<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-family:Consolas">Howdy,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">I’m new to PowerDNS. I’m using the authoritative server with the BIND backend for some testing. (Don’t need power or complexity of a DB backend).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">Fake IPs:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> 11.11.11.11 master<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> 22.22.22.22 slave<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">I’ve got a master and slave configured with three zones and doing zone transfers. Initially, I didn’t have TSIGs and have the following configured in pdns.conf on the master:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-indent:.5in"><span style="font-family:Consolas;color:#24292E;background:white">allow-axfr-ips=127.0.0.0/8,::1,22.22.22.22<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas;color:#24292E;background:white"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas;color:#24292E;background:white">Now I’d like to configure TSIG. But the
</span><span style="font-family:Consolas">instructions here seem to be related to DB backends:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><a href="https://doc.powerdns.com/authoritative/tsig.html#tsig-provision-signed-notify-axfr">https://doc.powerdns.com/authoritative/tsig.html#tsig-provision-signed-notify-axfr</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">I’d like to stick to the BIND backend. But I get errors when trying the same type of configuration options in named.conf that work in regular BIND.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">Here’s what I did:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">On the master:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">key “keyname” {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> algorithm hmac-sha256;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> secret “…”;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">};<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">zone “zonename” {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> file …;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> type master;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> allow-transfer { 22.22.22.22 key “keyname”; };<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">};<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">On the slave:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">key “keyname” {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> algorithm hmac-sha256;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> secret “…”;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">};<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">zone “zonename” {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> file …;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> type slave;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> masters { 11.11.11.11 key “keyname”; };
</span><span style="font-family:Wingdings">ß</span><span style="font-family:Consolas"> I get a syntax error on this, even though it works in regular BIND.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">};<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">So, I changed the slave to:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">server 11.11.11.11 {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> keys { “keyname”; };<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">};<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">zone “zonename” {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> file …;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> type slave;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> masters { 11.11.11.11 };
</span><span style="font-family:Wingdings">ß</span><span style="font-family:Consolas"> no more syntax error.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">};<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">And, in pdns.conf, I set “allow-axfr-ips” back to the default:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-indent:.5in"><span style="font-family:Consolas;color:#24292E;background:white">allow-axfr-ips=127.0.0.0/8,::1</span><span style="font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">But when I restart the slave, I get the following error:
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">Unable to AXFR zone ‘zonename' from remote 11.11.11.11' (resolver): AXFR chunk error: Server Not Authoritative for zone / Not Authorized (This was the first time. Excluding zone from slave-checks until
1636827466)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">Any help would be greatly appreciated!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">Michael<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>