Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #193544

Re: dnsmasq and SOA

Show all headers | View raw

On 08/03/2018 18:58, Jacques Rodary wrote:
>
>
> On 08/03/2018 09:51, Reco wrote:
>>     Hi.
>>
>> On Wed, Mar 07, 2018 at 10:19:32PM +0100, RODARY Jacques wrote:
>>>     Sorry for my last post: I sent a draft mail instead of the 
>>> corrected one.  Let's go back to my own concern: dnsmasq and soa,
>>> if you don't mind. Here is my dnsmasq.conf file:
>>> resolv-file=/etc/dnsmasqresolv.conf
>>>
>>> interface=eno1
>>> interface=wlp3s0
>>> no-dhcp-interface=enp2s0
>>>
>>> auth-zone=rodary.net
>>>
>>> auth-soa=2018022800,root.ns.rodary.net,10800,3600,10800
>>>
>>>     Shouldn't I add a "auth-peer=217.70.177.40" line for AXFR to 
>>> ns6.gandi.net? With all my stupid previous acts, I don't dare to try 
>>> it,
>>> specially when it could affect outside hosts e.g. my registrar.
>> I never tried it myself, but the manpage says this on auth-peer:
>>
>> If this option is not given, then AXFR requests will be accepted from 
>> any secondary.
>>
>>
>> The way I understand it, your configuration should work without
>> auth-peer, while being somewhat insecure. You may need to specify
>> ns6.gandi.net as secondary through auth-sec-servers, on the other hand.
>>
>> Yet your configuration does not work, apparently, as 'dig +trace'
>> shows me this:
>>
>> rodary.net.             3600    IN      SOA     ns.rodary.net.
>> root.ns.rodary.net. 2018022101 10800 3600 604800 3600
>> rodary.net.             3600    IN      NS      ns.rodary.net.
>> rodary.net.             3600    IN      NS      ns6.gandi.net.
>> ;; Received 169 bytes from 217.70.177.40#53(ns6.gandi.net) in 64 ms
> Today "dig in soa rodary.net" gives me:
> rodary.net.             600     IN      SOA     . root.ns.rodary.net. 
> 2018022801 10800 3600 10800 600
> Which is neither the answer I had  yesterday, neither yours (by the 
> way I don't find how to use the "dig +trace" command), and "dig in ns 
> rodary.net" which gave me ns.rodary.net and ns6.gandi.net , gives me 
> only ns.rodary.net now, and "dig in ns/soa rodary.net @ns6.gandi.net" 
> has no answer, but "recursion requested but not available"
>> Did your previous BIND configuration implement DNSSEC?
No
ns6.gandi.net was NS in my main zone file; so I think I will try 
auth-sec-servers=ns6.gandi.net as it was in my BIND setup. I did and it  
worked: "dig in soa  rodary.net" gives me:
;; ANSWER SECTION:
rodary.net.             600     IN      SOA     . root.ns.rodary.net. 
2018022801 10800 3600 10800 600

;; AUTHORITY SECTION:
rodary.net.             600     IN      NS      .
rodary.net.             600     IN      NS      ns6.gandi.net.

and even if I don't quite understand why "." (the root) is my secondary 
server, I suppose it means  I succeeded to have my host as a stealth 
server! But when I added "auth-peer=217.70.177.40"  I had to restart 
everything, which means reboot for me because I don't understand quite 
well how NetworkManager works.
     Jacques

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Issues while installing Debian 啊肥坚lolz <rex12425@gmail.com> - 2018-02-19 18:10 +0100
  Re: Issues while installing Debian Hans <hans.ullrich@loop.de> - 2018-02-19 18:10 +0100
  Re: Issues while installing Debian Raju Devidas <rajudev@disroot.org> - 2018-02-19 19:00 +0100
  dnsmasq and SOA RODARY Jacques <rodaryj@free.fr> - 2018-02-28 01:30 +0100
    Re: dnsmasq and SOA Reco <recoverym4n@gmail.com> - 2018-02-28 06:50 +0100
      Re: Re: dnsmasq and SOA RODARY Jacques <rodaryj@free.fr> - 2018-03-01 02:10 +0100
        Re: Re: dnsmasq and SOA Reco <recoverym4n@gmail.com> - 2018-03-01 07:40 +0100
          Re: dnsmasq and SOA Curt <curty@free.fr> - 2018-03-02 22:00 +0100
            Re: Re: dnsmasq and SOA RODARY Jacques <rodaryj@free.fr> - 2018-03-06 03:00 +0100
              Re: Re: dnsmasq and SOA Reco <recoverym4n@gmail.com> - 2018-03-06 07:30 +0100
          Re: Re: Re: dnsmasq and SOA RODARY Jacques <rodaryj@free.fr> - 2018-03-07 22:20 +0100
            Re: Re: Re: dnsmasq and SOA Reco <recoverym4n@gmail.com> - 2018-03-08 10:00 +0100
              Re: dnsmasq and SOA Jacques Rodary <rodaryj@free.fr> - 2018-03-08 19:00 +0100
                Re: dnsmasq and SOA Jacques Rodary <rodaryj@free.fr> - 2018-03-09 03:40 +0100
                Re: dnsmasq and SOA Reco <recoverym4n@gmail.com> - 2018-03-09 08:40 +0100
                Re: dnsmasq and SOA Jacques Rodary <rodaryj@free.fr> - 2018-03-09 18:30 +0100
                Re: dnsmasq and SOA Reco <recoverym4n@gmail.com> - 2018-03-09 19:30 +0100

csiph-web