Pesquisa inversa SERVFAIL

1

Acabei de configurar um servidor DNS e um servidor da web usando o Virtualbox. O endereço IP do servidor DNS é 192.168.56.101 e o servidor web 192.168.56.102.

Aqui estão meus arquivos de configuração para o servidor DNS:

named.conf:

[quan@localhost ~]$ sudo cat /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

options {
    directory   "/var/named";
    dump-file   "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
    //query-source address * port 53;

    //forward first;
    forwarders { 8.8.8.8; 8.8.4.4; };

    listen-on port 53 { 127.0.0.1; 192.168.56.0/24; };
    allow-query { localhost; 192.168.56.0/24; };
    recursion yes;

    dnssec-enable yes;
    dnssec-validation yes;
    dnssec-lookaside auto;

    /* Path to ISC DLV key */
    bindkeys-file "/etc/named.iscdlv.key";

    managed-keys-directory "/var/named/dynamic";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity debug 10;
                print-category yes;
                print-time yes;
                print-severity yes;
            };
};

zone "quantran.com" in {
    type master;
    file "named.quantran.com";
};

zone "56.168.192.in-addr.arpa" in {
    type master;
    file "named.192.168.56";
    allow-update { none; };
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

named.quantran.com:

[quan@localhost ~]$ sudo cat /var/named/named.quantran.com
$TTL 86400
quantran.com.       IN SOA  dns1.quantran.com. root.quantran.com. (
                        100     ; serial
                        3600    ; refresh
                        600     ; retry
                        604800  ; expire
                        86400 )
                    IN NS       dns1.quantran.com.
dns1.quantran.com.  IN A        192.168.56.101
www.quantran.com.   IN A        192.168.56.102

named.192.168.56:

[quan@localhost ~]$ sudo cat /var/named/named.192.168.56
$TTL 86400
$ORIGIN 56.168.192.in-addr.arpa.
@                               IN SOA  dns1.quantran.com. root.quantran.com. (
                                    100     ; serial
                                    3600    ; refresh
                                    600     ; retry
                                    604800  ; expire
                                    86400 ) ; minimum
                                IN NS   dns1.quantran.com.
101.56.168.192.in-addr.arpa.    IN PTR  dns1.quantran.com.
102                             IN PTR  www.quantran.com.

Quando eu tento uma pesquisa normal do host (eu configurei para que o único servidor de nomes usado pelo host seja o servidor DNS 192.168.56.101):

quan@quantran:~$ host www.quantran.com
www.quantran.com has address 192.168.56.102
quan@quantran:~$ host dns1.quantran.com
dns1.quantran.com has address 192.168.56.101

Mas quando eu tento uma pesquisa inversa:

quan@quantran:~$ host -v 192.168.56.101 192.168.56.101
Trying "101.56.168.192.in-addr.arpa"
Using domain server:
Name: 192.168.56.101
Address: 192.168.56.101#53
Aliases: 

Host 101.56.168.192.in-addr.arpa not found: 2(SERVFAIL)
Received 45 bytes from 192.168.56.101#53 in 0 ms

quan@quantran:~$ host -v 192.168.56.102 192.168.56.101
Trying "102.56.168.192.in-addr.arpa"
Using domain server:
Name: 192.168.56.101
Address: 192.168.56.101#53
Aliases: 

Host 102.56.168.192.in-addr.arpa not found: 2(SERVFAIL)
Received 45 bytes from 192.168.56.101#53 in 0 ms

Então, por que não posso realizar uma pesquisa inversa? Alguma coisa errada com os arquivos de configuração da zona?

Agradecemos antecipadamente:)

Ah, aqui está a saída do arquivo de log /var/named/data/named.run quando executo a pesquisa inversa:

quan@quantran:~$ host 192.168.56.102 192.168.56.101
Using domain server:
Name: 192.168.56.101
Address: 192.168.56.101#53
Aliases: 

Host 102.56.168.192.in-addr.arpa not found: 2(SERVFAIL)

/var/named/data/named.run:

02-Jun-2014 15:18:11.950 client: debug 3: client 192.168.56.1#51786: UDP request
02-Jun-2014 15:18:11.950 client: debug 5: client 192.168.56.1#51786: using view '_default'
02-Jun-2014 15:18:11.950 security: debug 3: client 192.168.56.1#51786: request is not signed
02-Jun-2014 15:18:11.950 security: debug 3: client 192.168.56.1#51786: recursion available
02-Jun-2014 15:18:11.950 client: debug 3: client 192.168.56.1#51786: query
02-Jun-2014 15:18:11.950 client: debug 10: client 192.168.56.1#51786: ns_client_attach: ref = 1
02-Jun-2014 15:18:11.950 query-errors: debug 1: client 192.168.56.1#51786: query failed (SERVFAIL) for 102.56.168.192.in-addr.arpa/IN/PTR at query.c:5428
02-Jun-2014 15:18:11.950 client: debug 3: client 192.168.56.1#51786: error
02-Jun-2014 15:18:11.950 client: debug 3: client 192.168.56.1#51786: send
02-Jun-2014 15:18:11.950 client: debug 3: client 192.168.56.1#51786: sendto
02-Jun-2014 15:18:11.951 client: debug 3: client 192.168.56.1#51786: senddone
02-Jun-2014 15:18:11.951 client: debug 3: client 192.168.56.1#51786: next
02-Jun-2014 15:18:11.951 client: debug 10: client 192.168.56.1#51786: ns_client_detach: ref = 0
02-Jun-2014 15:18:11.951 client: debug 3: client 192.168.56.1#51786: endrequest
02-Jun-2014 15:18:11.951 client: debug 3: client @0xb537e008: udprecv

Além disso, fiz algumas alterações na seção de log no named.conf.

O resolv.conf do host:

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 192.168.56.101
#nameserver 127.0.1.1
    
por Quan Tran 02.06.2014 / 09:18

1 resposta

1

O problema é, na verdade, a configuração de permissão dos arquivos. Aqui está o conteúdo da pasta / var / named:

[root@localhost quan]# ls -alZ /var/named/
drwxr-x---. root  named system_u:object_r:named_zone_t:s0 .
drwxr-xr-x. root  root  system_u:object_r:var_t:s0       ..
drwxrwx---. named named system_u:object_r:named_cache_t:s0 data
drwxrwx---. named named system_u:object_r:named_cache_t:s0 dynamic
-rw-r-----. root  root  unconfined_u:object_r:named_zone_t:s0 named.192.168.56
-rw-r-----. root  named system_u:object_r:named_conf_t:s0 named.ca
-rw-r-----. root  named system_u:object_r:named_zone_t:s0 named.empty
-rw-r-----. root  named system_u:object_r:named_zone_t:s0 named.localhost
-rw-r-----. root  named system_u:object_r:named_zone_t:s0 named.loopback
-rw-r--r--. root  root  unconfined_u:object_r:named_zone_t:s0 named.quantran.com
drwxrwx---. named named system_u:object_r:named_cache_t:s0 slaves

Como você pode ver, o arquivo named.quantran.com é chmod 644 e pode ser lido pelo usuário chamado. No entanto, o named.192.168.56 (o arquivo de configuração da zona reversa) é chmod 640 e não pode ser lido pelo usuário nomeado. Portanto, não consegui executar uma pesquisa inversa com êxito. Ainda assim, não consigo entender por que foi chmod 640 enquanto o named.quantran.com era chmod 644 @@

    
por 02.06.2014 / 18:50