BIND DNS 服务器搭建完全教程 / 第 02 章：安装与初始配置

# 更新包索引
sudo apt update

# 安装 BIND9（含服务器和工具）
sudo apt install -y bind9 bind9utils bind9-doc

# 验证安装
named -v
# 输出: BIND 9.18.x-...

# 查看已安装的包
dpkg -l | grep bind9

# 安装客户端查询工具（如果还没有）
sudo apt install -y dnsutils

# RHEL/CentOS 8+ / Fedora
sudo dnf install -y bind bind-utils

# RHEL/CentOS 7
sudo yum install -y bind bind-utils

# 验证安装
named -v

# 查看已安装的包
rpm -qa | grep bind

# 常用于 Docker 容器
apk add bind bind-tools

# 验证
named -v

sudo pacman -S bind

# Ubuntu/Debian
sudo apt install -y build-essential libssl-dev libuv1-dev \
    libnghttp2-dev libjemalloc-dev libfstrm-dev \
    protobuf-c-compiler libprotobuf-c-dev \
    libcap-dev libxml2-dev libkrb5-dev wget

# RHEL/CentOS
sudo dnf install -y gcc make openssl-devel libuv-devel \
    nghttp2-devel jemalloc-devel fstrm-devel \
    protobuf-c-devel libcap-devel libxml2-devel krb5-devel wget

# 定义版本（请替换为最新稳定版）
BIND_VERSION="9.20.0"

# 下载源码
cd /tmp
wget https://downloads.isc.org/isc/bind9/${BIND_VERSION}/bind-${BIND_VERSION}.tar.xz
tar xf bind-${BIND_VERSION}.tar.xz
cd bind-${BIND_VERSION}

# 配置（标准选项）
./configure \
    --prefix=/usr/local/bind \
    --sysconfdir=/etc/bind \
    --localstatedir=/var \
    --enable-full-report \
    --with-openssl \
    --with-libxml2 \
    --with-jemalloc \
    --enable-dnsrps

# 编译（使用所有 CPU 核心）
make -j$(nproc)

# 安装
sudo make install

# 创建 named 用户
sudo useradd -r -s /usr/sbin/nologin -d /var/named named

# 创建必要目录
sudo mkdir -p /var/named/{primary,secondary,dynamic,data}
sudo mkdir -p /var/log/named
sudo mkdir -p /run/named

# 设置权限
sudo chown -R named:named /var/named
sudo chown -R named:named /var/log/named
sudo chown -R named:named /run/named

# 创建 systemd 服务文件
sudo tee /etc/systemd/system/named.service <<'EOF'
[Unit]
Description=BIND DNS Server
Documentation=man:named(8)
After=network-online.target
Wants=network-online.target

[Service]
Type=forking
ExecStart=/usr/local/bind/sbin/named -u named -c /etc/bind/named.conf
ExecReload=/usr/local/bind/sbin/rndc reload
ExecStop=/usr/local/bind/sbin/rndc stop
Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
EOF

# 重载 systemd
sudo systemctl daemon-reload

# 添加到 /etc/profile.d/bind.sh
sudo tee /etc/profile.d/bind.sh <<'EOF'
export PATH="/usr/local/bind/sbin:/usr/local/bind/bin:$PATH"
export MANPATH="/usr/local/bind/share/man:$MANPATH"
EOF

# 立即生效
source /etc/profile.d/bind.sh

# 验证
which named
which dig

# 查看默认配置
cat /etc/bind/named.conf

// /etc/bind/named.conf

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";

cat /etc/bind/named.conf.options

// /etc/bind/named.conf.options
options {
    directory "/var/cache/bind";

    // 如果本机不是递归服务器，禁用递归
    recursion yes;
    allow-recursion { localhost; };

    // 隐藏版本号（安全）
    version "not disclosed";

    // 启用 DNSSEC 验证
    dnssec-validation auto;

    // 监听地址
    listen-on { 127.0.0.1; };
    listen-on-v6 { ::1; };

    // 转发器（可选）
    // forwarders {
    //     8.8.8.8;
    //     8.8.4.4;
    // };

    // PID 文件路径
    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";
};

// /etc/named.conf
options {
    listen-on port 53 { 127.0.0.1; };
    listen-on-v6 port 53 { ::1; };
    directory       "/var/named";
    dump-file       "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    secroots-file   "/var/named/data/named.secroots";
    recursing-file  "/var/named/data/named.recursing";

    allow-query     { localhost; };
    recursion yes;

    dnssec-validation auto;

    managed-keys-directory "/var/named/dynamic";
    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";
};

logging {
    channel default_debug {
        file "data/named.run";
        severity dynamic;
    };
};

zone "." IN {
    type hint;
    file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

# 检查 named.conf 语法
# Ubuntu/Debian
sudo named-checkconf /etc/bind/named.conf

# RHEL/CentOS
sudo named-checkconf /etc/named.conf

# 无输出 = 语法正确
# 有输出 = 显示错误位置和原因

# 启动
sudo systemctl start named    # RHEL/CentOS
sudo systemctl start bind9    # Ubuntu/Debian

# 设置开机自启
sudo systemctl enable named   # RHEL/CentOS
sudo systemctl enable bind9   # Ubuntu/Debian

# 查看状态
sudo systemctl status named

# 使用 dig 查询本地解析
dig @127.0.0.1 example.com A

# 预期输出：
# ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12345
# ;; ANSWER SECTION:
# example.com.        86400   IN  A   93.184.216.34

# 使用 nslookup
nslookup example.com 127.0.0.1

# 检查 BIND 版本
dig @127.0.0.1 version.bind txt chaos

# firewalld (RHEL/CentOS)
sudo firewall-cmd --permanent --add-service=dns
sudo firewall-cmd --reload

# 或手动添加端口
sudo firewall-cmd --permanent --add-port=53/tcp
sudo firewall-cmd --permanent --add-port=53/udp
sudo firewall-cmd --reload

# ufw (Ubuntu)
sudo ufw allow 53/tcp
sudo ufw allow 53/udp
sudo ufw reload

# iptables（传统方式）
sudo iptables -A INPUT -p tcp --dport 53 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 53 -j ACCEPT

# 生成 rndc 配置和密钥（包管理安装通常自动生成）
sudo rndc-confgen > /tmp/rndc.conf

# Ubuntu/Debian 自动生成的密钥和配置
cat /etc/bind/rndc.key

# 重载配置文件（不中断服务）
sudo rndc reload

# 重载特定区域
sudo rndc reload example.com

# 查看服务器状态
sudo rndc status

# 查看统计信息
sudo rndc stats

# 刷新缓存
sudo rndc flush

# 查询日志级别
sudo rndc querylog on    # 开启查询日志
sudo rndc querylog off   # 关闭查询日志

# 更改日志级别（调试用）
sudo rndc trace 3        # 设置调试级别为 3

# 冻结区域（防止动态更新）
sudo rndc freeze example.com

# 解冻区域
sudo rndc thaw example.com

# 停止服务
sudo rndc stop

# 创建 logrotate 配置
sudo tee /etc/logrotate.d/named <<'EOF'
/var/log/named/*.log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    create 0640 named named
    sharedscripts
    postrotate
        /usr/sbin/rndc reconfig > /dev/null 2>&1 || true
    endscript
}
EOF