On Tue, 26 Nov 2024 at 09:40, Greg Choules via bind-users < bind-users@lists.isc.org> wrote:
Hi Greg, Running "named-checkconf -p" will print your entire named configuration, > following any include files. There *must* be a "controls" section in there > or rndc could not work, since, from the ARM: > A "controls" section is *not* required in named.conf. If there isn't one, BIND uses some defaults. From the BIND ARM: "If no controls <https://bind9.readthedocs.io/en/v9.18.31/reference.html#namedconf-statement-controls> statement is present, named <https://bind9.readthedocs.io/en/v9.18.31/manpages.html#std-iscman-named> sets up a default control channel listening on the loopback address 127.0.0.1 and its IPv6 counterpart, ::1. In this case, and also when the controls <https://bind9.readthedocs.io/en/v9.18.31/reference.html#namedconf-statement-controls> statement is present but does not have a keys <https://bind9.readthedocs.io/en/v9.18.31/reference.html#namedconf-statement-keys> clause, named <https://bind9.readthedocs.io/en/v9.18.31/manpages.html#std-iscman-named> attempts to load the command channel key from the file /etc/rndc.key. To create an rndc.key file, run rndc-confgen -a <https://bind9.readthedocs.io/en/v9.18.31/manpages.html#cmdoption-rndc-confgen-a> ." Since this is Ubuntu, BIND on it has been compiled with "sysconfdir" set to "/etc/bind", and so a missing "controls" section will make BIND load the key from "/etc/bind/rndc.key". This is why "rndc" just works for Luis. Our BIND configuration files also do not have a "controls" section, and we rely on the default behaviour. Regards, Anand
-- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
