Re: DNS Blackholing

2012-12-04 Thread Phil Mayers
On 12/04/2012 02:44 AM, John Hascall wrote: We have found that RPZ works quite well for us. We have 366825 names in our RPZ zone at present and scaling thus far has been a non-issue.ot ( Likewise. We have 675k entries in an RPZ zone, and performance is fine. It's genuinely surprising how

R: OT - Dns test Q/A - [[]] - ok it's an OT, but no help?

2012-12-04 Thread Chiesa Stefano
-Messaggio originale- Da: bind-users-bounces+stefano.chiesa=wki...@lists.isc.org [mailto:bind-users-bounces+stefano.chiesa=wki...@lists.isc.org] Per conto di Chiesa Stefano Inviato: giovedì 29 novembre 2012 11.44 A: bind-users@lists.isc.org Oggetto: OT - Dns test Q/A - [[]] Hello

Update view without using 2 ip for each DNS Server

2012-12-04 Thread manman
Hi all and thanks for existing!!! I have two DNS server 1 Master and 1 Slave both of them with 2 view: - 1 external view, used for resolve existing domain; - 1 internal view with recursion enabled. When there is an update Master-Slave, the process to update 2 view is the follow: - The First IP

Re: Update view without using 2 ip for each DNS Server

2012-12-04 Thread Niall O'Reilly
On 4 Dec 2012, at 11:23, manman wrote: Is it possible to update the second view when the firstl view is updated without having to assign 2 IPs like now ? You could use a pair of TSIG secrets instead of a pair of IP addresses. There has been discussion about this on the list

Re: Update view without using 2 ip for each DNS Server

2012-12-04 Thread Kevin Oberman
On Tue, Dec 4, 2012 at 4:09 AM, Niall O'Reilly niall.orei...@ucd.ie wrote: On 4 Dec 2012, at 11:23, manman wrote: Is it possible to update the second view when the firstl view is updated without having to assign 2 IPs like now ? You could use a pair of TSIG secrets instead of a

Re: DNS Blackholing

2012-12-04 Thread Barry S. Finkel
On 12/4/2012 6:00 AM, John Hascall j...@iastate.edu wrote: We have found that RPZ works quite well for us. We have 366825 names in our RPZ zone at present and scaling thus far has been a non-issue. A question from the OP that has not yet been answered - Make the zones masters on all servers.

ISC Security Advisory: BIND 9 servers using DNS64 can be crashed by a crafted query

2012-12-04 Thread Michael McNally
A specific query can cause BIND nameservers using DNS64 to exit with a REQUIRE assertion failure. CVE: CVE-2012-5688 Document Version:2.0 Posting date:04 Dec 2012 Program Impacted:BIND Versions affected: 9.8.0-9.8.4, 9.9.0-9.9.2 Severity:

BIND 9.9.2-P1 is now available

2012-12-04 Thread Michael McNally
Introduction BIND 9.9.2-P1 is a security-fix release, superceding BIND 9.9.2 as the latest production release of BIND 9.9. This document summarizes changes from BIND 9.9.1 to BIND 9.9.2-P1. Please see the CHANGES file in the source code release for a complete list of all changes.

BIND 9.8.4-P1 is now available

2012-12-04 Thread Michael McNally
Introduction BIND 9.8.4-P1 is a security-fix release, superceding BIND 9.8.4 as the latest production release of BIND 9.8. This document summarizes changes from BIND 9.8.3 to BIND 9.8.4-P1. Please see the CHANGES file in the source code release for a complete list of all changes.

Re: Upstart job for BIND9

2012-12-04 Thread Anand Buddhdev
On 29/11/2012 11:25, Alexander Gurvitz wrote: Hi Alexander, I'm trying to run a bind9 from an upstart job instead of an init.d script. I'm a bit confused if I should expect fork or expect daemon. It seems to work with expect fork, though somehow I don't feel convinced. Actually, you don't

Re: DNS Blackholing

2012-12-04 Thread Ray Van Dolson
On Tue, Dec 04, 2012 at 09:45:07AM +, Phil Mayers wrote: On 12/04/2012 02:44 AM, John Hascall wrote: We have found that RPZ works quite well for us. We have 366825 names in our RPZ zone at present and scaling thus far has been a non-issue.ot ( Likewise. We have 675k entries in an RPZ

RHEL, Centos, Fedora rpm 9.9.2-p1

2012-12-04 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 http://www.five-ten-sg.com/util/bind-9.9.2-0.2.P1.fc18.src.rpm EL4: rpmbuild --rebuild --define 'dist .el4' \ bind-9.9.2-0.2.P1.fc18.src.rpm EL5: rpmbuild --rebuild --define 'dist .el5' \ bind-9.9.2-0.2.P1.fc18.src.rpm EL6:

Re: DNS Blackholing

2012-12-04 Thread Nick Edwards
Hi All, Is there a way for RPZ zone file to act on domain AND subdomains without using two separate entries? At present I can only get them to match on one or the other unless I do example.comblah *.example.com blah I'm sure I've missed the obvious, but thought I'd ask