Re: specifics of downgrading from rpz2 (3rd party patch) -> rpz1 (in Bind release) ?

2014-01-13 Thread pgndev
> You appear to want people to supply you with a new patch Oh, THAT's what I wanted? Thanks SO much for clearing that up! > ... and unless you are paying Vernon to support you he is under no obligation > to respond to you. ... You can keep bloviating, but it still doesn't mean you have the sli

Re: specifics of downgrading from rpz2 (3rd party patch) -> rpz1 (in Bind release) ?

2014-01-13 Thread Mark Andrews
In message , pgndev writes: > On Mon, Jan 13, 2014 at 2:15 PM, Mark Andrews wrote: > > Why does the *need* to be info as the existing patches works other > > than for the version file which for the fix by hand is pretty > > obvious or you can just leave it as it is in 9.9.4-P2. > > The patch de

Re: dumping master file: tmp-xxx: open: permission denied

2014-01-13 Thread Mark Andrews
In message <8919443e-8f62-48cd-8da4-9c9632fc5...@kreme.com>, LuKreme writes: > OK, I am getting this error "dumping master file: tmp-xxx: open: > permission denied", occasionally, on both my slave DNS servers and I > can't seem to fix it. > > The dns slave files are being written into /var/named/e

Re: specifics of downgrading from rpz2 (3rd party patch) -> rpz1 (in Bind release) ?

2014-01-13 Thread pgndev
On Mon, Jan 13, 2014 at 2:15 PM, Mark Andrews wrote: > Why does the *need* to be info as the existing patches works other > than for the version file which for the fix by hand is pretty > obvious or you can just leave it as it is in 9.9.4-P2. The patch devs have been silent on their site, and on

dumping master file: tmp-xxx: open: permission denied

2014-01-13 Thread LuKreme
OK, I am getting this error "dumping master file: tmp-xxx: open: permission denied", occasionally, on both my slave DNS servers and I can't seem to fix it. The dns slave files are being written into /var/named/etc/namedb/slave which is owned by bind 8 drwxr-xr-x 2 bind wheel 1024 Jan 13 19:4

Re: A Few Additional Words About CVE-2014-0591

2014-01-13 Thread Evan Hunt
On Mon, Jan 13, 2014 at 04:44:22PM -0600, Lawrence K. Chen, P.Eng. wrote: > Hmmm, from what I vaguely recall from my software engineering days, was > that memcpy() didn't ever handle overlapped memory buffers and that you > should consider memmove() in such cases. Yes, that's correct, and in fact

Re: A Few Additional Words About CVE-2014-0591

2014-01-13 Thread Lawrence K. Chen, P.Eng.
Hmmm, from what I vaguely recall from my software engineering days, was that memcpy() didn't ever handle overlapped memory buffers and that you should consider memmove() in such cases. Doesn't really make sense that it should, though I think I first learned about this during a code review. Don't

Re: Sites that points their A Record to localhost

2014-01-13 Thread Lawrence K. Chen, P.Eng.
On 01/13/14 03:43, Barry Margolin wrote: > In article , > Matus UHLAR - fantomas wrote: > >>> On Jan 11 2014, Joseph S D Yao wrote: (2) There is no requirement that a domain name refer to the Web site for that domain. I personally don't like that (for no special reason), and

RHEL, Centos, Fedora rpm 9.9.4-P2

2014-01-13 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 http://www.five-ten-sg.com/mapper/bind contains links to the source rpms, and build instructions. -BEGIN PGP SIGNATURE- Version: GnuPG v2.0.14 (GNU/Linux) iEYEARECAAYFAlLUTDoACgkQL6j7milTFsH5sgCfXRrP/D54ZM88CQnOQcNDTOPA yZ0AoIdbMDJ96Ax05qH+H

A Few Additional Words About CVE-2014-0591

2014-01-13 Thread Michael McNally
Hello, Bind-Users Readers -- Since you are all subscribers to bind-announce as well [You are, aren't you? It's where we make announcements about security vulnerabilities and about new versions of BIND] you are probably already aware that ISC has announced CVE-2014-0591, a vulnerability which can

Re: Sites that points their A Record to localhost

2014-01-13 Thread Eduardo Bonsi
> On 1/10/14, 8:36 PM, Joseph S D Yao wrote: > There seems to be a pile of misconceptions here. Joseph, 1. No one from this list that answered to my original question actually showed any degree of confusion, (including myself). There were only observations on the subject, nothing more... 2. Al

Re: specifics of downgrading from rpz2 (3rd party patch) -> rpz1 (in Bind release) ?

2014-01-13 Thread pgndev
> IIRC there's no syntax/feature difference. Quickly attempting to use the existing, same named config that I've been using with 9.9.4-rpz2+rl.13269.14 with a new build of 9.9.4-P2 release, 9.9.4-P2 refuses to boot. I've not (yet) gotten any farther than that ... ... shouldn't be tough to figure

Re: specifics of downgrading from rpz2 (3rd party patch) -> rpz1 (in Bind release) ?

2014-01-13 Thread Phil Mayers
On 13/01/2014 17:27, pgndev wrote: Can anyone clarify specifically the *diff* between rpz1, as in the Bind9 release, and rpz2? Particularly, which specific features/capabilities I need to unwind to get back to 'just' rpz1? IIRC there's no syntax/feature difference. Rather, RPZ2 is a set of (

specifics of downgrading from rpz2 (3rd party patch) -> rpz1 (in Bind release) ?

2014-01-13 Thread pgndev
We'd deployed named v9.9.4 with the patches from BIND9 RRL and RPZ Patches http://ss.vix.su/~vjs/rrlrpz.html ... Multiple Zone Response Policy Zone (RPZ2) Speed Improvement with Response Rate Limiting (RRL) BIND9 9.9.4 file rpz2+rl-9.9.4.patch, version

Re: Generic reasons for recursive performance not to peg CPU?

2014-01-13 Thread Phil Mayers
On 13/01/14 01:16, Doug Barton wrote: Howdy, Without going into too much detail, doing some performance testing and am seeing a weird result. On the same systems authoritative queries will happily peg the CPU. However when running recursive queries (with a small zone, all data cached before test

Re: Sites that points their A Record to localhost

2014-01-13 Thread Barry Margolin
In article , Matus UHLAR - fantomas wrote: > >On Jan 11 2014, Joseph S D Yao wrote: > >>(2) There is no requirement that a domain name refer to the Web > >>site for that domain. I personally don't like that (for no special > >>reason), and neither apparently does the owner of this domain, who

Re: rndc addzone gets permission denied

2014-01-13 Thread Georgy Goshin
Seems previously I made some mistake when tried to make writable /var/named... Currently chmod g+w /var/named resolved the problem. Thanks to all! 2014/1/13 Leonard Mills > You previously showed your unsuccessful rndc command. It contained: > 'type slave; file "slaves/zone.local"; > > Un

Re: Generic reasons for recursive performance not to peg CPU?

2014-01-13 Thread Matus UHLAR - fantomas
On 12.01.14 17:16, Doug Barton wrote: Without going into too much detail, doing some performance testing and am seeing a weird result. On the same systems authoritative queries will happily peg the CPU. However when running recursive queries (with a small zone, all data cached before testing) t

Re: rndc addzone gets permission denied

2014-01-13 Thread Leonard Mills
You previously showed your unsuccessful rndc command.  It contained: 'type slave; file "slaves/zone.local"; Unless you override the defaults, that says: "use the file /var/named/slaves/zone.local". So it appears that the directory /var/named/slaves was not writable. Hth, Len On Su

Re: Sites that points their A Record to localhost

2014-01-13 Thread Matus UHLAR - fantomas
On Jan 11 2014, Joseph S D Yao wrote: (2) There is no requirement that a domain name refer to the Web site for that domain. I personally don't like that (for no special reason), and neither apparently does the owner of this domain, who forces people to go to the trouble of typing in www.p3net.

Re: Is this scenario possible?

2014-01-13 Thread Matus UHLAR - fantomas
In article , Blason R wrote: Pertaining to the same discussion. Can someone validate below zone files and named.conf files? What I wanted to achieve here is; I wanted to make mail.example.com as my sub domain and give them A record so that I could load balance the traffic on LBs since my LBs are

Re: Generic reasons for recursive performance not to peg CPU?

2014-01-13 Thread Leonard Mills
>Thanks for the response, but you're answering a different question than >I asked. :)  The question I'm interested in is, "Why is the recursive >server not pegging the CPU?" I should have quoted Sten's context.  If the recursive answer contains additional data, that may contributing to the