53: connected using 192.168.102.15#1076
Aug 8 12:30:10 tonybox2 named[3849]: dumping master file: /etc/bind/tmp-dxbiD1JtTK: open: permission denied
Aug 8 12:30:10 tonybox2 named[3849]: transfer of '102.168.192.in-addr.arpa/IN' from 192.168.102.47#53: failed while receiving responses: permission denied
Aug 8 12:30:10 tonybox2 named[3849]: transfer of '102.168.192.in-addr.arpa/IN' from 192.168.102.47#53: end of transfer