使用 PowerDNS 轻松配置 DNS 名称服务器
DNS

> 
> 使用 PDNS 为你的项目提供稳定可靠的域名系统（DNS）服务器。
> 
> 
> 


![](/data/attachment/album/202008/07/202953copoqjmkefkdf3j4.jpg)


几个月前，我们接到了一个要求，为一个新项目提供一个稳定可靠的域名系统（[DNS](https://en.wikipedia.org/wiki/Domain_Name_System)）服务器。该项目使用容器进行自动部署，每个新环境都会生成唯一的随机 URL。在对可能的方案进行了大量研究之后，我们决定尝试一下 [PowerDNS](https://www.powerdns.com/opensource.html)（PDNS）。


一开始，我们发现 PowerDNS 在所有主流 Linux 发行版中都得到了支持，它采用 GPL 许可，且仓库保持更新。我们还在官方网站上发现了整洁、组织良好的[文档](https://doc.powerdns.com/)，以及大量来自真正喜欢和使用该产品的人在网络上的使用方法。看了一些并学习了一些基本命令之后，安装了 PDNS，启动并运行，我们的旅程开始了。


### 数据库驱动


PowerDNS 将记录保存在 SQL 数据库中。这对我们来说是新变化，不必使用文本文件来保存记录是一个不错的更改。我们选择 MariaDB 作为首选的强大工具，由于有大量的正确地设置来安装名称服务器的信息，我们可以完美地设置和加固我们的数据库。


### 简单配置


其次使我们感兴趣的是 PDNS 的所有功能都在配置文件中。`pdns.conf` 有许多选项，你可以通过添加或删除 `＃` 号来启用或禁用这些选项。这真是太神奇了，因为它使我们有机会将这项新的服务集成到我们现有的基础架构中，并且只有我们想要的功能，不多也不少。一个简单的例子：


谁可以访问你的网络服务器？



```
webserver-allow-from=172.10.0.1,172.10.1.2

```

我可以转发基于域的请求吗？当然！



```
forward-zones=mylocal.io=127.0.0.1:5300
forward-zones+=example.com=172.10.0.5:53
forward-zones+=lucky.tech=172.10.1.5:53

```

### 包含 API


我们可以使用配置文件进行激活 API 服务，解决了我们开发团队的第一个需求，让我们见识到了 PDNS 的强大。这个功能让我们通过发送请求，简单、干净地创建、修改或删除 DNS 服务器中的记录。


这个 API 有一些基本的安全性参数，因此，只需几步，你就可以基于 IP 地址和预共享密钥验证的组合来控制谁有权与名称服务器进行交互。这是配置文件的样子：



```
api=yes
api-key=lkjdsfpoiernf
webserver-allow-from=172.10.7.13,172.10.7.5

```

### 日志


在日志方面，PDNS 做得非常出色。你可以使用日志文件和一个简单的内置 Web 服务器来监控服务器并查看计算机的运行状况。你可以使用浏览器查看服务器不同类型的统计信息，例如 CPU 使用率和收到的 DNS 查询。这非常有价值。例如，我们能够检测到一些“不太健康”的 PC，它们正在向我们的服务器发送与恶意流量相关的站点的 DNS 请求。深入查看日志后，我们可以看到流量来自何处，并对这些 PC 进行清理操作。


### 其他功能


这只是你使用 PowerDNS 可以做的所有事情的一点点。它还有更多的功能。它是一个拥有很多功能和特性的完整名称服务器，因此值得一试。


目前，我们尚未部署 [DNSSEC](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions)，但似乎只需点击一下即可将其快速投入生产环境。另外，在将递归服务与名称服务器分离时，PowerDNS 有个不错的方法。我了解到它还支持 [DNS RPZ](https://dnsrpz.info/)（响应策略区域），并且还提供了非常不错且设计良好的前端，可让你使用 Web 浏览器来管理服务器，如下图。


![PowerDNS frontend](/data/attachment/album/202008/07/203202ldbrrdd6sabdar0d.jpg "PowerDNS frontend")


信不信由你，你只需花费几个小时了解 PDNS，就可以大大提高你对 DNS 和 IT 操作的了解。




---


via: <https://opensource.com/article/20/5/powerdns>


作者：[Jonathan Garrido](https://opensource.com/users/jgarrido) 选题：[lujun9972](https://github.com/lujun9972) 译者：[geekpi](https://github.com/geekpi) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
A few months ago, we got a requirement to provide a stable and reliable Domain Name System ([DNS](https://en.wikipedia.org/wiki/Domain_Name_System)) server for a new project. The project dealt with auto-deployment using containers and where each new environment would generate a unique, random URL. After a lot of research on possible solutions, we decided to give [PowerDNS](https://www.powerdns.com/opensource.html) (PDNS) a try.

At the outset, we discovered that PowerDNS is supported in all major Linux distros, is available under the GPL license, and keeps its repositories up to date. We also found neat and well-organized [documentation](https://doc.powerdns.com/) on the official site and tons of how-to's around the web from people who really like and use the product. After reading a few pages and learning some basic commands, PDNS was installed, up, and running, and our journey began.

## Database-driven


PowerDNS keeps its records in a SQL database. This was new for us, and not having to use flat files to keep records was a good change. We picked MariaDB as our power tool of choice, and since there is tons of advance information about the proper settings for installing the nameserver, we could set up and harden our database flawlessly.

## Easy configuration

The second thing that engaged us was all the features PDNS has in its config file. This file, pdns.conf, has a lot of options that you can enable or disable just by adding or removing the # sign. This was truly amazing because it gave us the chance to integrate this new service into our current infrastructure with only the values that we want, no more, no less, just the features that we need. A quick example:

Who can access your webserver?

`webserver-allow-from=172.10.0.1,172.10.1.2`


Can I forward requests based in a domain? Sure!

```
forward-zones=mylocal.io=127.0.0.1:5300
forward-zones+=example.com=172.10.0.5:53
forward-zones+=lucky.tech=172.10.1.5:53
```


## API included

We could activate using this config file, and this is when we started to meet PDNS's "power" by solving the first request from our development team, the API service. This feature gave us the ability to send requests to simply and cleanly create, modify, or remove records in our DNS server.

This API has some basic security parameters, so in just a few steps, you can control who has the right to interact with the nameserver based on a combination of an IP address and a pre-share key as a way of authentication. Here's what the configuration for this looks like:

```
api=yes
api-key=lkjdsfpoiernf
webserver-allow-from=172.10.7.13,172.10.7.5
```


## Logging

PDNS does an extraordinary job when it comes to logging. You can monitor your server and see how the machine is doing by using the log files and a simple built-in web server. Using a browser, you can see different types of statistics from the machine, like CPU usage and the DNS queries received. This is very valuable—for example, we were able to detect a few "not-so-healthy" PCs that were sending DNS requests to our server looking for sites that are related to malicious traffic. After digging into the logs, we could see where traffic was coming from and do a clean operation on those PCs.

## Other features

This is only a glimpse of all the things you can do with PowerDNS; there is much more to it. It is a complete nameserver with a lot of features and functionalities that make it worth giving it a try.

At this moment, we are not implementing [DNSSEC](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions), but it appears that it can be put into production quickly with just one click. Also, PowerDNS has a nice approach when it comes to separating the recursor service from the nameserver. I read that it also supports [DNS RPZ](https://dnsrpz.info/) (Response Policy Zones), and there are also some very nice and well-designed frontends available that let you manage your server using a simple web browser, like the one in the image below.

![PowerDNS frontend PowerDNS frontend](https://opensource.com/sites/default/files/uploads/pdns.jpg)

(PowerDNS documentation, MIT License)

Believe it or not, you can boost your knowledge about DNS and IT ops a lot just by expending a few hours "playing" with PDNS.

## 1 Comment