小蘇的世界

---

DDNS (Dynamic DNS)
Dynamic Update is a method for adding, replacing or deleting records in a master server by sending it a special form of DNS messages. The format and meaning of these messages is specified in RFC 2136.
自譯：DDNS是一種用來新增、替換或刪除Master DNS server中Resource Record Data的方法…相關內容可見RFC文件冊編號2136
==> 文件冊看這兒RFC2136 <==
底下是官方說明文件的內容…大概的內容提及DDNS的發展方法…與需要注意的安全性
http://oldwww.isc.org/sw/bind/arm95/Bv9ARM.ch07.html#dynamic_update_security
http://oldwww.isc.org/sw/bind/arm95/Bv9ARM.ch04.html#dynamic_update
底下模擬實作方法…
@Master DNS server (192.168.148.129 Ubuntu 9.04 Server) 主要的DNS server
@DDNS Client User (192.168.148.131 Linux) 在這台上使用 nsupdate指令更新DNS server的資料

---

The logging statement configures a wide variety of logging options for the name server.
Its channel phrase associates output methods, format options and severity levels with a name that can then be used with the category phrase to select how various classes of messages are logged.

---

在官方說明文件的第三章中的Tools for use with the name server daemon
有提到rndc這個指令~
The remote name daemon control
(rndc) program allows the
system
administrator to control the operation of a name server.

也就是允許遠端控制DNS Server 啦~
那要如何實作…總不可能讓隨便任何一台主機都能控制DNS Server吧…
來看吧…~基本上這個也不難
@DNS Server(OpenSuSE11.1 32Bits 192.168.148.129)
#cat /etc/rndc.key
#rndc-confgen -a
重新產生rndc.key…前後可用cat指令觀察內容變化~
#cat /etc/rndc.key
key "rndc-key" {
       algorithm hmac-md5;
       secret "dhvS0tzh2QhK0GpWouix2A==";
};
#rndc-confgen > /etc/rndc.conf
產生/etc/rndc.conf 檔案
#cat /etc/rndc.key >> /etc/rndc.conf
將rndc.key的內容附加到rndc.conf後面…根據rndc.conf內容的註解~有一些地方要修改~

---

很多東西都有ACLs…但每種東西設定的方法都不一樣~
那DNS的ACLs是做什麼功能吶?官方文件 <--這兒
根據官方文件第七章的Security Considerations所提到~

---

TSIG是做什麼的吶？

Transaction SIGnatures
(TSIG) based transaction security in BIND. 啥米…有聽沒有懂～繼續往下看囉

---

看DNS的Master與Slave架構吧
比較於基本架構…稍微難一些~
Master為主要管理該zone內容(要有zone file，在/var/lib/named/目錄下)
Slave向Master提出zone-transfer的要求(不需預先存在zone file，zone file是Master transfer給它的)
Master DNS的架設請參考上篇~此篇最主要指出有修改的位置而已~
@Master DNS server (OpenSuSE 11.1 32Bits 192.168.148.129)
#vi /etc/named.conf
zone "hellokitty.com.tw" {
     type master;
     file "hellokitty.com.tw";
     allow-transfer { //這兒要加入allow-transfer的用意在於說如果有其它DNS server提出要求，可以把zone file transfer給它的意思
           192.168.148.130;};
};
#/etc/init.d/named restart
#netstat -tlnup|grep 53

---

Computers communicate with each other using their IP addresses. But for humans, it is simpler to address a computer using its name.
DNS (Domain Name System) is a distributed database system that guarantees unique computer names worldwide.
It provides computers with IP addresses when a user enters a computer name,and vice versa.