Re: split horizon and zone transfers to secondary DNS servers

2011-11-26 Thread Marek Kozlowski
:-) Or should I use separate secondary DNS servers for internal and external zones? That depends a bit on your setup. Judicious use of views with ACLs could help you solve your problem regarding the zone transfers, but you may feel more comfortable with separate servers. I understand It

Re: split horizon and zone transfers to secondary DNS servers

2011-11-26 Thread Jan-Piet Mens
Judicious use of views with ACLs I haven't actually tested this, but there's a recent thread [1] which describes what I mean. Pay particular attention to the issue of getting master notification into the slaves. -JP [1] https://lists.isc.org/pipermail/bind-users/2011-May/083664.html

Re: Exercising RFC 5011 rollovers

2011-11-26 Thread Phil Mayers
On 11/25/2011 08:49 PM, Evan Hunt wrote: Timing considerations make it difficult to have an automatic test for this in the standard BIND test suite; the RFC requires certain things to take a very long time. Unless you modify named to speed Feature suggestion: some sort of synthetic clock

Re: Exercising RFC 5011 rollovers

2011-11-26 Thread Jan-Piet Mens
Feature suggestion: some sort of synthetic clock option to named for use in the test suite (--test-unixtime-offset) or something? Obviously non-trivial. Indeed. I think Chris' Evan's suggestion of a public zone that revokes and replaces trust anchors periodically (every few hours?) is

Re: Exercising RFC 5011 rollovers

2011-11-26 Thread Phil Mayers
On 11/26/2011 12:21 PM, Jan-Piet Mens wrote: Feature suggestion: some sort of synthetic clock option to named for use in the test suite (--test-unixtime-offset) or something? Obviously non-trivial. Indeed. I think Chris' Evan's suggestion of a public zone that revokes and replaces trust

Re: Exercising RFC 5011 rollovers

2011-11-26 Thread G.W. Haywood
Hi there, On Sat, 26 Nov 2011 Phil Mayers wrote: Feature suggestion: some sort of synthetic clock option ... They say there's a thin line between genius and insanity. Did you just cross it? -- 73, Ged. ___ Please visit

Re: Exercising RFC 5011 rollovers

2011-11-26 Thread Phil Mayers
On 11/26/2011 01:13 PM, G.W. Haywood wrote: Hi there, On Sat, 26 Nov 2011 Phil Mayers wrote: Feature suggestion: some sort of synthetic clock option ... They say there's a thin line between genius and insanity. Did you just cross it? Thanks for the compliment! But I can't take credit for

RE: Exercising RFC 5011 rollovers

2011-11-26 Thread Timothe Litt
There are tools for this. E.g. libfaketime - This communication may not represent my employer's views, if any, on the matters discussed. -Original Message- From: Phil Mayers [mailto:p.may...@imperial.ac.uk] Sent: Saturday,

RE: Exercising RFC 5011 rollovers

2011-11-26 Thread Spain, Dr. Jeffry A.
There are tools for this. E.g. libfaketime Looks like libfaketime (http://www.code-wizards.com/projects/libfaketime/) lets you accelerate the system time. Adapting one of their examples: LD_PRELOAD=./libfaketime.so.1 FAKETIME=x5000 /bin/bash -c 'while true; do echo $SECONDS ; sleep 43200 ;

Configuration RPZ using BIND RPM package

2011-11-26 Thread babu dheen
Hello All,    I am running BIND caching name server in my company and I installed caching name server RPM package(caching-nameserver-9.3.6-16.P1.el5_7.1) through Redhat network directly through YUM.   Now i would like to include RPZ(Response Policy Zone) funtionality with BIND caching server

RE: Configuration RPZ using BIND RPM package

2011-11-26 Thread Spain, Dr. Jeffry A.
Is it possible in configure RPZ by download Bind.tar.gz file from isc website. if yes, do i need to remove completely all running configuration including /etc/named.rfc1912.zones and /etc/named.caching-nameserver.conf files? Kindly suggest. Regards Babu Babu: While I am an Ubuntu user, I