Bind 9.9.5 assertion failure

2014-02-11 Thread Klaus Darilion
Hi all! I just managed to "crash" Bind 9.9.5 with an assertion failure - see attached log file. What my script does is: 1. delete zone via rndc (in this case the zone does not exist) 2. add zone via rndc 3. rndc signing -nsec3param 4. rndc sign 5. rndc signing -nsec3param (this

Re: Bind 9.9.5 assertion failure

2014-02-11 Thread Klaus Darilion
Very strange, it got another assertion when starting Bind after the crash: Feb 11 11:49:48 named[22328]: transfer of 'pernau.at/IN (unsigned)' from 88.198.53.113#53: connected using 11.22.33.28#46467 Feb 11 11:49:48 named[22328]: zone pernau.at/IN (unsigned): transferred serial 84 Feb 11 11:49:

Re: changing NSEC3 salt

2014-02-11 Thread Chris Thompson
On Feb 10 2014, Mark Andrews wrote: In message <52f94ee2.7080...@ksu.edu>, "Lawrence K. Chen, P.Eng." writes: [... snip ...] On 02/06/14 15:07, Timothe Litt wrote: [... snip ...] > Note also the RFC 5155 recommendation: >> The salt SHOULD be at least 64 bits long and unpredictable, so that >

static hosts in bind

2014-02-11 Thread Göran Höglund
Hi Is there any way to define a hostname and its static IP address in a caching setup? I would like to let bind answer queries about a small amount of hosts even if there is no Internet connection available. Thanks Göran ___ Please visit https://list

Re: static hosts in bind

2014-02-11 Thread Matus UHLAR - fantomas
On 11.02.14 16:59, Göran Höglund wrote: Is there any way to define a hostname and its static IP address in a caching setup? I would like to let bind answer queries about a small amount of hosts even if there is no Internet connection available. You can simply define locally managed DNS zone. T

Trouble building bind with Openssl support

2014-02-11 Thread Olsen, Richard William (Rick) CTR DISA PEO-MA (US)
We have been trying to build bind using with-openssl=PATH and not have it require the full openssl install on the destination system. We had this setup and running when we were building on solaris 9 using bind-9.9.2 up through bind-9.9.4-P2. Now we are building on a Solaris 10 system (remote sys

Re: Trouble building bind with Openssl support

2014-02-11 Thread Tony Finch
Olsen, Richard William (Rick) CTR DISA PEO-MA (US) We have been trying to build bind using with-openssl=PATH and not have > it require the full openssl install on the destination system. Try building BIND with --without-gost Tony. -- f.anthony.n.finchhttp://dotat.at/ Forties, Cromarty: East

Re: changing NSEC3 salt

2014-02-11 Thread David Newman
On 2/11/14 7:38 AM, Chris Thompson wrote: > On Feb 10 2014, Mark Andrews wrote: > >> In message <52f94ee2.7080...@ksu.edu>, "Lawrence K. Chen, P.Eng." writes: > [... snip ...] >>> On 02/06/14 15:07, Timothe Litt wrote: > [... snip ...] >>> > Note also the RFC 5155 recommendation: >>> >> The salt S

Re: changing NSEC3 salt

2014-02-11 Thread Mark Andrews
In message <52fa7d8e@networktest.com>, David Newman writes: > > It's probably worth noticing what the big operators do, e.g. > > > > $ dig +noall +answer +nottl NSEC3PARAM com. edu. net. org. > > com.IN NSEC3PARAM 1 0 0 - > > edu.IN NSEC3PARAM

Re: Trouble building bind with Openssl support

2014-02-11 Thread Mark Andrews
In message , "Olsen, Richard William (Rick) CTR DISA PEO-MA (US)" writes: > > We have been trying to build bind using with-openssl=PATH and not have it req > uire the full openssl install on the destination system. Why do people try to make things more complicated than they need to be. Just ins