public subnet에 인스턴스 생성
•
보안그룹에 TCP, UDP All any open 으로 열어주기
Userdata
sudo yum update -y
sudo yum install -y bind bind-utils
Shell
복사
sudo vim /etc/named.conf
Shell
복사
파일 내용 아래처럼 수정
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
listen-on port 53 { any; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
allow-query { any; };
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;
dnssec-validation yes;
managed-keys-directory "/var/named/dynamic";
geoip-directory "/usr/share/GeoIP";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
/* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
include "/etc/crypto-policies/back-ends/bind.config";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
zone "worldskills.site" IN {
type master;
file "/var/named/worldskills.site.zone";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
JSON
복사
sudo su
Shell
복사
sudo cat << 'EOF' > /var/named/worldskills.site.zone
$TTL 86400
@ IN SOA ns1.worldskills.site. root.worldskills.site. (
2024031401 ; Serial
3600 ; Refresh
1800 ; Retry
1209600 ; Expire
86400 ) ; Minimum TTL
@ IN NS ns1.worldskills.site.
ns1 IN A PRIVATE_IP
q1 IN A 172.16.0.10
EOF
Shell
복사
TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"`
PRIVATE_IP=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/local-ipv4)
Shell
복사
sed -i "s|PRIVATE_IP|$PRIVATE_IP|g" /var/named/worldskills.site.zone
Shell
복사
•
bind9 실행 및 running 상태 확인
sudo systemctl enable --now named
sudo systemctl status named
Shell
복사