Re: ISC-Bind Cache preserveration

2025-08-05 Thread Mark Andrews
No. If you want robustness secondary every internal zone in your recursive servers. At the minimum secondary the zones at the top of every internal namespace. Set up also-notify so they stay up to date on changes. -- Mark Andrews > El 6 ago 2025, a las 5:34, Michael Mullig via bind-users

Re: ISC-Bind Cache preserveration

2025-08-05 Thread Marco Moock
Am 05.08.2025 um 19:33:55 Uhr schrieb Michael Mullig via bind-users: > We're using ISC-Bind (v 9.16.45) out at remote locations to serve as > part of local DNS service in the event of a WAN outage. However we > are faced with the possibility that we might also suffer a power > outage at these loca

Re: ISC-Bind Cache preserveration

2025-08-05 Thread Danilo Godec via bind-users
Hello, you could configure Bind at remote locations as secondaries for your internal domains, so that they have a copy of the zone locally. Other, non-internal domains probably don't matter while WAN isn't working.  

Re: isc-bind service shutdown after update at 9.20.7-1.2.el8

2025-03-26 Thread Ben Scott
nty of any kind. - Original Message - > From: "Michal Nowak" > To: "bind-users" > Sent: Tuesday, March 25, 2025 1:09:36 PM > Subject: Re: isc-bind service shutdown after update at 9.20.7-1.2.el8 > Hi, > > I can reproduce your problem when I se

RE: isc-bind service shutdown after update at 9.20.7-1.2.el8

2025-03-25 Thread Langlois Joël via bind-users
rt de Michal Nowak Envoyé : 25 mars 2025 13:10 À : bind-users@lists.isc.org Objet : Re: isc-bind service shutdown after update at 9.20.7-1.2.el8 Hi, I can reproduce your problem when I setup chroot. Tho, I think this is the expected behaviour unless you setup the systemd notify socket inside the c

Re: isc-bind service shutdown after update at 9.20.7-1.2.el8

2025-03-25 Thread Michal Nowak
edBy=multi-user.target [root@dns_server]# cat /etc/opt/isc/scls/isc-bind/sysconfig/named # Command line options passed to named OPTIONS="-4 -t /var/named/chroot" Thanks a lot for your help! -- Joel Langlois -Message d'origine- De : bind-users De la part de Michal Now

RE: isc-bind service shutdown after update at 9.20.7-1.2.el8

2025-03-24 Thread Langlois Joël via bind-users
=multi-user.target [root@dns_server]# cat /etc/opt/isc/scls/isc-bind/sysconfig/named # Command line options passed to named OPTIONS="-4 -t /var/named/chroot" Thanks a lot for your help! -- Joel Langlois -Message d'origine- De : bind-users De la part de Michal Nowak Envoyé :

Re: isc-bind service shutdown after update at 9.20.7-1.2.el8

2025-03-24 Thread Michal Nowak
For BIND 9.20.7 and 9.21.6 we changed the service type from "forking" to "notify", also ExecStart now has the "-f" option: -[Service] -Type=forking -ExecStart=/opt/isc/isc-bind/root/usr/sbin/named -u named +[Service] +Type=notify +ExecStart=/opt/isc/isc-bind/root/usr/sbin/named -u named -f Coul

Re: isc-bind service shutdown after update at 9.20.7-1.2.el8

2025-03-21 Thread Ondřej Surý
This looks like named is not sending the systemd notifications to the supervisor. Is there anything unusual on your system? Are those stock ISC packages? Ondrej -- Ondřej Surý — ISC (He/Him) My working hours and your working hours may be different. Please do not feel obligated to reply outside

Re: ISC BIND & Windows

2022-02-01 Thread Benny Pedersen
On 2022-02-01 17:59, Danny Mayer via bind-users wrote: Just run it as a docker image. Docker runs on Windows. next will be we all run windows 12 in docker :) /me hiddes, i am still using gentoo -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC fund

Re: ISC BIND & Windows

2022-02-01 Thread John Thurston
Check the list archives beginning April 2021 for the thread: Deprecating BIND 9.18+ on Windows (or making it community improved and supported)​ -- Do things because you should, not just because you can. John Thurston907-465-8591 john.thurs...@alaska.gov Department of Administration Sta

Re: ISC BIND & Windows

2022-02-01 Thread Danny Mayer via bind-users
On 2/1/22 11:14 AM, jukka.pakka...@qnet.fi wrote: Just read from the 9.18.0 release notes that Windows is not supported. Since don't remember reading expressly stated that Windows support would end with 9.16.x branch, inquiring if there is more information about future Windows compatibility

Re: ISC BIND & Windows

2022-02-01 Thread Matus UHLAR - fantomas
On 02.02.22 00:14, jukka.pakka...@qnet.fi wrote: Just read from the 9.18.0 release notes that Windows is not supported. Since don't remember reading expressly stated that Windows support would end with 9.16.x branch, inquiring if there is more information about future Windows compatibility ava

RE: ISC Bind as secondary to Windows Server: bad bitmap error on named xfer.

2021-05-12 Thread Stoffel, John (TAI)
: Service Now Self Service Portal -Original Message- From: Mark Andrews Sent: Wednesday, May 12, 2021 8:40 AM To: Stoffel, John (TAI) Cc: Tony Finch ; bind-users@lists.isc.org Subject: Re: ISC Bind as secondary to Windows Server: bad bitmap error on named xfer. There is enough information to

Re: ISC Bind as secondary to Windows Server: bad bitmap error on named xfer.

2021-05-12 Thread Mark Andrews
Now Self Service Portal > > > -Original Message- > From: Tony Finch On Behalf Of Tony Finch > Sent: Tuesday, May 11, 2021 7:13 PM > To: Stoffel, John (TAI) > Cc: bind-users@lists.isc.org > Subject: RE: ISC Bind as secondary to Windows Server: bad bitmap error on &g

RE: ISC Bind as secondary to Windows Server: bad bitmap error on named xfer.

2021-05-12 Thread Stoffel, John (TAI)
ubject: RE: ISC Bind as secondary to Windows Server: bad bitmap error on named xfer. Stoffel, John (TAI) wrote: > > And it does dump some errors too, which hopefully will give me an idea > of where my crappy bad record is located, and no use hiding crap: yuck, this looks lik

RE: ISC Bind as secondary to Windows Server: bad bitmap error on named xfer.

2021-05-11 Thread Stoffel, John (TAI)
John (TAI) Cc: bind-users@lists.isc.org Subject: Re: ISC Bind as secondary to Windows Server: bad bitmap error on named xfer. Stoffel, John (TAI) wrote: > failed while receiving responses: bad bitmap > > None of my googling has given me any hints on what this error could be. I had to

RE: ISC Bind as secondary to Windows Server: bad bitmap error on named xfer.

2021-05-11 Thread Tony Finch
Stoffel, John (TAI) wrote: > > And it does dump some errors too, which hopefully will give me an idea > of where my crappy bad record is located, and no use hiding crap: yuck, this looks like no fun... > www.cisco.toshiba.com. 3600IN CNAME redirect.toshiba.com. > www.cisco.toshiba.co

RE: ISC Bind as secondary to Windows Server: bad bitmap error on named xfer.

2021-05-11 Thread Stoffel, John (TAI)
..2..*T 65 16 1b 28 09 ac aa b3 41 f0 85 60 e6 e2 18 ae e..(A..` -Original Message- From: Tony Finch On Behalf Of Tony Finch Sent: Tuesday, May 11, 2021 5:24 PM To: Stoffel, John (TAI) Cc: bind-users@lists.isc.org Subject: Re: ISC Bind as secondary to Windows Server: bad

Re: ISC Bind as secondary to Windows Server: bad bitmap error on named xfer.

2021-05-11 Thread Tony Finch
Stoffel, John (TAI) wrote: > failed while receiving responses: bad bitmap > > None of my googling has given me any hints on what this error could be. I had to look at the source, which told me it's to do with NXT records which are super obsolete, so I wonder what weird stuff is in the zone that

Re: isc-bind-esv Repository - "yum update" doing undesirable things!

2019-05-28 Thread Michał Kępień
> Purely out of curiosity, I did try building libevent which failed > miserably:- > > (...) > > For my part, I am not concerned about this as I am not using DNSTAP and > only mention the issue in case others encounter it. Ah, thanks for checking this. I was wrong - SRPMs for dnstap dependencies

Re: isc-bind-esv Repository - "yum update" doing undesirable things!

2019-05-27 Thread Matthew Richardson
/rpmbuild/BUILD >libevent-2.1.8-stable >[root@li1523-85 ~]# ls /root/rpmbuild/SOURCES >libevent-2.1.8-stable.tar.gz libevent-nonettests.patch >[root@li1523-85 ~]# For my part, I am not concerned about this as I am not using DNSTAP and only mention the issue in case others encounter it.

Re: isc-bind-esv Repository - "yum update" doing undesirable things!

2019-05-27 Thread Michał Kępień
> Thank you for your most helpful advice. On Centos 7, I have easily managed > to build the non-scl packages using the following method starting with a > default Centos 7 (I was using Linode) logged in as root:- > > (...) > > However, my luck is not quite as good with Centos 6 where my method is

Re: isc-bind-esv Repository - "yum update" doing undesirable things!

2019-05-27 Thread Matthew Richardson
of installing the current Centos 6 Copr packages on the build machine, but that did not assist. Any guidance would be much appreciated. With many thanks. Best wishes, Matthew -- >From: Micha? K?pie? >To: Matthew Richardson >Cc: bind-users@lists.isc.org >Date: Mon, 13 May 2

RE: isc-bind-esv Repository - "yum update" doing undesirable things!

2019-05-13 Thread Lightner, Jeffrey
it to change the default Java version when multiple versions were installed, and I didn't want the latest to be the default. -Original Message- From: bind-users On Behalf Of Michal Kepien Sent: Monday, May 13, 2019 9:04 AM To: Matthew Richardson Cc: bind-users@lists.isc.org Subject:

Re: isc-bind-esv Repository - "yum update" doing undesirable things!

2019-05-13 Thread Michał Kępień
Matthew, > The tools (dig etc) are used both manually and by a number of scripts. > Following the upgrade without enabling SCL, dig (for example) was the > previous version which came from the previous Copr package. Is there any > official/recommended method for updating server to make the new to

Re: isc-bind-esv Repository - "yum update" doing undesirable things!

2019-05-13 Thread Matthew Richardson
quot; with SRPMs. Does this give the previous behaviour? Also, what is the correct location from which to download the SRPMs? With many thanks. Best wishes, Matthew -- >From: Micha? K?pie? >To: Matthew Richardson >Cc: bind-users@lists.isc.org >Date: Thu, 9 May 2019 09:19:13 +

Re: isc-bind-esv Repository - "yum update" doing undesirable things!

2019-05-13 Thread Michał Kępień
After running some experiments, our plan is to make the SCL RPMs for the upcoming set of releases (9.11.7, 9.14.2, 9.15.0; all due in two days) use an FHS-compliant directory layout. Scriptlets in the revised RPMs will attempt to adjust existing installations automatically, so that the upgrade is

Re: isc-bind-esv Repository - "yum update" doing undesirable things!

2019-05-10 Thread Michał Kępień
> I believe SCL allows multiple versions of the same package ... will ISC be > using SCL in this manner? If you are asking whether it will be possible to install multiple BIND Software Collections side by side on the same machine, then no. All our Copr repositories use the same Software Collecti

Re: isc-bind-esv Repository - "yum update" doing undesirable things!

2019-05-10 Thread Verne Britton
I believe SCL allows multiple versions of the same package ... will ISC be using SCL in this manner? Verne -- Verne Britton, Lead Systems Programmervoice: (304) 293-5192 x230 Systems Support Group (in W

Re: isc-bind-esv Repository - "yum update" doing undesirable things!

2019-05-10 Thread Michał Kępień
> If the old XPG4 and POSIX rules are to be at least paid some attention > then the config data should be under /etc/opt/isc/named and the software > binaries and libs stay in /opt/isc/named with logs going to the correct > /var/opt/isc/named. This is a good point, thanks for raising it. Software

Re: isc-bind-esv Repository - "yum update" doing undesirable things!

2019-05-09 Thread Michał Kępień
> While it is an understood intent to move to scl, it is not nesseraly a > welcome change for all. > We were excited and were hoping to start using ISB BIND rpm's as they used to > be prior to the latest build, but I guess we will have to continue building > our own rpm's. FWIW, currently publi

Re: isc-bind-esv Repository - "yum update" doing undesirable things!

2019-05-09 Thread Dmitry Vayntrub
While it is an understood intent to move to scl, it is not nesseraly a welcome change for all. We were excited and were hoping to start using ISB BIND rpm's as they used to be prior to the latest build, but I guess we will have to continue building our own rpm's. Anyways, highly appreciated the

Re: isc-bind-esv Repository - "yum update" doing undesirable things!

2019-05-09 Thread Michał Kępień
Hi Matthew, > I have been using the isc-bind-esv repository on Centos 7 since it was > created. On each upgrade, a "yum update" has done the correct thing by > upgrading from the running version to the latest version. > > Today (happily on a cloned test server!) I repeated this with the upgrade

Re: isc-bind-esv Repository - "yum update" doing undesirable things!

2019-05-08 Thread Dennis Clarke
On 5/8/19 11:06 PM, Greg Rivers wrote: On Wednesday, May 8, 2019 1:49:38 PM CDT Matthew Richardson wrote: I have been using the isc-bind-esv repository on Centos 7 since it was created. On each upgrade, a "yum update" has done the correct thing by upgrading from the running version to the lates

Re: isc-bind-esv Repository - "yum update" doing undesirable things!

2019-05-08 Thread Greg Rivers
On Wednesday, May 8, 2019 1:49:38 PM CDT Matthew Richardson wrote: > I have been using the isc-bind-esv repository on Centos 7 since it was > created. On each upgrade, a "yum update" has done the correct thing by > upgrading from the running version to the latest version. > > Today (happily on a

RE: ISC BIND 9.12.3-P1 Question re: DNSSEC Zone Signing

2019-03-19 Thread LeBlanc, Daniel James
[mailto:bind-users-boun...@lists.isc.org] On Behalf Of Alan Clegg Sent: March-18-19 9:12 PM To: bind-users@lists.isc.org Subject: Re: ISC BIND 9.12.3-P1 Question re: DNSSEC Zone Signing On 3/18/19 7:33 PM, LeBlanc, Daniel James wrote: > I have a pair of ISC BIND 9.12.3-P1 servers that are configu

RE: ISC BIND 9.12.3-P1 Question re: DNSSEC Zone Signing

2019-03-19 Thread LeBlanc, Daniel James
th dnssec-settime and dnssec-keygen or dnssec-keymgr. > I will try this out in the morning. > > Thanks again! > > Daniel J. LeBlanc, P.Eng., MBA, DTME | Senior Network Architect | Bell Canada > > -Original Message----- > From: Mark Andrews [mailto:ma...@isc.org] >

Re: ISC BIND 9.12.3-P1 Question re: DNSSEC Zone Signing

2019-03-18 Thread Mark Andrews
; Thanks again! > > Daniel J. LeBlanc, P.Eng., MBA, DTME | Senior Network Architect | Bell Canada > > -Original Message- > From: Mark Andrews [mailto:ma...@isc.org] > Sent: March-18-19 8:40 PM > To: LeBlanc, Daniel James > Cc: bind-users@lists.isc.org > Subject: Re: IS

Re: ISC BIND 9.12.3-P1 Question re: DNSSEC Zone Signing

2019-03-18 Thread Alan Clegg
On 3/18/19 7:33 PM, LeBlanc, Daniel James wrote: > I have a pair of ISC BIND 9.12.3-P1 servers that are configured as > slaves to a pair of Hidden Master servers.  The Hidden Masters are a > proprietary product and unfortunately when used to sign the zones, the > SOA records are not populated as e

RE: ISC BIND 9.12.3-P1 Question re: DNSSEC Zone Signing

2019-03-18 Thread LeBlanc, Daniel James
try this out in the morning. Thanks again! Daniel J. LeBlanc, P.Eng., MBA, DTME | Senior Network Architect | Bell Canada -Original Message- From: Mark Andrews [mailto:ma...@isc.org] Sent: March-18-19 8:40 PM To: LeBlanc, Daniel James Cc: bind-users@lists.isc.org Subject: Re: ISC BIND 9.12.3-P1

Re: ISC BIND 9.12.3-P1 Question re: DNSSEC Zone Signing

2019-03-18 Thread Mark Andrews
You don’t need update-policy local. In inline-signing mode named maintains its own copy of the zone with the DNSSEC records in addition to the copy from upstream. DNSSEC is controlled by rndc. > On 19 Mar 2019, at 10:33 am, LeBlanc, Daniel James > wrote: > > Hello All. > > I have a pair o

Re: ISC Bind stops answering queries

2018-09-20 Thread Dave
-users on behalf of Dave Warren *Sent:* 17 September 2018 19:01 *To:* bind-users@lists.isc.org *Subject:* Re: ISC Bind stops answering queries On Mon, Sep 17, 2018, at 06:07, Ian Collins wrote: I have been runnig various versions of ISC Bind for a number of years without any issues. My current

Re: ISC Bind stops answering queries

2018-09-18 Thread Ian Collins
Hi, Updated to the latest stable and it seems to have resolved t heissue. Thanks ian.. From: bind-users on behalf of Dave Warren Sent: 17 September 2018 19:01 To: bind-users@lists.isc.org Subject: Re: ISC Bind stops answering queries On Mon, Sep 17

Re: ISC Bind stops answering queries

2018-09-17 Thread Dave Warren
On Mon, Sep 17, 2018, at 06:07, Ian Collins wrote: > I have been runnig various versions of ISC Bind for a number of years > without any issues.> > My current server is a Windows 2012 R2 running 9.3.0 > <...> Does anyone have any idea what could be causing the server to > stop answering querie

Re: ISC Bind stops answering queries

2018-09-17 Thread Tony Finch
Ian Collins wrote: > > My current server is a Windows 2012 R2 running 9.3.0 Surely that has to be a typo! You should ensure that you are running the latest version of BIND on a supported branch, to avoid being vulnerable to known bugs that can crash your server. https://kb.isc.org/docs/aa-00913

Re: ISC Bind 9.11 and dyndb-ldap

2016-12-14 Thread Petr Mensik
- Original Message - From: "ramkishore b" To: comp-protocols-dns-b...@isc.org Sent: Tuesday, December 13, 2016 6:22:09 PM Subject: Re: ISC Bind 9.11 and dyndb-ldap On Monday, October 17, 2016 at 7:23:34 AM UTC+5:30, Pallissard, Matt wrote: > Has anyone successfully used LDAP as a

Re: ISC Bind 9.11 and dyndb-ldap

2016-12-13 Thread ramkishore . b
On Monday, October 17, 2016 at 7:23:34 AM UTC+5:30, Pallissard, Matt wrote: > Has anyone successfully used LDAP as a dynamic back-end for bind 9.11? > > > > Unless I'm reading the release notes/new features pages incorrectly the > bind-dyndb-ldap plugin has been rolled into ISC's official relea

Re: ISC Bind 9.11 and dyndb-ldap

2016-10-17 Thread Pallissard, Matt
On 10/17/2016 05:50 PM, Mark Andrews wrote: > In message , > "Pallissard, Matthew" writes: >> On 10/16/2016 09:34 PM, Mark Andrews wrote: >>> In message , "Pallissard, >>> Matt" writes: Has anyone successfully used LDAP as a dynamic back-end for bind 9.11? Unless I'm reading

Re: ISC Bind 9.11 and dyndb-ldap

2016-10-17 Thread Mark Andrews
In message , "Pallissard, Matthew" writes: > On 10/16/2016 09:34 PM, Mark Andrews wrote: > > In message , "Pallissard, > > Matt" writes: > >> > >> Has anyone successfully used LDAP as a dynamic back-end for bind 9.11? > >> > >> Unless I'm reading the release notes/new features pages incorrectly

Re: ISC Bind 9.11 and dyndb-ldap

2016-10-17 Thread Pallissard, Matthew
On 10/16/2016 09:34 PM, Mark Andrews wrote: > In message , "Pallissard, > Matt" writes: >> >> Has anyone successfully used LDAP as a dynamic back-end for bind 9.11? >> >> Unless I'm reading the release notes/new features pages incorrectly the >> bind-dyndb-ldap plugin has been rolled into ISC's o

Re: ISC Bind 9.11 and dyndb-ldap

2016-10-16 Thread Mark Andrews
In message , "Pallissard, Mat t" writes: > > Has anyone successfully used LDAP as a dynamic back-end for bind 9.11? > > Unless I'm reading the release notes/new features pages incorrectly the bind- > dyndb-ldap plugin has been rolled into ISC's official release and I shouldn't > have to mess ar

Re: [ISC BIND 9.10.2-P1 and older] "flawed" zone file modification check

2015-06-29 Thread Mark Andrews
In message , Barry Marg olin writes: > > Furthermore, it's not necessarily true that you want to ignore a zone > file just because it's older than the one previously used. Suppose you > restore a zone file from a backup, and it gets the original mtime. > Wouldn't you want a reload to pick this

Re: [ISC BIND 9.10.2-P1 and older] "flawed" zone file modification check

2015-06-29 Thread Barry Margolin
In article , Milos Ivanovic wrote: > To reproduce: > 1. Set the hardware clock to some time in the future > 2. Boot the system, including BIND > 3. Let NTP fix the time, or fix the time manually > 4. Edit a zone, finishing by increasing its serial > 5. run `rndc reload yourzone.example.com' > 6.

Re: [ISC BIND 9.10.2-P1 and older] "flawed" zone file modification check

2015-06-29 Thread Rob Foehl
On Tue, 30 Jun 2015, Milos Ivanovic wrote: I've encountered an edge case that was not considered while developing the method that BIND uses to check if a zone file has been modified. I will immediately state that this is an extreme edge case, but nonetheless one that should (and can) be avoided

Re: ISC Bind in Active Directory

2012-11-02 Thread Carsten Strotmann
Hello Phil, Phil Mayers writes: > On 10/24/2012 10:17 PM, Carsten Strotmann wrote: > >> my experience is that it is safe to place clients in either a DNS domain >> with the same name as the AD domain, or in a subdomain of the AD >> domain. > > What does "place" mean, exactly? configure the clie

Re: ISC Bind in Active Directory

2012-10-27 Thread Phil Mayers
On 10/27/2012 04:28 PM, Chuck Anderson wrote: I don't disagree that broadcast netbios probably should be disabled (though it's not at our site, for historical reasons, and I'm not sure I'm willing to take on the monumental task of disabling it). WINS is slightly different, and the main reason to

Re: ISC Bind in Active Directory

2012-10-27 Thread Chuck Anderson
> I don't disagree that broadcast netbios probably should be disabled > (though it's not at our site, for historical reasons, and I'm not > sure I'm willing to take on the monumental task of disabling it). > > WINS is slightly different, and the main reason to disable it is > that it hides misconf

Re: ISC Bind in Active Directory

2012-10-26 Thread Phil Mayers
On 10/25/2012 08:44 PM, Kevin Darcy wrote: On 10/24/2012 6:02 PM, Phil Mayers wrote: Hell, if you've got WINS running and broadcast netbios, I think it's still possible to log in with *no* working DNS at all. At the risk of getting *totally* off-topic, no-one who cares about security or abou

Re: ISC Bind in Active Directory

2012-10-25 Thread Kevin Darcy
On 10/24/2012 6:02 PM, Phil Mayers wrote: Hell, if you've got WINS running and broadcast netbios, I think it's still possible to log in with *no* working DNS at all. At the risk of getting *totally* off-topic, no-one who cares about security or about broadcast traffic on their LANs would ev

Re: ISC Bind in Active Directory

2012-10-24 Thread Phil Mayers
On 10/24/2012 10:17 PM, Carsten Strotmann wrote: my experience is that it is safe to place clients in either a DNS domain with the same name as the AD domain, or in a subdomain of the AD domain. What does "place" mean, exactly? Bear in mind that, unfortunately, Microsoft chose to embed DNS na

Re: ISC Bind in Active Directory

2012-10-24 Thread Carsten Strotmann
Hello Phil, Phil Mayers writes: > Our experience is that this can cause (minor) problems. > > The basic issue is that, if you have an AD realm: > > EXAMPLE.COM > > ...and a machine: > > foo > > ...then windows tries very hard to stick its fingers in its ears, > shout "la la I am not listening"

Re: ISC Bind in Active Directory

2012-10-24 Thread Carsten Strotmann
Hello Aaron, Aaron Thompson writes: > I have little experience in the AD arena for DNS/DHCP. Without being > a too loaded question, with your experience is it possible or common > to have a very knowledgeable understanding of the performance and > health of an AD system similar to a BIND syst

Re: ISC Bind in Active Directory

2012-10-24 Thread Phil Mayers
On 24/10/12 16:54, Kevin Darcy wrote: Why do you feel the need to register clients in your AD domain at all? We register our clients outside of the AD domain via the DHCP server; Our experience is that this can cause (minor) problems. The basic issue is that, if you have an AD realm: EXAMPLE

Re: ISC Bind in Active Directory

2012-10-24 Thread Chris Buxton
On Oct 24, 2012, at 6:50 AM, Nicholas F Miller wrote: > Scavenging is a concern but we didn't have much choice. Our AD is only one of > many subdomains and our DHCP spans all of them. If we used DHCP for DDNS > records we wouldn't be guaranteed unique names. By limiting DDNS to just the > AD we

Re: ISC Bind in Active Directory

2012-10-24 Thread Kevin Darcy
On 10/24/2012 9:50 AM, Nicholas F Miller wrote: On Oct 24, 2012, at 7:12 AM, Matus UHLAR - fantomas wrote: We use Bind for all DNS including DDNS for our AD. We use GSS-TSIG to control what record types and machines can make dynamic updates to our AD zone. We use ISC's DHCP but don't allow it

Re: ISC Bind in Active Directory

2012-10-24 Thread Nicholas F Miller
On Oct 24, 2012, at 7:12 AM, Matus UHLAR - fantomas wrote: >> We use Bind for all DNS including DDNS for our AD. We use GSS-TSIG to >> control what record types and machines can make dynamic updates to our AD >> zone. We use ISC's DHCP but don't allow it to do DNS updates since we use >> GSS-TSIG

Re: ISC Bind in Active Directory

2012-10-24 Thread Matus UHLAR - fantomas
On 22.10.12 13:39, Nicholas F Miller wrote: We use Bind for all DNS including DDNS for our AD. We use GSS-TSIG to control what record types and machines can make dynamic updates to our AD zone. We use ISC's DHCP but don't allow it to do DNS updates since we use GSS-TSIG at the client level inste

Re: ISC Bind in Active Directory

2012-10-22 Thread Nicholas F Miller
We use Bind for all DNS including DDNS for our AD. We use GSS-TSIG to control what record types and machines can make dynamic updates to our AD zone. We use ISC's DHCP but don't allow it to do DNS updates since we use GSS-TSIG at the client level instead.

Re: ISC Bind in Active Directory

2012-10-22 Thread Aaron Thompson
Hi Carsten, Thanks for the feedback, a top notch summary! I have little experience in the AD arena for DNS/DHCP. Without being a too loaded question, with your experience is it possible or common to have a very knowledgeable understanding of the performance and health of an AD system similar

Re: ISC Bind in Active Directory

2012-10-22 Thread Aaron Thompson
Nicholas, Are you using AD or Bind for DNS/DHCP? I'm assuming your using AD for authentication. Thanks for the feed back and input on the survey! Survey Request: Active Directory with ISC Bind and DHCPD http://www.surveymonkey.com/s/2VYNKW - Aaron Thompson Network Architect for IT Operations

Re: ISC Bind in Active Directory

2012-10-22 Thread Aaron Thompson
Michael, much appreciation for the feed back from our west coast Berkeley! You wouldn't know or have a copy of that Gartner paper would you?? Best, Aaron - Aaron Thompson Network Architect for IT Operations Berklee College of Music 1140 Boylston Street, MS-186-NETT Boston, MA 02215-369

Re: ISC Bind in Active Directory

2012-10-22 Thread Aaron Thompson
Kevin: So I think you separated services and updated Bind statically, sorry If my brevity description of your design is incorrect. Did you try or have any success or difficulties of having Bind as master and AD resolve directly to it as well as everyone else? Thanks for the feed back and the

Re: ISC Bind in Active Directory

2012-10-20 Thread Phil Mayers
b...@bitrate.net wrote: eful. > > >to be honest, this doesn't seem to me to be something that would fall >within bind's purview. comparing bind to "microsoft dns" isn't really >apples to apples. microsoft dns is more than just a dns server. it's >also a dns management system [whereas bind is no

Re: ISC Bind in Active Directory

2012-10-20 Thread Carsten Strotmann
Hello Aaron, Aaron Thompson writes: > I'm hopping to get some feedback from people who use ISC Bind and > DHCPD in Active Directory environments. [...] > > If you have any relevant feed back I would appreciate it.  I'm looking > for information on experience with Active Directory integration wi

Re: ISC Bind in Active Directory

2012-10-19 Thread btb
On Oct 19, 2012, at 13.27, Phil Mayers wrote: > Nicholas F Miller wrote: > >> DDNS record scavenging is the only feature I'm aware of that MS DNS has >> that Bind doesn't . On the flip side, ISC Bind can ACL who can add >> certain record types to a dynamic zone using GSS-TSIG as well as >> supp

Re: ISC Bind in Active Directory

2012-10-19 Thread Phil Mayers
Nicholas F Miller wrote: >DDNS record scavenging is the only feature I'm aware of that MS DNS has >that Bind doesn't . On the flip side, ISC Bind can ACL who can add >certain record types to a dynamic zone using GSS-TSIG as well as >supports views and ACLs for recursion. Everything else should be

Re: ISC Bind in Active Directory

2012-10-19 Thread Nicholas F Miller
DDNS record scavenging is the only feature I'm aware of that MS DNS has that Bind doesn't . On the flip side, ISC Bind can ACL who can add certain record types to a dynamic zone using GSS-TSIG as well as supports views and ACLs for recursion. Everything else should be standard DNS.

Re: ISC Bind in Active Directory

2012-10-19 Thread Barry S. Finkel
On 10/18/2012 3:17 PM, bind-users-requ...@lists.isc.org wrote: Hi All, I'm hopping to get some feedback from people who use ISC Bind and DHCPD in Active Directory environments. Currently we use Bind/DHCPD for dynamic DNS and DHCP. It's been a pretty stable service, redundant and we are polli

Re: ISC Bind in Active Directory

2012-10-18 Thread G.W. Haywood
Hi there, On Thu, 18 Oct 2012, bind-users-requ...@lists.isc.org wrote: ISC Bind in Active Directory (Aaron Thompson) I'm hopping Sometimes AD has that effect. :) to get some feedback from people who use ISC Bind and DHCPD in Active Directory environments. I've been working on a client's

Re: ISC Bind in Active Directory

2012-10-18 Thread Michael Sinatra
On 10/18/12 11:03 AM, Aaron Thompson wrote: > Hi All, > > I'm hopping to get some feedback from people who use ISC Bind and DHCPD > in Active Directory environments. > > Currently we use Bind/DHCPD for dynamic DNS and DHCP. It's been a > pretty stable service, redundant and we are polling statis

Re: ISC Bind in Active Directory

2012-10-18 Thread Kevin Darcy
You should think of DNS hosting, DNS resolution and DHCP, as separate services that can either be put together on a single platform, or run on separate platforms in various combinations, interoperating with each other. Another important factor is whether your AD domain is colocated with a bunch

Re: ISC BIND 9.8.2 followup announcement

2012-04-11 Thread Dennis Clarke
> >> fyi, DLZ external has been broken post 9.8.1p1. fails to compile with >> an undefined reference to main. both for 9.8.2 and 9.9.0 > > Thanks for the heads-up. Please open a bug ticket at bind9-b...@isc.org, > and include information about the OS you're building on. I expect this is > goin

Re: ISC BIND 9.8.2 followup announcement

2012-04-10 Thread Evan Hunt
> fyi, DLZ external has been broken post 9.8.1p1. fails to compile with > an undefined reference to main. both for 9.8.2 and 9.9.0 Thanks for the heads-up. Please open a bug ticket at bind9-b...@isc.org, and include information about the OS you're building on. I expect this is going to turn

Re: ISC BIND 9.8.2 followup announcement

2012-04-10 Thread David Ford
fyi, DLZ external has been broken post 9.8.1p1. fails to compile with an undefined reference to main. both for 9.8.2 and 9.9.0 -david make[4]: Entering directory `/usr/vport/portage/net-dns/bind-9.9.0/work/bind-9.9.0/bin/tests/system/dlzexternal' /bin/sh /usr/vport/portage/net-dns/bind-9.9.0

Re: ISC BIND 9.8.1b3 is now available

2011-07-20 Thread Mark Andrews
In message <20110717004717.gb24...@isc.org>, Evan Hunt writes: > > I am a bit intrigued by this entry in the CHANGES file > > > > 3133. [bug] Change #3114 was incomplete. [RT #24577] > > > > as I can't find a reference to #3114 or RT #24577 anywhere else... > > D'oh! Sorry about th

Re: ISC BIND 9.8.1b3 is now available

2011-07-16 Thread Evan Hunt
> I am a bit intrigued by this entry in the CHANGES file > > 3133. [bug] Change #3114 was incomplete. [RT #24577] > > as I can't find a reference to #3114 or RT #24577 anywhere else... D'oh! Sorry about that. 3114. [bug] Retain expired RRSIGs in dynamic zones if key is

Re: ISC BIND 9.8.1b3 is now available

2011-07-16 Thread Chris Thompson
On Jul 16 2011, Evan Hunt wrote: BIND 9.8.1b3 is the third beta release of BIND 9.8. I am a bit intrigued by this entry in the CHANGES file 3133. [bug] Change #3114 was incomplete. [RT #24577] as I can't find a reference to #3114 or RT #24577 anywhere else... -- Chris Thompson

Re: ISC BIND 9.8.0 is now available

2011-03-03 Thread Noel Butler
It should work too, it was fixed within in a few minutes :) On Thu, 2011-03-03 at 04:47 -0500, Dennis Clarke wrote: > > In addition to my pvt email Evan > > > > The dev link page still shows 9.7.3 as current production, no 9.8.0, but > > going to all downloads shows 9.8.0 as current productio

Re: ISC BIND 9.8.0 is now available

2011-03-03 Thread Dennis Clarke
> In addition to my pvt email Evan > > The dev link page still shows 9.7.3 as current production, no 9.8.0, but > going to all downloads shows 9.8.0 as current production, and as things > happen in three's ... > > bind-9.8.0.tar.gz clicking on this yields a file called > bind-980targz

Re: ISC BIND 9.8.0 is now available

2011-03-02 Thread Noel Butler
In addition to my pvt email Evan The dev link page still shows 9.7.3 as current production, no 9.8.0, but going to all downloads shows 9.8.0 as current production, and as things happen in three's ... bind-9.8.0.tar.gz clicking on this yields a file called bind-980targzno periods, l

SO_ACCEPTFILTER in FreeBSD (Was: Re: ISC BIND 9.6.3 is now available)

2011-02-04 Thread Doug Barton
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 02/04/2011 16:09, Evan Hunt wrote: | * A bug in NetBSD and FreeBSD kernels with SO_ACCEPTFILTER enabled | allows for a TCP DoS attack. Until there is a kernel fix, ISC is | disabling SO_ACCEPTFILTER support in BIND. [RT #225

Re: ISC BIND 9.7.0 syslog recorded notices

2010-02-19 Thread Jeremy C. Reed
On Fri, 19 Feb 2010, Jeremy C. Reed wrote: > Some loggings maybe could be made more clear, for example: > > stats.surfaid.ihost.com/ > no SOA returned Not sure why I saw that. Looking again I see com. But I have other problems there too. ___ bind

Re: ISC BIND 9.7.0 syslog recorded notices

2010-02-19 Thread Jeremy C. Reed
On Fri, 19 Feb 2010, ic.nssip wrote: > I just installed ISC 9.7.0 on one of our x86 SUN Solaris 10 machines. > I did a fresh local compiled install with all default settings. > It looks that DNS is working fine for customers (anyway the time is too short > to conclude that), but my syslog suddenly

Re: ISC BIND 9.7.0 syslog recorded notices

2010-02-19 Thread ic.nssip
I just installed ISC 9.7.0 on one of our x86 SUN Solaris 10 machines. I did a fresh local compiled install with all default settings. It looks that DNS is working fine for customers (anyway the time is too short to conclude that), but my syslog suddenly got populated with tones of daemon.notice

Re: ISC BIND 9.7.0 is now available

2010-02-19 Thread ic.nssip
Hi Doug, I just installed from a local compiled bind-9.7.0.tar.gz with all ISC defalt settings and the issue is gone. Thank you, Julian - Original Message - From: "Doug Barton" To: "ic.nssip" Cc: "Mark Andrews" ; Sent: Thursday, February 18, 2010

Re: ISC BIND 9.7.0 is now available

2010-02-18 Thread Doug Barton
On 02/18/10 16:20, ic.nssip wrote: Hi Mark, This is what I suspect too. Syslog gives me this record when I start BIND: named[14380]: [ID 873579 daemon.notice] built with '--with-openssl=yes' '--enable-largefile' '--sysconfdir=/usr/local/etc' '--localstatedir=/usr/local/var' Since no PREFIX w

Re: ISC BIND 9.7.0 is now available

2010-02-18 Thread ic.nssip
al/rrdtool-1.2.19/include -I/usr/local/BerkeleyDB.4.7/include -I/usr/local/include/lzo' 'CXX=g++' 'CXXFLAGS=-fpermissive -felide-constructors' Thank you, Julian - Original Message ----- From: "Mark Andrews" To: "ic.nssip" Cc: Sent: Thur

Re: ISC BIND 9.7.0 is now available

2010-02-18 Thread Mark Andrews
In message , "ic.nssip" writes: > Hello everyone, > > I tried to install BIND 9.7.0 from www.sunfreeware.com on a Solaris 10, x86 > machine that was running before BIND 9.6.1-P1 with no problems. > > The new install goes to the same directories, but for some reasons when I > run named-checkco

Re: ISC BIND 9.7.0 is now available

2010-02-18 Thread ic.nssip
Hello everyone, I tried to install BIND 9.7.0 from www.sunfreeware.com on a Solaris 10, x86 machine that was running before BIND 9.6.1-P1 with no problems. The new install goes to the same directories, but for some reasons when I run named-checkconf for my default /etc/named.conf file I get:

  1   2   >