bind：
根据上面的查询情况，rhel7 bind配置文件仍然是在/etc/下面的named.conf, 而数据库在/var/named/chroot/var/named/
/var/named/chroot/var/named下面的example.com.zone最少要写成这样：
- ; Specify the time-to-live( TTL ) for the zone
- $TTL 86400 ; 1 Day ( we could have used 1D )
- ; Begin Start Of Authority resource record
- example.com. IN SOA server3.example.com. root.server3.example.com. (
- 2010091500 ; serial number
- 1H ; refresh slave
- 5M ; retry query
- 1W ; expire
- 1M ; negative TTL
- )
- ; Specify our name servers
- ; !!WARNING: You can not use CNAMEs for RDATA here !!
- ; owner TTL CL type RDATA
- @ IN NS server3.example.com.
- ; Specify our mail exchangers
- ; !!WARNING: You can not use CNAMEs for RDATA here !!
- ; owner TTL CL type RDATA
- ; This is broken and against RFC but must be done to placate the masses
- ; owner TTL CL type RDATA
- example.com. IN A 192.168.0.103
- ; List our CNAME records ( aliases ) here
- ; owner TTL CL type RDATA
- ; List our A records ( hosts ) here
- ; owner TTL CL type RDATA
- server3.example.com. IN A 192.168.0.103
/var/named/chroot/var/named/下面的192.168.0.zone最少要写成：
- ; Specify the time-to-live( TTL ) for the zone
- $TTL 86400 ; 1 Day ( we could have used 1D )
- ; Begin Start Of Authority resource record
- 0.168.192.IN-ADDR.ARPA. IN SOA server3.example.com. root.server3.example.com.(
- 2009062000 ; serial number
- 1H ; refresh slave
- 5M ; retry query
- 1W ; expire
- 1M ; negative TTL
- )
- ; Specify our name servers
- ; !!WARNING: You can not use CNAMEs for RDATA here !!
- ; owner TTL CL type RDATA
- @ IN NS server3.example.com.
- ; List our PTR records ( rev lookup ) here
- ; owner TTL CL type RDATA
- 103.0.168.192.IN-ADDR.ARPA. IN PTR server3.example.com.
-------------------------
在bind的世界里，全长的主机名结尾都要加上. 没有任何例外。
[root@server3 named]# ls -l
total 0
lrwxrwxrwx. 1 root root 25 Aug 29 20:40 192.168.0.zone -> /var/named/192.168.0.zone
lrwxrwxrwx. 1 root root 27 Aug 29 20:40 example.com.zone -> /var/named/example.com.zone
lrwxrwxrwx. 1 root root 19 Aug 29 20:19 named.ca -> /var/named/named.ca
lrwxrwxrwx. 1 root root 26 Aug 29 20:19 named.localhost -> /var/named/named.localhost
lrwxrwxrwx. 1 root root 25 Aug 29 20:19 named.loopback -> /var/named/named.loopback
------------------------------
最后是权限问题（组要归named所有）：
[root@server3 named]# ls -Z
-rw-r-----. root root unconfined_u bject_r:named_zone_t:s0 192.168.0.zone
drwxr-x---. root named system_ubject_r:named_conf_t:s0 chroot
drwxrwx---. named named system_ubject_r:named_cache_t:s0 data
drwxrwx---. named named system_ubject_r:named_cache_t:s0 dynamic
-rw-r-----. root root unconfined_ubject_r:named_zone_t:s0 example.com.zone
-rw-r-----. root named system_ubject_r:named_conf_t:s0 named.ca
-rw-r-----. root named system_ubject_r:named_zone_t:s0 named.empty
-rw-r-----. root named system_ubject_r:named_zone_t:s0 named.localhost
-rw-r-----. root named system_ubject_r:named_zone_t:s0 named.loopback
drwxrwx---. named named system_ubject_r:named_cache_t:s0 slaves
[root@server3 named]# chgrp named 192.168.0.zone
[root@server3 named]# chgrp named example.com.zone
[root@server3 named]# systemctl restart named
----------------------------------------------------------------
---------------------------------------
每次重新启动sshd的时候，会检查/etc/ssh有没有key，如果没有就会重新生成：
- [root@server3 ssh]# ls
- moduli ssh_host_ed25519_key ssh_host_rsa_key.pub
- ssh_config ssh_host_ed25519_key.pub
- sshd_config ssh_host_rsa_key
- [root@server3 ssh]# systemctl restart sshd
- [root@server3 ssh]# ls
- moduli ssh_host_ecdsa_key ssh_host_ed25519_key.pub
- ssh_config ssh_host_ecdsa_key.pub ssh_host_rsa_key
- sshd_config ssh_host_ed25519_key ssh_host_rsa_key.pub
- ssh -L 9999:172.31.118.100:22 192.168.0.103 sleep 30000
- [root@desktop3 ~]# ssh -p 9999 127.0.0.1
- root@127.0.0.1's password:
- Last login: Thu Aug 29 10:13:39 2019 from 172.31.118.103
- [root@server1 ~]# ls
- anaconda-ks.cfg initial-setup-ks.cfg 下载 图片 桌面 视频
- Desktop tmp 公共 文档 模板 音乐
chronyd本地时间源服务器，配置：
- # Use public servers from the pool.ntp.org project.
- # Please consider joining the pool (http://www.pool.ntp.org/join.html).
- local stratum 8
- manual
- # Record the rate at which the system clock gains/losses time.
- driftfile /var/lib/chrony/drift
- # Allow the system clock to be stepped in the first three updates
- # if its offset is larger than 1 second.
- makestep 1.0 3
- # Enable kernel synchronization of the real-time clock (RTC).
- rtcsync
- # Enable hardware timestamping on all interfaces that support it.
- #hwtimestamp *
- # Increase the minimum number of selectable sources required to adjust
- # the system clock.
- #minsources 2
- # Allow NTP client access from local network.
- allow 192.168.0.0/24
- # Serve time even if not synchronized to a time source.
- #local stratum 10
- # Specify file containing keys for NTP authentication.
- #keyfile /etc/chrony.keys
- # Specify directory for log files.
- logdir /var/log/chrony
- # Select which information is logged.
- #log measurements statistics tracking
- firewall-cmd --permanent --add-service ntp
- firewall-cmd --reload
------------------------------------------------------------------- [root@server3 network-scripts]# ethtool ens33
- Settings for ens33:
- Supported ports: [ TP ]
- Supported link modes: 10baseT/Half 10baseT/Full
- 100baseT/Half 100baseT/Full
- 1000baseT/Full
- Supported pause frame use: No
- Supports auto-negotiation: Yes
- Supported FEC modes: Not reported
- Advertised link modes: 10baseT/Half 10baseT/Full
- 100baseT/Half 100baseT/Full
- 1000baseT/Full
- Advertised pause frame use: No
- Advertised auto-negotiation: Yes
- Advertised FEC modes: Not reported
- Speed: 1000Mb/s
- Duplex: Full
- Port: Twisted Pair
- PHYAD: 0
- Transceiver: internal
- Auto-negotiation: on
- MDI-X: off (auto)
- Supports Wake-on: d
- Wake-on: d
- Current message level: 0x00000007 (7)
- drv probe link
- Link detected: yes
- [root@server3 network-scripts]# ip route
- default via 192.168.0.1 dev ens33 proto static metric 100
- 192.168.0.0/24 dev ens33 proto kernel scope link src 192.168.0.103 metric 100
- 192.168.122.0/24 dev virbr0 proto kernel scope link src 192.168.122.1
- [root@server3 network-scripts]# netstat -nr
- Kernel IP routing table
- Destination Gateway Genmask Flags MSS Window irtt Iface
- 0.0.0.0 192.168.0.1 0.0.0.0 UG 0 0 0 ens33
- 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 ens33
- 192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr0
- [root@server3 network-scripts]# ping 202.101.98.55
- PING 202.101.98.55 (202.101.98.55) 56(84) bytes of data.
- 64 bytes from 202.101.98.55: icmp_seq=2 ttl=48 time=272 ms
- 64 bytes from 202.101.98.55: icmp_seq=3 ttl=48 time=306 ms
- 64 bytes from 202.101.98.55: icmp_seq=4 ttl=48 time=272 ms
- ^C
- --- 202.101.98.55 ping statistics ---
- 4 packets transmitted, 3 received, 25% packet loss, time 3001ms
- rtt min/avg/max/mdev = 272.149/283.844/306.480/16.014 ms
- [root@server3 network-scripts]# route del -net 0.0.0.0
- [root@server3 network-scripts]# ping 202.101.98.55
- connect: Network is unreachable
- [root@server3 network-scripts]# ping 192.168.0.3
- PING 192.168.0.3 (192.168.0.3) 56(84) bytes of data.
- 64 bytes from 192.168.0.3: icmp_seq=1 ttl=64 time=0.501 ms
- ^C
- --- 192.168.0.3 ping statistics ---
- 1 packets transmitted, 1 received, 0% packet loss, time 0ms
- rtt min/avg/max/mdev = 0.501/0.501/0.501/0.000 ms
- [root@server3 network-scripts]# route add -net 0.0.0.0 gw 192.168.0.1
- [root@server3 network-scripts]# ping 202.101.98.55
- PING 202.101.98.55 (202.101.98.55) 56(84) bytes of data.
- 64 bytes from 202.101.98.55: icmp_seq=2 ttl=48 time=276 ms
- 64 bytes from 202.101.98.55: icmp_seq=3 ttl=48 time=273 ms
- ^C
- --- 202.101.98.55 ping statistics ---
- 4 packets transmitted, 2 received, 50% packet loss, time 3015ms
- rtt min/avg/max/mdev = 273.343/275.079/276.815/1.736 ms
- [root@server3 network-scripts]#
netstat -lntp 列出本机监听的端口，而ss -ta列出对方连接的过程。
|
匿名
发表于 2019-8-29 20:07:19
