Hi!<div><br></div><div>Thanks for the answer :) Well, this is web-server, there is no such thing as an internal user or network, let alone 127.0.0.1 (which is definitely in "internal" only). Since the shipped configuration files is accepting queries from:</div>
<div><br></div><div><div>acl "trusted" {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span><a href="http://127.0.0.0/8">127.0.0.0/8</a>;</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>::1/128;</div>
<div>};</div></div><div><br></div><div>I'd say is made for a single machine only, which is definitely not my case.</div><div><br></div><div>My internal currently is:</div><div><br></div><div><div><span class="Apple-tab-span" style="white-space:pre"> </span>match-clients { trusted; };</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>recursion yes;</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>additional-from-auth yes;</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>additional-from-cache yes;</div>
<div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>zone "." in {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>type hint;</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>file "/var/bind/root.cache";</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>};</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>zone "localhost" IN {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>type master;</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>file "/var/bind/pri/localhost.zone";</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>allow-update { none; };</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>notify no;</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>allow-query { any; };</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>allow-transfer { none; }; </div><div><span class="Apple-tab-span" style="white-space:pre"> </span>};</div>
<div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>zone "127.in-addr.arpa" IN {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>type master;</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>file "/var/bind/pri/127.zone";</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>allow-update { none; };</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>notify no;</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>allow-query { any; };</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>allow-transfer { none; };</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>};</div><div><br></div><div>I cannot think of much using it, apart from database listeners on 127.0.0.1 so allowing matches for "trusted" should be okay. There is nothing that should call one domain from another. Interlinks in web pages are actually client-side calls from the public network, so nothing comes from "within".</div>
<div><br></div><div>My Public is </div><div><br></div><div><div>view "public" in {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>/*</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> * Our external (untrusted) view. We permit any client to access</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span> * portions of this view. We do not perform recursion or cache</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> * access for hosts using this view.</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span> */</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>match-clients { any; };</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>recursion no;</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>additional-from-auth no;</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>additional-from-cache no;</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>zone "." in {</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>type hint;</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>file "/var/bind/root.cache";</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>};</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>zone "<a href="http://example.org">example.org</a>" {</div><div> type master;</div>
<div> file "/var/bind/pri/example.org.external";</div><div> allow-query { any; };</div><div> allow-transfer { xfer; };</div><div> };</div></div><div><br></div>
<div> etc etc</div><div><br></div><div>xfer goes to the secondary nameserver, so everything should be safe.</div><div><br></div><div>Thanks</div><div>Bèrto</div><div><br></div><div><br></div><br><div class="gmail_quote">
On 23 September 2010 20:21, Lightner, Jeff <span dir="ltr"><<a href="mailto:jlightner@water.com">jlightner@water.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<div>
<p class="MsoNormal"><font size="2" color="navy" face="Arial"><span style="font-size:10.0pt;font-family:Arial;color:navy">In views order is important. If you have
internal before others (e.g. external) then that is the default view. </span></font></p>
<p class="MsoNormal"><font size="2" color="navy" face="Arial"><span style="font-size:10.0pt;font-family:Arial;color:navy"> </span></font></p>
<p class="MsoNormal"><font size="2" color="navy" face="Arial"><span style="font-size:10.0pt;font-family:Arial;color:navy">What I *<b><span style="font-weight:bold">think</span></b>*
it is telling you is that if you have an internal view that you restrict to
certain networks that you need to insure you have all the public zones in the
external view and the internal view if you intend to have your internal users
see them. That is what we do here.</span></font></p>
<p class="MsoNormal"><font size="2" color="navy" face="Arial"><span style="font-size:10.0pt;font-family:Arial;color:navy"> </span></font></p>
<div>
<div class="MsoNormal" align="center" style="text-align:center"><font size="3" face="Times New Roman"><span style="font-size:12.0pt">
<hr size="2" width="100%" align="center">
</span></font></div>
<p class="MsoNormal"><b><font size="2" face="Tahoma"><span style="font-size:10.0pt;font-family:Tahoma;font-weight:bold">From:</span></font></b><font size="2" face="Tahoma"><span style="font-size:10.0pt;font-family:Tahoma">
bind-users-bounces+jlightner=<a href="http://water.com" target="_blank">water.com</a>@<a href="http://lists.isc.org" target="_blank">lists.isc.org</a>
[mailto:<a href="mailto:bind-users-bounces%2Bjlightner" target="_blank">bind-users-bounces+jlightner</a>=<a href="http://water.com" target="_blank">water.com</a>@<a href="http://lists.isc.org" target="_blank">lists.isc.org</a>] <b><span style="font-weight:bold">On Behalf Of </span></b>Bèrto ëd Sèra<br>
<b><span style="font-weight:bold">Sent:</span></b> Thursday, September 23, 2010
1:14 PM<br>
<b><span style="font-weight:bold">To:</span></b> <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
<b><span style="font-weight:bold">Subject:</span></b> All zone blocks for
"public" view should be listed here in "internal"too!</span></font></p>
</div><div><div></div><div class="h5">
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:12.0pt"> </span></font></p>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:12.0pt">Hi!</span></font></p>
<div>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:12.0pt"> </span></font></p>
</div>
<div>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:12.0pt">I hope this is the right alley for my question. I run a public DNS for
several domains on a gentoo server. After upgrading to 9.7.1_p2 I read in
the shipped configuration that "All zone blocks for "public"
view should be listed here in "internal" too!".</span></font></p>
</div>
<div>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:12.0pt"> </span></font></p>
</div>
<div>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:12.0pt">Now, what does it mean? Do I simply copy and paste the public zone
entries in the internal zone? And what's the point in doing it, is everyone
needs it anyway?</span></font></p>
</div>
<div>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:12.0pt"> </span></font></p>
</div>
<div>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:12.0pt">I hope you'll pardon my obvious lack of basic knowledge on the subject.</span></font></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><font size="3" face="Times New Roman"><span style="font-size:12.0pt">Bèrto<br clear="all">
</span></font></p>
</div>
</div></div></div>
</div>
<div> </div>
<div>
<font face="Arial" size="2">Proud partner. Susan G. Komen for the Cure.</font>
</div>
<div> </div>
<div>
<font face="Arial" color="green" size="1"><em>Please consider our environment before printing this e-mail or attachments.</em></font>
</div>
<div style="font-size:9pt;font-family:Courier New">
<font face="Arial" size="2">----------------------------------<br>CONFIDENTIALITY NOTICE: This e-mail may contain privileged or confidential information and is for the sole use of the intended recipient(s). If you are not the intended recipient, any disclosure, copying, distribution, or use of the contents of this information is prohibited and may be unlawful. If you have received this electronic transmission in error, please reply immediately to the sender that you have received the message in error, and delete it. Thank you.<br>
----------------------------------<br></font>
</div></div>
</blockquote></div><br><br clear="all"><br>-- <br>==============================<br>Constitution du 24 juin 1793 - Article 35. - Quand le gouvernement viole les droits du peuple, l'insurrection est, pour le peuple et pour chaque portion du peuple, le plus sacré des droits et le plus indispensable des devoirs.<br>
</div>