Re: Server overwhelmed by rejections?

2010-01-20 Thread Matus UHLAR - fantomas
On 19.01.10 08:29, Lightner, Jeff wrote: Luckily my machines have enough horsepower not to shut down from this but I have on occasion seen the CPU load start going up due to it. On lowered powered machines this would likely cause what you're seeing. If you're running a firewall (external

Re: Strange CNAME issue

2010-01-20 Thread Niall O'Reilly
seren wrote: Hi, I've run into some strange issues with BIND and CNAMES. The examples you show indicate strange issues only with whatever name server code is running on your localhost. Nothing in your examples actually identify this as BIND. We're using BIND9 (on

Re: ISC BIND 9.5.2-P2 is now available

2010-01-20 Thread lhecking
Evan Hunt writes: BIND 9.5.2-P2 is now available. BIND 9.5.2-P2 is a SECURITY PATCH for BIND 9.5.2. It addresses two potential cache poisoning vulnerabilities, both of which could allow a validating recursive nameserver to cache data which had not been authenticated or

master server selection / notify

2010-01-20 Thread Matus UHLAR - fantomas
Hello, I wasn't able to find answer, if this is documented anywhere, please point me there. I like reading docs ;-) when I have configured a zone with multiple masters, does the server selection work the same way as ordinary when resolving remote domains? And if a NOTIFY comes from one of those

RE: Server overwhelmed by rejections?

2010-01-20 Thread Lightner, Jeff
I was quite satisfied the ones I blacklisted were causing my CPU load to spike and have seen no ill effects from having blocked them. I wasn't suggesting anyone blacklist every IP they don't recognize but rather those that are trying the same thing over and over such as attempting to update one

Re: Upgrading BIND 9.2.1 to BIND 9.6.1-p3 on AIX

2010-01-20 Thread Mark Andrews
In message ofe366df90.6b8e5635-on482576b1.00241d55-482576b1.00247...@sg.ibm.com, Balanagaraju Munukutla writes: Hi we are running BIND 9.2.1 on AIX 5.3 TL11. Now, I would like to upgrade it to BIND 9.6.1-p3. Is this BIND version is stable? Can anybody help me to suggest how upgrade

Re: ISC BIND 9.6.1-P3 is now available

2010-01-20 Thread David Coulthart
On Jan 19, 2010, at 12:28 PM, Evan Hunt wrote: BIND 9.6.1-P3 is a SECURITY PATCH for BIND 9.6.1. It addresses two potential cache poisoning vulnerabilities, both of which could allow a validating recursive nameserver to cache data which had not been authenticated or was invalid. Do these

Re: ISC BIND 9.6.1-P3 is now available

2010-01-20 Thread Cathy Almond
David Coulthart wrote: On Jan 19, 2010, at 12:28 PM, Evan Hunt wrote: BIND 9.6.1-P3 is a SECURITY PATCH for BIND 9.6.1. It addresses two potential cache poisoning vulnerabilities, both of which could allow a validating recursive nameserver to cache data which had not been authenticated or

Fatal Error in resolver.c

2010-01-20 Thread Timothy Holtzen
Our secondary server died last night with the following messages: named[18768]: resolver.c:3827: fatal error: named[18768]: RUNTIME_CHECK(((pthread_mutex_unlock(((res-buckets[bucketnum].lock))) == 0) ? 0 : 34) == 0) failed named[18768]: exiting (due to fatal error in library) Has anyone seen

Re: Notify storms

2010-01-20 Thread Matthew Pounsett
On 2010/01/20, at 13:03, Dave Sparro wrote: We would like to make this better. Can anyone help with ideas on this? Are we missing something obvious? In that situation I'd consider using CVS on all of the servers to maintain the DNS data. Just make all of the servers masters, and

Re: master server selection / notify

2010-01-20 Thread Peter Andreev
When I tested the multiple masters configuration, I noticed, that slave chooses master which sends notifies. I used bind-9.4.3-p2. 2010/1/20 Matus UHLAR - fantomas uh...@fantomas.sk Hello, I wasn't able to find answer, if this is documented anywhere, please point me there. I like reading

Re: Notify storms

2010-01-20 Thread Todd
serial-query-rate While this appears to be helping in the lab, it's still taking between 2 and 3 minutes for each slave to even finish receiving the NOTIFYs from the master. They then start hitting the master(s) with SOA queries whch seems to take a really long time. We're going to keep

compiling bind without xml support

2010-01-20 Thread Vincent Poy
Greetings everyone: How do I configure bind 9.5 and newer without xml support in FreeBSD as what happens is named fails to start in FreeBSD from /etc/rc.conf as it basically says: /libexec/ld-elf.so.1: Shared object libxml2.so.9 not found, required by named It runs fine when I do

Re: ISC BIND 9.5.2-P2 is now available

2010-01-20 Thread Sue Graves
This has been fixed, sorry. On 1/20/2010 2:13 AM, lheck...@users.sourceforge.net wrote: Evan Hunt writes: BIND 9.5.2-P2 is now available. BIND 9.5.2-P2 is a SECURITY PATCH for BIND 9.5.2. It addresses two potential cache poisoning vulnerabilities, both of which could allow

Re: Notify storms

2010-01-20 Thread Joseph S D Yao
On Wed, Jan 20, 2010 at 03:52:33PM -0500, Todd wrote: serial-query-rate While this appears to be helping in the lab, it's still taking between 2 and 3 minutes for each slave to even finish receiving the NOTIFYs from the master. They then start hitting the master(s) with SOA queries whch