<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font face="Calibri">WOW!!! Thank you so much Barry... external zone
is now transferring. Thank you thank you thank you...</font><br>
<pre class="moz-signature" cols="72">William Clarke
ITS System Administrator
Bard College at Simon's Rock
84 Alford Road
Great Barrington, MA 01230
(413) 528-7428 (voice)
(413) 528-7405 (fax)
<a class="moz-txt-link-abbreviated" href="mailto:wclarke@simons-rock.edu">wclarke@simons-rock.edu</a></pre>
<div class="moz-cite-prefix">On 4/8/2015 12:26 PM, Barry Margolin
wrote:<br>
</div>
<blockquote
cite="mid:22834_1428510357_55255694_22834_339_1_barmar-41E00D.12261308042015@88-209-239-213.giganet.hu"
type="cite">
<pre wrap="">In article <a class="moz-txt-link-rfc2396E" href="mailto:mailman.1916.1428507901.26362.bind-users@lists.isc.org"><mailman.1916.1428507901.26362.bind-users@lists.isc.org></a>,
William Clarke <a class="moz-txt-link-rfc2396E" href="mailto:wclarke@simons-rock.edu"><wclarke@simons-rock.edu></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Barry,
Thanks you. I appreciate your response Barry. I'm fairly new to Bind and
DNS and have gotten a bit lost. Is there any way you can provide a
little more information for me? Am I not correct in saying that I'm
already using TSIG keys in the include lines?
</pre>
</blockquote>
<pre wrap="">
You need to use the TSIG key in the "match-clients" clause so it will be
used to select the appropriate view.
view "internal" {
match-clients { !key slave-external; !192.168.1.4; 10.0.0.0/8;
192.168.0.0/16; 127.0.0.0/8; };
allow-transfer { key slave-internal; };
...
}
view "external" {
match-clients { any; };
allow-transfer { key slave-external; };
...
}
</pre>
<blockquote type="cite">
<pre wrap="">------------------------------------------------------------
view "external" {
match-clients { any; };
allow-transfer { key slave-external; };
....
...
..
include "/etc/rndc.key";
include "/etc/transfer-internal.key";
include "/etc/transfer-external.key";
------------------------------------------------------------
/var/named/chroot/etc/transfer-external.key
key "slave-external" {
algorithm hmac-md5;
secret "blahblahblahblahblah";
};
Thanks,
William Clarke
ITS System Administrator
Bard College at Simon's Rock
84 Alford Road
Great Barrington, MA 01230
(413) 528-7428 (voice)
(413) 528-7405 (fax)
<a class="moz-txt-link-abbreviated" href="mailto:wclarke@simons-rock.edu">wclarke@simons-rock.edu</a>
On 4/8/2015 10:54 AM, Barry Margolin wrote:
</pre>
<blockquote type="cite">
<pre wrap="">In article <a class="moz-txt-link-rfc2396E" href="mailto:mailman.1910.1428503936.26362.bind-users@lists.isc.org"><mailman.1910.1428503936.26362.bind-users@lists.isc.org></a>,
William Clarke <a class="moz-txt-link-rfc2396E" href="mailto:wclarke@simons-rock.edu"><wclarke@simons-rock.edu></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Resending because the message was over 40K... I removed most of the
internal\external zones and logs to shorten the message.
We have a split DNS chrooted master\slave setup running on CentOS 5.11.
I have 3 named.conf files below, Working master, working slave and a new
CentOS 7 non-working slave that I'm trying to spin up. The internal
zones do get transferred\updated however theexternal zones aren't
transferring at all, the master doesn't even have any mentioning of
external transfers for this specific slave. I have a hunch that this is
either happening because I don't have multiple network adapters
configured ie split DNS for slave or possibly a hostname issue. I tried
to basically mirror the setup of my new slave all except the ip address.
My new slave is 192.168.1.224. The instructions I followed to set this
up was from:
<a class="moz-txt-link-freetext" href="http://www.ehowstuff.com/how-to-setup-bind-chroot-dns-server-on-centos-7-0">http://www.ehowstuff.com/how-to-setup-bind-chroot-dns-server-on-centos-7-0</a>-
vps
/
</pre>
</blockquote>
<pre wrap="">Since the new slave only has one address, you can't use the IP to
distinguish which view should be sent in a zone transfer. You need to
use TSIG keys.
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
</blockquote>
<br>
</body>
</html>