Re: BIND Security Advisory (CVE-2009-0025; Severity: Low)

2009-01-08 Thread David Coulthart
On Jan 7, 2009, at 2:32 PM, rob_aust...@isc.org wrote: Internet Systems Consortium Security Advisory. BIND: EVP_VerifyFinal() and DSA_do_verify() return checks. 7 January 2009 Versions affected: BIND 9.0 (all versions) BIND 9

Re: Security Advisory: Server Lockup Upon IXFR or DDNS Update Combined with High Query Rate

2011-02-23 Thread David Coulthart
On Feb 22, 2011, at 3:55 PM, Larissa Shapiro wrote: > Description and Impact: > > When an authoritative server processes a successful IXFR transfer or a > dynamic update, there is a small window of time during which the IXFR/update > coupled with a query may cause a deadlock to occur. This deadl

IXFR & manually edited zone files

2011-03-07 Thread David Coulthart
BIND Version: 9.7.3 on Solaris 9 & 10 (locally compiled) Our current workflow for managing DNS involves generating master zone files from a database, pushing the new files to a hidden master nameserver & then running "rndc reload" on that nameserver. Based on the ARM & a posting to bind-users[1

Re: IXFR & manually edited zone files

2011-03-07 Thread David Coulthart
On Mar 7, 2011, at 11:42 AM, Chris Thompson wrote: > On Mar 7 2011, David Coulthart wrote: >> BIND Version: 9.7.3 on Solaris 9 & 10 (locally compiled) >> >> Our current workflow for managing DNS involves generating master zone >> files from a database, pushing t

Re: IXFR & manually edited zone files

2011-03-08 Thread David Coulthart
On Mar 7, 2011, at 12:24 PM, David Coulthart wrote: > On Mar 7, 2011, at 11:42 AM, Chris Thompson wrote: >> On Mar 7 2011, David Coulthart wrote: >>> BIND Version: 9.7.3 on Solaris 9 & 10 (locally compiled) ... >>> Based on the ARM & a posting to bind-

Re: IXFR & manually edited zone files

2011-03-08 Thread David Coulthart
On Mar 8, 2011, at 3:44 PM, Mark Andrews wrote: > In message , David > Coulthart > writes: >> It looks like the problem is with setting ixfr-from-differences to master. I >> f I instead set the option to yes, a journal file is generated & IXFR works c >> orrectl

Better solution than making a recursive nameserver authoritative?

2011-06-24 Thread David Coulthart
Currently the two recursive caching nameservers for clients on our network are also authoritative for a few zones. In particular, they are authoritative for: 1) our main forward zone (columbia.edu) in order to provide an internal view of the zone 2) RFC 1918 reverse zones (e.g., 10.in-addr.arpa

Re: Better solution than making a recursive nameserver authoritative?

2011-06-27 Thread David Coulthart
On Jun 24, 2011, at 3:33 PM, Phil Mayers wrote: > On 06/24/2011 06:39 PM, David Coulthart wrote: > >> configure the zone as forward first, the recursive nameserver gets >> back the NS delegation& then uses that to perform an iterative query >> against the auth

Re: avoid-v4-udp-ports ineffective? (BIND 9.8.1-P1)

2011-11-17 Thread David Coulthart
On Nov 17, 2011, at 6:28 PM, Mark Andrews wrote: > In message <20171600.pahg0ucw011...@scramble.princeton.edu>, Irwin > Tillman writes: >> It appears that named is trying to use ports I've mentioned in >> avoid-v4-udp-ports. >> >> Platform: BIND 9.8.1-P1 on Solaris 10 / SPARC >> >> On some

Re: ISC BIND 9.6.1-P3 is now available

2010-01-20 Thread David Coulthart
On Jan 19, 2010, at 12:28 PM, Evan Hunt wrote: BIND 9.6.1-P3 is a SECURITY PATCH for BIND 9.6.1. It addresses two potential cache poisoning vulnerabilities, both of which could allow a validating recursive nameserver to cache data which had not been authenticated or was invalid. Do these vulne