Path: csiph.com!x330-a1.tempe.blueboxinc.net!newsfeed.hal-mli.net!feeder3.hal-mli.net!newsfeed.hal-mli.net!feeder1.hal-mli.net!nx01.iad01.newshosting.com!newshosting.com!novia!usenet.stanford.edu!not-for-mail
From: Jan-Piet Mens <jpmens.dns@gmail.com>
Newsgroups: comp.protocols.dns.bind
Subject: Re: Securing zone transfer and DDNS
Date: Mon, 7 Nov 2011 15:59:34 +0100
Lines: 43
Sender: Jan-Piet Mens <jpmens@gmail.com>
Approved: bind-users@lists.isc.org
Message-ID: <mailman.9.1320677995.68562.bind-users@lists.isc.org>
References: <21ed7915.4729b742.4eb72f52.7f82@o2.pl> <4EB746D7.9000205@dougbarton.us> <687fd44f.1f6eb34b.4eb7ebcc.d7948@o2.pl>
NNTP-Posting-Host: lists.isc.org
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: bind-users@lists.isc.org
To: Aleksander Kurczyk <aleksanderkurczyk@o2.pl>
Content-Disposition: inline
In-Reply-To: <687fd44f.1f6eb34b.4eb7ebcc.d7948@o2.pl>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: list
Xref: x330-a1.tempe.blueboxinc.net comp.protocols.dns.bind:49

> Bind version is: 9.7.4

Upgrade; 9.8.1 is current. (In addition, you're reading a book called
BIND 10 -- even though the book doesn't once mention that software!)

> Maybe this is a stupid question but what is ARM?

BIND 9 Administrator Reference Manual. It is provided in multiple
formats within the BIND source distribution. (doc/arm/*)

[...]

I assume what you probably want to do is something like this:

        key "my.key" {
                algorithm HMAC-MD5;
                secret "xxxx";
        };
        key "my.key2" {
        ...
        };

        acl xferkey {
                key my.key2;
        };

        zone "example.net" IN {
                type master;
                file "example.net";
                allow-update {
                        key "my.key";
                };
                allow-transfer {
                        xferkey;
                };
        };

Create your keys with the dnssec-keygen utility (check its manual page).

Instead of allow-update, I'd like to suggest you read up on the `grant'
statement which allows a much finer granularity on DDNS.

        -JP