Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #193533

Re: dnsmasq and SOA

Show all headers | View raw

On 08/03/2018 09:51, Reco wrote:
> 	Hi.
>
> On Wed, Mar 07, 2018 at 10:19:32PM +0100, RODARY Jacques wrote:
>> 	Sorry for my last post: I sent a draft mail instead of the corrected one.  Let's go back to my own concern: dnsmasq and soa,
>> if you don't mind. Here is my dnsmasq.conf file:
>> resolv-file=/etc/dnsmasqresolv.conf
>>
>> interface=eno1
>> interface=wlp3s0
>> no-dhcp-interface=enp2s0
>>
>> auth-zone=rodary.net
>>
>> auth-soa=2018022800,root.ns.rodary.net,10800,3600,10800
>>
>> 	Shouldn't I add a "auth-peer=217.70.177.40" line for AXFR to ns6.gandi.net? With all my stupid previous acts, I don't dare to try it,
>> specially when it could affect outside hosts e.g. my registrar.
> I never tried it myself, but the manpage says this on auth-peer:
>
> If this option is not given, then AXFR requests will be accepted from any secondary.
>
>
> The way I understand it, your configuration should work without
> auth-peer, while being somewhat insecure. You may need to specify
> ns6.gandi.net as secondary through auth-sec-servers, on the other hand.
>
> Yet your configuration does not work, apparently, as 'dig +trace'
> shows me this:
>
> rodary.net.             3600    IN      SOA     ns.rodary.net.
> root.ns.rodary.net. 2018022101 10800 3600 604800 3600
> rodary.net.             3600    IN      NS      ns.rodary.net.
> rodary.net.             3600    IN      NS      ns6.gandi.net.
> ;; Received 169 bytes from 217.70.177.40#53(ns6.gandi.net) in 64 ms
Today "dig in soa rodary.net" gives me:
rodary.net.             600     IN      SOA     . root.ns.rodary.net. 
2018022801 10800 3600 10800 600
Which is neither the answer I had  yesterday, neither yours (by the way 
I don't find how to use the "dig +trace" command), and "dig in ns 
rodary.net" which gave me ns.rodary.net and ns6.gandi.net , gives me 
only ns.rodary.net now, and "dig in ns/soa rodary.net @ns6.gandi.net" 
has no answer, but "recursion requested but not available"
> Did your previous BIND configuration implement DNSSEC?
No.

ns6.gandi.net was NS in my main zone file; so I think I will try 
auth-sec-servers=ns6.gandi.net as it was in my BIND setup
     Jacques

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Issues while installing Debian 啊肥坚lolz <rex12425@gmail.com> - 2018-02-19 18:10 +0100
  Re: Issues while installing Debian Hans <hans.ullrich@loop.de> - 2018-02-19 18:10 +0100
  Re: Issues while installing Debian Raju Devidas <rajudev@disroot.org> - 2018-02-19 19:00 +0100
  dnsmasq and SOA RODARY Jacques <rodaryj@free.fr> - 2018-02-28 01:30 +0100
    Re: dnsmasq and SOA Reco <recoverym4n@gmail.com> - 2018-02-28 06:50 +0100
      Re: Re: dnsmasq and SOA RODARY Jacques <rodaryj@free.fr> - 2018-03-01 02:10 +0100
        Re: Re: dnsmasq and SOA Reco <recoverym4n@gmail.com> - 2018-03-01 07:40 +0100
          Re: dnsmasq and SOA Curt <curty@free.fr> - 2018-03-02 22:00 +0100
            Re: Re: dnsmasq and SOA RODARY Jacques <rodaryj@free.fr> - 2018-03-06 03:00 +0100
              Re: Re: dnsmasq and SOA Reco <recoverym4n@gmail.com> - 2018-03-06 07:30 +0100
          Re: Re: Re: dnsmasq and SOA RODARY Jacques <rodaryj@free.fr> - 2018-03-07 22:20 +0100
            Re: Re: Re: dnsmasq and SOA Reco <recoverym4n@gmail.com> - 2018-03-08 10:00 +0100
              Re: dnsmasq and SOA Jacques Rodary <rodaryj@free.fr> - 2018-03-08 19:00 +0100
                Re: dnsmasq and SOA Jacques Rodary <rodaryj@free.fr> - 2018-03-09 03:40 +0100
                Re: dnsmasq and SOA Reco <recoverym4n@gmail.com> - 2018-03-09 08:40 +0100
                Re: dnsmasq and SOA Jacques Rodary <rodaryj@free.fr> - 2018-03-09 18:30 +0100
                Re: dnsmasq and SOA Reco <recoverym4n@gmail.com> - 2018-03-09 19:30 +0100

csiph-web