Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

After going through OReilly dns and bind book, I still have problems with a master and slave configuration, I am getting

client 192.168.1.67#34245: update '<domain>.co.uk/IN' denied
as a syslog error for the master definintion of the zone. and
named[19034]: client 192.168.1.67#47452: update forwarding '<domain>.co.uk/IN' denied
as a syslog error for the slave definition

The server that has the master zones has a named.conf :

options {
    allow-transfer { 192.168.1/24; };
}
// The reverse lookup of 192.168.1.* - the local IP addresses
zone "1.168.192.in-addr.arpa" in {
    type master;
    file "192.168.1.db";
    allow-transfer { key TRANSFER; };
    allow-update { key TRANSER; };
};

// The forward lookup of hosts on this domain
zone "<domain>.co.uk" in {
    type master;
    file "<domain>.co.uk.db";
    allow-transfer { key TRANSFER; };
    allow-update { key TRANSER; };
};

key "TRANSFER" {
    algorithm hmac-md5;
    secret "<the secret key>";
};

# Slave DNS server
server 192.167.1.67 {
    keys {
            TRANSFER;
    };
};

The server that has the slave zones has :

options {
    allow-transfer { none; };
}

// The reverse lookup of 192.168.1.* - the local IP addresses
zone "1.168.192.in-addr.arpa" in {
    type slave;
    file "bak.192.168.1.db";
    masters { 192.168.1.52 key TRANSFER; };
    allow-update-forwarding { any; };
};

// The forward lookup of hosts on this domain
zone "blairsltd.co.uk" in {
    type slave;
    file "bak.blairsltd.co.uk.db";
    masters { 192.168.1.52 key TRANSFER; };
};

key "TRANSFER" {
    algorithm hmac-md5;
    secret "<the same secret key>";
};

# Master DNS server
server 192.167.1.52 {
    keys {
            TRANSFER;
    };
};

I think eveything is configured so it will allow all legitimate updates securely from the slave to the master, what am I missing?

share|improve this question
    
do you need to allow AXFR transfers for the slave ip? –  U4iK_HaZe Sep 6 '11 at 14:45
add comment

2 Answers

up vote 0 down vote accepted

allow-update-forwarding { any; }; is only on the slave's reverse lookup zone, so it's gonna block attempts to update the forward lookup zone on it - that's the error message on the slave.

The master is configured to require updates to be signed with the transfer key - based on its error message, that's probably not happening since the intent seems to have been to use that key for transfers, correct?

share|improve this answer
    
O.K. I have added allow-update-forwarding { key TRANSFER; }; to both slave zones, and fixed the I.P. address typo but I am still getting the above error on the master. –  Tim the Enchanter Sep 7 '11 at 10:24
    
@Tim You still have allow-update { key TRANSER; };, which is preventing unsigned updates. If your intent is to allow unauthenticated updates, then change to { all; };; if you don't need unsigned dynamic updates, or even dynamic updates at all, leave this in place. –  Shane Madden Sep 7 '11 at 14:19
    
Why do I need to allow unsigned updates, I thought I had done everything to allow secure updates? What other updates are trying to be applied? –  Tim the Enchanter Sep 8 '11 at 13:32
    
@Tim Updates are failing because clients are sending unsigned updates. If you don't want to allow unsigned updates, then just ignore the error messages when they fail. –  Shane Madden Sep 8 '11 at 14:19
    
Is there anyway to tell which clients are responsible for this, I'd like all updates to be done and all to be secure? –  Tim the Enchanter Sep 9 '11 at 12:44
add comment

Looks like some of your IPs are incorrect. Unless you have some special private network, change this:

# Slave DNS server
server 192.167.1.67 {
    keys {
            TRANSFER;
    };
};

# Master DNS server
server 192.167.1.52 {
    keys {
            TRANSFER;
    };
};

to this:

# Slave DNS server
server 192.168.1.67 {
    keys {
            TRANSFER;
    };
};

# Master DNS server
server 192.168.1.52 {
    keys {
            TRANSFER;
    };
};
share|improve this answer
    
I can't believe I made that typo! –  Tim the Enchanter Sep 7 '11 at 8:24
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.