Skip to main content

PowerDNS 架設 - Debian

  BUBU 因之前都是用 CentOS7 版本架設,但因 CentOS 系列已經沒有下個版本了,剛好 BUBU 現在目前的站台的服務都是用 Debian 系統來運行服務為主,因此此篇會重新改寫成 Debian 的操作流程。

運行環境


  環境都是在 「Proxmox VE 」 虛擬系統上架設,都是以 「 LXC 」模式為主,除非有特殊狀況會告知使用 「 VM 」 模式

  • 系統環境: Debian 10
  • Web 服務: Nginx 1.20
  • 資料庫服務: MariaDB 10.6

資料庫


  • BUBU 是採用 MariaDB 10.6 版本,來進行安裝,新增加來源庫
sudo apt-get install software-properties-common dirmngr -y
sudo apt-key adv --fetch-keys 'https://mariadb.org/mariadb_release_signing_key.asc'
sudo add-apt-repository 'deb [arch=amd64,arm64,ppc64el] https://tw1.mirror.blendbyte.net/mariadb/repo/10.6/debian buster main'
  • 安裝資料庫
sudo apt update
sudo apt install mariadb-server
  • 啟動資料庫並設定開始時自動啟動
systemctl restart mariadb ; systemctl enable mariadb
  • 資料庫基本設定,那在 MariaDB 10.5 以上版本官方已經改用 mariadb-secure-installation 那 MariaDB 10.4 以下還是可以用 mysql_secure_installation 來執行, MaridDB 官方說明
mariadb-secure-installation  # 設定資料庫的root密碼

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user. If you've just installed MariaDB, and
haven't set the root password yet, you should just press enter here.

Enter current password for root (enter for none):
OK, successfully used password, moving on...

Setting the root password or using the unix_socket ensures that nobody
can log into the MariaDB root user without the proper authorisation.

You already have your root account protected, so you can safely answer 'n'.

Switch to unix_socket authentication [Y/n]
Enabled successfully!
Reloading privilege tables..
 ... Success!


You already have your root account protected, so you can safely answer 'n'.

Change the root password? [Y/n]
New password:					輸入 root 的密碼
Re-enter new password:				再次確認 root 的密碼
Password updated successfully!
Reloading privilege tables..
 ... Success!


By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n]
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n]
 ... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n]
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n]
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

  • 設定 PowerDNS 資料庫權限
mysql -u root -p   # 登入資料庫裡設定資表及權限

CREATE DATABASE powerdns CHARACTER SET utf8 COLLATE utf8_general_ci;

GRANT ALL ON powerdns.* TO 'powerdns'@'localhost' IDENTIFIED BY 'powerdns-password';

FLUSH PRIVILEGES;

增加 PowerDNS 必要的表單及欄位


官方 GitHub 有提供 .sql 資料表 官方載點

USE powerdns; #切換到 powerdns 資料表

CREATE TABLE domains (
  id                    INT AUTO_INCREMENT,
  name                  VARCHAR(255) NOT NULL,
  master                VARCHAR(128) DEFAULT NULL,
  last_check            INT DEFAULT NULL,
  type                  VARCHAR(6) NOT NULL,
  notified_serial       INT UNSIGNED DEFAULT NULL,
  account               VARCHAR(40) CHARACTER SET 'utf8' DEFAULT NULL,
  PRIMARY KEY (id)
) Engine=InnoDB CHARACTER SET 'latin1';

CREATE UNIQUE INDEX name_index ON domains(name);


CREATE TABLE records (
  id                    BIGINT AUTO_INCREMENT,
  domain_id             INT DEFAULT NULL,
  name                  VARCHAR(255) DEFAULT NULL,
  type                  VARCHAR(10) DEFAULT NULL,
  content               VARCHAR(64000) DEFAULT NULL,
  ttl                   INT DEFAULT NULL,
  prio                  INT DEFAULT NULL,
  disabled              TINYINT(1) DEFAULT 0,
  ordername             VARCHAR(255) BINARY DEFAULT NULL,
  auth                  TINYINT(1) DEFAULT 1,
  PRIMARY KEY (id)
) Engine=InnoDB CHARACTER SET 'latin1';

CREATE INDEX nametype_index ON records(name,type);
CREATE INDEX domain_id ON records(domain_id);
CREATE INDEX ordername ON records (ordername);


CREATE TABLE supermasters (
  ip                    VARCHAR(64) NOT NULL,
  nameserver            VARCHAR(255) NOT NULL,
  account               VARCHAR(40) CHARACTER SET 'utf8' NOT NULL,
  PRIMARY KEY (ip, nameserver)
) Engine=InnoDB CHARACTER SET 'latin1';


CREATE TABLE comments (
  id                    INT AUTO_INCREMENT,
  domain_id             INT NOT NULL,
  name                  VARCHAR(255) NOT NULL,
  type                  VARCHAR(10) NOT NULL,
  modified_at           INT NOT NULL,
  account               VARCHAR(40) CHARACTER SET 'utf8' DEFAULT NULL,
  comment               TEXT CHARACTER SET 'utf8' NOT NULL,
  PRIMARY KEY (id)
) Engine=InnoDB CHARACTER SET 'latin1';

CREATE INDEX comments_name_type_idx ON comments (name, type);
CREATE INDEX comments_order_idx ON comments (domain_id, modified_at);


CREATE TABLE domainmetadata (
  id                    INT AUTO_INCREMENT,
  domain_id             INT NOT NULL,
  kind                  VARCHAR(32),
  content               TEXT,
  PRIMARY KEY (id)
) Engine=InnoDB CHARACTER SET 'latin1';

CREATE INDEX domainmetadata_idx ON domainmetadata (domain_id, kind);


CREATE TABLE cryptokeys (
  id                    INT AUTO_INCREMENT,
  domain_id             INT NOT NULL,
  flags                 INT NOT NULL,
  active                BOOL,
  published             BOOL DEFAULT 1,
  content               TEXT,
  PRIMARY KEY(id)
) Engine=InnoDB CHARACTER SET 'latin1';

CREATE INDEX domainidindex ON cryptokeys(domain_id);


CREATE TABLE tsigkeys (
  id                    INT AUTO_INCREMENT,
  name                  VARCHAR(255),
  algorithm             VARCHAR(50),
  secret                VARCHAR(255),
  PRIMARY KEY (id)
) Engine=InnoDB CHARACTER SET 'latin1';

CREATE UNIQUE INDEX namealgoindex ON tsigkeys(name, algorithm);

開始安裝 PowerDNS 服務


官方各系統的 套件載點 BUBU 是使用 Debian 系統為服務,當下安裝的版本為 PowerDNS 主流的來源庫

  • 新增加來源庫 vim /etc/apt/sources.list.d/pdns.list
# PowerDNS Authoritative Server - master branch
deb [arch=amd64] http://repo.powerdns.com/debian buster-auth-master main

# PowerDNS Recursor - master branch
deb [arch=amd64] http://repo.powerdns.com/debian buster-rec-master main
  • 新增加 vim /etc/apt/preferences.d/pdns
Package: pdns-*
Pin: origin repo.powerdns.com
Pin-Priority: 600
  • 新增加 PowerDNS 來源庫的金鑰
curl https://repo.powerdns.com/CBC8B383-pub.asc | sudo apt-key add - &&
sudo apt-get update


安裝完成之後系統會自動啟動各服務,啟動 PowerDNS Server 及 PowerDNS Recursor 啟動會失敗,因為兩個服務都在搶 Port 的關係造成的,所以等一下修改好服務的設定檔就可以正常啟用服務了。



在安裝 PowerDNS 服務之前要先把系統本的 systemd-resolved 這個服務先停用,因為此服務會跟 PowerDNS Recursor 反解服務 Port 會互搶

sudo systemctl disable systemd-resolved
sudo systemctl stop systemd-resolved
  • 在安裝 PowerDNS 服務之前要先處理反解服務,所以我們要先安裝 PowerDNS Recursor 服務
PowerDNS Recursor - master branch

sudo apt-get install pdns-recursor -y
PowerDNS Recursor 設定檔 這是負責遞迥查詢服務

  • 備份預設檔,建立新的設定檔
mv /etc/powerdns/recursor.conf /etc/powerdns/recursor.conf.bak
vim /etc/powerdns/recursor.conf
  • 以下是我比較會異動到的設定檔,如果還要增加設定,請參考預設檔複製過來即可
#################################
# allow-from	If set, only allow these comma separated netmasks to recurse
#
# allow-from=127.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 169.254.0.0/16, 192.168.0.0/16, 172.16.0.0/12, ::1/128, fc00::/7, fe80::/10
allow-from=127.0.0.1, 192.168.0.0/24  #設定允許遞迥查詢內部網段

#################################
# forward-zones	Zones for which we forward queries, comma separated domain=ip pairs
#
# forward-zones=
forward-zones=.=127.0.0.1:54  #轉送查詢的網域與伺服器,格式是 網域=伺服器ip,多個網域以逗點分隔

#################################
# forward-zones-recurse Zones for which we forward queries with recursion bit, comma separated domain=ip pairs
#
# forward-zones-recurse=
forward-zones-recurse=.=8.8.8.8, .=168.95.1.1 #內部查詢不到會查到外部查詢

#################################
# local-address	IP addresses to listen on, separated by spaces or commas. Also accepts ports.
#
# local-address=127.0.0.1
local-address=0.0.0.0

#################################
# local-port	port to listen on
#
# local-port=53
local-port=53

#################################
# logging-facility      Facility to log messages as. 0 corresponds to local0
#
# logging-facility=
logging-facility=0

#################################
# max-negative-ttl      maximum number of seconds to keep a negative cached entry in memory
#
# max-negative-ttl=3600
max-negative-ttl=3600

#################################
# setgid        If set, change group id to this gid for more security
#
setgid=pdns

#################################
# setuid        If set, change user id to this uid for more security
#
setuid=pdns

#################################
# config-dir	Location of configuration directory (recursor.conf)
#
config-dir=/etc/powerdns

#################################
# hint-file	If set, load root hints from this file
#
# hint-file=
hint-file=/usr/share/dns/root.hints

#################################
# include-dir	Include *.conf files from this directory
#
# include-dir=
include-dir=/etc/powerdns/recursor.d

#################################
# lua-config-file	More powerful configuration options
#
lua-config-file=/etc/powerdns/recursor.lua

#################################
# quiet	Suppress logging of questions and answers
#
quiet=yes
  • 設定自動啟動及重啟 PowerDNS-Recursor 服務
systemctl start pdns-recursor ; systemctl enable pdns-recursor
PowerDNS Authoritative Server - master branch

sudo apt-get install pdns-server pdns-backend-mysql -y
  • 服務都安裝完之後開始設定兩個設定檔
PowerDNS 設定檔(Master)

  • 備份預設檔,建立新的設定檔
mv /etc/powerdns/pdns.conf /etc/powerdns/pdns.conf.bak
vim /etc/powerdns/pdns.conf
  • 以下是我比較會異動到的設定檔,如果還要增加設定,請參考預設檔複製過來即可
#################################
# api	Enable/disable the REST API (including HTTP listener)
#
# api=no
api=yes

#################################
# api-key	Static pre-shared authentication key for access to the REST API
#
# api-key=
api-key=自行定義密碼

#################################
# daemon	Operate as a daemon
#
daemon=yes

#################################
# guardian	Run within a guardian process
#
guardian=no

#################################
# include-dir	Include *.conf files from this directory
#
# include-dir=
include-dir=/etc/powerdns/pdns.d

#################################
# launch	Which backends to launch and order to query them in
#
# launch=\nlaunch=
#
launch=gmysql
gmysql-host=localhost
gmysql-user=powerdns
gmysql-password=powerdns-password
gmysql-dbname=powerdns
gmysql-dnssec=yes

#################################
# local-address	Local IP addresses to which we bind
#
# local-address=0.0.0.0
local-address=0.0.0.0

#################################
# local-port	The port on which we listen
#
# local-port=53
local-port=54

#################################
# log-dns-details	If PDNS should log DNS non-erroneous details
#
# log-dns-details=no
log-dns-details=yes

#################################
# log-dns-queries	If PDNS should log all incoming DNS queries
#
# log-dns-queries=no
log-dns-queries=yes

#################################
# log-timestamp	Print timestamps in log lines
#
# log-timestamp=yes
log-timestamp=yes

#################################
# logging-facility      Facility to log messages as. 0 corresponds to local0
#
# logging-facility=
logging-facility=0

#################################
# loglevel	Amount of logging. Higher is more. Do not set below 3
#
# loglevel=4
loglevel=4

#################################
# master        Act as a master
#
# master=no
master=yes

#################################
# setgid        If set, change group id to this gid for more security
#
setgid=pdns

#################################
# setuid        If set, change user id to this uid for more security
#
setuid=pdns

#################################
# webserver	Start a webserver for monitoring (api=yes also enables the HTTP listener)
#
# webserver=no
webserver=yes

#################################
# webserver-address	IP Address of webserver/API to listen on
#
# webserver-address=127.0.0.1
webserver-address=0.0.0.0

#################################
# webserver-port	Port of webserver/API to listen on
#
# webserver-port=8081
webserver-port=8081

#################################
# webserver-allow-from	Webserver/API access is only allowed from these subnets
#
# webserver-allow-from=127.0.0.1,::1
webserver-allow-from=0.0.0.0/0

#################################
# query-logging Hint backends that queries should be logged
#
# query-logging=no
query-logging=yes
  • 設定自動啟動及重啟 PowerDNS 服務
systemctl enable pdns ; systemctl restart  pdns

PowerDNS 設定檔 (Slave)

  • 備份預設檔,建立新的設定檔
mv /etc/powerdns/pdns.conf /etc/powerdns/pdns.conf.bak
vim /etc/powerdns/pdns.conf
  • 以下是我比較會異動到的設定檔,如果還要增加設定,請參考預設檔複製過來即可
#################################
# api	Enable/disable the REST API (including HTTP listener)
#
# api=no
api=yes

#################################
# api-key	Static pre-shared authentication key for access to the REST API
#
# api-key=
api-key=自行定義密碼

#################################
# daemon	Operate as a daemon
#
daemon=yes

#################################
# guardian	Run within a guardian process
#
guardian=no

#################################
# launch	Which backends to launch and order to query them in
#
# launch=\nlaunch=
#
launch=gmysql
gmysql-host=localhost
gmysql-user=powerdns
gmysql-password=powerdns-password
gmysql-dbname=powerdns
gmysql-dnssec=yes

#################################
# local-address	Local IP addresses to which we bind
#
# local-address=0.0.0.0
local-address=0.0.0.0

#################################
# local-port	The port on which we listen
#
# local-port=53
local-port=54

#################################
# log-dns-details	If PDNS should log DNS non-erroneous details
#
# log-dns-details=no
log-dns-details=yes

#################################
# log-dns-queries	If PDNS should log all incoming DNS queries
#
# log-dns-queries=no
log-dns-queries=yes

#################################
# log-timestamp	Print timestamps in log lines
#
# log-timestamp=yes
log-timestamp=yes

#################################
# logging-facility      Facility to log messages as. 0 corresponds to local0
#
# logging-facility=
logging-facility=0

#################################
# loglevel	Amount of logging. Higher is more. Do not set below 3
#
# loglevel=4
loglevel=4

#################################
# slave Act as a slave
#
# slave=no
slave=yes

#################################
# slave-cycle-interval  Schedule slave freshness checks once every .. seconds
#
# slave-cycle-interval=60
slave-cycle-interval=60

#################################
# setgid        If set, change group id to this gid for more security
#
setgid=pdns

#################################
# setuid        If set, change user id to this uid for more security
#
setuid=pdns

#################################
# webserver	Start a webserver for monitoring (api=yes also enables the HTTP listener)
#
# webserver=no
webserver=yes

#################################
# query-logging Hint backends that queries should be logged
#
# query-logging=no
query-logging=yes

#################################
# webserver-address	IP Address of webserver/API to listen on
#
# webserver-address=127.0.0.1
webserver-address=0.0.0.0

#################################
# webserver-port	Port of webserver/API to listen on
#
# webserver-port=8081
webserver-port=8081

#################################
# webserver-allow-from	Webserver/API access is only allowed from these subnets
#
# webserver-allow-from=127.0.0.1,::1
webserver-allow-from=0.0.0.0/0
  • 設定自動啟動及重啟 PowerDNS 服務
systemctl enable pdns.service ; systemctl restart  pdns.service

PowerDNS-Admin 服務設定


  • 安裝 Python 開發包
sudo apt install python3-dev -y

  • 安裝 requirements.txt 構建 Pythone 套件
sudo apt install -y libmariadb-dev libsasl2-dev libldap2-dev libssl-dev libxml2-dev libxslt1-dev libxmlsec1-dev libffi-dev pkg-config apt-transport-https virtualenv build-essential python3-venv

因官方是使用 MySql 服務,所以有說明套件 libmysqlclient-dev 會因您使用的資料庫服務會不一樣這點要注意一下。那本篇所使用的資料是 MariadDB 所以是改用資料庫的專屬套件

  • 安裝 Nodejs
curl -sL https://deb.nodesource.com/setup_14.x | bash -
apt install -y nodejs
  • 安裝 Yarn
curl -sL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor | sudo tee /usr/share/keyrings/yarnkey.gpg >/dev/null
echo "deb [signed-by=/usr/share/keyrings/yarnkey.gpg] https://dl.yarnpkg.com/debian stable main" | sudo tee /etc/apt/sources.list.d/yarn.list
sudo apt-get update && sudo apt-get install yarn -y

安裝 PowerDNS-Admin


  • 設定 PowerDNS 的 API
api=yes
api-key=your-powerdns-api-key
webserver=yes
  • PowerDNS-Admin 建立資料庫
CREATE DATABASE powerdnsadmin CHARACTER SET utf8 COLLATE utf8_general_ci;
GRANT ALL PRIVILEGES ON powerdnsadmin.* TO 'pdnsadminuser'@'%' IDENTIFIED BY 'p4ssw0rd';
FLUSH PRIVILEGES;
quit;
  • 安裝 PowerDNS-Admin
git clone https://github.com/ngoduykhanh/PowerDNS-Admin.git /opt/web/powerdns-admin
cd /opt/web/powerdns-admin
python3 -mvenv ./venv
  • 在執行 python3 -mvenv ./venv 這一行指令會報出需要額外安裝 python3-venv 訊息如下
The virtual environment was not created successfully because ensurepip is not
available.  On Debian/Ubuntu systems, you need to install the python3-venv
package using the following command.

    apt-get install python3-venv

You may need to use sudo with that command.  After installing the python3-venv
package, recreate your virtual environment.

Failing command: ['/opt/web/powerdns-admin/venv/bin/python3', '-Im', 'ensurepip', '--upgrade', '--default-pip']

  • 安裝 python3-venv
apt-get install python3-venv -y
  • 進入 Python 模式並且開始安裝
source ./venv/bin/activate
pip install --upgrade pip
pip install -r requirements.txt
  • 安裝完之後設定 PowerDNS-Admin 設定檔
vim /opt/web/powerdns-admin/powerdnsadmin/default_config.py
  • 修改設定檔如下
SECRET_KEY = 'We are the world' 在瀏覽器中對cookie進行簽名
BIND_ADDRESS = '127.0.0.1' 修改成 0.0.0.0 允許所有可以連線
PORT = 9191

SQLA_DB_USER = 'pdnsadminuser'
SQLA_DB_PASSWORD = 'powerdns-password'
SQLA_DB_HOST = '127.0.0.1'
SQLA_DB_PORT = 3306
SQLA_DB_NAME = 'powerdnsadmin'
SQLALCHEMY_TRACK_MODIFICATIONS = True

設定完存檔,並且開始安裝服務

  • 運行下面指令自動建立 PowerDNS-Admin 資料庫裡的表單及欄位
export FLASK_APP=powerdnsadmin/__init__.py
flask db upgrade
  • 產生資料檔
yarn install --pure-lockfile
flask assets build
  • 運行 PowerDNS-Admin 服務
./run.py
  • 安裝完之後開始瀏灠器輸入 http://dns主機ip:9191 如果看到登入畫面表示您已安裝成功了可以使用了

dns-1.png

  • 剛安裝完成官方並沒有預計任何的帳號,所以需要手動自行去建立帳號跟密碼輸入完之後就可以登入了

dns-2.png

  • 登入後會看到此頁面,要開輸入跟 PowerDNS 連接的 API

    • API :http://127.0.0.1:8081
    • API-kye:輸入當時所設定的密碼
    • PDNS:輸入當時安裝的版本
    • PowerDNS 版本查詢: pdns_control version
  • 設定完之後按下 Update 就可以了

dns-3.png

  • 如果設定成功的話在 PDNS 選項裡面就可以看到 PDNS 目前設定狀況,如圖下

DNS7.png

  • 如果設定失敗的話,有可能是 api 的資訊有誤,跟版本或者密碼輸入有訊,如圖下是失敗的畫面,沒有連線成功的話後面新增網域的設定會有問題的。

DNS6.png

  • 再來進到設定裡面把預設可以讓使用者註冊給取消掉,把 Allow users to sign up 這個打勾給拿掉就可以了

dns-4.png

  • 離開 Python 虛擬環境
deactivate

但是這樣子使用上並不方便,服務都需要手動去啟用,所以官方建議還需要寫個服務來啟用,並且搭配網頁服務來使用。

  • 新增 powerdns-admin 服務設定檔 vim /etc/systemd/system/powerdns-admin.service
[Unit]
Description=PowerDNS-Admin
Requires=powerdns-admin.socket
After=network.target

[Service]
PIDFile=/run/powerdns-admin/pid
User=pdns
Group=pdns
WorkingDirectory=/opt/web/powerdns-admin
ExecStart=/opt/web/powerdns-admin/venv/bin/gunicorn --pid /run/powerdns-admin/pid --bind unix:/run/powerdns-admin/socket 'powerdnsadmin:create_app()'
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s TERM $MAINPID
PrivateTmp=true

[Install]
WantedBy=multi-user.target
  • 新增 powerdns-admin.socket 設定檔 vim /etc/systemd/system/powerdns-admin.socket
[Unit]
Description=PowerDNS-Admin socket

[Socket]
ListenStream=/run/powerdns-admin/socket

[Install]
WantedBy=sockets.target
  • 新增 powerdns-admin.conf 設定檔 vim /etc/tmpfiles.d/powerdns-admin.conf
d /run/powerdns-admin 0755 pdns pdns -
  • 啟動服務
sudo systemctl daemon-reload
sudo systemctl restart powerdns-admin
sudo systemctl enable powerdns-admin
  • 修改 powerdns-admin 目錄權限
sudo chown -R pdns:pdns /run/powerdns-admin
sudo chown -R pdns:pdns /opt/web/powerdns-admin
sudo systemctl restart powerdns-admin

web服務


  • 安裝 nginx 服務
# 安裝必要套件
sudo apt install curl gnupg2 ca-certificates lsb-release -y

# 想要使用的版本請自己選擇
# 來源庫新增加穩定版 nginx 服務
echo "deb http://nginx.org/packages/debian `lsb_release -cs` nginx" \
    | sudo tee /etc/apt/sources.list.d/nginx.list

# 導入官方金鑰來確認該套件安全性
curl -fsSL https://nginx.org/keys/nginx_signing.key | sudo apt-key add -

# 驗證現在的金鑰是否正確
sudo apt-key fingerprint ABF5BD827BD9BF62

# 輸出的指紋如下 573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62
pub   rsa2048 2011-08-19 [SC] [expires: 2024-06-14]
      573B FD6B 3D8F BC64 1079  A6AB ABF5 BD82 7BD9 BF62
uid   [ unknown] nginx signing key <[email protected]>

# 安裝 nginx 服務
sudo apt update
sudo apt install nginx -y

# 啟動及自動啟動服務
systemctl start nginx ; systemctl enable nginx
  • Nginx 設定檔
server {
  listen *:80;
  server_name               powerdns-admin.local www.powerdns-admin.local;

  index                     index.html index.htm index.php;
  root                      /opt/web/powerdns-admin;
  access_log                /var/log/nginx/powerdns-admin.local.access.log combined;
  error_log                 /var/log/nginx/powerdns-admin.local.error.log;

  client_max_body_size              10m;
  client_body_buffer_size           128k;
  proxy_redirect                    off;
  proxy_connect_timeout             90;
  proxy_send_timeout                90;
  proxy_read_timeout                90;
  proxy_buffers                     32 4k;
  proxy_buffer_size                 8k;
  proxy_set_header                  Host $host;
  proxy_set_header                  X-Real-IP $remote_addr;
  proxy_set_header                  X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_headers_hash_bucket_size    64;

  location ~ ^/static/  {
    include  /etc/nginx/mime.types;
    root /opt/web/powerdns-admin/powerdnsadmin;

    location ~*  \.(jpg|jpeg|png|gif)$ {
      expires 365d;
    }

    location ~* ^.+.(css|js)$ {
      expires 7d;
    }
  }

  location / {
    proxy_pass            http://unix:/run/powerdns-admin/socket;
    proxy_read_timeout    120;
    proxy_connect_timeout 120;
    proxy_redirect        off;
  }

}

PowerDNS Log 記錄


因官方預設是關閉的,所要手動去啟用

systemctl edit --full pdns

看到 ExecStart 這一行將裡面的 --disable-syslog 刪除掉

去到 vim /etc/rsyslog.conf 增加給 PowerDNS 使用
local0.info                       -/var/log/pdns.info
local0.warn                       -/var/log/pdns.warn
local0.err                        /var/log/pdns.err

再去將 pdns.conf 及 recursor.conf 這兩個設定檔
修變這一行 logging-facility=0

以上修改完之後整個系統都重啟,就可以在 log 資料夾裡面看到這三個檔案

PowerDNS 支援 Active Directory 網域服務


PowerDNS 有支援動態更新 DNS 服務,在建置 AD 服務可以考慮將 DNS 設定指向 PowerDNS 服務來使用,修改 PowerDNS 配置文件使其支持动态更新。

vim /etc/pdns/pdns.conf

################################
# allow-dnsupdate-from  A global setting to allow DNS updates from these IP ranges.
#
# allow-dnsupdate-from=127.0.0.0/8,::1
allow-dnsupdate-from=127.0.0.0/8

#################################
# dnsupdate     Enable/Disable DNS update (RFC2136) support. Default is no.
#
# dnsupdate=no
dnsupdate=yes
  • 添加修改解析記錄
@	SOA	Active	3600	ns.adtest.com. ns.adtest.com. 2017112802 10800 3600 604800 3600 
_kerberos._tcp	SRV	Active	3600	0 0 88 ad.adtest.com. 
_kerberos._tcp.dc._msdcs	SRV	Active	3600	0 0 88 ad.adtest.com. 
_ldap._tcp	SRV	Active	3600	0 0 389 ad.adtest.com. 
_ldap._tcp.dc._msdcs	SRV	Active	3600	0 0 389 ad.adtest.com. 
ad	A	Active	3600	192.168.50.207 
ns	A	Active	3600	192.168.50.237
  • PowerDNS-Admin 允許通過 DynDNS 更新需創建記錄域名面板中,進入需要修改的域名 Admin 設定,在 DynDNS 2 Settings 勾選 Allow on-demand creation of records via DynDNS updates?

更新 PowerDNS-Admin


  • 先備份整個 powerdns-admin 整個目錄,備份完之後再重新安裝一次流程

  • 下載新版的 powerdns-admin

git clone https://github.com/ngoduykhanh/PowerDNS-Admin.git /opt/web/powerdns-admin
cd /opt/web/powerdns-admin
python3 -mvenv ./venv
  • 進入 Python 模式並重新安裝
source ./venv/bin/activate
pip install --upgrade pip
pip install -r requirements.txt
  • 再從備份檔裡面的還原 default_config.py 這個設定檔,還原前先把原本的設定檔先備份起來再還原

  • 還原完之後繼續執行

export FLASK_APP=powerdnsadmin/__init__.py
flask db upgrade
  • 產生資料檔
yarn install --pure-lockfile
flask assets build
  • 確認沒有問題再將該目錄的權限修改
chown -R pdns:pdns powerdns-admin
  • 重啟服務
systemctl restart powerdns-admin



參考相關網頁