最近我们移动了主要的外部 DNS 服务器。它前面有我们的 ISP 提供的三个缓存 DNS 从站。他们告诉我们,他们在进行区域传输 (AXFR) 时开始收到访问被拒绝的请求。如果我将自己的 IP 添加到允许传输列表中,则在将 dig 与 AXFR 参数一起使用时,我也会遇到传输失败的情况。这是我的绑定配置的样子:
options {
directory "/var/lib/named";
dump-file "/var/log/named_dump.db";
zone-statistics yes;
statistics-file "/var/log/named.stats";
listen-on-v6 { any; };
notify-source 10.19.0.68 port 53;
querylog yes;
notify yes;
allow-transfer {
127.0.0.1; //localhost
1.1.1.1; //public dns slave 1
2.2.2.2; //public dns slave 2
3.3.3.3; //public dns slave 3
};
also-notify {
1.1.1.1; //public dns slave 1
2.2.2.2; //public dns slave 2
3.3.3.3; //public dns slave 3
};
include "/etc/named.d/forwarders.conf";
};
logging {
channel simple_log {
file "/var/log/bind.log" versions 10 size 3m;
severity info;
print-time yes;
print-severity yes;
print-category yes;
};
category default{ simple_log; };
channel log_zone_transfers {
file "/var/log/axfr.log" versions 10 size 3m;
print-time yes;
print-category yes;
print-severity yes;
};
category xfer-out { log_zone_transfers; };
channel log_notify {
file "/var/log/notify.log" versions 10 size 3m;
print-time yes;
print-category yes;
print-severity yes;
};
category notify { log_notify; };
channel queries {
file "/var/log/queries.log" versions 10 size 30m;
print-time yes;
severity info;
print-category yes;
print-severity yes;
};
category queries { queries; };
};
zone "." in {
type hint;
file "root.hint";
};
zone "localhost" in {
type master;
file "localhost.zone";
};
zone "0.0.127.in-addr.arpa" in {
type master;
file "127.0.0.zone";
};
include "/etc/named.conf.include";
zone "example.net " {
type master;
file "/var/lib/named/master/example.net.hosts";
};
zone "example.com " {
type master;
file "/var/lib/named/master/example.com.hosts";
};
## -- other master files --
xfer 日志中的错误如下所示:
29-Oct-2012 14:20:02.806 xfer-out: info: client 1.1.1.1#59069: bad zone transfer request: 'example.com./IN': non-authoritative zone (NOTAUTH)
我试过直接在区域文件上添加允许传输参数,但传输仍然失败。知道我做错了什么吗?
是准确复制的吗?你不应该在那里有空间。