|
1
2
3
4
|
[root@dns ~]
# yum install gcc gcc-c++ bind bind-chroot bind-utils
[root@dns ~]
# cp -r /usr/share/doc/bind-9.8.2/sample/etc/named.conf /var/named/chroot/etc/
[root@dns ~]
# cp -r /usr/share/doc/bind-9.8.2/sample/var/named/* /var/named/chroot/var/named/
[root@dns ~]
# cd /var/named/chroot/var/named/
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
|
[root@dns named]
# vi ../../etc/named.conf
options
#全局配置
{
directory
"/var/named"
;
#区域文件存储目录
listen-on port 53 { 192.168.0.202; };
#监听端口，any为所有
listen-on-v6 port 53 { ::1; };
#ipv6支持
allow-query { any; };
#any对所有主机提供查询
allow-query-cache { any; };
#开启所有主机查询缓存
recursion
yes
;
#启动递归查询
};
logging
#定义记录所有查询主机内容、信息日志
{
channel default_debug {
file
"data/named.run"
;
severity dynamic;
};
};
zone
"test.com"
IN {
#正向区域声明
type
master;
file
"test.com.zone"
;
allow-update { none; };
#允许动态更新哪些客户机地址，none 表示全部禁止
allow-transfer { none; };
#设置允许下载该区域解析记录的从域名服务的地址，一般指定slave地址
};
zone
"0.168.192.in-addr.apra"
IN {
#反向区域声明
type
master;
file
"test.com.zone"
;
allow-update { none; };
allow-transfer { none; };
};
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
[root@dns named]
# cp named.localhost test.net.zone
[root@dns named]
# vi test.net.zone
$TTL 1D
@ IN SOA
test
.com. root.
test
.com. (
#第一个是该DNS区域地址，第二个是邮箱地址
0 ; serial
#更新序列号
1D ; refresh
#无效地址解析的缓存时间
1H ; retry
#刷新时间
1W ; expire
#失效时间
3H ) ; minimum
@ IN NS dns.
test
.com.
#域名服务器记录
dns IN A 192.168.0.202
mail IN A 192.168.0.203
#MX邮件交换记录
IN MX 10 mail.
test
.com.
www IN A 192.168.0.203
#A地址解析记录
203 IN PTR mail.
test
.com.
#PTR
|
|
1
2
3
|
[root@dns ~]
# named-checkconf /var/named/chroot/etc/named.conf
[root@dns ~]
# named-checkzone test.com /var/named/chroot/var/named/test.net.zone
[root@dns ~]
# named-checkzone 0.168.192.in-addr.apra /var/named/chroot/var/named/test.net.zone
|
|
1
2
3
4
5
6
7
|
[root@dns ~]
# vi /etc/resolv.conf
nameserver 192.168.0.202
[root@dns ~]
# service named start #启动时一直停在这
Generating
/etc/rndc
.key:
[root@dns ~]
# rndc-confgen -r /dev/urandom -a #执行此命令导入KEY，再启动就能启动了
[root@dns ~]
# service named start
[root@dns ~]
# chkconfig named on
|
|
1
2
3
4
5
6
7
8
9
10
11
|
[root@client ~]
# nslookup www.test.com #正向解析，也可以使用host测试
Server: 192.168.0.202
Address: 192.168.0.202
#53
Name: www.
test
.com
Address: 192.168.0.203
[root@client ~]
# nslookup #反向解析
> 192.168.0.203
Server: 202.106.0.20
Address: 202.106.0.20
#53
203.0.168.192.
in
-addr.arpa name = client.
>
|
|
1
2
3
4
5
6
|
[root@slaves ~]
# vi /var/named/chroot/etc/named.conf
zone
"test.com"
IN {
type
slave;
file
"test.com.zone"
;
masters { 192.168.0.202; };
};
|
|
1
2
3
4
5
6
7
|
[root@slaves ~]
# vi /var/named/chroot/etc/named.conf
Options{
Directory “
/var/named/chroot/var/named/etc/
”；
Forwarders only；
#本DNS服务器不提供解析，将所有请求转发到forwarders列表
forwarders { DNS服务器IP地址；}；
#定义转发请求目的ip
allow-query {any；}；
#允许所有客户查询
}；
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
|
[root@
ftp
~]
# yum install vsftpd -y
[root@
ftp
~]
# mkdir /data
[root@
ftp
~]
# vi /etc/vsftpd/vsftpd.conf #末尾添加如下
anonymous_enable=no
#禁用匿名登陆
local_root=
/data
#FTP根目录
chroot_local_user=
yes
#锁定宿主目录
pasv_enable=YES
#启动被动模式连接
pasv_min_port=6001
#最小端口号
pasv_max_port=6100
#最大端口号
[root@
ftp
~]
# service vsftpd start
[root@
ftp
~]
# useradd ftpadmin #创建登陆FTP用户并设置密码
[root@
ftp
~]
# passwd ftpadmin
[root@
ftp
~]
# chown ftpadmin:ftpadmin /data/ -R
|
|
1
2
|
[root@
ftp
~]
# iptables -A INPUT -p tcp --dport 20:21 -j ACCEPT
[root@
ftp
~]
# iptables -A INPUT -p tcp --dport 6001:6100 -j ACCEPT
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
|
[root@
ftp
vsftpd]
# openssl req -new -x509 -nodes -out vsftpd.pem -keyout vsftpd.pem
Generating a 2048 bit RSA private key
...........+++
...........................................+++
writing new private key to
'vsftpd.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter
'.'
, the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:
test
Organization Name (eg, company) [Default Company Ltd]:
test
Organizational Unit Name (eg, section) []:
test
.com
Common Name (eg, your name or your server's
hostname
) []:
Email Address []:
|
|
1
|
[root@
ftp
vsftpd]
# chmod 400 vsftpd.pem
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
[root@
ftp
~]
# vi /etc/vsftpd/vsftpd.conf #末尾添加如下
anonymous_enable=no
#关闭匿名访问
local_root=
/ftp
#指定宿主目录
chroot_local_user=YES
#锁定宿主目录
ssl_enable=YES
ssl_sslv2=YES
ssl_sslv3=YES
ssl_tlsv1=YES
force_local_logins_ssl=YES
#登录使用ssl认证
force_local_data_ssl=YES
#数据传输使用ssl认证
force_anon_logins_ssl=YES
#匿名登录使用ssl认证
force_anon_data_ssl=YES
rsa_cert_file=
/etc/vsftpd/vsftpd
.pem
#设置证书位置
[root@
ftp
~]
# service vsftpd restart
[root@
ftp
~]
# chkconfig vsftpd on
|
|
1
|
yum install -y dhcp
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
|
cp
/usr/share/doc/dhcp-4
.1.1
/dhcpd
.conf.sample
/etc/dhcp/dhcpd
.conf
#默认配置文件是空的，复制dhcpd.conf模板
vi
/etc/dhcp/dhcpd
.conf
ddns-update-style interim;
#设置dhcp互动更新模式
ignore client-updates;
#忽略客户端更新
shared-network
test
{
#这个段是一个作用域，不同子网配置多个作用域
subnet 192.168.1.0 netmask 255.255.255.0{
#子网声明
option routers 192.168.1.1;
#客户端默认获取网关
option subnet-mask 255.255.255.0;
#客户端默认获取子网掩码
option domain-name
"test.com"
;
#DNS域
option domain-name-servers 8.8.8.8;
#DNS服务器地址
range 192.168.1.200 192.168.1.202;
#分配地址池
default-lease-time3600;
#默认租期，单位秒
max-lease-time7200;
#最长租期，单位秒
可选：
#host print { #设置静态分配主机
#hardware ethernet 00:0C:29:7E:52:64； #静态分配主机MAC
#fixed-address 192.168.1.200； #静态分配的IP
# }
}
}
|
|
1
2
|
service dhcpd start
chkconfig dhcpd on
|
