Re: nsupdate reject

2019-05-20 Thread @lbutlr
On 20 May 2019, at 20:45, @lbutlr wrote: > > On 20 May 2019, at 16:21, Noel Butler wrote: >> allow-update { key "keyname"; }; > > Ah, no I did not. The instructions I found, as I mentioned in a later post, > were to add grant dons-key. iOS this a change in 9.14, because I did not have

Re: nsupdate reject

2019-05-20 Thread @lbutlr
On 20 May 2019, at 16:21, Noel Butler wrote: >allow-update { key "keyname"; }; Ah, no I did not. The instructions I found, as I mentioned in a later post, were to add grant dons-key. iOS this a change in 9.14, because I did not have to do this in 9.12? > and nsLOOKUP ? Just a thinko.

Re: nsupdate reject

2019-05-20 Thread Noel Butler
did you allow for it under the zone ? Adding a key as such will not give you global operations zone foo { ... allow-update { key "keyname"; }; ... } and nsLOOKUP ? Its either to early in the morning here and i'm mis-reading what you're doing, or you should be

Preferred log location with ISC copr package

2019-05-20 Thread John Thurston
I'm considering changing one of my BIND installations to use the experimental ISC-provided packages: https://www.isc.org/blogs/bind-9-packages/ With these packages, what it the recommended location for log files? A directory was created as part of the package installation:

Re: Should we remove the DLV code?

2019-05-20 Thread Grant Taylor via bind-users
On 5/20/19 4:34 AM, Matthijs Mekking wrote: * It will make the code much easier to maintain, which is beneficial for users too since that will mean in general less bugs, easier to find bugs, and easier to extend it with new features. Drive by 2ยข comment: Is the existing DLV code causing a

Re: nsupdate reject

2019-05-20 Thread @lbutlr
On 19 May 2019, at 18:27, @lbutlr wrote: > This is the same key block that is in named.conf. I am launching NSLOOKUP > with -k admin.key, but when I try to make a change and then "send", I get > "update failed: REFUSED." I found a page that recommended adding a ddns-key and then adding "grant

Re: BIND 9.10 fast only on alias IP

2019-05-20 Thread Ict Security
Dear Mukund, thank you for the excellent reply, really. In fact, it is very strange. In the same machine, and same Bind daemon, when incoming queries increase and bottlenecks become visible, is i try to query an alias IP it respond immediately. Bind doesn't seem to be the problem but, as you

Re: High load on BIND DNS and query timeouts after RPZ XFR retrieve

2019-05-20 Thread Mukund Sivaraman
On Sun, May 19, 2019 at 10:55:53PM +0200, Peter V wrote: > Hi all, > > I would like to get opinion on issue I was involved over weekend. > Customer utilizes RPZ feed from spamhaus and worked pretty OK for some > months after initial deployment. > They reported issue with wrong performance of BIND

Re: BIND 9.10 fast only on alias IP

2019-05-20 Thread Mukund Sivaraman
On Mon, May 20, 2019 at 10:06:09AM +0200, Ict Security wrote: > Dear guys, > > i am experiencing a very strange beahviour of Bind under busy peak time. > > With a quite important number of incoming DNS queries, response are > really, really slow; > sometimes they even stuck. > > If i try to

RE: nsupdate reject

2019-05-20 Thread Bob McDonald
The most obvious thing is to look at the zone and see if that key is included in an allow-update statement for the zone. Bob ___ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list

Should we remove the DLV code?

2019-05-20 Thread Matthijs Mekking
Dear BIND 9 users, The BIND 9 development team has been discussing whether we should remove the DLV code from the BIND 9 source. Reasons for doing this: * The zone dlv.isc.org has been decommissioned some time ago. * It will make the code much easier to maintain, which is beneficial for

BIND 9.10 fast only on alias IP

2019-05-20 Thread Ict Security
Dear guys, i am experiencing a very strange beahviour of Bind under busy peak time. With a quite important number of incoming DNS queries, response are really, really slow; sometimes they even stuck. If i try to query, in those busy moments, an alias secondary IP address of the same machine,