加强linux操作系统DNS服务安全

#!/bin/bash
#2017-12-3
#by-duwentao

domain_name="hetian.com"
rip=`ifconfig eth0|grep Mask|awk -F ":" '{print $2}'|awk -F " " '{print $1}'|awk -F "." '{print $3"."$2"."$1}'`
ip=`ifconfig eth0|grep Mask|awk -F ":" '{print $2}'|awk -F " " '{print $1}'`
ip_last=`ifconfig eth0|grep Mask|awk -F ":" '{print $2}'|awk -F " " '{print $1}'|awk -F "." '{print $4}'`
named="/etc/named.conf"                                  #主配文件
Forward_parsing_file="/var/named/$domain_name.zone"             #正向解析文件
Reverse_parsing_file="/var/named/$rip.in-addr.arpa.zone" #反向解析文件

#check the yum allocation of right and wrong
function Check_Yum( )
{
yum clean all>/dev/null 2>&1  #判断yum配置文件的格式是否正确
if [ $? -ne '0' ];then
echo -e "\033[31m yum allocation is wrong \033[0m"
Repair_Yum

else
#定义变量用来查看yum有多少安装包
Yum_Num=`yum repolist all|grep repolist|awk -F ":" '{print $2}'|sed s'/,//'g|sed s'/ //'g`

if [ $Yum_Num -eq  0 ];then
echo -e "\033[31m yum allocation is wrong \033[0m"
Repair_Yum
else
echo -e "\033[32m yum allocation is right \033[0m"

fi
fi
}

#repair yum
function Repair_Yum( )
{
dvd_file="/etc/yum.repos.d/dvd.repo"
read -p "Do you want to repair yum y/n:" check

if [ "$check" = "y" -o "$check" = "yes" -o "$check" = "Y" ];then
mount /dev/cdrom /mnt 1>/dev/null 2>&1
if [ -f $dvd_file ];then
rm -rf  $dvd_file
touch $dvd_file
cat >> $dvd_file << +END+
[dvd]
name=dvd
baseurl=file:///mnt
gpgcheck=0
+END+
else
touch $dvd_file
cat >> $dvd_file << +END+
[dvd]
name=dvd
baseurl=file:///mnt
gpgcheck=0
+END+
echo -e "\033[31m Please run it again and see the repair results \033[0m"
exit 0
fi

elif [ "$check" = "n" -o "$check" = "N" -o "$check" = "no" ];then
echo -e "\033[31m yum allocation is wrong,Please configure it manually \033[0m"
exit 0
else
while [[ 1 < 2 ]]
do
echo -e "\033[31m Your input is wrong,please try again \033[0m"
Repair_Yum
done
fi

}

#install dns server
function Install_DNS_Server( )
{
#把原有的卸载干净
yum remove bind* -y
rm -rf /var/named/*
rm -rf  /etc/named.conf.rpm*
#开始安全dns服务
yum install bind bind-libs bind-utils -y
/etc/init.d/named restart > /dev/null 2>&1
if [ $? -eq 0 ];then

echo -e "\033[32m DNS server install sucessful \033[0m"
else
echo -e "\033[31m DNS server install failed try again \033[0m"
fi

}

#Edit named configuration file

function Edit_Conf ( )
{

#修改
sed -i '/^include/d' $named
sed -i s'/127.0.0.1/any/'g $named
sed -i s'/localhost/any/'g $named
sed -i '/recursion/i version "I do not tell you";' $named    #隐藏版本号
sed -i s'/recursion yes/recursion no/'g $named 		     #关闭rescursion功能，防止spoofig
sed -i '/recursion/i fetch-glue no;' $named                  #关闭glue fetching功能

##Edit named configuration file
cat >> $named << +END+

zone "$domain_name" IN{
type master;
file "$Forward_parsing_file";

};

zone "$rip.in-addr.arpa" IN{
type master;
file "$Reverse_parsing_file";

};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

+END+

#Edit Forward and Reverse configuration file
#Edit Forward  configuration file
if [ ! -f $Forward_parsing_file  ];then
touch $Forward_parsing_file
else
rm -rf $Forward_parsing_file
touch $Forward_parsing_file
fi

cat >> $Forward_parsing_file << +END+
\$TTL 1D
@   IN SOA  $domain_name.  root.$domain_name. (
0   ; serial
1D  ; refresh
1H  ; retry
1W  ; expire
3H )   ; minimum
@     IN     NS     dns.smile.com.
dns   IN     A      $ip
mail  IN     A      $ip
www   IN     A      $ip

+END+

#Edit Reverse configuration file

if [ ! -f $Reverse_parsing_file  ];then
touch $Reverse_parsing_file
else
rm -rf $Reverse_parsing_file
touch $Reverse_parsing_file
fi

cat >> $Reverse_parsing_file << +END+

\$TTL 86400
@   IN SOA  $rip.in-addr.arpa. root.$domain_name. (
0   ; serial
1D  ; refresh
1H  ; retry
1W  ; expire
3H )   ; minimum
@     IN     NS     dns.$domain_name.
$ip_last   IN    PTR     www.$domain_name.
$ip_last   IN    PTR     mail.$domain_name.

+END+

#修改权限
chgrp named $named
chgrp named $Reverse_parsing_file
chgrp named $Forward_parsing_file

echo "nameserver $ip" >> /etc/resolv.conf
/etc/init.d/named restart

}

#copy
function copy( )
{
scp -r /root/shell/DNS_Server_masters.sh root@172.24.10.106:/root
if [ $? -ne '0' ];then
echo -e "\033[31m 拷贝失败 \033[0m"
else
echo -e "\033[32m 拷贝成功 \033[0m"
fi

ssh -l root 172.24.10.106 '/bin/bash /root/DNS_Server_masters.sh'
}

#chenge_DNS_slave
function chenge_DNS_slave ( )
{

#修改
sed -i '/^include/d' $named
sed -i s'/127.0.0.1/any/'g $named
sed -i s'/localhost/any/'g $named
sed -i '/recursion/i version "I do not tell you";' $named    #隐藏版本号
sed -i s'/recursion yes/recursion no/'g $named               #关闭rescursion功能，防止spoofig
sed -i '/recursion/i fetch-glue no;' $named                  #关闭glue fetching功能

##Edit named configuration file
cat >> $named << +END+

zone "$domain_name" IN{
type slave;
file "$Forward_parsing_file";
masters {172.24.10.105;};
};

zone "$rip.in-addr.arpa" IN{
type slave;
file "$Reverse_parsing_file";
masters {172.24.10.105;};
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

+END+

chmod g+w  /var/named/
echo "nameserver $ip" >> /etc/resolv.conf
service named restart
}

#echo menu
function menu ( )
{

echo -e "\033[32m 1.检查yum是否配置正确 \033[0m"
echo -e "\033[32m 2.安装DNS服务 \033[0m"
echo -e "\033[32m 3.修改DNS-master服务的配置文件 \033[0m"
echo -e "\033[32m 4.拷贝文件到目标主机并且进入目标主机\033[0m"
echo -e "\033[32m 5.修改目标机的主配文件\033[0m"
echo -e "\033[32m exit.输入exit或者ctrl+c退出 \033[0m"
echo -e "\033[32m help.请输入1|2|3|help|exit \033[0m"

read -p "请选择你菜单：" menu

case $menu in
1) Check_Yum
;;
2) Install_DNS_Server
;;
3)
if [ `rpm -qa |grep bind-9.8|wc -l` -ne 1 ];then
echo -e "\033[31m 请确保已经安装DNS服务 \033[0m"
fi
Edit_Conf
;;
4)copy
;;
5) chenge_DNS_slave
;;
help)
echo -e "\033[32m help.请输入1|2|3|4 \033[0m"
menu
;;
exit) exit 0
;;
*)
echo -e "\033[31m 输入有误，请重新输入 \033[0m"
menu

;;

esac

}

while [[ 1 < 2 ]]
do
hostname=`hostname`
if [ "$hostname" =  "DNS_SERVER_1"  ];then

echo "当前设备是DNS_SERVER_1:请选择你菜单："
menu
else
echo "当前设备是$hostname:请选择你菜单："
menu
fi
done