<html><head/><body><html><head></head><body>Thank you very much learnt a new thing too<br><br><div class="gmail_quote">Mark Andrews <marka@isc.org> ha scritto:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre style="white-space: pre-wrap; word-wrap:break-word; font-family: sans-serif; margin-top: 0px"><br />In message <50BFABA3.5040304@dougbarton.us>, Doug Barton writes:<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;">On 12/05/2012 11:29 AM, fddi wrote:<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;">Hello, I have a domain called <a href="http://mydomain.org">mydomain.org</a><br /><br />I would need a way to allow access with nsupdate not to the entire<br />domain <a href="http://mydomain.org">mydomain.org</a><br />but only to specific hosts and specific IP Address do be modified using<br />nsupdate.<br /><br /><br />here is my config<br /><br />zone "<a href="http://mydomain.org">mydomain.org</a>" IN {<br />type master;<br />allow-query { any; };<br />file "<a href="http://mydomain.org">mydomain.org</a>.db";<br />update-p
olicy
{<br />grant mykey. subdomain <a href="http://mydomain.org">mydomain.org</a>. A TXT CNAME;<br />};<br />};<br /><br />but in this way anyone can modify any hosts in the domain.<br />How can I restrict and allow to modify only specific hosts ?<br /><br />for example I would like to restrict to modify only <a href="http://host1.mydomain.org">host1.mydomain.org</a><br />with a given key.<br /><br />is it possibile ?</blockquote><br />make the records you want to be modifiable into their own zones.</blockquote><br /> grant mykey. name <a href="http://host1.mydomain.org">host1.mydomain.org</a>. A AAAA<br /><br /> or<br /><br /> grant <a href="http://host1.mydomain.org">host1.mydomain.org</a>. self . A AAAA<br /><br /> or<br /><br /> grant "local:/path/to/socket" external * A AAAA<br /><br /> or <br /><br /> grant "local:/path/to/socket" external * ANY<br /><br /> The last two require a external tool to make the decision.<br /><br /><blockquote class="gmail_quote" style="margin:
0pt
0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"><hr /><br />Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe <br />from this list<br /><br />bind-users mailing list<br />bind-users@lists.isc.org<br /><a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a><br /></blockquote>-- <br />Mark Andrews, ISC<br />1 Seymour St., Dundas Valley, NSW 2117, Australia<br />PHONE: +61 2 9871 4742 INTERNET: marka@isc.org<br /></pre></blockquote></div></body></html></body></html>