Can we use rndc addzone to add zone in rpz configuration?

2020-05-26 Thread Blason R
Hi, Keen to know if rndc addzone functionality can be used to add zones in bind serving response-policy? If so then what would be my view? Do I need to define my view to make it work? I tried this and its failing hence wondering if rndc can be used to add zone or delete zone on the fly? Here is

Re: automating DS Record submit to parent with 'new' kasp/dnssec-policy support in bind?

2020-05-26 Thread Mark Andrews
This is where we need to get the registrars to follow standards. They are written so everyone doesn’t have to cobble together ad-hoc solutions. Hourly scans of all the DNSSEC delegations by the registrars would do. Personally I prefer push solutions but I couldn’t get the IETF to agree. https:

Re: Best way to force a TC=1 response?

2020-05-26 Thread Mark Andrews
> On 27 May 2020, at 07:27, John Levine wrote: > > In article you write: >> What's the best way to force an A query via UDP to return a TC=1 result: >> a really long CNAME chain? > > I'd suggest lots of records. You could do it with A records but you'd > need four times as many Well ~2

Re: Best way to force a TC=1 response?

2020-05-26 Thread John Levine
In article you write: >What's the best way to force an A query via UDP to return a TC=1 result: >a really long CNAME chain? I'd suggest lots of records. You could do it with A records but you'd need four times as many $ dig wordy.examp1e.com ;; Truncated, retrying in TCP mode. ; <<>>

Best way to force a TC=1 response?

2020-05-26 Thread Fred Morris
What's the best way to force an A query via UDP to return a TC=1 result: a really long CNAME chain? I want to set up a name that can be used in e.g. ping to perform an end to end resolution check in application context. The longer version is that there was a thread on postfix-users not too long

BIND log format Splunk regex

2020-05-26 Thread Bob Harold
I am told from my Splunk experts that the vendor supplied Splunk app for isc-bind matches the BIND 9.8 version used in RHEL6, but not the BIND 9.11 version using in RHEL7. I have a mix now. Does anyone have a REGEX for 9.11, or better yet, a regex that matches both formats? -- Bob Harold __

automating DS Record submit to parent with 'new' kasp/dnssec-policy support in bind?

2020-05-26 Thread PGNet Dev
i'm migrating/implementing the new `dnssec-policy` usage & KASP workflow in my bind 9.16.3. the new policy does a nice job of streamlining the signing/key mgmt. after key generation/rotation, the 'last step' is submitting new/changed DS Records to the relevant registrar i'd like to automate th

Re: Upgrade from 9.14 to 9.16 - transfer-source with low source port no longer works.

2020-05-26 Thread Matus UHLAR - fantomas
On 26.05.20 11:38, Ingeborg Hellemo wrote: If I do a full 'rndc reload' I finally get an error: May 26 11:08:14 ludvigsen named[25953]: unable to create dispatch for reserved port 129.242.5.254#53: permission denied Since this is a host with serveral virtual interfaces this address/port is set

Re: Upgrade from 9.14 to 9.16 - transfer-source with low source port no longer works.

2020-05-26 Thread Ingeborg Hellemo
ond...@isc.org said: > please see release notes: > https://downloads.isc.org/isc/bind9/9.16.3/RELEASE-NOTES-bind-9.16.3.html Thank you! Time to check my eyes (and renew my google search engine membership) since I should have been able to find that myself. --Ingeborg -- Ingeborg Østrem H

Re: Upgrade from 9.14 to 9.16 - transfer-source with low source port no longer works.

2020-05-26 Thread sthaug
> please see release notes: > > https://downloads.isc.org/isc/bind9/9.16.3/RELEASE-NOTES-bind-9.16.3.html > > This is listed in Known Issues for BIND 9.16.1: > >> • UDP network ports used for listening can no longer simultaneously be >> used for sending traffic. An example configuration wh

Re: Upgrade from 9.14 to 9.16 - transfer-source with low source port no longer works.

2020-05-26 Thread Ondřej Surý
Hi Ingeborg, please see release notes: https://downloads.isc.org/isc/bind9/9.16.3/RELEASE-NOTES-bind-9.16.3.html This is listed in Known Issues for BIND 9.16.1: > • UDP network ports used for listening can no longer simultaneously be > used for sending traffic. An example configuration w

Upgrade from 9.14 to 9.16 - transfer-source with low source port no longer works.

2020-05-26 Thread Ingeborg Hellemo
FreeBSD 11.3-RELEASE-p3 This morning I upgraded from BIND 9.14.11 to 9.16.3 via FreeBSD ports. Then I realize that my slave server no longer transfer zones from the master. The zone transfers worked as expected before the upgrade. There are no error messages. The slave receives notifies from th

Re: DLZ: dlz/modules, dlz/drivers ?

2020-05-26 Thread Evan Hunt
> contrib/README says that dlz/drivers are the old style dlz support, > and one should use dlz/modules. Correct. The modules in contrib/dlz/modules are loaded at runtime. Since they're dynamically linked, you don't have to link them into named at compile time, so configure doesn't know about them