{"id":18706,"date":"2015-01-11T06:46:12","date_gmt":"2015-01-10T22:46:12","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2015\/01\/11\/%e5%9c%a8-debian-%e5%bb%ba%e7%bd%ae%e6%9c%89-logging-%e5%8a%9f%e8%83%bd%e7%9a%84-dns-server\/"},"modified":"2021-03-18T17:24:16","modified_gmt":"2021-03-18T09:24:16","slug":"%e5%9c%a8-debian-%e5%bb%ba%e7%bd%ae%e6%9c%89-logging-%e5%8a%9f%e8%83%bd%e7%9a%84-dns-server","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2015\/01\/11\/%e5%9c%a8-debian-%e5%bb%ba%e7%bd%ae%e6%9c%89-logging-%e5%8a%9f%e8%83%bd%e7%9a%84-dns-server\/","title":{"rendered":"\u5728 Debian \u5efa\u7f6e\u6709 logging \u529f\u80fd\u7684 DNS Server"},"content":{"rendered":"

\u5728\u7db2\u8def\u4e2d\uff0cDNS Server \u670d\u52d9\u662f\u975e\u5e38\u91cd\u8981\u7684\uff0c\u7531 DNS Server \u7684 log \u4e2d\uff0c\u53ef\u4ee5\u67e5\u8a62\u5230\u4e00\u4e9b\u975e\u5e38\u91cd\u8981\u7684\u8cc7\u6599\u3002
\"\"<\/a>
# tail dns-security.log<\/span>
24-Dec-2014 00:49:26.723 security: info: client 192.3.96.146#48302: query (cache) ‘openresolver.com\/A\/IN’ denied<\/span>
24-Dec-2014 02:11:25.169 security: info: client 89.248.172.169#46003: query (cache) ‘globe.gov\/ANY\/IN’ denied<\/span>
24-Dec-2014 05:09:04.502 security: info: client 202.153.191.99#60017: query (cache) ‘.\/NS\/IN’ denied<\/span>
24-Dec-2014 08:31:24.675 security: info: client 204.42.253.2#58601: query (cache) ‘c526034a.openresolvertest.net\/A\/IN’ denied<\/span>
24-Dec-2014 08:59:36.327 security: info: client 124.232.142.220#54455: query (cache) ‘www.google.com\/A\/IN’ denied<\/span>
24-Dec-2014 12:44:44.954 security: info: client 74.82.47.8#54631: query (cache) ‘dnsscan.shadowserver.org\/A\/IN’ denied<\/span>
24-Dec-2014 15:33:08.420 security: info: client 207.244.82.115#48706: query (cache) ‘.\/ANY\/IN’ denied<\/span>[@more@]\u8a2d\u5b9a\u65b9\u5f0f\uff1aDNS Server \u5df2\u7d93\u8a2d\u5b9a chroot
\u53c3\u8003\u7db2\u9801\uff1aBind9 – Debian Wiki<\/a>
1. \u5efa\u7acb \/var\/chroot\/bind9\/var\/log<\/span> \u76ee\u9304
# mkdir \/var\/chroot\/bind9\/var\/log<\/span><\/p>\n

2. \u66f4\u6539\u76ee\u9304\u6b0a\u9650
# chown bind:bind \/var\/chroot\/bind9\/var\/log<\/span><\/p>\n

3. \u4fee\u6539 \/etc\/bind\/named.conf<\/span>
# vim \/etc\/bind\/named.conf<\/span>
\u52a0\u5165\u4e0b\u9762\u4e00\u884c
include “\/etc\/bind\/named.conf.log”;<\/span><\/p>\n

4. \u5efa\u7acb \/etc\/bind\/named.conf.log<\/span>
# vim \/etc\/bind\/named.conf.log<\/span>
logging {<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 channel update_debug {<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 file “\/var\/log\/update_debug.log” versions 3 size 100k;<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 severity debug;<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 print-severity\u00a0 yes;<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 print-time\u00a0\u00a0\u00a0\u00a0\u00a0 yes;<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 };<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 channel security_info {<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 file “\/var\/log\/security_info.log” versions 1 size 100k;<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 severity info;<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 print-severity\u00a0 yes;<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 print-time\u00a0\u00a0\u00a0\u00a0\u00a0 yes;<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 };<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 channel bind_log {<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 file “\/var\/log\/bind.log” versions 3 size 1m;<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 severity info;<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 print-category\u00a0 yes;<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 print-severity\u00a0 yes;<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 print-time\u00a0\u00a0\u00a0\u00a0\u00a0 yes;<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 };<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 category default { bind_log; };<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 category lame-servers { null; };<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 category update { update_debug; };<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 category update-security { update_debug; };<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 category security { security_info; };<\/span>
};<\/span><\/p>\n

5. \u91cd\u65b0\u555f\u52d5 DNS Server \u53ca Log Server
# \/etc\/init.d\/rsyslog restart; \/etc\/init.d\/bind9 start<\/span><\/p>\n

6. \u9a57\u6536\u6210\u679c\u53ca\u6536\u5de5
# ls -l \/var\/chroot\/bind9\/var\/log\/<\/span>
total 4<\/span>
-rw-r–r– 1 bind bind 1417 Dec 24 15:45 bind.log<\/span>
-rw-r–r– 1 bind bind\u00a0\u00a0\u00a0 0 Dec 24 15:45 security_info.log<\/span>
-rw-r–r– 1 bind bind\u00a0\u00a0\u00a0 0 Dec 24 15:45 update_debug.log<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

\u5728\u7db2\u8def\u4e2d\uff0cDNS Server \u670d\u52d9\u662f\u975e\u5e38\u91cd\u8981\u7684\uff0c\u7531 DNS Server \u7684 log \u4e2d\uff0c\u53ef\u4ee5\u67e5\u8a62\u5230\u4e00\u4e9b\u975e\u5e38 … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008\u5728 Debian \u5efa\u7f6e\u6709 logging \u529f\u80fd\u7684 DNS Server\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[179,148],"tags":[],"class_list":["post-18706","post","type-post","status-publish","format-standard","hentry","category-c-87877","category-c-78513"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["551629"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18706"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=18706"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18706\/revisions"}],"predecessor-version":[{"id":20321,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18706\/revisions\/20321"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=18706"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=18706"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=18706"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}