No more idea about loging...?

2018-01-19 Thread Pierre Couderc
On 01/18/2018 05:48 PM, Pierre Couderc wrote: On 01/18/2018 01:01 PM, Anand Buddhdev wrote: I don't know what the function "isc_file_isplainfile" checks for, but perhaps the executable bits on the file are causing the failure. Log files shouldn't be executable, so you nor

Re: Impossible to activate logging

2018-01-18 Thread Pierre Couderc
On 01/18/2018 01:01 PM, Anand Buddhdev wrote: I don't know what the function "isc_file_isplainfile" checks for, but perhaps the executable bits on the file are causing the failure. Log files shouldn't be executable, so you normally need mode 0644 for them. Try changing the mode, and seeing if

Impossible to activate logging

2018-01-18 Thread Pierre Couderc
under systemd, and under a lxd stretch container in a minimal stretch host. I get : Jan 18 10:21:13 bind named[893]: command channel listening on ::1#953 Jan 18 10:21:13 bind named[893]: isc_file_isplainfile '/var/log/bind/bind.log' failed: permission denied Jan 18 10:21:13 bind named[893]: co

Re: How do I reset a DNSSEC zone ?

2017-08-21 Thread Pierre Couderc
On 08/20/2017 02:43 PM, Alberto Colosi wrote: is like is missing the file referenced in log SHA-1 RSA signing is obsolete and banned from NIST and ENRISA is a CVE or should if I remember ell All CA only use SHA-2 no more version 1 as said before. SHA-2 and 2048 or greater yor problem i

Re: How do I reset a DNSSEC zone ?

2017-08-20 Thread Pierre Couderc
On 08/20/2017 03:21 PM, /dev/rob0 wrote: On Sun, Aug 20, 2017 at 01:21:21PM +0200, Pierre Couderc wrote: how to get rid of this message ? If named is configured to sign the zone, it will continue looking for your zone keys. Thank you, your answer is what I needed. I have stop signing then

How do I reset a DNSSEC zone ?

2017-08-20 Thread Pierre Couderc
I did do it roughly on a test zone, by erasing the key and erasing all zone.jnl, zone.signed, etc hoping come back to the initial status. But I get the message : dns_dnssec_keylistfromrdataset: error reading private key file zone/RSASHA1/21477: file not found That is normal as I have erased

Re: reverse dns configuration for IPV4, IPV6+ dns+ mail ?

2017-06-19 Thread Pierre Couderc
On 06/19/2017 10:42 AM, Matus UHLAR - fantomas wrote: If I do what you say reverse IP for DNS will point on mail.xxx.com and not on ns.xxx.com. I have asked you twice: WHO TOLD YOU THIS IS A PROBLEM? IT IS NOT! There are only a few services on the net who currently use reverse DNS records

Re: reverse dns configuration for IPV4, IPV6+ dns+ mail ?

2017-06-19 Thread Pierre Couderc
On 06/19/2017 10:27 AM, Mark Elkins wrote: Another solution could be to make one of the names a CNAME pointing to the other name. -or- Just use one generic name for both services. rather than the two "service" names. Although in all honesty, I see nothing wrong with a lookup returning two a

Re: reverse dns configuration for IPV4, IPV6+ dns+ mail ?

2017-06-19 Thread Pierre Couderc
On 06/19/2017 08:51 AM, Matus UHLAR - fantomas wrote: On 19.06.17 08:03, Pierre Couderc wrote: Ok, thank you all, now I need to understand your answers... long story short: in the "125.124.123.in-addr.arpa" zone: 126 IN PTR mail.xxx.com. quoting your original message: W

Re: reverse dns configuration for IPV4, IPV6+ dns+ mail ?

2017-06-19 Thread Pierre Couderc
On 06/19/2017 01:05 AM, Reindl Harald wrote: Am 18.06.2017 um 17:38 schrieb Matus UHLAR - fantomas: On 18.06.17 16:26, Mark Elkins wrote: Put two reverse records in both the IPv4 and IPv6 reverse zones in the "125.124.123.in-addr.arpa" zone: 126 IN PTR mail.xxx.com. 126 IN PT

Re: reverse dns configuration for IPV4, IPV6+ dns+ mail ?

2017-06-18 Thread Pierre Couderc
On 06/19/2017 01:05 AM, Reindl Harald wrote: Am 18.06.2017 um 17:38 schrieb Matus UHLAR - fantomas: On 18.06.17 16:26, Mark Elkins wrote: Put two reverse records in both the IPv4 and IPv6 reverse zones in the "125.124.123.in-addr.arpa" zone: 126 IN PTR mail.xxx.com. 126 IN

reverse dns configuration for IPV4, IPV6+ dns+ mail ?

2017-06-18 Thread Pierre Couderc
Well, we have 2 computers in xxx.com subnet provided by ISP on 123.124.125.126 ipV4 address and corresponding IPV6 segment mail.xxx.com :2a01:e34:::::1122:3344 for mail server ns.xxx.com : 2a01:e34:::::aabb:ccdd for dns server In xxx.com bind : mail A 123.