<div style=3D"box-sizing:border-box;font-family:"Segoe UI",syst= em-ui,"Apple Color Emoji","Segoe UI Emoji",sans-serif;f= ont-size:14px"><br></div><div style=3D"box-sizing:border-box;font-family:&q= uot;Segoe UI",system-ui,"Apple Color Emoji","Segoe UI E= moji",sans-serif;font-size:14px">acl dynamic-TEST-tsig {<br>=C2=A0 =C2= =A0// any host which is not..<br>=C2=A0 =C2=A0!{<br>=C2=A0 =C2=A0 =C2=A0 //=not in the new acls<br>=C2=A0 =C2=A0 =C2=A0 !dynamic-test-site1;<br>=C2=A0=
<a href=3D"http://192.168.5.1/32">192.168.5.1/32</a>; // HostB<br>};<br><=/div><div style=3D"box-sizing:border-box;font-family:"Segoe UI",s= ystem-ui,"Apple Color Emoji","Segoe UI Emoji",sans-seri= f;font-size:14px"><pre class=3D"gmail-code gmail-highlight" lang=3D"conf"><= span id=3D"gmail-LC155" class=3D"gmail-line" lang=3D"conf"></span>
All
I've inherited a BIND environment and i'm trying to understand a few
things as currently we are experiences an issue related to DDNS.
we have
site 1
hostA
site 2
hostB
We have a HArecord, and we want HostA or HostB to be able to update the HArecord (i.e. failover cluster type configuration)
config:
Zone file:
zone "TEST" {
check-names ignore;
type master;
file "/var/named/dynamic/TEST";
allow-update {
auth-dns;
dynamic-TEST;
};
};
lists.conf
acl dynamic-update-ads {
192.168.2.1 // hostA
192.168.5.1 // hostB
dynamic-TEST-tsig;
};
acl dynamic-TEST-tsig {
// any host which is not..
!{
// not in the new acls
!dynamic-test-site1;
!dynamic-test-site2;
any;
};
// but has the key
key TEST-key;
};
acl !dynamic-test-site1 {
192.168.2.1/32; // HostA
};
acl !dynamic-test-site2 {
192.168.5.1/32; // HostB
};
however these windows machines keep saying bad key, I know i'm missing something obvious but how do i get this to work?
happy to be able to give the key to the windows boxes if anyone knows but i'm drawing a blank
Regards
Cade
<a href=3D"http://192.168.5.1/32" target=3D"_blank">192.168.5.1/32</a>;=// HostB<br>};<br></div><div style=3D"box-sizing:border-box;font-family:&q=
All
I've inherited a BIND environment and i'm trying to understand a few
things as currently we are experiences an issue related to DDNS.
we have
site 1
hostA
site 2
hostB
We have a HArecord, and we want HostA or HostB to be able to update the HArecord (i.e. failover cluster type configuration)
config:
Zone file:
zone "TEST" {
check-names ignore;
type master;
file "/var/named/dynamic/TEST";
allow-update {
auth-dns;
dynamic-TEST;
};
};
lists.conf
acl dynamic-update-ads {
192.168.2.1 // hostA
192.168.5.1 // hostB
dynamic-TEST-tsig;
};
acl dynamic-TEST-tsig {
// any host which is not..
!{
// not in the new acls
!dynamic-test-site1;
!dynamic-test-site2;
any;
};
// but has the key
key TEST-key;
};
acl !dynamic-test-site1 {
192.168.2.1/32; // HostA
};
acl !dynamic-test-site2 {
192.168.5.1/32; // HostB
};
however these windows machines keep saying bad key, I know i'm missing something obvious but how do i get this to work?
happy to be able to give the key to the windows boxes if anyone knows but i'm drawing a blank
Regards
Cade
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to
unsubscribe from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
=C2=A0 =C2=A0192.168.2.1 // hostA<br>=C2=A0 =C2=A0192.168.5.1 // hostB =<br>=C2=A0 =C2=A0dynamic-TEST-tsig; <br>};<br></div><div style=3D"box-sizin= g:border-box;font-family:"Segoe UI",system-ui,"Apple Color E= moji","Segoe UI Emoji",sans-serif;font-size:14px"><br></div>= <div style=3D"box-sizing:border-box;font-family:"Segoe UI",system= -ui,"Apple Color Emoji","Segoe UI Emoji",sans-serif;fon= t-size:14px">acl dynamic-TEST-tsig {<br>=C2=A0 =C2=A0// any host which is n= ot..<br>=C2=A0 =C2=A0!{<br>=C2=A0 =C2=A0 =C2=A0 // not in the new acls<br>= =C2=A0 =C2=A0 =C2=A0 !dynamic-test-site1;<br>=C2=A0 =C2=A0 =C2=A0 !dynamic-= test-site2;<br>=C2=A0 =C2=A0 =C2=A0 any;<br>=C2=A0 =C2=A0};<br>=C2=A0 =C2= =A0// but has the key<br>=C2=A0 =C2=A0key TEST-key;<br>};<br><br><br>acl !d= ynamic-test-site1 {<br> <a href=3D"http://192.168.2.1/32" target=3D"_blank"=
On Tue, May 12, 2020 at 5:57 AM Pete Fry via bind-users < bind-users@lists.isc.org> wrote:
All
I've inherited a BIND environment and i'm trying to understand a few
things as currently we are experiences an issue related to DDNS.
we have
site 1
hostA
site 2
hostB
We have a HArecord, and we want HostA or HostB to be able to update the
HArecord (i.e. failover cluster type configuration)
config:
Zone file:
zone "TEST" {
check-names ignore;
type master;
file "/var/named/dynamic/TEST";
allow-update {
auth-dns;
dynamic-TEST;
};
};
lists.conf
acl dynamic-update-ads {
192.168.2.1 // hostA
192.168.5.1 // hostB
dynamic-TEST-tsig;
};
acl dynamic-TEST-tsig {
// any host which is not..
!{
// not in the new acls
!dynamic-test-site1;
!dynamic-test-site2;
any;
};
// but has the key
key TEST-key;
};
For testing purposes, start with a simpler acl, like:
acl dynamic-TEST-tsig {
key TEST-key;
};
And see if that works.
"acl !" seems wrong to me. Is that a legal syntax? And if so, what does
acl !dynamic-test-site1 {
192.168.2.1/32; // HostA
};
acl !dynamic-test-site2 {
192.168.5.1/32; // HostB
};
it mean?
--
Bob Harold
however these windows machines keep saying bad key, I know i'm missing something obvious but how do i get this to work?
happy to be able to give the key to the windows boxes if anyone knows but i'm drawing a blank
Regards
Cade
</div><div style=3D"box-sizing:border-box;font-family:"Segoe UI"= ,system-ui,"Apple Color Emoji","Segoe UI Emoji",sans-se= rif;font-size:14px"><pre lang=3D"conf"><span id=3D"gmail-m_-470165666823455= 0113gmail-m_2062855817749687786gmail-LC155" lang=3D"conf"></span></pre></di= v></div></blockquote><div><br></div><div>"acl !" seems wrong to m= e.=C2=A0 Is that a legal syntax?=C2=A0 And if so, what does it mean?</div><= div><br></div><div>--=C2=A0</div><div>Bob Harold</div><div>=C2=A0</div><blo= ckquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left= :1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr"><div style= =3D"box-sizing:border-box;font-family:"Segoe UI",system-ui,"= Apple Color Emoji","Segoe UI Emoji",sans-serif;font-size:14p= x"><pre lang=3D"conf"></pre><pre lang=3D"conf">however these windows machin=es keep saying bad key, I know i'm missing something obvious but how do=
Bob
thanks for the reply and the correction ( the acl dones't have a ! it was
a cut and paste error when i was trying to remove some information.
the TSIG works when from other linux machine via nsupdate etc, however i'm trying to figure out how to get the windows machines to do the same and was trying to follow this
http://serverfault.com/questions/376578/bind9-combining-key-and-acl-for- allow-update
Regards
Pete
On Tue, 12 May 2020 at 13:40, Bob Harold <rharolde@umich.edu> wrote:
On Tue, May 12, 2020 at 5:57 AM Pete Fry via bind-users <
bind-users@lists.isc.org> wrote:
All
I've inherited a BIND environment and i'm trying to understand a few
things as currently we are experiences an issue related to DDNS.
we have
site 1
hostA
site 2
hostB
We have a HArecord, and we want HostA or HostB to be able to update the
HArecord (i.e. failover cluster type configuration)
config:
Zone file:
zone "TEST" {
check-names ignore;
type master;
file "/var/named/dynamic/TEST";
allow-update {
auth-dns;
dynamic-TEST;
};
};
lists.conf
acl dynamic-update-ads {
192.168.2.1 // hostA
192.168.5.1 // hostB
dynamic-TEST-tsig;
};
acl dynamic-TEST-tsig {
// any host which is not..
!{
// not in the new acls
!dynamic-test-site1;
!dynamic-test-site2;
any;
};
// but has the key
key TEST-key;
};
For testing purposes, start with a simpler acl, like:
acl dynamic-TEST-tsig {
key TEST-key;
};
And see if that works.
"acl !" seems wrong to me. Is that a legal syntax? And if so, what does
acl !dynamic-test-site1 {
192.168.2.1/32; // HostA
};
acl !dynamic-test-site2 {
192.168.5.1/32; // HostB
};
it mean?
--
Bob Harold
however these windows machines keep saying bad key, I know i'm missing something obvious but how do i get this to work?
happy to be able to give the key to the windows boxes if anyone knows but i'm drawing a blank
Regards
Cade
Your ACL looks right.=C2=A0 I think Ben has the key - Windows uses GSS-=TSIG,=20
not regular TSIG.=C2=A0 Not sure how or if that can be solved.
On 5/13/20 6:29 AM, Bob Harold wrote:
Your ACL looks right. I think Ben has the key - Windows uses GSS-TSIG,
not regular TSIG. Not sure how or if that can be solved.
I would bet someone a coffee and doughnut that it can.
Check out Jan-Piet Mens' article:
Link - RFC 2136 Dynamic DNS Updates using GSS-TSIG and Kerberos
-
https://jpmens.net/2012/06/29/dynamic-dns-updates-using-gss-tsig-and-kerberos/
--
Grant. . . .
unix || die
On Wed, May 13, 2020 at 3:20 AM Pete Fry <cadel2010@googlemail.com> wrote:
Bob
thanks for the reply and the correction ( the acl dones't have a ! it was
a cut and paste error when i was trying to remove some information.
the TSIG works when from other linux machine via nsupdate etc, however
i'm trying to figure out how to get the windows machines to do the same and >> was trying to follow this
http://serverfault.com/questions/376578/bind9-combining-key-and-acl-for-
allow-update
Regards
Pete
Your ACL looks right. I think Ben has the key - Windows uses GSS-TSIG,
not regular TSIG. Not sure how or if that can be solved.
--
Bob Harold
On Tue, 12 May 2020 at 13:40, Bob Harold <rharolde@umich.edu> wrote:
On Tue, May 12, 2020 at 5:57 AM Pete Fry via bind-users <
bind-users@lists.isc.org> wrote:
All
I've inherited a BIND environment and i'm trying to understand a few
things as currently we are experiences an issue related to DDNS.
we have
site 1
hostA
site 2
hostB
We have a HArecord, and we want HostA or HostB to be able to update the >>>> HArecord (i.e. failover cluster type configuration)
config:
Zone file:
zone "TEST" {
check-names ignore;
type master;
file "/var/named/dynamic/TEST";
allow-update {
auth-dns;
dynamic-TEST;
};
};
lists.conf
acl dynamic-update-ads {
192.168.2.1 // hostA
192.168.5.1 // hostB
dynamic-TEST-tsig;
};
acl dynamic-TEST-tsig {
// any host which is not..
!{
// not in the new acls
!dynamic-test-site1;
!dynamic-test-site2;
any;
};
// but has the key
key TEST-key;
};
For testing purposes, start with a simpler acl, like:
acl dynamic-TEST-tsig {
key TEST-key;
};
And see if that works.
"acl !" seems wrong to me. Is that a legal syntax? And if so, what
acl !dynamic-test-site1 {
192.168.2.1/32; // HostA
};
acl !dynamic-test-site2 {
192.168.5.1/32; // HostB
};
does it mean?
--
Bob Harold
however these windows machines keep saying bad key, I know i'm missing something obvious but how do i get this to work?
happy to be able to give the key to the windows boxes if anyone knows but i'm drawing a blank
Regards
Cade
| Sysop: | DaiTengu |
|---|---|
| Location: | Appleton, WI |
| Users: | 1,064 |
| Nodes: | 10 (0 / 10) |
| Uptime: | 150:01:44 |
| Calls: | 13,691 |
| Calls today: | 1 |
| Files: | 186,936 |
| D/L today: |
438 files (115M bytes) |
| Messages: | 2,410,972 |