Sponsored Content
Special Forums IP Networking DNS upgrade issues, bind9.5.0_P1 Post 302225179 by jamison_utter on Thursday 14th of August 2008 07:23:03 PM
Old 08-14-2008
Sorry your thread was sitting, I just joined and maybe I can help.

From the error this is a recursion setting, your inside server is trying to do look ups and being denied (which you knew) I think it might be related to changes in the named.conf noted here:

2206. [security] "allow-query-cache" and "allow-recursion" now
cross inherit from each other.

If allow-query-cache is not set in named.conf then
allow-recursion is used if set, otherwise allow-query
is used if set, otherwise the default (localnets;
localhostSmilie is used.

If allow-recursion is not set in named.conf then
allow-query-cache is used if set, otherwise allow-query
is used if set, otherwise the default (localnets;
localhostSmilie is used.

Are you using allow-recursion? or allow-query-source, are you using any sort of match clients or anything like that? (a snip of the named.conf would help).


Quote:
Originally Posted by robsonde
so we had bind 9.3.0...

we upgraded to 9.5.0 patch 1

we kept the exact same named.conf

now we have a problem that some DMZ server cant do lookups from our DNS slave anymore.

in the named.log we see things like this:
Code:
22-Jul-2008 16:05:04.694 security: info: client <our DMZ servers IP>3#50992: query (cache) './NS/IN' denied

note I have removed out IP addresses, the IP was an external facing IP.

the question is...
what changed???
why is bind behaving is a new way?

I am very new to DNS and bind so be easy on me :-)
 

9 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

dns issues

Just recently we have been having some dns issues. Some websites won't work i.e. (www.msn.com, aimexpress.aim.com...) I have manually put A records in my named.db file and in the hosts file to try to get it to work but still they do not work. I have looked up updating my named.ca file for the... (1 Reply)
Discussion started by: rickyt00
1 Replies

2. Ubuntu

Linux Redhat ES 4.0 - DNS Config Issues

Hello all, I've a very strange thing hapenning in my Sys, I've configured the IP, DNS eveything for my internat connection, but Im only able to browse Redhat.com websites. I cant open anyother site!!! :eek: Im sure the internet is configured 'coz it displays the list of avail updates for... (11 Replies)
Discussion started by: AbhijithS
11 Replies

3. Cybersecurity

Dns cache poisoning upgrade to bind9.5.0p2

Hi again guys, It seems this is a global thing affecting all the DNS bind versions prior to July 28 2008. I have my work cut out for me very soon, I see at least a handful of servers in my list that either need to patching or upgrading. How many of you guys are affected? Anybody successfully... (4 Replies)
Discussion started by: sparcguy
4 Replies

4. UNIX and Linux Applications

bind9 with ldap using dlz

Hello guys, can anyone help me with the below error I'm getting from bind9? I'm trying to make bind read all the zone info from openldap, I have already created the schema and I've put some info into the ldap. I have also tried to google the error with no success. I'm aware there is an problem... (1 Reply)
Discussion started by: yered
1 Replies

5. Solaris

Solaris 10 - DNS / Issues / Help

Hi all Long time no speak, I hope you are all well. Im looking at a DNS issue here and reckon Igot a AD / DNS server issue elsewhere but need to rule out the configuration of my two server's first. IVe got the nameserver enteries in /etc/resolv.conf and dns in the /etc/nsswitch.conf ... (2 Replies)
Discussion started by: sbk1972
2 Replies

6. UNIX for Dummies Questions & Answers

DNS on Unix box issues

Hi Guys, Just wanted to seek your assistance on an issue encountered with one of our client DNS server query. we have 2 sets of DNS servers.. internal and external. For Internal to reach the external DNS server (DMZ) it has to go through 2 FWs. Current settings: - FW rules for Internal... (3 Replies)
Discussion started by: Hotshot8259
3 Replies

7. Solaris

Bind9 DNS on Solaris 10 x4270 & CPU usage

I have configured a Bind9 DNS on a X4270 machine with Solaris10 I am excuting some repformance tests with DNSPERF tool and maximun CPU usage is 23%. I have seen with prstat -L -p PID that named process usses only 2 of the 8 available CPU at the same time although threads for all CPUs exist.... (2 Replies)
Discussion started by: parisph
2 Replies

8. Red Hat

DNS Server Setup Centos 6.5 Issues

I am having a bit of trouble getting my CENTOS 6.5 DNS server to work correctly in our testlab environment. Lab network is 10.8.0.0/24 in which we all access from 10.7.0.0.0/24 && 10.0.0.0/24. Here are my configs: options { listen-on port 53 { 127.0.0.1; 10.8.0.19;}; #listen-on-v6 port 53 {... (2 Replies)
Discussion started by: metallica1973
2 Replies

9. IP Networking

Bind9 DNSSEC and rollerd

Hi all, I've a litte problem to get rollerd running and signing my zones if the ZSK of my zones are near expiring or expired. rollerd is running but do nothing startet with: /usr/bin/perl /usr/sbin/rollerd -rrfile /etc/bind/all.rollrec -directory /etc/bind -logfile /dev/stdout ... (1 Reply)
Discussion started by: xabbu
1 Replies
Net::DNS::Header(3)					User Contributed Perl Documentation				       Net::DNS::Header(3)

NAME
Net::DNS::Header - DNS packet header class SYNOPSIS
"use Net::DNS::Header;" DESCRIPTION
A "Net::DNS::Header" object represents the header portion of a DNS packet. METHODS
new $header = Net::DNS::Header->new; "new" creates a header object appropriate for making a DNS query. parse ($header, $offset) = Net::DNS::Header->parse($data); Parses the header record at the start of a DNS packet. The argument is a reference to the packet data. Returns a Net::DNS::Header object and the offset of the next location in the packet. Parsing is aborted if the header object cannot be created (e.g., corrupt or insufficient data). print $header->print; Prints the header record on the standard output. string print $header->string; Returns a string representation of the header object. id print "query id = ", $header->id, " "; $header->id(1234); Gets or sets the query identification number. qr print "query response flag = ", $header->qr, " "; $header->qr(0); Gets or sets the query response flag. opcode print "query opcode = ", $header->opcode, " "; $header->opcode("UPDATE"); Gets or sets the query opcode (the purpose of the query). aa print "answer is ", $header->aa ? "" : "non-", "authoritative "; $header->aa(0); Gets or sets the authoritative answer flag. tc print "packet is ", $header->tc ? "" : "not ", "truncated "; $header->tc(0); Gets or sets the truncated packet flag. rd print "recursion was ", $header->rd ? "" : "not ", "desired "; $header->rd(0); Gets or sets the recursion desired flag. cd print "checking was ", $header->cd ? "not" : "", "desired "; $header->cd(0); Gets or sets the checking disabled flag. ra print "recursion is ", $header->ra ? "" : "not ", "available "; $header->ra(0); Gets or sets the recursion available flag. ad print "The result has ", $header->ad ? "" : "not", "been verified " Relevant in DNSSEC context. (The AD bit is only set on answers where signatures have been cryptographically verified or the server is authoritative for the data and is allowed to set the bit by policy.) rcode print "query response code = ", $header->rcode, " "; $header->rcode("SERVFAIL"); Gets or sets the query response code (the status of the query). qdcount, zocount print "# of question records: ", $header->qdcount, " "; $header->qdcount(2); Gets or sets the number of records in the question section of the packet. In dynamic update packets, this field is known as "zocount" and refers to the number of RRs in the zone section. ancount, prcount print "# of answer records: ", $header->ancount, " "; $header->ancount(5); Gets or sets the number of records in the answer section of the packet. In dynamic update packets, this field is known as "prcount" and refers to the number of RRs in the prerequisite section. nscount, upcount print "# of authority records: ", $header->nscount, " "; $header->nscount(2); Gets or sets the number of records in the authority section of the packet. In dynamic update packets, this field is known as "upcount" and refers to the number of RRs in the update section. arcount, adcount print "# of additional records: ", $header->arcount, " "; $header->arcount(3); Gets or sets the number of records in the additional section of the packet. In dynamic update packets, this field is known as "adcount". data $hdata = $header->data; Returns the header data in binary format, appropriate for use in a DNS query packet. COPYRIGHT
Copyright (c) 1997-2002 Michael Fuhr. Portions Copyright (c) 2002-2004 Chris Reinhardt. Portions Copyright (c) 2007 Dick Franks. All rights reserved. This program is free software; you may redistribute it and/or modify it under the same terms as Perl itself. SEE ALSO
perl(1), Net::DNS, Net::DNS::Resolver, Net::DNS::Packet, Net::DNS::Update, Net::DNS::Question, Net::DNS::RR, RFC 1035 Section 4.1.1 perl v5.12.1 2009-12-30 Net::DNS::Header(3)
All times are GMT -4. The time now is 07:05 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy