AXFR/IN' denied
Greetings
I have 2 systems master and slave, the slave seems to not allow the zone
transfer.
master 192.168.1.2
//
// mydomain.com
zone "mydomain.com" {
type master;
file "domain.db";
allow-transfer { 192.168.96.3; };
allow-update {none;};
};
zone "96.168.192.in-addr.arpa" {
type master;
file "in-arpa-192/REV-NOC.db";
};
zone "97.168.192.in-addr.arpa" {
type master;
file "in-arpa-192/REV-EDC.db";
};
slave; 192.168.1.3
//
// mydomain.com
zone "mydomain.com" {
type slave;
masters { 192.168.96.2; };
file "domain.db";
allow-transfer {none;};
};
zone "96.168.192.in-addr.arpa" {
type slave;
masters { 192.168.96.2; };
file "in-arpa-209/REV-NOC.db";
};
zone "97.168.192.in-addr.arpa" {
type slave;
masters { 209.96.96.2; };
file "in-arpa-209/REV-EDC.db";
};
here is the log output
from master
-Apr-2011 22:54:17.539 security: error: client 192.168.96.3#60712: view
com.basd.DNS.public: zone transfer '96.168.192.in-addr.arpa/AXFR/IN' denied
-Apr-2011 22:54:17.539 security: error: client 192.168.96.3#60737: view
com.basd.DNS.public: zone transfer '97.168.192.in-addr.arpa/AXFR/IN' denied
from slave
27-Apr-2011 22:57:23.039 general: info: zone
96.168.192.in-addr.arpa/IN/com.basd.DNS.public: Transfer started.
27-Apr-2011 22:57:23.041 xfer-in: info: transfer of
'96.168.192.in-addr.arpa/IN/com.basd.DNS.public' from 192.168.96.2#53:
connected using 192.168.96.3#60755
27-Apr-2011 22:57:23.042 xfer-in: error: transfer of
'96.168.192.in-addr.arpa/IN/com.basd.DNS.public' from 192.168.96.2#53: failed
while receiving responses: REFUSED
27-Apr-2011 22:57:23.042 xfer-in: info: transfer of
'96.168.192.in-addr.arpa/IN/com.basd.DNS.public' from 192.168.96.2#53: Transfer
completed: 0 messages, 0 records, 0 bytes, 0.001 secs (0 bytes/sec)
firewall on the slave is off and the master has an allow statement for dns
12310271101096192 allow tcp from any to any dst-port 53
12310 2124656 168384287 allow udp from any to any dst-port 53
not sure what I missed , any insight would be helpful
-j
___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
Re: AXFR/IN' denied
On 04/28/11 05:10, jeffrey j donovan wrote:
> Greetings
>
> I have 2 systems master and slave, the slave seems to not allow the zone
> transfer.
It's the master that doesn't allow zone transfer. You have
allow-transfer and allow-update in mydomain.com (which I guess is
transfering correctly, at least nothing you've written says otherwise),
but you don't have these in reverse zones.
Torinthiel
>
> master 192.168.1.2
>
> //
> // mydomain.com
>
> zone "mydomain.com" {
> type master;
> file "domain.db";
> allow-transfer { 192.168.96.3; };
> allow-update {none;};
> };
>
> zone "96.168.192.in-addr.arpa" {
> type master;
> file "in-arpa-192/REV-NOC.db";
> };
>
> zone "97.168.192.in-addr.arpa" {
> type master;
> file "in-arpa-192/REV-EDC.db";
> };
>
>
> slave; 192.168.1.3
>
> //
> // mydomain.com
>
> zone "mydomain.com" {
> type slave;
> masters { 192.168.96.2; };
> file "domain.db";
> allow-transfer {none;};
> };
>
> zone "96.168.192.in-addr.arpa" {
> type slave;
> masters { 192.168.96.2; };
> file "in-arpa-209/REV-NOC.db";
> };
>
> zone "97.168.192.in-addr.arpa" {
> type slave;
> masters { 209.96.96.2; };
> file "in-arpa-209/REV-EDC.db";
> };
>
>
> here is the log output
>
> from master
> -Apr-2011 22:54:17.539 security: error: client 192.168.96.3#60712: view
> com.basd.DNS.public: zone transfer '96.168.192.in-addr.arpa/AXFR/IN' denied
> -Apr-2011 22:54:17.539 security: error: client 192.168.96.3#60737: view
> com.basd.DNS.public: zone transfer '97.168.192.in-addr.arpa/AXFR/IN' denied
>
> from slave
>
>
> 27-Apr-2011 22:57:23.039 general: info: zone
> 96.168.192.in-addr.arpa/IN/com.basd.DNS.public: Transfer started.
> 27-Apr-2011 22:57:23.041 xfer-in: info: transfer of
> '96.168.192.in-addr.arpa/IN/com.basd.DNS.public' from 192.168.96.2#53:
> connected using 192.168.96.3#60755
> 27-Apr-2011 22:57:23.042 xfer-in: error: transfer of
> '96.168.192.in-addr.arpa/IN/com.basd.DNS.public' from 192.168.96.2#53: failed
> while receiving responses: REFUSED
> 27-Apr-2011 22:57:23.042 xfer-in: info: transfer of
> '96.168.192.in-addr.arpa/IN/com.basd.DNS.public' from 192.168.96.2#53:
> Transfer completed: 0 messages, 0 records, 0 bytes, 0.001 secs (0 bytes/sec)
>
>
> firewall on the slave is off and the master has an allow statement for dns
> 12310271101096192 allow tcp from any to any dst-port 53
> 12310 2124656 168384287 allow udp from any to any dst-port 53
>
>
> not sure what I missed , any insight would be helpful
>
> -j
>
> ___
> bind-users mailing list
> bind-users@lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users
signature.asc
Description: OpenPGP digital signature
___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
Re: AXFR/IN' denied
On 04/28/2011 04:10 AM, jeffrey j donovan wrote:
master 192.168.1.2
zone "mydomain.com" {
type master;
file "domain.db";
allow-transfer { 192.168.96.3; };
Ok, you have an allow-transfer so this is working.
allow-update {none;};
};
zone "96.168.192.in-addr.arpa" {
type master;
file "in-arpa-192/REV-NOC.db";
};
zone "97.168.192.in-addr.arpa" {
type master;
file "in-arpa-192/REV-EDC.db";
};
There is no allow-transfer on these two zones, so they are failing.
___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
Re: AXFR/IN' denied ::solved::
On Apr 27, 2011, at 11:10 PM, jeffrey j donovan wrote:
> Greetings
>
> I have 2 systems master and slave, the slave seems to not allow the zone
> transfer.
>
found the problem, I had multiple option entries in named.conf there was an
original option line that I over looked that was from a previous master that
had allow-transfer { none; };
sorry to waste bandwidth :)
-j
___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
