Re: BIND 9.10 compilation problem for FreeBSD 6.x/7.x

2014-05-06 Thread Daniel Ryšlink
Both FreeBSD 6 and 7 are years past their End of Life date, and are no longer supported. The oldest supported branch is 8.4-RELEASE. -- Daniel Ryšlink System Administrator Dial Telecom a. s. Kr(ižíkova 36a/237 186 00 Praha 3, C(eská Republika Tel.:+420.226204627 daniel.rysl...@dialtelecom.cz

Re: BIND 9.10 compilation problem for FreeBSD 6.x/7.x

2014-05-06 Thread Tony Finch
Shawn Zhou shawnzho...@yahoo.com wrote: Any problem has problem building BIND 9.10 for FreeBSD? We are using the same process that worked for building 9.9.4 to build 9.10 on FreeBSD 6.x/7.x but we are getting ld: invalid BFD target error. Yes. BIND's linking stage changed between 9.9 and 9.10

Re: GSS-TSIG updates from Windows clients

2014-05-06 Thread Nicholas F Miller
You might try changing your update-policy from: grant johnmill-dnst...@lab.brandeis.edu zonesub ANY; grant * zonesub ANY; to grant johnmill-dnst...@lab.brandeis.edu zonesub ANY; grant LAB.BRANDEIS.EDU zonesub ANY; I’m not positive this is the proper syntax since we don’t use the zonesub

Re: bin 9.10 verbose logging

2014-05-06 Thread Tony Finch
Noel Butler noel.but...@ausics.net wrote: U, since upgrade 9.9.5 to 9.10 every request to the name server is spewing copious amounts of debug type data (thankfully I only upgraded the one server) Was debug left on in the final release source code? :) When I was running pre-release

Re: BIND 9.10 compilation problem for FreeBSD 6.x/7.x

2014-05-06 Thread Shawn Zhou
Thanks for explanation and solution! I just tested the change and worked fine. On Tuesday, May 6, 2014 7:32 AM, Tony Finch d...@dotat.at wrote: Shawn Zhou shawnzho...@yahoo.com wrote: Any problem has problem building BIND 9.10 for FreeBSD? We are using the same process that worked for

Point domain name of my zone to name in somebody else's zone?

2014-05-06 Thread Rom, Gloria
Hello All, Here's an easy one. I administer a zone that consists of a few names, each of which points to a name in a zone that I do not administer. Now my project manager wants to resolve the domain name of my zone to another name in that foreign zone. Can I tell him that it can't be done,

Re: Point domain name of my zone to name in somebody else's zone?

2014-05-06 Thread Kevin Darcy
The apex name of a zone can't own a CNAME, if that's what you're asking. E.g. the name example.com can't be a CNAME pointing at otherexample.com. But, of course, you can certainly put A and/or records at the apex, that resolve to one or more addresses in one or more ranges you don't

RE: Point domain name of my zone to name in somebody else's zone?

2014-05-06 Thread Rom, Gloria
Yup, that's what I was asking. Thanks. Gloria Rom UCLA Library Digital Initiatives and Information Technology glor...@library.ucla.edumailto:glor...@library.ucla.edu 310-206-9784 From: bind-users-boun...@lists.isc.org [mailto:bind-users-boun...@lists.isc.org] On Behalf Of Kevin Darcy Sent:

Re: GSS-TSIG updates from Windows clients

2014-05-06 Thread John Miller
Thanks to both Mark and Nicholas for the help. Unfortunately, still not able to get this working (BIND 9.8.2 (RHEL 6) AD 2008R2). It's a case of AD negotiating a TKEY (successfully), then reverting back to unsigned updates. If an update's not signed, doesn't matter what your update-policy

Multi-master (HA)

2014-05-06 Thread Baird, Josh
Hi, For those of you who operate at multiple sites or datacenters, are you doing any HA for your BIND masters? Ideally, we would have a master in each datacenter; maybe not an active one, but one that is standing by in case your primary master becomes unavailable. Do you have multiple

Re: Multi-master (HA)

2014-05-06 Thread Marty Lee
Josh, we use multiple masters across multiple hosts, with mysql as a backend for the zone data. Each DNS server is a master and has it’s own local mysql DB. Each mysql database is then kept in ‘sync’ using mysql replication over a VPN link from a single (private) admin host. The single admin

Re: Multi-master (HA)

2014-05-06 Thread Evan Hunt
On Tue, May 06, 2014 at 06:20:11PM +, Baird, Josh wrote: Hi, For those of you who operate at multiple sites or datacenters, are you doing any HA for your BIND masters? Ideally, we would have a master in each datacenter; maybe not an active one, but one that is standing by in case your

bind 9.10.0 xfer test failing

2014-05-06 Thread J. Thomsen
I am wondering why a particular test of 9.10.0 is failing and how it can be fixed. It happens repeatedly with linux on two different hardware platforms. I:System test result summary: I: 1 FAIL I: 63 PASS I: 4 SKIPPED T:xfer:1:A A:System test xfer I:testing basic zone transfer

Re: Multi-master (HA)

2014-05-06 Thread Phil Mayers
On 06/05/2014 19:39, Evan Hunt wrote: I don't want to influence the conversation here by saying too much about the ideas we've had so far, but I wanted to say: if anyone has specific thoughts on how to make this sort of thing easier in BIND -- even just at the level of boy, it irritates me that

Re: Multi-master (HA)

2014-05-06 Thread Alan Clegg
On 5/6/14, 3:41 PM, Phil Mayers wrote: I could expand on the idea if people don't think it's too insane ;o) I suspect it has all kinds of caveats I haven't thought of, however. The concept of a meta-zone containing config data is something that I discussed with a number of ISC staff over the

Re: BIND 9.10 compilation problem for FreeBSD 6.x/7.x

2014-05-06 Thread Mark Andrews
In message alpine.lsu.2.00.1405061457310.1...@hermes-1.csi.cam.ac.uk, Tony Fi nch writes: Shawn Zhou shawnzho...@yahoo.com wrote: Any problem has problem building BIND 9.10 for FreeBSD? We are using the same process that worked for building 9.9.4 to build 9.10 on FreeBSD 6.x/7.x but we

Re: bind 9.10.0 xfer test failing

2014-05-06 Thread Mark Andrews
In message 2ddim91ft8u2u4uelvoqeajer8idpj6...@4ax.com, J. Thomsen writes: I am wondering why a particular test of 9.10.0 is failing and how it can be= fixed. It happens repeatedly with linux on two different hardware platforms. I:System test result summary: I: 1 FAIL I: 63

need a temp workaround for dns64 when A is available and AAAA SERVFAILs

2014-05-06 Thread Veaceslav Revutchi
I need to provide DNS64 on a caching resolver for a project (MS direct access). It will mostly be resolving internal names, most of which are delegated to an LB. The requests will be arriving over v4 only (nat64 already in place). Here is the setup: for simplicity I will show one authoritative

Re: BIND 9.10.0 is now available

2014-05-06 Thread James Brown
I can’t download the source for 9.10.0. www.isc.org/downloads/# Click on Download for 9.10.0. Modal-1 appears. Click on BIND 9.10.0 - tar.gz. It tries to download: http://www.isc.org/downloads/file/bind-9-10-0b1-2/?version=tar.gz and fails. Looks like that link is wrong. Anyone else having

Re: BIND 9.10.0 is now available

2014-05-06 Thread Mark Andrews
In message 9cd0cbfd-743d-455a-9000-6ceb8d926...@bordo.com.au, James Brown wri tes: I can't download the source for 9.10.0. www.isc.org/downloads/# Click on Download for 9.10.0. Modal-1 appears. Click on BIND 9.10.0 - tar.gz. It tries to download:

ISC Responds to Questions About SRTT Algorithm Vulnerability

2014-05-06 Thread Michael McNally
This week several of our customers have contacted us to inquire about our reaction to an article entitled Critical Vulnerability in BIND Software Puts DNS Protocol Security at Risk [1] ISC would like to clarify that we evaluated the risk from this issue in 2013 when it was disclosed to us, and