7

Finally figured it out. Thanks to @Håkan Lindqvist for inspiration. These solutions are probably Debian/Ubuntu-specific and weren't tested in other distros. 1. FIRST SOLUTION (Using update-policy local;). You may actually use update-policy local; directive in /etc/bind/named.conf.local in each zone declaration you want, which restricts update requests ...


4

nsupdate can't do that. The first parameter after "delete" is "name" of the record. You're trying to delete with "data" of the record. You can scan the zone file, find matching records, add them to a file with a format that nsupdate understands and feed it to nsupdate.


3

When you not only specify the record name and type but also the existing value the name server should only remove the record with that value and leave the other records of the same type unchanged. man nsupdate update delete domain-name [ ttl ] [ class ] [ type [ data...] ] Deletes any resource records named domain-name. If type and data is provided, ...


3

My apologies for quoting the manual verbatim, but the authors are probably better writers than I am https://ftp.isc.org/www/bind/arm95/Bv9ARM.ch04.html The section on the journal database starts with: All changes made to a zone using dynamic update are stored in the zone's journal file. This file is automatically created by the server when the first ...


2

You're using nsupdate -l which sends the update message to localhost (the verbose output confirms that it used the loopback address, as expected, Sending update to 127.0.0.1#53). However, the zone you are attempting to update is not in the view that this update message will hit. Your first view (localhost_view) has match-clients { localhost_acl; };. acl ...


2

Thank you for acting like a sysadmin and posting your server logs rather trying to debug server issues from a client utility alone. apparmor="DENIED" operation="mknod" profile="/usr/sbin/named" name="/etc/bind/zones/" pid=18799 comm="named" requested_mask="c" denied_mask="c" fsuid=112 ouid=112 That seems to indicate that Apparmor is blocking your name ...


2

After spending more than a day on it, I found it as I was writing the question. Just as there is no wildcard expansion available past the left-most subdomain, you can't use the update-policy wildcard ruletype that way either. That is, it won't work for _acme-domain.*.example.tld, but would for *.www.example.tld. Considering I already know that the left-most ...


2

When you specify zone, you are defining the "origin" for all transactions that follow. The record names that you specify are assumed to be relative to this origin unless a trailing dot is present. With zone sample.test.net, the record should be @ or sample.test.net.. With zone test.net, the record should be sample or sample.test.net.. The SERVFAIL happens ...


1

I think the best solution would generally be to just use dedicated TSIG keys to access the different views. I know the question mentions this and says it didn't work, but that must have been because the client matching directives of the two views were not updated appropriately. If we assume that there are the two TSIG keys named internal and external for ...


1

The secret is encrypted. We can't tell you the strength of the encryption as you didn't provide us the specifics (HMAC-MD5 via TSIG, etc.), but it is a safe assumption that DDNS secrets include a cryptographic wrapper of some sort. They would be susceptible to replay attacks otherwise, as you have noted.


1

Your question is a bit confusing so I may miss something in my answer. I'm guessing you want to update AD-integrated DNS. Nsupdate Regarding recompiling nsupdate - where did you get stuck? "I don't know how" is a bit vague. dnscmd.exe I guarantee that dnscmd authenticates using AD kerberos. You can verify this by running "klist" before and after running a ...


1

You can do this using $INCLUDE in your zone file, which will allow you to split the contents of the zone to multiple component files arbitrarily. See here for more info.


Only top voted, non community-wiki answers of a minimum length are eligible