Re: [Pdns-users] Fwd: Re: Recursion when Powerdns auth servers is SOA

2012-01-10 Thread Rory Toma
To be clear, in our case, the exact same data is returned, just from different sources. On 1/10/12 4:21 PM, Chris Moates wrote: We have a different use case but similar situation. In our case, we are (unfortunately) using the same domain both internally and externally. So some entries only exi

Re: [Pdns-users] Fwd: Re: Recursion when Powerdns auth servers is SOA

2012-01-10 Thread Chris Moates
We have a different use case but similar situation. In our case, we are (unfortunately) using the same domain both internally and externally. So some entries only exist internally, some only externally, and some both, but with different IP's. Here's an example: web1.domain.com has a 10.x and 208.x

[Pdns-users] Fwd: Re: Recursion when Powerdns auth servers is SOA

2012-01-10 Thread Rory Toma
I noticed I failed to reply to the list... Original Message Subject:Re: [Pdns-users] Recursion when Powerdns auth servers is SOA Date: Tue, 10 Jan 2012 14:56:13 -0800 From: Rory Toma To: bert hubert On 1/10/12 2:48 PM, bert hubert wrote: On Jan 10, 2012,

Re: [Pdns-users] Recursion when Powerdns auth servers is SOA

2012-01-10 Thread bert hubert
On Jan 10, 2012, at 11:37 PM, Rory Toma wrote: > "To make sure that the local authoritative database overrides recursive > information, PowerDNS first tries to answer a question from its own database. > If that succeeds, the answer packet is sent back immediately without > involving the recurs

Re: [Pdns-users] Recursion when Powerdns auth servers is SOA

2012-01-10 Thread Rory Toma
On 1/10/12 2:35 PM, bert hubert wrote: On Jan 10, 2012, at 11:28 PM, Rory Toma wrote: I have a case where we are transitioning from a traditional (albeit hacked) bind server to powerdns auth server. I have the case right now where I've set up powerdns, and set the allow-recursion-override=ye

Re: [Pdns-users] Recursion when Powerdns auth servers is SOA

2012-01-10 Thread bert hubert
On Jan 10, 2012, at 11:28 PM, Rory Toma wrote: > I have a case where we are transitioning from a traditional (albeit hacked) > bind server to powerdns auth server. > > I have the case right now where I've set up powerdns, and set the > allow-recursion-override=yes and set up the recursor, and

[Pdns-users] Recursion when Powerdns auth servers is SOA

2012-01-10 Thread Rory Toma
I have a case where we are transitioning from a traditional (albeit hacked) bind server to powerdns auth server. I have the case right now where I've set up powerdns, and set the allow-recursion-override=yes and set up the recursor, and I have a few questions. 1) It seems that "recursor" onl

Re: [Pdns-users] PowerDNS Security Advisory 2012-01: Denial of Service vulnerability in most versions of the PowerDNS Authoritative Server

2012-01-10 Thread bert hubert
On Tue, Jan 10, 2012 at 10:20:59AM -0800, Augie Schwer wrote: > On Tue, Jan 10, 2012 at 6:01 AM, bert hubert > wrote: > > To solve this issue, we recommend upgrading to the latest packages available > > for your system. Tarballs and new static builds (32/64bit, RPM/DEB) of > > 2.9.22.5 > > and 3

Re: [Pdns-users] PowerDNS Security Advisory 2012-01: Denial of Service vulnerability in most versions of the PowerDNS Authoritative Server

2012-01-10 Thread Augie Schwer
On Tue, Jan 10, 2012 at 6:01 AM, bert hubert wrote: > To solve this issue, we recommend upgrading to the latest packages available > for your system. Tarballs and new static builds (32/64bit, RPM/DEB) of > 2.9.22.5 > and 3.0.1 have been uploaded to our download site. Kees Monshouwer has > provid

Re: [Pdns-users] PowerDNS Security Advisory 2012-01: Denial of Service vulnerability in most versions of the PowerDNS Authoritative Server

2012-01-10 Thread bert hubert
Yes, the freebsd maintainer was notified a few days ago and is working on it. Secondly, the iptables command blocks incoming responses by matching packets with the QR bit in the fixed dnsheader set. We tried to find a bsd equivalent command but failed to do so. Sent from a phone, pardon my brev

Re: [Pdns-users] PowerDNS Security Advisory 2012-01: Denial of Service vulnerability in most versions of the PowerDNS Authoritative Server

2012-01-10 Thread Charles Sprickman
Two quick questions for those of us not running Linux: -Are you coordinating with the FreeBSD port maintainer to get the new version pushed out? (http://www.freshports.org/dns/powerdns) -For those of us unfamiliar with iptables, can you describe in a more generic fashion what that rule is accom

[Pdns-users] updated Debian and RPM 3.0.1 packages for DNSSEC zone transfers

2012-01-10 Thread bert hubert
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi everybody, Diligent testing by PowerDNS user Jan-Piet Mens showed that our Debian and RPM packages had problems DNSSEC signing zone transfers. This was due to linking with the wrong version of the Botan C++ libraries, which was our fault. About 9

Re: [Pdns-users] PowerDNS Security Advisory 2012-01: Denial of Service vulnerability in most versions of the PowerDNS Authoritative Server

2012-01-10 Thread Peter van Dijk
Dear PowerDNS users, On Jan 10, 2012, at 15:01 , bert hubert wrote: > |Workaround |Several, the easiest is setting: cache-ttl=0, which does have > a| > | |performance impact. Please see below. > | Based on a detailed report from a user (thank you!) I reco

[Pdns-users] PowerDNS Security Advisory 2012-01: Denial of Service vulnerability in most versions of the PowerDNS Authoritative Server

2012-01-10 Thread bert hubert
Dear PowerDNS users, It saddens us to have to release this Security Advisory, the first one since almost exactly two years ago. Updated versions of the Authoritative Server are available from http://www.powerdns.com/content/downloads.html and you will find two workarounds and a patch below. A v