Hi all!<br><br>I found out what was missing in my configuration.<br><br>I just did not read documentation properly and did not find dnssec enabling flag.<br><br><a href="http://doc.powerdns.com/html/domainmetadata.html">http://doc.powerdns.com/html/domainmetadata.html</a> <br>
<br>I just added gmysql-dnssec to pdns.conf and restarted service.<br><br>AXFR ACL's are working now. <br><br>Thank You all who helped.<br><br>Best Regards,<br>Margus Kiting<br><br><div class="gmail_quote">On 19 March 2013 14:05, Ruben d'Arco <span dir="ltr"><<a href="mailto:cyclops@prof-x.net" target="_blank">cyclops@prof-x.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<br>
This ia bit of a gues, but:<br>
The AUTO-NS feature seems to use a normal getaddrinfo(). This might have a different result than you expect on your system.<br>
Can you check what's in your resolv.conf and see what that replied when you ask for <a href="http://dns1.test.com" target="_blank">dns1.test.com</a> and <a href="http://dns2.test.com" target="_blank">dns2.test.com</a>?<br>
<br>
Regards,<br>
Ruben<br>
<div><div class="h5"><br>
<br>
<br>
On Tue, Mar 19, 2013 at 01:51:20PM +0200, Margus Kiting wrote:<br>
> Hi,<br>
><br>
> I'm new to this list and this is the first time I encountered a problem<br>
> using powerdns authoritative DNS server, so I hope I find solution for this<br>
> problem from here.<br>
><br>
> The problem is in AXFR per domain ACL's. They are just nor working for me.<br>
> Below is configuration and test outputs.<br>
><br>
> Master DNS: pdns-master 192.168.1.10<br>
> Slave DNS: pdns-slave 192.168.1.11<br>
> Test server: pdns-test 192.168.1.13<br>
><br>
> PowerDNS Version 3.2, compiled on Mar 12 2013, 10:19:57 with gcc version<br>
> 4.1.2 20080704 (Red Hat 4.1.2-51)<br>
><br>
><br>
> pdns-master pdns.conf<br>
><br>
> setuid=daemon<br>
> setgid=daemon<br>
> cache-ttl=60<br>
> daemon=yes<br>
> disable-tcp=no<br>
> distributor-threads=10<br>
><br>
> launch=gmysql<br>
> gmysql-host=127.0.0.1<br>
> gmysql-user=powerdns<br>
> gmysql-password=password<br>
> gmysql-dbname=powerdns<br>
> logging-facility=1<br>
> loglevel=4<br>
> master=yes<br>
> query-cache-ttl=60<br>
> recursive-cache-ttl=60<br>
> recursor=127.0.0.1<br>
> query-local-address6=<br>
><br>
> NB! recursor is not running.<br>
><br>
> pdns-master mysql information:<br>
><br>
> mysql> select * from domains;<br>
> id name master last_check type notified_serial account<br>
> 1 <a href="http://test.com" target="_blank">test.com</a> NULL NULL MASTER 1363693953 NULL<br>
><br>
> mysql> select * from records;<br>
> id domain_id name type content ttl prio<br>
> change_date ordername auth<br>
> 1 1 <a href="http://test.com" target="_blank">test.com</a> SOA <a href="http://dns1.test.com" target="_blank">dns1.test.com</a> <a href="mailto:root@test.com">root@test.com</a> 0<br>
> 86400 NULL NULL NULL NULL<br>
> 2 1 <a href="http://test.com" target="_blank">test.com</a> NS <a href="http://dns1.test.com" target="_blank">dns1.test.com</a> 86400 NULL<br>
> 1363693952 NULL NULL<br>
> 3 1 <a href="http://test.com" target="_blank">test.com</a> NS <a href="http://dns2.test.com" target="_blank">dns2.test.com</a> 86400 NULL<br>
> 1363693952 NULL NULL<br>
> 4 1 <a href="http://www.test.com" target="_blank">www.test.com</a> A 192.168.1.12 120 NULL<br>
> 1363693952 NULL NULL<br>
> 5 1 <a href="http://mail.test.com" target="_blank">mail.test.com</a> A 192.168.1.12 120 NULL<br>
> 1363693952 NULL NULL<br>
> 6 1 <a href="http://dns1.test.com" target="_blank">dns1.test.com</a> A 192.168.1.11 120 NULL<br>
> 1363693952 NULL NULL<br>
> 7 1 <a href="http://dns2.test.com" target="_blank">dns2.test.com</a> A 192.168.1.10 120 NULL<br>
> 1363693952 NULL NULL<br>
> 8 1 <a href="http://test.com" target="_blank">test.com</a> MX <a href="http://mail.test.com" target="_blank">mail.test.com</a> 120 25<br>
> 1363693953 NULL NULL<br>
><br>
> mysql> select * from domainmetadata;<br>
> id domain_id kind content<br>
> 1 1 ALLOW-AXFR-FROM AUTO-NS<br>
> AXFR queries should be allowd onlly from server, which are in<br>
</div></div>> test.comdomain NS records.<br>
<div><div class="h5">> I will AXFR query from pdns-slave, which has IP 192.168.1.11 and it is<br>
> configured as NS record in test.ccom domain and it should get correct axfr<br>
> query answer.<br>
> I also try AXFR query from pdns-test, which has IP 192.168.1.12 and it's<br>
> not configured as NS record in <a href="http://test.com" target="_blank">test.com</a> domain and this server should get<br>
> transfer failure message from pdns-master server. powerdns daemon is<br>
> running with monitor flag, which gives debug output from servers side.<br>
><br>
> AXFR query from pdns-slave 192.168.1.11 server:<br>
><br>
> [root@pdns-slave ~]# dig axfr <a href="http://test.com" target="_blank">test.com</a> @<a href="http://192.168.1.10" target="_blank">192.168.1.10</a><br>
><br>
> ; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5_8.6 <<>> axfr <a href="http://test.com" target="_blank">test.com</a> @<br>
> 192.168.1.10<br>
> ;; global options: printcmd<br>
> <a href="http://test.com" target="_blank">test.com</a>. 86400 IN SOA <a href="http://dns1.test.com" target="_blank">dns1.test.com</a>. <a href="http://root.test.com" target="_blank">root.test.com</a>.<br>
> 1363693953 10800 3600 604800 3600<br>
> <a href="http://test.com" target="_blank">test.com</a>. 86400 IN NS <a href="http://dns1.test.com" target="_blank">dns1.test.com</a>.<br>
> <a href="http://test.com" target="_blank">test.com</a>. 86400 IN NS <a href="http://dns2.test.com" target="_blank">dns2.test.com</a>.<br>
> <a href="http://www.test.com" target="_blank">www.test.com</a>. 120 IN A 192.168.1.12<br>
> <a href="http://mail.test.com" target="_blank">mail.test.com</a>. 120 IN A 192.168.1.12<br>
> <a href="http://dns1.test.com" target="_blank">dns1.test.com</a>. 120 IN A 192.168.1.11<br>
> <a href="http://dns2.test.com" target="_blank">dns2.test.com</a>. 120 IN A 192.168.1.10<br>
> <a href="http://test.com" target="_blank">test.com</a>. 120 IN MX 25 <a href="http://mail.test.com" target="_blank">mail.test.com</a>.<br>
> <a href="http://test.com" target="_blank">test.com</a>. 86400 IN SOA <a href="http://dns1.test.com" target="_blank">dns1.test.com</a>. <a href="http://root.test.com" target="_blank">root.test.com</a>.<br>
> 1363693953 10800 3600 604800 3600<br>
> ;; Query time: 12 msec<br>
> ;; SERVER: 192.168.1.10#53(192.168.1.10)<br>
> ;; WHEN: Tue Mar 19 13:24:06 2013<br>
> ;; XFR size: 9 records (messages 3)<br>
><br>
> Powerdns log output in pdns-master server:<br>
><br>
> Mar 19 13:24:06 AXFR of domain '<a href="http://test.com" target="_blank">test.com</a>' initiated by 192.168.1.11<br>
> Mar 19 13:24:06 AXFR of domain '<a href="http://test.com" target="_blank">test.com</a>' allowed: client IP 192.168.1.11<br>
> is in allow-axfr-ips<br>
> Mar 19 13:24:06 gmysql Connection successful<br>
> Mar 19 13:24:06 gmysql Connection successful<br>
> Mar 19 13:24:06 AXFR of domain '<a href="http://test.com" target="_blank">test.com</a>' to 192.168.1.11 finished<br>
><br>
> AXFR query from pdns-test 192.168.1.12 server:<br>
><br>
> [root@pdns-test ~]# dig axfr <a href="http://test.com" target="_blank">test.com</a> @<a href="http://192.168.1.10" target="_blank">192.168.1.10</a><br>
><br>
> ; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5_8.6 <<>> axfr <a href="http://test.com" target="_blank">test.com</a> @<br>
> 192.168.1.10<br>
> ;; global options: printcmd<br>
> <a href="http://test.com" target="_blank">test.com</a>. 86400 IN SOA <a href="http://dns1.test.com" target="_blank">dns1.test.com</a>. <a href="http://root.test.com" target="_blank">root.test.com</a>.<br>
> 1363693953 10800 3600 604800 3600<br>
> <a href="http://test.com" target="_blank">test.com</a>. 86400 IN NS <a href="http://dns1.test.com" target="_blank">dns1.test.com</a>.<br>
> <a href="http://test.com" target="_blank">test.com</a>. 86400 IN NS <a href="http://dns2.test.com" target="_blank">dns2.test.com</a>.<br>
> <a href="http://www.test.com" target="_blank">www.test.com</a>. 120 IN A 192.168.1.12<br>
> <a href="http://mail.test.com" target="_blank">mail.test.com</a>. 120 IN A 192.168.1.12<br>
> <a href="http://dns1.test.com" target="_blank">dns1.test.com</a>. 120 IN A 192.168.1.11<br>
> <a href="http://dns2.test.com" target="_blank">dns2.test.com</a>. 120 IN A 192.168.1.10<br>
> <a href="http://test.com" target="_blank">test.com</a>. 120 IN MX 25 <a href="http://mail.test.com" target="_blank">mail.test.com</a>.<br>
> <a href="http://test.com" target="_blank">test.com</a>. 86400 IN SOA <a href="http://dns1.test.com" target="_blank">dns1.test.com</a>. <a href="http://root.test.com" target="_blank">root.test.com</a>.<br>
> 1363693953 10800 3600 604800 3600<br>
> ;; Query time: 17 msec<br>
> ;; SERVER: 192.168.1.10#53(192.168.1.10)<br>
> ;; WHEN: Tue Mar 19 13:25:50 2013<br>
> ;; XFR size: 9 records (messages 3)<br>
><br>
><br>
> Powerdns log output in pdns-master server:<br>
><br>
> Mar 19 13:25:50 AXFR of domain '<a href="http://test.com" target="_blank">test.com</a>' initiated by 192.168.1.12<br>
> Mar 19 13:25:50 AXFR of domain '<a href="http://test.com" target="_blank">test.com</a>' allowed: client IP 192.168.1.12<br>
> is in allow-axfr-ips<br>
> Mar 19 13:25:50 gmysql Connection successful<br>
> Mar 19 13:25:50 gmysql Connection successful<br>
> Mar 19 13:25:50 AXFR of domain '<a href="http://test.com" target="_blank">test.com</a>' to 192.168.1.12 finished<br>
><br>
> As seen from abowe, AXFR ACL's per domain is not working. Am I missing some<br>
> configuration or I'm doing something very wrong?<br>
> Please help.<br>
><br>
> NB! English is not my native language, so appologies if there are mistakes.<br>
><br>
> Thanks in advance!<br>
> Margus Kiting<br>
<br>
</div></div>> _______________________________________________<br>
> Pdns-users mailing list<br>
> <a href="mailto:Pdns-users@mailman.powerdns.com">Pdns-users@mailman.powerdns.com</a><br>
> <a href="http://mailman.powerdns.com/mailman/listinfo/pdns-users" target="_blank">http://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br>
<br>
_______________________________________________<br>
Pdns-users mailing list<br>
<a href="mailto:Pdns-users@mailman.powerdns.com">Pdns-users@mailman.powerdns.com</a><br>
<a href="http://mailman.powerdns.com/mailman/listinfo/pdns-users" target="_blank">http://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br>
</blockquote></div><br>