up vote 1 down vote favorite
share [g+] share [fb]

From everything I've researched and tried, it appears that my named.conf is configured correctly, including the allow-transfer section.

EDIT I just took out the allow-transfer block and restarted bind. This should now allow anyone to do a transfer. The ones that could before still can, but the two servers that had problems before are still being denied! EDIT

Here is a sample of the errors. It is only happening with a couple of my secondary servers, but it is happening for every zone for those servers that are failing. One of the servers is attempting IXFR, the other AXFR. The result is the same:

18-Mar-2011 14:27:51.372 security: error: client 84.234.24.90#59208: zone transfer 'juansgaranton.com/IXFR/IN' denied

18-Mar-2011 14:32:18.015 security: error: client 174.37.196.55#50783: zone transfer 'cheshirecat.net/AXFR/IN' denied

Here is the relevant part of named.conf. 

options {
        directory "/etc/bind";
        pid-file "/var/run/named/named.pid";
        files 4096;

        allow-transfer { 140.186.190.103; 84.234.24.90; 207.246.95.34;
                         203.20.52.5; 140.186.190.103; 127.0.0.1; 174.37.196.55; };
};

logging {
channel "bind" {
    file "/var/log/bind.log" versions 3;
    print-time yes;
    print-severity yes;
    print-category yes;
    severity info;
};

category lame-servers { null; };
category "default" { "bind"; };
};
link|improve this question
0% accept rate
Do you have a more restrictive allow-transfer in your zone configuration blocks? – Zoredache Mar 18 '11 at 23:13
Nope, just the one global. – danielj Mar 18 '11 at 23:16
Have you tried briefly adding an allow-transfer setting into one of your zones? – Zoredache Mar 18 '11 at 23:18
At your suggestion, I just tried it. No difference. – danielj Mar 19 '11 at 2:21
1  
Also verify that you're allowing TCP:53 to the server you're trying to transfer from. – Greeblesnort Apr 11 '11 at 20:48
show 1 more comment
feedback

1 Answer

up vote 1 down vote

Check your firewall to make sure you have port 53/tcp open from your slaves. If the zone is larger than 512 bytes the transfer needs to go across tcp versus udp.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.