OS : CentOS 7.4

1. bind 설치(1/2차 서버)

[root@ns1 ehost]# yum install bind  

2. 1차 네임 서버 named.conf

 options {
         listen-on port 53 { 127.0.0.1; 1차네임서버IP; };
 #       listen-on-v6 port 53 { ::1; };
         directory       "/var/named";
         dump-file       "/var/named/data/cache_dump.db";
         statistics-file "/var/named/data/named_stats.txt";
         memstatistics-file "/var/named/data/named_mem_stats.txt";
         allow-query     { any; };

        #dns 공격 방지(등록된 도메인외 쿼리 안해줌)
         recursion no;        #zone transfer 설정

        allow-transfer { 2차 네임서버 IP; };        

         dnssec-enable yes;
         dnssec-validation yes; 

        /* Path to ISC DLV key */
         bindkeys-file "/etc/named.iscdlv.key";

#       managed-keys-directory "/var/named/dynamic";

         pid-file "/run/named/named.pid";
         session-keyfile "/run/named/session.key"; 

        #2차 네임서버 zone을 text 로 설정(default raw) 

        masterfile-format text;

        #존파일 이름검사를 무시 

        check-names master ignore;

        #_ 가 들어가더라도 정상처리
        check-names response ignore;
               

        #업데이트 정보 2차 네임서버 전송        
         allow-notify { 2차네임서버IP; }; 

};

        category security { debug_log; };
         category xfer-in  { debug_log; };
         category xfer-out { debug_log; };
         category general  { debug_log; default_syslog; };
 };

3. 2차 네임서버 named.conf 

[root@ns2 ehost]# vi /etc/named.conf

options {
         listen-on port 53 { 127.0.0.1; 2차네임서버IP; };
 #       listen-on-v6 port 53 { ::1; };
         directory       "/var/named";
         dump-file       "/var/named/data/cache_dump.db";
         statistics-file "/var/named/data/named_stats.txt";
         memstatistics-file "/var/named/data/named_mem_stats.txt";
         allow-query     { any; }; 

         dnssec-enable yes;
         dnssec-validation yes; 

        /* Path to ISC DLV key */
         bindkeys-file "/etc/named.iscdlv.key";

        pid-file "/run/named/named.pid";
         session-keyfile "/run/named/session.key";
         masterfile-format text ;

         category lame-servers {null;};

controls {
         inet 127.0.0.1 allow { localhost; 1차네임서버IP; } keys { rndckey; };
}; 

         channel default_debug { null; };
         channel debug_log {
                 file "/var/log/named_debug.log" versions 10 size 20M;
                 severity dynamic;
                 print-category yes;
                 print-severity yes;
                 print-time yes;
         };

[root@ns1 ehost]# vi /etc/named.conf

$TTL    86400
 @       IN      SOA     ns.ehostidc.co.kr.  root.ns.ehostidc.co.kr.  (
                                       1997022700 ; Serial
                                       28800      ; Refresh
                                       14400      ; Retry
                                       3600000    ; Expire
                                       86400 )    ; Minimum

                         IN      NS              ns.ehostidc.co.kr.
                         IN      NS              ns2.ehostidc.co.kr. 

ns                      IN      A                 127.0.0.1

설정 파일 check 

[root@ns1 data]# /usr/sbin/named-checkconf -z "$NAMEDCONF";

특정 zone 만 체크 

[root@ns1 data]# named-checkzone ehostidc.co.kr /var/named/ehostidc.co.kr 

서비스 reload 

[root@ns1 log]# systemctl reload named  

5. 도메인 등록(2차) 

[root@ns2 ehost]# vi /etc/named.conf 

[root@ns1 log]# systemctl reload named   

6. 방화벽 등록- dns 서비스 등록 

firewall-cmd --zone=public --add-service=dns

- firewall save 

firewall-cmd --runtime-to-permanent

- firewall service 확인 

firewall-cmd --zone=public --list-services