Hi,
I've been struggling to get TSIG setup for securing the AXFR of my zone
transfers from the master to the secondaries. I've tried what feels like
everything I can think of, but I am still unable to get it to work
right. I must be missing something, and I hope that the bind community
can tell me what it is.
I'm using the new 9.10 version of bind, so I created the tsig file on
the master by doing tsig-keygen > /etc/bind/tsig.keys, it looks like
this:
key "tsig-key" {
algorithm hmac-sha256;
secret "weeetsigblobhere=";
};
my named.conf has:
include "/etc/bind/rndc.key";
include "/etc/bind/tsig.keys";
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
and my named.conf.options has:
zone "example.net" {
type master;
allow-transfer { key tsig.key.; };
also-notify { ip.address.here.x; };
file "/etc/bind/master/db.example";
auto-dnssec maintain;
inline-signing yes;
};
on the slave I have copied over the tsig.keys file and added to the
bottom of it:
key "tsig-key" {
algorithm hmac-sha256;
secret "weeetsigblobhere=";
};
server ip.of.master.here {
keys { "tsig-key"; };
};
now when I try to do a zone transfer:
root@owl:/etc/bind# rndc retransfer example.net
21-May-2014 09:34:11.828 received control channel command 'retransfer
example.net'
21-May-2014 09:34:11.907 zone example.net/IN: Transfer started.
21-May-2014 09:34:11.987 transfer of 'example.net/IN' from
ip.address.of.master#53: connected using ip.address.of.slave#48600
21-May-2014 09:34:12.068 transfer of 'example.net/IN' from
ip.address.of.master#53: failed while receiving responses: REFUSED
21-May-2014 09:34:12.068 transfer of 'example.net/IN' from
ip.address.of.master#53: Transfer completed: 0 messages, 0 records, 0 bytes,
0.080 secs (0 bytes/sec)
and I see on the master:
21-May-2014 16:34:12.031 client ip.address.of.slave#48600/key tsig-key
(example.net): zone transfer example.net/AXFR/IN' denied
What am I missing?
thanks!
micah
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
