<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffcc" text="#000000">
Given that you control your key distribution correctly and safely,
would the following work?<br>
<br>
<pre wrap="">allow-transfer { key key-slave-1; key key-slave-2; };
</pre>
Only relevant slaves have the various keys, so do you need to have
the IPs mentioned here?<br>
<br>
<br>
On 05/12/10 18:10, <a class="moz-txt-link-abbreviated" href="mailto:pgngw+dev001+bind-users@f-m.fm">pgngw+dev001+bind-users@f-m.fm</a> wrote:
<blockquote
cite="mid:1291569044.3406.1408755107@webmail.messagingengine.com"
type="cite">
<pre wrap="">i've bind9 running as a primaryhost to a number of bind-andb-other
slaves.
i'm trying to set up to use different TSIG keys with different
secondaries.
in my named.conf, i've
...
acl acl_slave_1 { 1.1.1.1; };
acl acl_slave_2 { 2.2.2.2; 3.3.3.3; 4.4.4.4; 5.5.5.5; };
...
zone "test.com" {
type master; file "/master/test.com.hosts";
allow-transfer { { !{!1.1.1.1;}; key key-slave-1; }; {
!{!acl_slave_2;}; key key-slave-2; }; };
allow-update { none; };
};
...
key "key-slave-1" { algorithm hmac-md5; secret "Cf...g=="; };
key "key-slave-2" { algorithm hmac-md5; secret "rl...8=="; };
in this conf, IXFR to 1.1.1.1 with TSIG works as expected. but, *NO*
IXFR occurs to any slave in acl_slave_2{}.
if, however, I change to
--- allow-transfer { { !{!1.1.1.1;}; key key-slave-1; }; {
!{!acl_slave_2;}; key key-slave-2; }; };
+++ allow-transfer { { !{!1.1.1.1;}; key key-slave-1; }; {
!{!2.2.2.2;}; key key-slave-2; }; };
IXFR to 1.1.1.1 & 2.2.2.2 both occur OK with TSIG.
also, with
--- allow-transfer { { !{!1.1.1.1;}; key key-slave-1; }; {
!{!acl_slave_2;}; key key-slave-2; }; };
--- allow-transfer { { !{!1.1.1.1;}; key key-slave-1; };
acl_slave_2; };
IXFR to 1.1.1.1 with TSIG & to all slaves in acl_slave_2{}, without
TSIG, both occur OK.
what's the right syntax for enabling IXFR to the entire TSIG- &
IP-restricted set of hosts in acl_slave_2{}?
_______________________________________________
bind-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a>
<a class="moz-txt-link-freetext" href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Best regards
Sten Carlsen
No improvements come from shouting:
"MALE BOVINE MANURE!!!"
</pre>
</body>
</html>