I've configured bind-9.7.1 with DNSSec and stored the keys online, to
allow dynamic updates via nsupdate. Here are the relevant bits from my
named.conf:
options {
...
dnssec-enable yes;
directory "/var/named/db";
key-directory "/var/named/keys";
...
};
key foo {
algorithm hmac-md5;
secret "XXXXX";
};
view "global" {
zone "example.org" {
type master;
file "example.org.signed";
allow-update {
key foo;
};
};
I have KSK and ZSK pairs for example.org, I can query data from the
zone and get all the DNSSec bits back as expected, everything works
fine. I can even do this on a remote server:
$ nsupdate
server my-example-server.example.org
key foo XXXXX
zone example.org
update add somerecord.example.org 300 A 192.168.0.123
send
And have it work perfectly (i.e. the KSK and ZSK in the key-directory
are found and used by named).
The problem is that, when I attempt
rndc sign example.org
from my server, I get
rndc: 'sign' failed: permission denied
The only thing logged by my server is
07-Jul-2010 15:11:29.614 info: received control channel command 'sign
example.org'
No indication as to what "permission" is denied, specifically.
Any ideas as to what I may be doing wrong ?
The server runs as user 'named', and the keys in the key directory are
owned by 'named' with rw permissions (both public and private). This
is also evidenced by the fact that nsupdate works, even from a remote
machine.
Thanks for any ideas,
--Gabriel
_______________________________________________
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
