Hi, I have had a DNS server with a dynamic zone that allows updates running for a fair number of years. However, I discovered yesterday that this setup no longer works and I cannot see anything in the documentation that indicates why. Unfortunately, I did not notice when this broke, so it may have been a while ago. Here's my setup:
Starting with a plain Ubuntu 24.04 server (also tried with 22.04 as well as 24.04 + the ISC PPA) that has static network configuration and systemd-resolved disabled plus bind9 package installed. Config: /etc/bind/named.conf.options: options { directory "/var/cache/bind"; dnssec-validation no; listen-on { any; }; listen-on-v6 { none; }; }; /etc/bind/named.conf.local: zone "dyn.example.com" { type primary; masterfile-format text; check-names ignore; file "/var/lib/bind/db.dyn.example.com"; update-policy { grant local-ddns zonesub any; grant * self . any; }; }; /var/lib/bind/db.dyn.example.com: $ORIGIN . $TTL 60 dyn.example.com IN SOA 127.0.0.1. admins.example.com. (2024080306 300 300 604800 60) NS 127.0.0.1. Then I run from the command-line (better run this from an empty directory or else the wild-cards may pick up the wrong files): dnssec-keygen -a ECDSAP384SHA384 -n host -K . -T KEY test.dyn.example.com nsupdate -4l <<<$'update add '"$(sed -e 's/ IN / 60 /' ./*.key)"$'\nsend\n' nsupdate -k *.private <<<$'server 127.0.0.1\nupdate add test.dyn.example.com. 60 IN A 10.200.20.28\nsend\n' The first command generates a key-pair, the second uses the local session key to add the public key into the zone and the last one is supposed to use the newly added key to add an address. It is the last command that fails with "REFUSED" and I cannot figure out what's wrong. I'm fairly sure nothing has changed on my end and that this simplified example is a fair representation of what used to work. In any case, I believe this example *should* work according to the docs. Any ideas? Cheers, Seb
-- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users