一、拓扑图二、服务器信息角色主机名IP 地址优先级keepalived 状态VIP虚拟 IP—192.168.113.10/24—故障自动漂移DNS 主服务器dns1.czsgcc.com192.168.113.66/24100 (权重-60)MASTERDNS 备服务器dns2.czsgcc.com192.168.113.77/2450BACKUP三、已安装软件软件版本用途bind/bind-utils9.18.21DNS 服务namedkeepalived2.2.8VRRP 高可用 VIP 漂移chrony—时间同步tcpdump/lsof—网络排查四、主DNS配置文件信息主 DNS/etc/named.conf— Masteroptions { listen-on port 53 { any; }; listen-on-v6 port 53 { none; }; directory /var/named; allow-query { any; }; recursion yes; allow-recursion { 192.168.113.0/24; }; forwarders { 223.5.5.5; // 阿里 DNS 223.6.6.6; 114.114.114.114; // 114 DNS 8.8.8.8; // Google DNS备用 }; forward only; dnssec-validation yes; max-cache-size 4096m; recursive-clients 30000; tcp-clients 2000; version none; }; #正向解析 zone czsgcc.com IN { type master; file czsgcc.com.zone; allow-transfer { key czsgcc-transfer-key; }; allow-update { none; }; notify yes; also-notify { 192.168.113.77; }; }; #反向解析 zone 113.168.192.in-addr.arpa IN { type master; file 192.168.113.rev; allow-transfer { key czsgcc-transfer-key; }; };五、备 DNS/etc/named.conf— Slavezone czsgcc.com IN { type slave; file slaves/czsgcc.com.zone; masters { 192.168.113.66 key czsgcc-transfer-key; }; }; zone 113.168.192.in-addr.arpa IN { type slave; file slaves/192.168.113.rev; masters { 192.168.113.66 key czsgcc-transfer-key; }; };六、正向解析区域配置czsgcc.com.zone$TTL 600 IN SOA dns1.czsgcc.com. admin.czsgcc.com. ( 2026071602 3600 900 604800 86400 ) IN NS dns1.czsgcc.com. IN NS dns2.czsgcc.com. dns1 IN A 192.168.113.66 dns2 IN A 192.168.113.77 IN A 192.168.113.66 IN A 192.168.113.77 www IN A 192.168.113.66 www IN A 192.168.113.77七、反向区域文件192.168.113.rev$TTL 600 IN SOA dns1.czsgcc.com. admin.czsgcc.com. ( 2026071601 3600 900 604800 86400 ) IN NS dns1.czsgcc.com. IN NS dns2.czsgcc.com. 66 IN PTR www.czsgcc.com. 77 IN PTR www.czsgcc.com.八、keepalived 配置 — Master192.168.113.66global_defs { router_id DNS_MASTER enable_script_security } vrrp_script check_dns { script /etc/keepalived/check_named.sh interval 2 timeout 3 weight -60 fall 2 rise 2 } vrrp_instance VI_DNS { state MASTER interface ens160 virtual_router_id 66 priority 100 advert_int 1 authentication { auth_type PASS auth_pass czsgcc_12 } virtual_ipaddress { 192.168.113.10/24 dev ens160 } track_script { check_dns } }九、keepalived 配置 — Slave192.168.113.77global_defs { router_id DNS_SLAVE enable_script_security } vrrp_script check_dns { script /etc/keepalived/check_named.sh interval 2 timeout 3 weight -60 fall 2 rise 2 } vrrp_instance VI_DNS { state BACKUP interface ens160 virtual_router_id 66 priority 50 advert_int 1 authentication { auth_type PASS auth_pass czsgcc_12 } virtual_ipaddress { 192.168.113.10/24 dev ens160 } track_script { check_dns } }十、TSIG 密钥/etc/named/transfer.keykey czsgcc-transfer-key { algorithm hmac-sha256; secret beRylVlLeQO003ifIdkKij7sLNDlFhvUwKcnqjMU3g; };十一、健康检测脚本#!/bin/bash if ! pgrep -x named /dev/null; then exit 1; fi if ! ss -tuln | grep -q :53 ; then exit 1; fi exit 0
一、拓扑图二、服务器信息角色主机名IP 地址优先级keepalived 状态VIP虚拟 IP—192.168.113.10/24—故障自动漂移DNS 主服务器dns1.czsgcc.com192.168.113.66/24100 (权重-60)MASTERDNS 备服务器dns2.czsgcc.com192.168.113.77/2450BACKUP三、已安装软件软件版本用途bind/bind-utils9.18.21DNS 服务namedkeepalived2.2.8VRRP 高可用 VIP 漂移chrony—时间同步tcpdump/lsof—网络排查四、主DNS配置文件信息主 DNS/etc/named.conf— Masteroptions { listen-on port 53 { any; }; listen-on-v6 port 53 { none; }; directory /var/named; allow-query { any; }; recursion yes; allow-recursion { 192.168.113.0/24; }; forwarders { 223.5.5.5; // 阿里 DNS 223.6.6.6; 114.114.114.114; // 114 DNS 8.8.8.8; // Google DNS备用 }; forward only; dnssec-validation yes; max-cache-size 4096m; recursive-clients 30000; tcp-clients 2000; version none; }; #正向解析 zone czsgcc.com IN { type master; file czsgcc.com.zone; allow-transfer { key czsgcc-transfer-key; }; allow-update { none; }; notify yes; also-notify { 192.168.113.77; }; }; #反向解析 zone 113.168.192.in-addr.arpa IN { type master; file 192.168.113.rev; allow-transfer { key czsgcc-transfer-key; }; };五、备 DNS/etc/named.conf— Slavezone czsgcc.com IN { type slave; file slaves/czsgcc.com.zone; masters { 192.168.113.66 key czsgcc-transfer-key; }; }; zone 113.168.192.in-addr.arpa IN { type slave; file slaves/192.168.113.rev; masters { 192.168.113.66 key czsgcc-transfer-key; }; };六、正向解析区域配置czsgcc.com.zone$TTL 600 IN SOA dns1.czsgcc.com. admin.czsgcc.com. ( 2026071602 3600 900 604800 86400 ) IN NS dns1.czsgcc.com. IN NS dns2.czsgcc.com. dns1 IN A 192.168.113.66 dns2 IN A 192.168.113.77 IN A 192.168.113.66 IN A 192.168.113.77 www IN A 192.168.113.66 www IN A 192.168.113.77七、反向区域文件192.168.113.rev$TTL 600 IN SOA dns1.czsgcc.com. admin.czsgcc.com. ( 2026071601 3600 900 604800 86400 ) IN NS dns1.czsgcc.com. IN NS dns2.czsgcc.com. 66 IN PTR www.czsgcc.com. 77 IN PTR www.czsgcc.com.八、keepalived 配置 — Master192.168.113.66global_defs { router_id DNS_MASTER enable_script_security } vrrp_script check_dns { script /etc/keepalived/check_named.sh interval 2 timeout 3 weight -60 fall 2 rise 2 } vrrp_instance VI_DNS { state MASTER interface ens160 virtual_router_id 66 priority 100 advert_int 1 authentication { auth_type PASS auth_pass czsgcc_12 } virtual_ipaddress { 192.168.113.10/24 dev ens160 } track_script { check_dns } }九、keepalived 配置 — Slave192.168.113.77global_defs { router_id DNS_SLAVE enable_script_security } vrrp_script check_dns { script /etc/keepalived/check_named.sh interval 2 timeout 3 weight -60 fall 2 rise 2 } vrrp_instance VI_DNS { state BACKUP interface ens160 virtual_router_id 66 priority 50 advert_int 1 authentication { auth_type PASS auth_pass czsgcc_12 } virtual_ipaddress { 192.168.113.10/24 dev ens160 } track_script { check_dns } }十、TSIG 密钥/etc/named/transfer.keykey czsgcc-transfer-key { algorithm hmac-sha256; secret beRylVlLeQO003ifIdkKij7sLNDlFhvUwKcnqjMU3g; };十一、健康检测脚本#!/bin/bash if ! pgrep -x named /dev/null; then exit 1; fi if ! ss -tuln | grep -q :53 ; then exit 1; fi exit 0
