Re: Testing RFC 5011 key roll

2015-04-20 Thread Warren Kumari
On Mon, Apr 20, 2015 at 4:33 PM, Evan Hunt wrote: > On Mon, Apr 20, 2015 at 04:17:57PM -0400, Warren Kumari wrote: >> That page says (for BIND): >> "Note: When using this config file you will probably need to delete >> /var/named/21ce078705d04ca6324c1d0313fc08ea99f3cef6389a6744d40bd2d9d0cd7816.mke

Re: Testing RFC 5011 key roll

2015-04-20 Thread Evan Hunt
On Mon, Apr 20, 2015 at 04:17:57PM -0400, Warren Kumari wrote: > That page says (for BIND): > "Note: When using this config file you will probably need to delete > /var/named/21ce078705d04ca6324c1d0313fc08ea99f3cef6389a6744d40bd2d9d0cd7816.mkeys* > every time you restart BIND after missing a keyrol

Re: Testing RFC 5011 key roll

2015-04-20 Thread Warren Kumari
On Mon, Apr 20, 2015 at 3:41 PM, Edward Lewis wrote: > Thanks. rm'd the file and added the timers. (I did that also after > sending, so it is the deleting the old file that did the trick.) The > start-up lines look good. > > Got an AD bit again too. > > (I may have a few more issues as I move t

Re: Testing RFC 5011 key roll

2015-04-20 Thread Edward Lewis
Thanks. rm'd the file and added the timers. (I did that also after sending, so it is the deleting the old file that did the trick.) The start-up lines look good. Got an AD bit again too. (I may have a few more issues as I move this off a laptop on to a regular machine. Right now it helps know

Re: Testing RFC 5011 key roll

2015-04-20 Thread Evan Hunt
On Mon, Apr 20, 2015 at 06:42:42PM +, Edward Lewis wrote: > Being that I'm working on a laptop (hence on on over the weekend) I've had > to recreate the environment today. I'm a bit more puzzled now. There's a separate file that named creates to keep the current managed keys state information

Re: Testing RFC 5011 key roll

2015-04-20 Thread Edward Lewis
Thanks to Evan for the last look and thanks to Jan-Piet for the suggestion to go to 9.10.2. Being that I'm working on a laptop (hence on on over the weekend) I've had to recreate the environment today. I'm a bit more puzzled now. I've built and installed BIND 9.10.2. Using http://keyroll.system

Re: Confusion about "try-tcp-refresh"

2015-04-20 Thread Tony Finch
Anand Buddhdev wrote: > > The BIND 9.10.2 ARM suggests that it is a per-zone setting. Can I also > set it in the global "options" area? Yes. It is mentioned in the options documentation towards the end of ARM section 6.2.16.1. (A useful thing to know about is doc/misc/options which is automatica

Confusion about "try-tcp-refresh"

2015-04-20 Thread Anand Buddhdev
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello BIND developers, We have some BIND servers configured as slaves for many hundreds of zones, with the master pointing to our distribution master's IPv4 and IPv6 address. One some of these servers, the IPv6 routing was broken, so that when BIND t