Re: named and database backed systems

2009-01-28 Thread Mark Andrews
In message <29c7b7bc-f017-4404-b011-8b50206c7...@newgeo.com>, Scott Haneda writ es: > Damnit, ever time I search this stuff out, I search for "named > something-or-other" and should use BIND in my search :) > > I am going to test deploy on my worksation on OS X. Named comes up > with relativ

Re: named and database backed systems

2009-01-28 Thread Scott Haneda
Damnit, ever time I search this stuff out, I search for "named something-or-other" and should use BIND in my search :) I am going to test deploy on my worksation on OS X. Named comes up with relative ease, just add a key and I am pretty much up and running, albeit out of date, but for test

Re: named and database backed systems

2009-01-28 Thread David Ford
Use the DLZ extension. It's been around for a while. I.e. put the following in your named.conf and use whatever interface you wish. I use Ant with a few modifications. I don't have nearly the number of domains that you do so my simple system works fine. dlz "postgres zone" { database "p

Re: wildcarding everything

2009-01-28 Thread Scott Haneda
On Jan 28, 2009, at 3:34 PM, Mark Andrews wrote: In message <30e0039f-b0fd-4322-b0e0-52eeefa76...@newgeo.com>, Scott Haneda writ es: I can remove the entire DNS management, zone creation, and deltion if I wildcard. Any domain in which they enter in my clients ns's will resolve automatically a

named and database backed systems

2009-01-28 Thread Scott Haneda
Hello, my past post about wildcarding the "." in a named server seems it may be wrought with issues in the long term. In short, my issues is a auto website creation tool that needs to be simple for users to change their registrar data, and have their site be served up. The old method work

Re: What are these entries in the log file - " query: . IN NS +"?

2009-01-28 Thread Tony Toews [MVP]
Mark Andrews wrote: >> 0.86.80.98 14051 > > So who isn't doing even loose URPF? > 0/8 is totally bogus and is a attack directed at you. Well, if you do a tracert to granite.ab.ca you can see my upstream provider. I was wondering what that 0 was doing there. Tony -- Tony Toews

Re: What are these entries in the log file - " query: . IN NS +"?

2009-01-28 Thread Mark Andrews
In message , "Tony Toews [MVP]" wri tes: > "Tony Toews [MVP]" wrote: > > >FWIW In the last 28 hours I have the following alleged IP addresses and coun > t in my > >log file. > > > >Real lookups 1665 > >204.15.80.50 4 > >3.217.28.226 1144 > >4.57.246.146 9541 > >6.9.16.171 577 > >63.217.28.226

Re: What are these entries in the log file - " query: . IN NS +"?

2009-01-28 Thread Tony Toews [MVP]
"Tony Toews [MVP]" wrote: >FWIW In the last 28 hours I have the following alleged IP addresses and count >in my >log file. > >Real lookups 1665 >204.15.80.50 4 >3.217.28.226 1144 >4.57.246.146 9541 >6.9.16.171 577 >63.217.28.226 1463 >64.57.246.146 35163 >65.173.218.96 1 >67.192.1

Re: wildcarding everything

2009-01-28 Thread Mark Andrews
In message <30e0039f-b0fd-4322-b0e0-52eeefa76...@newgeo.com>, Scott Haneda writ es: > I can remove the entire DNS management, zone creation, and deltion if > I wildcard. Any domain in which they enter in my clients ns's will > resolve automatically as soon as the whois updates. Actual

Re: disableing EDNS messages bind-9.5.0

2009-01-28 Thread Danny Thomas
Matus UHLAR - fantomas wrote: I strongly recommend you upgrading the BIND first. Later versions issue that message much less often. if the only reason is the fix mentioned by Mark 2504. [bug] Address race condition in the socket code. then that doesn't explain why my small manual sample

Re: [SPAM] Re: Split view multiple zones

2009-01-28 Thread JINMEI Tatuya / 神明達哉
At Wed, 28 Jan 2009 08:59:42 +0100, Matus UHLAR - fantomas wrote: > > >Of course I could just copy and paste all the zones also in 'custom' view > > >but it doubles the configuration size. > > On 27.01.09 17:26, Chris Burton wrote: > > I've been using an include file for zones common between mu

Re: wildcarding everything

2009-01-28 Thread Scott Haneda
Excuse any spelling. I'm mobile. I would be wildcarding "." My client has a website building service. You get a free account and tools to get your site online all built in a browser with web based tools. It works well now but the synchronization of the database with named, users coming a

RE: wildcarding everything

2009-01-28 Thread Ben Bridges
What specifically are you intending to wildcard? "com."? "net."? "."? If so, then you would be implicitly making your name servers authoritative for domains for which your servers are not supposed to be authoritative. Ben Bridges > -Original Message- > From: bind-users-boun...@lists.

Re: error sending response log messages

2009-01-28 Thread Andre LeClaire
Mark Andrews wrote: In message <497caef2.80...@yahoo.com>, Andre LeClaire writes: Hello everyone, I've been seeing these syslog messages for about a week on a FreeBSD server running BIND 9.4.3-P1: Jan 25 02:35:21 asimov named[145]: client 206.71.158.30#138: error sending response: permission

Re: BIND 9.4.x vs 9.6.x - pid-file check and creation

2009-01-28 Thread Thomas Schulz
In article , Jan Arild =?iso-8859-1?Q?Lindstr=F8m?= wrote: > >Hi, > >ah, of course. I did not think about it as a Solaris bug. > >I patched BIND 9.6.0-P1 os.c code so it first checks for the diretory >before it tries the fast approach of just running mkdir. And that of >course works fine. > >But,

Re: wildcarding everything

2009-01-28 Thread Serge Fonville
If the dns only needs to resolve certain domains (you manage) and no other, it can be done Regards, Serge Fonville On Wed, Jan 28, 2009 at 1:11 PM, Alan Clegg wrote: > Scott Haneda wrote: > > > An example would be: > > some-domain-foo.com is registered. My NS of ns-me.example.com is set up > >

Re: wildcarding everything

2009-01-28 Thread Alan Clegg
Scott Haneda wrote: > An example would be: > some-domain-foo.com is registered. My NS of ns-me.example.com is set up > and working, but does not have some-domain-foo.com entered as a zone. > When a request comes in for some-domain-foo.com I want an A record for > an IP of my choice, also for www.

Re: reg - BIND 9.3.0 - CVE-2009-0025

2009-01-28 Thread Alan Clegg
Ashish wrote: > This is regarding the recent security threat CVE-2009-0025. > > We are using DNS 9.3.0 and unfortunately, we cannot upgrade (management > issues) to 9.3.6 (As suggested in ISC website) > > ISC’s website suggests to Upgrade OpenSSL to at least OpenSSL 0.9.8j and > then to upgrade

reg - BIND 9.3.0 - CVE-2009-0025

2009-01-28 Thread Ashish
Hi Folks, This is regarding the recent security threat CVE-2009-0025. We are using DNS 9.3.0 and unfortunately, we cannot upgrade (management issues) to 9.3.6 (As suggested in ISC website) ISC's website suggests to Upgrade OpenSSL to at least OpenSSL 0.9.8j and then to upgrade to 9.3.6-

wildcarding everything

2009-01-28 Thread Scott Haneda
Hello, I am wondering the technical possibility of a DNS change. Even if it is technically possible, I also want to make sure it is compliant as well. I would like to resolve any and all requests to a fixed IP, if there is no zone in place. While I understand I can create a zone for *.e

Re: What are these entries in the log file - " query: . IN NS +"?

2009-01-28 Thread Jukka Pakkanen
Sorry remembered wrong, it's not free. But not that expensive either. Yeah now I remember, I browsed for a free firewall for server platform for days, but didn't find any. But have been very happy with the Net Firewall. Jukka "Tony Toews [MVP]" kirjoitti viestissä:... "Jukka Pakkanen"

Re: contacting a external nameserver

2009-01-28 Thread Serge Fonville
In that case you can use either views or a split dns Regards. Serge Fonville On Wed, Jan 28, 2009 at 12:44 AM, Luis Silva wrote: > Yes, basically what I need is a forwarder. Basically I want an internal > network but external queries must be handled by another server. > Thanks a lot for the qui

Re: disableing EDNS messages bind-9.5.0

2009-01-28 Thread Matus UHLAR - fantomas
> Dean Clapper wrote: > >I'm trying to troubleshoot why we are getting a lot of disabling EDNS > >messages in /var/log/messages. > > > >We are running bind-9.5.0.P2 on a linux box. [...] > >Jan 27 11:43:39 ns0 named[27764]: too many timeouts resolving > >'196.198.117.216.zen.spamhaus.org/A' (in '

Re: BIND 9.4.x vs 9.6.x - pid-file check and creation

2009-01-28 Thread Jan Arild Lindstrøm
Hi, ah, of course. I did not think about it as a Solaris bug. I patched BIND 9.6.0-P1 os.c code so it first checks for the diretory before it tries the fast approach of just running mkdir. And that of course works fine. But, since I do not want to run a self-patch BIND in production, I will in

Re: BIND 9.6 Flaw - CNAME vs. A Record in MX Records are NOT "Illegal"

2009-01-28 Thread Matus UHLAR - fantomas
On 27.01.09 10:18, Al Stu wrote: > I not only say it, I have demonstrated it. But you have demonstrated something different than we're discussing all the time. > BIND is the DNS system we are discussing. > Have not looked to see if that specifically is spec'ed in an RFC. > Yes other DNS implement

Re: e: BIND 9.6 Flaw - CNAME vs. A Record in MX Records are NOT "Illegal"

2009-01-28 Thread Matus UHLAR - fantomas
> > You say, "both the A record and the CNAME record are returned." > > We know that BIND does this. On 27.01.09 19:33, sth...@nethelp.no wrote: > No, not all BIND versions do this. I'm running BIND 9.5, and when > asking about the MX for nullmx.domainmanager.com I'm getting > > Answer:

Re: Split view multiple zones

2009-01-28 Thread Mark Andrews
In message <49800cfd.nihabiqjcalhfl+u%akos...@andykosela.com>, Andy Kosela writ es: > "Reinis Rozitis" wrote: > > > > I've been using an include file for zones common between multiple > > > views, might help in your case too. > > > > Thanks somehow didnt think about this way. Pretty much takes

Re: [SPAM] Re: Split view multiple zones

2009-01-28 Thread Matus UHLAR - fantomas
> >Of course I could just copy and paste all the zones also in 'custom' view > >but it doubles the configuration size. On 27.01.09 17:26, Chris Burton wrote: > I've been using an include file for zones common between multiple views, it > might help in your case too. I'm afraid they won't eat the