Re: inline-signing a zone that exists in two views

2017-05-19 Thread Bob Harold
On Fri, May 19, 2017 at 8:56 AM, Matus UHLAR - fantomas wrote: > Gordon Messmer wrote: >>> > Is it considered best-practice (or just normal) for authoritative >>> > servers to just not use the local server for resolution? >>> >> > On Wed, May 10, 2017 at 5:56 AM, Tony Finch wrote: >> >>> Mine d

Re: inline-signing a zone that exists in two views

2017-05-19 Thread Matus UHLAR - fantomas
Gordon Messmer wrote: > Is it considered best-practice (or just normal) for authoritative > servers to just not use the local server for resolution? On Wed, May 10, 2017 at 5:56 AM, Tony Finch wrote: Mine don't :-) On 18.05.17 16:38, Bob Harold wrote: My authoritative servers are non-recu

Re: inline-signing a zone that exists in two views

2017-05-18 Thread Bob Harold
On Wed, May 10, 2017 at 5:56 AM, Tony Finch wrote: > Gordon Messmer wrote: > ... > > > Is it considered best-practice (or just normal) for authoritative > > servers to just not use the local server for resolution? > > Mine don't :-) > > Tony. > > My authoritative servers are non-recursive. They

Re: inline-signing a zone that exists in two views

2017-05-10 Thread Tony Finch
Gordon Messmer wrote: > > I'm happy that it's working, but it seems like it was fairly difficult to get > right. Am I doing an unusual thing? Yes, it is fiddly, and a relatively common problem - which is why in-view was introduced! > Is it considered best-practice (or just normal) for authorita

Re: inline-signing a zone that exists in two views

2017-05-09 Thread Gordon Messmer
On 05/09/2017 03:15 AM, Tony Finch wrote: The classic solution is to make one view a slave of the other. Configure the slave zone with `masters { localhost key my-tsig; };` and configure the master view with `match-clients { key my-tsig; };`. OK, I think I've got this nailed down. I had to mo

Re: inline-signing a zone that exists in two views

2017-05-09 Thread Tony Finch
Gordon Messmer wrote: > On 05/08/2017 03:26 AM, Tony Finch wrote: > > You can't have zones in different views (which sre by implication > > different zones, or different versions of the same zone) pointing to the > > same files on disk, because updates to one version will corrupt the other > > ve

Re: inline-signing a zone that exists in two views

2017-05-08 Thread Gordon Messmer
On 05/08/2017 03:26 AM, Tony Finch wrote: Gordon Messmer wrote: I have a zone that I'd like to serve in two different views, with dnssec in both views. You can't have zones in different views (which sre by implication different zones, or different versions of the same zone) pointing to the sa

Re: inline-signing a zone that exists in two views

2017-05-08 Thread Tony Finch
Gordon Messmer wrote: > I have a zone that I'd like to serve in two different views, with dnssec in > both views. You can't have zones in different views (which sre by implication different zones, or different versions of the same zone) pointing to the same files on disk, because updates to one

inline-signing a zone that exists in two views

2017-05-06 Thread Gordon Messmer
I have a zone that I'd like to serve in two different views, with dnssec in both views. However, this leads to a pair of error messages: named[858]: malformed transaction: dynamic/db.dragonsdawn.net.signed.jnl last serial 2017011485 != transaction first serial 2017011477 named[858]: