Bind and dns master and slave

binddomain-name-system

After going through OReilly dns and bind book, I still have problems with a master and slave configuration, I am getting

client 192.168.1.67#34245: update '<domain>.co.uk/IN' denied
as a syslog error for the master definintion of the zone.
and
named[19034]: client 192.168.1.67#47452: update forwarding '<domain>.co.uk/IN' denied
as a syslog error for the slave definition

The server that has the master zones has a named.conf :

options {
    allow-transfer { 192.168.1/24; };
}
// The reverse lookup of 192.168.1.* - the local IP addresses
zone "1.168.192.in-addr.arpa" in {
    type master;
    file "192.168.1.db";
    allow-transfer { key TRANSFER; };
    allow-update { key TRANSER; };
};

// The forward lookup of hosts on this domain
zone "<domain>.co.uk" in {
    type master;
    file "<domain>.co.uk.db";
    allow-transfer { key TRANSFER; };
    allow-update { key TRANSER; };
};

key "TRANSFER" {
    algorithm hmac-md5;
    secret "<the secret key>";
};

# Slave DNS server
server 192.167.1.67 {
    keys {
            TRANSFER;
    };
};

The server that has the slave zones has :

options {
    allow-transfer { none; };
}

// The reverse lookup of 192.168.1.* - the local IP addresses
zone "1.168.192.in-addr.arpa" in {
    type slave;
    file "bak.192.168.1.db";
    masters { 192.168.1.52 key TRANSFER; };
    allow-update-forwarding { any; };
};

// The forward lookup of hosts on this domain
zone "blairsltd.co.uk" in {
    type slave;
    file "bak.blairsltd.co.uk.db";
    masters { 192.168.1.52 key TRANSFER; };
};

key "TRANSFER" {
    algorithm hmac-md5;
    secret "<the same secret key>";
};

# Master DNS server
server 192.167.1.52 {
    keys {
            TRANSFER;
    };
};

I think eveything is configured so it will allow all legitimate updates securely from the slave to the master, what am I missing?

Best Answer

allow-update-forwarding { any; }; is only on the slave's reverse lookup zone, so it's gonna block attempts to update the forward lookup zone on it - that's the error message on the slave.

The master is configured to require updates to be signed with the transfer key - based on its error message, that's probably not happening since the intent seems to have been to use that key for transfers, correct?

Related Topic