Hi list,
I'm trying to use BIND 9.3.4 as a slave server for a couple of my zones.
The primary name server is running NSD. Both are running NTPD.
Master has an an external IP address (MAS.TER.MAS.TER), while slave
server has a RFC1918 address (192.168.1.153) and the leading firewall
redirects UDP/TCP packets to SLA.VE.SLA.VE:53 to it.
AXFR fails invariably with the following error: "tsig verify failure".
Do, by chance, TSIG packets use IP address during encryption?
I've been struggling to understand the problem for maybe 8 hours, but
I'm clueless now... Any help would be welcome.
The configuration of the master server, running NSD, is straightforward:
% key:
% name: master-slave.
% algorithm: hmac-md5
% secret: "ABCDEFGHIJKLMNOPQRSTUV=="
% zone:
% name: "le-hen.org"
% zonefile: "le-hen.org.zone"
% notify: SLA.VE.SLA.VE master-slave.
% provide-xfr: SLA.VE.SLA.VE master-slave.
The slave BIND relevant configuration is:
% key master-slave. {
% algorithm hmac-md5;
% secret: "ABCDEFGHIJKLMNOPQRSTUV==";
% };
% server MAS.TER.MAS.TER {
% keys { master-slave. };
% };
% view external {
% [...]
%
% zone "le-hen.org" {
% type slave;
% masters { MAS.TER.MAS.TER; };
% file "/var/db/named/le-hen.org.bak";
% allow-transfer { none; };
% };
% };
BIND log (sorry if the line wraps):
% Feb 28 09:54:25 slave named[37517]: notify: info: client
MAS.TER.MAS.TER#54434: view external: received notify for zone 'le-hen.org':
TSIG 'master-slave'
% Feb 28 09:54:26 slave named[37517]: xfer-in: info: zone
le-hen.org/IN/external: zone transfer deferred due to quota
% Feb 28 09:54:26 slave named[37517]: general: info: zone
le-hen.org/IN/external: Transfer started.
% Feb 28 09:54:26 slave named[37517]: xfer-in: info: transfer of
'le-hen.org/IN' from MAS.TER.MAS.TER#53: connected using 192.168.1.153#53780
% Feb 28 09:54:26 slave named[37517]: xfer-in: debug 3: transfer of
'le-hen.org/IN' from MAS.TER.MAS.TER#53: requesting IXFR for serial 2009021700
% Feb 28 09:54:26 slave named[37517]: xfer-in: debug 3: transfer of
'le-hen.org/IN' from MAS.TER.MAS.TER#53: sent request length prefix
% Feb 28 09:54:26 slave named[37517]: xfer-in: debug 3: transfer of
'le-hen.org/IN' from MAS.TER.MAS.TER#53: sent request data
% Feb 28 09:54:26 slave named[37517]: xfer-in: debug 7: transfer of
'le-hen.org/IN' from MAS.TER.MAS.TER#53: received 188 bytes
% Feb 28 09:54:26 slave named[37517]: xfer-in: debug 3: transfer of
'le-hen.org/IN' from MAS.TER.MAS.TER#53: got NOTIMP, retrying with AXFR
% Feb 28 09:54:26 slave named[37517]: xfer-in: info: transfer of
'le-hen.org/IN' from MAS.TER.MAS.TER#53: resetting
% Feb 28 09:54:26 slave named[37517]: xfer-in: info: transfer of
'le-hen.org/IN' from MAS.TER.MAS.TER#53: connected using 192.168.1.153#55660
% Feb 28 09:54:26 slave named[37517]: xfer-in: debug 3: transfer of
'le-hen.org/IN' from MAS.TER.MAS.TER#53: sent request length prefix
% Feb 28 09:54:26 slave named[37517]: xfer-in: debug 3: transfer of
'le-hen.org/IN' from MAS.TER.MAS.TER#53: sent request data
% Feb 28 09:54:27 slave named[37517]: xfer-in: debug 7: transfer of
'le-hen.org/IN' from MAS.TER.MAS.TER#53: received 263 bytes
% Feb 28 09:54:27 slave named[37517]: xfer-in: debug 3: transfer of
'le-hen.org/IN' from MAS.TER.MAS.TER#53: sent request length prefix
% Feb 28 09:54:27 slave named[37517]: xfer-in: debug 3: transfer of
'le-hen.org/IN' from MAS.TER.MAS.TER#53: sent request data
% Feb 28 09:54:27 slave named[37517]: xfer-in: debug 7: transfer of
'le-hen.org/IN' from MAS.TER.MAS.TER#53: received 707 bytes
% Feb 28 09:54:27 slave named[37517]: dnssec: debug 2: tsig key 'master-slave':
signature failed to verify
% Feb 28 09:54:27 slave named[37517]: xfer-in: debug 3: transfer of
'le-hen.org/IN' from MAS.TER.MAS.TER#53: TSIG check failed: tsig verify failure
% Feb 28 09:54:27 slave named[37517]: xfer-in: error: transfer of
'le-hen.org/IN' from MAS.TER.MAS.TER#53: failed while receiving responses: tsig
verify failure
% Feb 28 09:54:27 slave named[37517]: general: debug 1: zone
le-hen.org/IN/external: zone transfer finished: tsig verify failure
% Feb 28 09:54:27 slave named[37517]: xfer-in: info: transfer of
'le-hen.org/IN' from MAS.TER.MAS.TER#53: end of transfer
Thanks.
Best regards,
--
Jeremie Le Hen
< jeremie at le-hen dot org >< ttz at chchile dot org >
_______________________________________________
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
