콘텐츠로 이동
1337skills 1337skills - 치트시트

DNS 관리 치트 시트

개요

DNS 관리는 도메인 이름 시스템 인프라의 관리, 구성 및 유지 보수를 포함합니다. 이 치트 시트는 다양한 플랫폼과 환경에서 DNS 서버, 영역 및 레코드를 관리하기 위한 필수 명령 및 절차를 다룹니다.

⚠️ 경고: DNS 변경은 네트워크 연결 및 서비스 가용성에 영향을 줄 수 있습니다. 항상 비운영 환경에서 변경 사항을 테스트하고 변경 관리 절차를 따르세요.

DNS 서버 관리

BIND (Berkeley Internet Name Domain)

설치

# Ubuntu/Debian
sudo apt update && sudo apt install bind9 bind9utils bind9-doc

# CentOS/RHEL/Rocky Linux
sudo dnf install bind bind-utils

# macOS (using Homebrew)
brew install bind

서비스 관리

# Start BIND service
sudo systemctl start named
sudo systemctl start bind9  # Ubuntu/Debian

# Stop BIND service
sudo systemctl stop named
sudo systemctl stop bind9   # Ubuntu/Debian

# Restart BIND service
sudo systemctl restart named
sudo systemctl restart bind9  # Ubuntu/Debian

# Enable auto-start
sudo systemctl enable named
sudo systemctl enable bind9   # Ubuntu/Debian

# Check service status
sudo systemctl status named
sudo systemctl status bind9   # Ubuntu/Debian

구성 관리

# Check BIND configuration syntax
sudo named-checkconf

# Check zone file syntax
sudo named-checkzone example.com /etc/bind/db.example.com

# Reload configuration without restart
sudo rndc reload

# Reload specific zone
sudo rndc reload example.com

# Flush cache
sudo rndc flush

# View BIND statistics
sudo rndc stats

Windows DNS 서버

PowerShell 관리

# Install DNS Server role
Install-WindowsFeature -Name DNS -IncludeManagementTools

# Start DNS service
Start-Service DNS

# Stop DNS service
Stop-Service DNS

# Restart DNS service
Restart-Service DNS

# Get DNS server settings
Get-DnsServer

# Get DNS server statistics
Get-DnsServerStatistics

영역 관리

영역 생성

BIND 영역 생성

# Create forward lookup zone file
sudo nano /etc/bind/db.example.com

# Add zone to named.conf
echo 'zone "example.com" \\\\{
    type master;
    file "/etc/bind/db.example.com";
    allow-transfer \\\\{ 192.168.1.10; \\\\};
\\\\};'|sudo tee -a /etc/bind/named.conf.local

# Create reverse lookup zone
sudo nano /etc/bind/db.192.168.1

# Add reverse zone to named.conf
echo 'zone "1.168.192.in-addr.arpa" \\\\{
    type master;
    file "/etc/bind/db.192.168.1";
    allow-transfer \\\\{ 192.168.1.10; \\\\};
\\\\};'|sudo tee -a /etc/bind/named.conf.local

Windows DNS 영역 생성

# Create primary zone
Add-DnsServerPrimaryZone -Name "example.com" -ZoneFile "example.com.dns"

# Create Active Directory integrated zone
Add-DnsServerPrimaryZone -Name "example.com" -ReplicationScope "Domain"

# Create secondary zone
Add-DnsServerSecondaryZone -Name "example.com" -ZoneFile "example.com.dns" -MasterServers "192.168.1.10"

# Create reverse lookup zone
Add-DnsServerPrimaryZone -NetworkId "192.168.1.0/24" -ReplicationScope "Domain"

영역 전송 관리

BIND 영역 전송

# Configure zone transfer in named.conf
zone "example.com" \\\\{
    type master;
    file "/etc/bind/db.example.com";
    allow-transfer \\\\{ 192.168.1.10; 192.168.1.11; \\\\};
    also-notify \\\\{ 192.168.1.10; 192.168.1.11; \\\\};
    notify yes;
\\\\};

# Force zone transfer
sudo rndc notify example.com

# Check zone transfer status
sudo rndc status

Windows 영역 전송

# Configure zone transfer settings
Set-DnsServerZoneTransferPolicy -ZoneName "example.com" -SecondaryServers "192.168.1.10","192.168.1.11"

# Enable zone transfer notifications
Set-DnsServerZoneTransferPolicy -ZoneName "example.com" -Notify "Yes" -NotifyServers "192.168.1.10","192.168.1.11"

# Force zone transfer
Start-DnsServerZoneTransfer -ZoneName "example.com"

DNS 레코드 관리

일반적인 레코드 유형

A 레코드 (IPv4)

# BIND - Add A record to zone file
echo "www    IN    A    192.168.1.100" >> /etc/bind/db.example.com

# Windows PowerShell
Add-DnsServerResourceRecordA -ZoneName "example.com" -Name "www" -IPv4Address "192.168.1.100"

# Using nsupdate (dynamic updates)
nsupdate -k /etc/bind/rndc.key
> server 192.168.1.10
> zone example.com
> update add www.example.com 300 A 192.168.1.100
> send
> quit

AAAA 레코드 (IPv6)

# BIND - Add AAAA record
echo "www    IN    AAAA    2001:db8::1" >> /etc/bind/db.example.com

# Windows PowerShell
Add-DnsServerResourceRecordAAAA -ZoneName "example.com" -Name "www" -IPv6Address "2001:db8::1"

CNAME 레코드

# BIND - Add CNAME record
echo "mail    IN    CNAME    www.example.com." >> /etc/bind/db.example.com

# Windows PowerShell
Add-DnsServerResourceRecordCName -ZoneName "example.com" -Name "mail" -HostNameAlias "www.example.com"

MX 레코드

# BIND - Add MX record
echo "@    IN    MX    10    mail.example.com." >> /etc/bind/db.example.com

# Windows PowerShell
Add-DnsServerResourceRecordMX -ZoneName "example.com" -Name "@" -MailExchange "mail.example.com" -Preference 10

TXT 레코드

# BIND - Add TXT record
echo "@    IN    TXT    \"v=spf1 include:_spf.google.com ~all\"" >> /etc/bind/db.example.com

# Windows PowerShell
Add-DnsServerResourceRecordTxt -ZoneName "example.com" -Name "@" -DescriptiveText "v=spf1 include:_spf.google.com ~all"

PTR 레코드 (역방향 DNS)

# BIND - Add PTR record to reverse zone
echo "100    IN    PTR    www.example.com." >> /etc/bind/db.192.168.1

# Windows PowerShell
Add-DnsServerResourceRecordPtr -ZoneName "1.168.192.in-addr.arpa" -Name "100" -PtrDomainName "www.example.com"

레코드 수정 및 삭제

BIND 레코드 관리

# Edit zone file directly
sudo nano /etc/bind/db.example.com

# Increment serial number (important!)
# Change: 2024063001 to 2024063002

# Reload zone after changes
sudo rndc reload example.com

# Delete record using nsupdate
nsupdate -k /etc/bind/rndc.key
> server 192.168.1.10
> zone example.com
> update delete old-server.example.com A
> send
> quit

Windows 레코드 관리

# Modify A record
Set-DnsServerResourceRecordA -ZoneName "example.com" -Name "www" -IPv4Address "192.168.1.101"

# Remove A record
Remove-DnsServerResourceRecord -ZoneName "example.com" -Name "www" -RRType "A"

# Remove all records for a name
Remove-DnsServerResourceRecord -ZoneName "example.com" -Name "old-server" -Force

DNS 보안 관리

DNSSEC 구성

BIND DNSSEC 설정

# Generate zone signing keys
cd /etc/bind/keys
dnssec-keygen -a RSASHA256 -b 2048 -n ZONE example.com
dnssec-keygen -a RSASHA256 -b 4096 -f KSK -n ZONE example.com

# Sign the zone
dnssec-signzone -A -3 $(head -c 1000 /dev/random|sha1sum|cut -b 1-16) -N INCREMENT -o example.com -t /etc/bind/db.example.com

# Update named.conf to use signed zone
zone "example.com" \\\\{
    type master;
    file "/etc/bind/db.example.com.signed";
    key-directory "/etc/bind/keys";
    auto-dnssec maintain;
    inline-signing yes;
\\\\};

Windows DNSSEC 설정

# Enable DNSSEC for zone
Enable-DnsServerSigningKeyRollover -ZoneName "example.com" -KeyType "KeySigningKey"

# Add Key Signing Key (KSK)
Add-DnsServerSigningKey -ZoneName "example.com" -Type "KeySigningKey" -CryptoAlgorithm "RsaSha256"

# Add Zone Signing Key (ZSK)
Add-DnsServerSigningKey -ZoneName "example.com" -Type "ZoneSigningKey" -CryptoAlgorithm "RsaSha256"

# Sign the zone
Invoke-DnsServerZoneSigning -ZoneName "example.com" -Sign

접근 제어 목록 (ACL)

BIND ACL 구성

Would you like me to continue and fill in the remaining numbered sections with translations?```bash

Define ACLs in named.conf

acl “internal-networks” \\{ 192.168.1.0/24; 10.0.0.0/8; 172.16.0.0/12; \\};

acl “dns-servers” \\{ 192.168.1.10; 192.168.1.11; \\};

Apply ACLs to zones

zone “example.com” \\{ type master; file “/etc/bind/db.example.com”; allow-query \\{ internal-networks; \\}; allow-transfer \\{ dns-servers; \\}; allow-update \\{ none; \\}; \\};

```powershell
# Configure zone transfer security
Set-DnsServerZoneTransferPolicy -ZoneName "example.com" -SecondaryServers "192.168.1.10","192.168.1.11"

# Disable recursion for external queries
Set-DnsServerRecursion -Enable $false -AdditionalTimeout 4 -RetryInterval 3 -Timeout 8
```## DNS 모니터링 및 문제 해결
```bash
# Configure logging in named.conf
logging \\\\{
    channel default_debug \\\\{
        file "data/named.run";
        severity dynamic;
    \\\\};
    channel query_log \\\\{
        file "/var/log/bind/query.log" versions 3 size 5m;
        severity info;
        print-category yes;
        print-severity yes;
        print-time yes;
    \\\\};
    category queries \\\\{ query_log; \\\\};
    category default \\\\{ default_debug; \\\\};
\\\\};

# Enable query logging
sudo rndc querylog on

# View logs
sudo tail -f /var/log/bind/query.log
sudo journalctl -u named -f
```### 로그 관리
```powershell
# Enable DNS debug logging
Set-DnsServerDiagnostics -All $true

# Enable query logging
Set-DnsServerDiagnostics -Queries $true

# View DNS events
Get-WinEvent -LogName "DNS Server"|Select-Object -First 10

# Export DNS logs
Get-DnsServerQueryResolutionPolicy|Export-Csv -Path "C:\dns-policies.csv"
```#### BIND 로깅
```bash
# Enable statistics
statistics-channels \\\\{
    inet 127.0.0.1 port 8053 allow \\\\{ 127.0.0.1; \\\\};
\\\\};

# View statistics via HTTP
curl http://127.0.0.1:8053/

# Command line statistics
sudo rndc stats
cat /var/cache/bind/named.stats
```#### Windows DNS 로깅
```powershell
# Get DNS server statistics
Get-DnsServerStatistics

# Monitor DNS performance counters
Get-Counter "\DNS\Total Query Received/sec"
Get-Counter "\DNS\Total Response Sent/sec"
Get-Counter "\DNS\Recursive Queries/sec"

# Export performance data
Get-DnsServerStatistics|Export-Csv -Path "C:\dns-stats.csv"
```### 성능 모니터링
```bash
# Test DNS resolution
nslookup www.example.com
dig www.example.com
host www.example.com

# Test specific record types
dig MX example.com
dig TXT example.com
dig NS example.com

# Test reverse DNS
dig -x 192.168.1.100

# Test DNSSEC validation
dig +dnssec www.example.com
```#### BIND 통계
```bash
# Test zone transfer
dig @192.168.1.10 example.com AXFR

# Test zone serial number
dig @192.168.1.10 example.com SOA
```#### Windows DNS 성능
```powershell
# Test DNS resolution
Resolve-DnsName -Name "www.example.com"
Resolve-DnsName -Name "example.com" -Type MX

# Test DNS server connectivity
Test-DnsServer -IPAddress "192.168.1.10" -ZoneName "example.com"

# Validate zone
Test-DnsServer -IPAddress "192.168.1.10" -ZoneName "example.com" -RRType "SOA"
```### 문제 해결 명령어
```bash
# Backup BIND zone files
sudo tar -czf /backup/dns-zones-$(date +%Y%m%d).tar.gz /etc/bind/

# Backup Windows DNS zones
Export-DnsServerZone -Name "example.com" -FileName "example.com.backup"
```#### DNS 해석 테스트
```bash
# Clear DNS cache (BIND)
sudo rndc flush

# Clear DNS cache (Windows)
Clear-DnsServerCache

# Clear local resolver cache (Linux)
sudo systemctl restart systemd-resolved

# Clear local resolver cache (Windows)
ipconfig /flushdns
```#### 영역 전송 테스트
```bash
# Update zone serial number
# Edit zone file and increment serial: 2024063001 -> 2024063002

# Reload zone
sudo rndc reload example.com

# Force zone refresh on secondary
sudo rndc refresh example.com
```#### Windows DNS 테스트

| 명령어 | 설명 |
|---------|-------------|
| `named-checkconf` | BIND 구성 확인 |
| `named-checkzone` | 영역 파일 구문 유효성 검사 |
| `rndc reload` | DNS 구성 다시 로드 |
| `rndc flush` | DNS 캐시 지우기 |
| `rndc stats` | 통계 생성 |
| `rndc querylog` | 쿼리 로깅 토글 |
| `nsupdate` | 동적 DNS 업데이트 |
| `dig` | DNS 조회 유틸리티 |
| `nslookup` | DNS 조회 유틸리티 |
| `host` | DNS 조회 유틸리티 |## DNS 유지 관리 작업

| Cmdlet | 설명 |
|--------|-------------|
| `Get-DnsServer` | DNS 서버 구성 가져오기 |
| `Add-DnsServerPrimaryZone` | 기본 영역 생성 |
| `Add-DnsServerSecondaryZone` | 보조 영역 생성 |
| `Add-DnsServerResourceRecord*` | DNS 레코드 추가 |
| `Remove-DnsServerResourceRecord` | DNS 레코드 제거 |
| `Set-DnsServerZoneTransferPolicy` | 영역 전송 구성 |
| `Test-DnsServer` | DNS 서버 기능 테스트 |
| `Clear-DnsServerCache` | DNS 캐시 지우기 |### 영역 파일 백업
```bash
# Check zone transfer configuration
named-checkconf
named-checkzone example.com /etc/bind/db.example.com

# Verify network connectivity
telnet secondary-dns-server 53

# Check TSIG key configuration
rndc-confgen -a
```### 캐시 관리
```bash
# Check DNSSEC chain
dig +dnssec +trace www.example.com

# Verify key signatures
dig +dnssec example.com DNSKEY

# Check DS records in parent zone
dig +dnssec example.com DS
```### 영역 유지 관리
```bash
# Monitor query load
rndc stats
tail -f /var/log/bind/query.log

# Check cache hit ratio
rndc dumpdb -cache
grep "cache" /var/cache/bind/named_dump.db

# Analyze query patterns
awk '\\\\{print $1\\\\}' /var/log/bind/query.log|sort|uniq -c|sort -nr
```## 명령어 참조