Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to configure bind to accept updates from the dhcp server, I have made the changes to the dhcpd.conf file to refer to the appropriate zones and the rndc.key password file but when I restart the dhcp server I get :

Can't open /etc/bind/rndc.key: Permission denied

rndc.key has permissions 640, group and owner is bind.

If I change rndc.key to have permissions of 666 it works, but this is insecure is there a better way?

Ubuntu 11.04

share|improve this question
up vote 2 down vote accepted

For me, using rndc.key for DHCP updates seems to be a strange idea. (I googled some debian manual that used such a setup, maybe that is where it originates from). Besides, according to bind manual, rndc.key is kept just for backward compatibility with bind8.

What I'd suggest is the following: for DHCP, insert the following statement directly in both named.conf and your DHCP configuration file:

key "zone-updates-key" {
        algorithm       hmac-md5;
        secret          "lgkbhjhtthgtlghtl6567==";

(of course change the secret phrase ;) , you may generate random one by running rndc-confgen)

There's no need for any "include rndc.key" statements. Now into zone config in named.conf you add

allow-update { key "zone-updates-key"; };

and in dhcp zone config:

key zone-updates-key;

That's all. Both files should be readable by their respective processes, as usual.

** You may choose to stop here as well **

For rndc, you may run rndc-confgen and use it's output in rndc.conf and named.conf - this way bind will not use rndc.key at all.

(As for why not to use rndc.key for dynamic updates: this key gives complete control over bind, and there's no reason to compromise that if all you need is dynamic updates for single zone.)

Alternatively, in newer bind versionss, there's /var/run/named/session.key that may be helpful - have a look at "session-..." bind directives.

share|improve this answer
I have a primary and secondary server, updates are restricted by the use of the key, I thought since I made it only possible for dhcp to revise the zone data using the same key. – Tim the Enchanter Nov 22 '11 at 14:54
Sorry ? (Don't get your point) – Sandman4 Nov 22 '11 at 15:04
If I need to use the rndc key for the DNS updates do I not also need to use the same key for DHCP updates? – Tim the Enchanter Nov 22 '11 at 15:43
rndc key made for program called rndc which used to control commands like reload bind configuration and such, it is normally not related to zone updates. For DNS updates you may use another key, and you may have separate keys for each zone, for each "updater" etc. – Sandman4 Nov 22 '11 at 15:55
What you need for DHCP to make DNS updates is some key that will be same on DHCP and DNS servers, and on DNS that key should be listed in allow-update statement. – Sandman4 Nov 22 '11 at 15:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.