bind and certbot with dns-challenge

2019-03-17 Thread Stephan von Krawczynski
Hello all, I am using "BIND 9.13.7 (Development Release) " on arch linux. Up to few days ago everything was fine using "certbot renew". I had "allow-update" in nameds' global section, everything worked well. Updating to the above version threw a config error that "allow-update" has no global

Re: bind and certbot with dns-challenge

2019-03-17 Thread Stephan von Krawczynski
On Sun, 17 Mar 2019 12:40:35 +0100 Reindl Harald wrote: > Am 17.03.19 um 12:13 schrieb Stephan von Krawczynski: > > So why is it, that there is no global way of defining default zone > > definitions which are only overriden by the actual zone definition? > > maybe because it brings a ton of

Re: bind and certbot with dns-challenge

2019-03-17 Thread Timothe Litt
Named has options at the global, view and zone levels.  The 9.11 ARM shows allow-update in the options and zone statements.  If it's broken in 9.13 - note that it is a "Developement Release". So bugs are expected, and you should raise an issue on bind9-bugs or on gitlab

Re: bind and certbot with dns-challenge

2019-03-17 Thread Grant Taylor via bind-users
On 3/17/19 8:35 AM, Stephan von Krawczynski wrote: In todays' internet this is no niche any more. Oh, there most certainly are niches today. I think there are more today than there were before. And the right tool means mostly "yet-another-host" because you then need at least a cascade of

Re: bind and certbot with dns-challenge

2019-03-17 Thread Alan Clegg
On 3/17/19 7:13 AM, Stephan von Krawczynski wrote: > Hello all, > > I am using "BIND 9.13.7 (Development Release) " on arch linux. Up > to few days ago everything was fine using "certbot renew". I had > "allow-update" in nameds' global section, everything worked well. Updating to > the above

Re: allow-update in global options (was Re: bind and certbot with dns-challenge)

2019-03-17 Thread Grant Taylor via bind-users
On 3/17/19 2:37 PM, Alan Clegg wrote: It turns out that this series of changes, taken as a whole, removed allow-update as a global option. That sounds like either an unintended consequence -or- a change in anticipated ~> expected behavior by some people. The question now becomes: Is there

Re: bind and certbot with dns-challenge

2019-03-17 Thread Grant Taylor via bind-users
On 3/17/19 5:13 AM, Stephan von Krawczynski wrote: Hello all, Hi, I am using "BIND 9.13.7 (Development Release) " on arch linux. Up to few days ago everything was fine using "certbot renew". I had "allow-update" in nameds' global section, everything worked well. Updating to the above

allow-update in global options (was Re: bind and certbot with dns-challenge)

2019-03-17 Thread Alan Clegg
On 3/17/19 2:51 PM, Alan Clegg wrote: > On 3/17/19 7:13 AM, Stephan von Krawczynski wrote: >> Hello all, >> >> I am using "BIND 9.13.7 (Development Release) " on arch linux. Up >> to few days ago everything was fine using "certbot renew". I had >> "allow-update" in nameds' global section,

Re: allow-update in global options (was Re: bind and certbot with dns-challenge)

2019-03-17 Thread Timothe Litt
Data points: I saw another report of this issue on gitlab - #913 just after my previous note.  It indicated that a distributions initial configuration breaks with the change.  I see that it has been updated by Alan since. I checked my configuration files. I use allow-update-forwarding at the

Re: allow-update in global options (was Re: bind and certbot with dns-challenge)

2019-03-17 Thread Alan Clegg
On 3/17/19 5:52 PM, Grant Taylor via bind-users wrote: > On 3/17/19 2:37 PM, Alan Clegg wrote: >> It turns out that this series of changes, taken as a whole, removed >> allow-update as a global option. > > That sounds like either an unintended consequence -or- a change in > anticipated ~>

Re: allow-update in global options (was Re: bind and certbot with dns-challenge)

2019-03-17 Thread @lbutlr
On 17 Mar 2019, at 15:52, Grant Taylor via bind-users wrote: > If the consensus is that the new behavior is desired, I would hope ~> expect > for a survey of the BIND user community like I've seen in the past about > removing / significantly altering functionality. I disagree. I'd prefer the

Re: allow-update in global options (was Re: bind and certbot with dns-challenge)

2019-03-17 Thread Grant Taylor via bind-users
On 3/17/19 5:48 PM, @lbutlr wrote: I disagree. I'd prefer the best decision be made by consensus of the contributors rather than the community at large. I agree that the decision should be made by the contributors / maintainers. I'm saying that I think they should have data / information /

Re: allow-update in global options (was Re: bind and certbot with dns-challenge)

2019-03-17 Thread Grant Taylor via bind-users
On 3/17/19 6:31 PM, Alan Clegg wrote: The change was an unintended consequence ending up in what was thought to have been the correct behavior all along, so.. Yes. How many zones are you authoritative for? I think most people on this list have forgotten how to count as low as the number of