BIND DNS 服务器搭建完全教程 / 第 15 章：运维最佳实践

options {
    // 启用统计通道
    statistics-channels {
        inet 127.0.0.1 port 8053 allow { 127.0.0.1; };
    };
};

# docker-compose.monitoring.yml
services:
  bind-exporter:
    image: prometheus/bind_exporter:latest
    command:
      - --bind.pid-file=/var/run/named/named.pid
      - --bind.timeout=10s
    ports:
      - "9119:9119"
    volumes:
      - /var/run/named:/var/run/named:ro
    networks:
      - monitoring

  prometheus:
    image: prom/prometheus:latest
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
    ports:
      - "9090:9090"
    networks:
      - monitoring

  grafana:
    image: grafana/grafana:latest
    ports:
      - "3000:3000"
    networks:
      - monitoring

# prometheus.yml
scrape_configs:
  - job_name: 'bind9'
    static_configs:
      - targets: ['bind-exporter:9119']
    scrape_interval: 15s

#!/bin/bash
# /opt/scripts/dns-healthcheck.sh

DNS_SERVER="127.0.0.1"
DOMAIN="example.com"
EXPECTED_IP="93.184.216.34"
TIMEOUT=5
LOG_FILE="/var/log/dns-healthcheck.log"

# 检查解析
RESULT=$(dig @${DNS_SERVER} ${DOMAIN} A +short +time=${TIMEOUT} 2>/dev/null)
STATUS=$?

if [ $STATUS -ne 0 ]; then
    echo "$(date '+%Y-%m-%d %H:%M:%S') CRITICAL: DNS query failed" >> "$LOG_FILE"
    exit 2
fi

if [ "$RESULT" != "$EXPECTED_IP" ]; then
    echo "$(date '+%Y-%m-%d %H:%M:%S') WARNING: Unexpected result: $RESULT" >> "$LOG_FILE"
    exit 1
fi

# 检查查询延迟
START=$(date +%s%N)
dig @${DNS_SERVER} ${DOMAIN} A +short > /dev/null 2>&1
END=$(date +%s%N)
LATENCY=$(( (END - START) / 1000000 ))

if [ $LATENCY -gt 100 ]; then
    echo "$(date '+%Y-%m-%d %H:%M:%S') WARNING: High latency: ${LATENCY}ms" >> "$LOG_FILE"
    exit 1
fi

echo "$(date '+%Y-%m-%d %H:%M:%S') OK: ${DOMAIN} = ${RESULT}, ${LATENCY}ms" >> "$LOG_FILE"
exit 0

# 添加到 crontab
# 每分钟检查
* * * * * /opt/scripts/dns-healthcheck.sh

#!/bin/bash
# /opt/scripts/backup-bind.sh

BACKUP_DIR="/var/backups/bind"
DATE=$(date +%Y%m%d_%H%M%S)
BACKUP_FILE="${BACKUP_DIR}/bind_backup_${DATE}.tar.gz"
RETENTION_DAYS=30

# 创建备份目录
mkdir -p "$BACKUP_DIR"

# 创建备份
tar czf "$BACKUP_FILE" \
    /etc/named.conf \
    /etc/bind/ \
    /var/named/primary/ \
    /var/named/secondary/ \
    /var/cache/bind/ \
    --exclude="*.jnl" \
    --exclude="*.bak" \
    2>/dev/null

# 验证备份
if [ -f "$BACKUP_FILE" ]; then
    SIZE=$(du -h "$BACKUP_FILE" | cut -f1)
    echo "Backup created: $BACKUP_FILE ($SIZE)"
    
    # 同步到远程存储（可选）
    # rsync -avz "$BACKUP_FILE" backup@remote:/backups/bind/
    # aws s3 cp "$BACKUP_FILE" s3://backups/bind/
else
    echo "Backup failed!" >&2
    exit 1
fi

# 清理旧备份
find "$BACKUP_DIR" -name "bind_backup_*.tar.gz" -mtime +${RETENTION_DAYS} -delete

# 邮件通知（可选）
# mail -s "BIND Backup: ${DATE}" admin@example.com << EOF
# Backup completed: $BACKUP_FILE
# Size: $SIZE
# Retention: ${RETENTION_DAYS} days
# EOF

# 使用 Git 管理区域文件
cd /var/named/primary
git init
git add *.zone
git commit -m "Initial zone files"

# 修改后提交
vim example.com.zone
git add example.com.zone
git commit -m "Update example.com: add new A record for api"

# 查看变更历史
git log --oneline
git diff HEAD~1 example.com.zone

# Terraform 示例：多区域 DNS 部署
resource "aws_route53_record" "primary" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "ns1.example.com"
  type    = "A"
  ttl     = 300
  records = ["203.0.113.10"]
}

resource "aws_route53_record" "secondary" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "ns2.example.com"
  type    = "A"
  ttl     = 300
  records = ["198.51.100.10"]
}

#!/bin/bash
# /opt/scripts/dns-failover.sh
# 主服务器故障时自动提升从服务器

PRIMARY="192.168.1.10"
SECONDARY="192.168.1.11"
DOMAIN="example.com"
HEALTH_CHECK_URL="http://health.example.com/status"

# 检查主服务器健康状态
check_primary() {
    # DNS 查询检查
    dig @${PRIMARY} ${DOMAIN} SOA +short +time=2 > /dev/null 2>&1
    return $?
}

# 切换到从服务器
failover() {
    echo "$(date): Initiating failover..."
    
    # 方案 1: 更新负载均衡器（如 HAProxy）
    # sed -i 's/192.168.1.10/192.168.1.11/' /etc/haproxy/haproxy.cfg
    # systemctl reload haproxy
    
    # 方案 2: 通知监控系统
    curl -X POST "https://monitoring.example.com/api/alert" \
        -d "message=DNS primary server failed, switched to secondary"
    
    # 方案 3: 发送告警邮件
    echo "DNS primary server ${PRIMARY} is down. Switched to ${SECONDARY}." | \
        mail -s "DNS Failover Alert" admin@example.com
}

# 主循环
FAIL_COUNT=0
MAX_FAIL=3

while true; do
    if check_primary; then
        FAIL_COUNT=0
    else
        FAIL_COUNT=$((FAIL_COUNT + 1))
        echo "$(date): Primary check failed (${FAIL_COUNT}/${MAX_FAIL})"
        
        if [ $FAIL_COUNT -ge $MAX_FAIL ]; then
            failover
            break
        fi
    fi
    sleep 10
done

# /etc/keepalived/keepalived.conf
vrrp_script check_dns {
    script "/usr/bin/dig @127.0.0.1 example.com SOA +short +time=2"
    interval 10
    weight 20
    fall 3
    rise 2
}

vrrp_instance VI_DNS {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 100
    advert_int 1
    
    authentication {
        auth_type PASS
        auth_pass dns_secret
    }
    
    virtual_ipaddress {
        192.168.1.100/24
    }
    
    track_script {
        check_dns
    }
    
    notify_master "/opt/scripts/dns-master.sh"
    notify_backup "/opt/scripts/dns-backup.sh"
    notify_fault "/opt/scripts/dns-fault.sh"
}

# playbook.yml
---
- name: Deploy BIND DNS Server
  hosts: dns_servers
  become: yes
  
  vars:
    bind_zones:
      - name: example.com
        type: primary
        file: primary/example.com.zone
    
    bind_forwarders:
      - 8.8.8.8
      - 1.1.1.1
  
  tasks:
    - name: Install BIND
      apt:
        name: "{{ item }}"
        state: present
      loop:
        - bind9
        - bind9utils
        - dnsutils
    
    - name: Deploy named.conf
      template:
        src: named.conf.j2
        dest: /etc/bind/named.conf
        owner: root
        group: bind
        mode: '0640'
      notify: Restart BIND
    
    - name: Deploy zone files
      template:
        src: "zones/{{ item.name }}.zone.j2"
        dest: "/var/cache/bind/{{ item.type }}/{{ item.name }}.zone"
        owner: bind
        group: bind
        mode: '0640'
      loop: "{{ bind_zones }}"
      notify: Reload BIND
    
    - name: Ensure BIND is running
      service:
        name: bind9
        state: started
        enabled: yes
  
  handlers:
    - name: Restart BIND
      service:
        name: bind9
        state: restarted
    
    - name: Reload BIND
      command: rndc reload

#!/bin/bash
# /opt/scripts/deploy-zones.sh

REPO_DIR="/opt/dns-zones"
NAMED_DIR="/var/named/primary"

cd "$REPO_DIR"
git pull

# 检查变更
CHANGED=$(git diff --name-only HEAD~1 | grep "\.zone$")

for zone_file in $CHANGED; do
    zone_name=$(basename "$zone_file" .zone)
    
    # 语法检查
    named-checkzone "$zone_name" "$REPO_DIR/$zone_file"
    if [ $? -eq 0 ]; then
        cp "$REPO_DIR/$zone_file" "$NAMED_DIR/"
        rndc reload "$zone_name"
        echo "Deployed: $zone_name"
    else
        echo "Failed: $zone_name" >&2
    fi
done

#!/bin/bash
# /opt/scripts/pre-change-check.sh

echo "=== Pre-Change DNS Check ==="

# 1. 检查服务状态
echo "1. Service Status:"
systemctl status named | head -5

# 2. 记录当前 Serial
echo "2. Current Serials:"
for zone in example.com internal.corp; do
    echo -n "  $zone: "
    dig @127.0.0.1 $zone SOA +short | awk '{print $3}'
done

# 3. 检查查询延迟
echo "3. Query Latency:"
START=$(date +%s%N)
dig @127.0.0.1 example.com A +short > /dev/null
END=$(date +%s%N)
echo "  example.com: $(( (END - START) / 1000000 ))ms"

# 4. 检查缓存大小
echo "4. Cache Status:"
rndc status | grep -E "cache|memory"

echo "=== Ready for change ==="

# 启用审计日志
# /etc/audit/rules.d/bind.rules
-w /etc/named.conf -p wa -k dns-config
-w /var/named/primary/ -p wa -k dns-zones
-w /etc/bind/*.key -p wa -k dns-keys