| View previous topic :: View next topic |
| Author |
Message |
Francois
n00b
Joined: 10 Jan 2011
Posts: 19
Location: LE Pouliguen - 44 - France
|
 Posted: Mon Jan 10, 2011 4:45 pm Post subject: [BIND]Problème Mise à jour DNS secondaire BIND |
 |
|
Bonjour, je me présente, je suis étudiant en informatique et je suis actuellement en stage. On me demande de mettre en place deux serveurs DNS sous Gentoo, un primaire et un secondaire. Après avoir batailler avec le noyau de Gentoo et l'installation, je me retrouve avec un environnement de virtualisation qui comprend 2 serveurs DNS qui fonctionnent sous Gentoo. J'ai correctement installer BIND sur mes deux serveurs et ils marchent bien pour résoudre mon domaine "exempletest.francois" (qui est un domaine factice). Mon problème est que lorsque je modifie mon fichier de zone sur mon DNS primaire, il ne fait pas la mise à jour sur mon DNS secondaire alors que je pense avoir configuré mon fichier "named.conf" avec les bonnes options pour ma zone sur mon DNS primaire. Mon DNS secondaire se met à jour seulement lorsque, je redémarre le service "named" (/etc/init.d/named restart) sur le DNS primaire. Je vous poste ici, mes fichiers de configuration :
DNS PRIMAIRE
named.conf
| Code: |
/*
* Refer to the named.conf(5) and named(8) man pages, and the documentation
* in /usr/share/doc/bind-9 for more details.
* Online versions of the documentation can be found here:
* http://www.isc.org/software/bind/documentation
*
* If you are going to set up an authoritative server, make sure you
* understand the hairy details of how DNS works. Even with simple mistakes,
* you can break connectivity for affected parties, or cause huge amounts of
* useless Internet traffic.
*/
acl "xfer" {
/* Deny transfers by default except for the listed hosts.
* If we have other name servers, place them here.
*/
none;
};
/*
* You might put in here some ips which are allowed to use the cache or
* recursive queries
*/
acl "trusted" {
127.0.0.0/8;
::1/128;
};
options {
directory "/var/bind";
pid-file "/var/run/named/named.pid";
/* https://www.isc.org/solutions/dlv >=bind-9.7.x only */
//bindkeys-file "/etc/bind/bind.keys";
listen-on-v6 { none; };
listen-on { 127.0.0.1; };
listen-on { 192.168.1.104; };
allow-query {
/*
* Accept queries from our "trusted" ACL. We will
* allow anyone to query our master zones below.
* This prevents us from becoming a free DNS server
* to the masses.
*/
any;
};
allow-query-cache {
/* Use the cache for the "trusted" ACL. */
trusted;
};
allow-recursion {
/* Only trusted addresses are allowed to use recursion. */
localhost;
};
allow-transfer {
/* Zone tranfers are denied by default. */
trusted;
};
allow-update {
/* Don't allow updates, e.g. via nsupdate. */
trusted;
};
/*
* If you've got a DNS server around at your upstream provider, enter its
* IP address here, and enable the line below. This will make you benefit
* from its cache, thus reduce overall DNS traffic in the Internet.
*
* Uncomment the following lines to turn on DNS forwarding, and change
* and/or update the forwarding ip address(es):
*/
/*
forward first;
forwarders {
// 123.123.123.123; // Your ISP NS
// 124.124.124.124; // Your ISP NS
// 4.2.2.1; // Level3 Public DNS
// 4.2.2.2; // Level3 Public DNS
8.8.8.8; // Google Open DNS
8.8.4.4; // Google Open DNS
};
*/
//dnssec-enable yes;
//dnssec-validation yes;
/* if you have problems and are behind a firewall: */
//query-source address * port 53;
};
/*
logging {
channel default_log {
file "/var/log/named/named.log" versions 5 size 50M;
print-time yes;
print-severity yes;
print-category yes;
};
category default { default_log; };
category general { default_log; };
};
*/
include "/etc/bind/rndc.key";
controls {
inet 127.0.0.1 port 953 allow { 127.0.0.1/32; ::1/128; } keys { "rndc-key"; };
};
zone "." in {
type hint;
file "/var/bind/root.cache";
};
zone "localhost" IN {
type master;
file "pri/localhost.zone";
notify no;
};
zone "127.in-addr.arpa" IN {
type master;
file "pri/127.zone";
notify no;
};
/*
* Briefly, a zone which has been declared delegation-only will be effectively
* limited to containing NS RRs for subdomains, but no actual data beyond its
* own apex (for example, its SOA RR and apex NS RRset). This can be used to
* filter out "wildcard" or "synthesized" data from NAT boxes or from
* authoritative name servers whose undelegated (in-zone) data is of no
* interest.
* See http://www.isc.org/software/bind/delegation-only for more info
*/
//zone "COM" { type delegation-only; };
//zone "NET" { type delegation-only; };
//zone "YOUR-DOMAIN.TLD" {
// type master;
// file "/var/bind/pri/YOUR-DOMAIN.TLD.zone";
// allow-query { any; };
// allow-transfer { xfer; };
//};
//zone "YOUR-SLAVE.TLD" {
// type slave;
// file "/var/bind/sec/YOUR-SLAVE.TLD.zone";
// masters { <MASTER>; };
/* Anybody is allowed to query but transfer should be controlled by the master. */
//allow-query { any; };
// allow-transfer { none; };
/* The master should be the only one who notifies the slaves, shouldn't it? */
// allow-notify { <MASTER>; };
// notify no;
//};
zone "exempletest.francois" {
type master;
file "/var/bind/pri/exempletest.francois.zone";
allow-transfer { 192.168.1.107; };
allow-update { 192.168.1.107; };
also-notify { 192.168.1.107; };
};
|
DNS PRIMAIRE
exempletest.francois.zone (/var/bind/pri/)
| Code: |
$TTL 86400
exempletest.francois. IN SOA exempletest.francois. <adresse e-mail> (
2011010641
300
600
21600
86400
)
@ IN NS gentoo1.
@ IN NS gentoo2.
@ IN A 192.168.1.104
|
DNS SECONDAIRE
named.conf
| Code: |
/*
* Refer to the named.conf(5) and named(8) man pages, and the documentation
* in /usr/share/doc/bind-9 for more details.
* Online versions of the documentation can be found here:
* http://www.isc.org/software/bind/documentation
*
* If you are going to set up an authoritative server, make sure you
* understand the hairy details of how DNS works. Even with simple mistakes,
* you can break connectivity for affected parties, or cause huge amounts of
* useless Internet traffic.
*/
acl "xfer" {
/* Deny transfers by default except for the listed hosts.
* If we have other name servers, place them here.
*/
none;
};
/*
* You might put in here some ips which are allowed to use the cache or
* recursive queries
*/
acl "trusted" {
127.0.0.0/8;
::1/128;
};
options {
directory "/var/bind";
pid-file "/var/run/named/named.pid";
/* https://www.isc.org/solutions/dlv >=bind-9.7.x only */
//bindkeys-file "/etc/bind/bind.keys";
listen-on-v6 { none; };
listen-on { 127.0.0.1; };
listen-on { 192.168.1.107; };
allow-query {
/*
* Accept queries from our "trusted" ACL. We will
* allow anyone to query our master zones below.
* This prevents us from becoming a free DNS server
* to the masses.
*/
any;
};
allow-query-cache {
/* Use the cache for the "trusted" ACL. */
trusted;
};
allow-recursion {
/* Only trusted addresses are allowed to use recursion. */
localhost;
};
allow-transfer {
/* Zone tranfers are denied by default. */
trusted;
};
allow-update {
/* Don't allow updates, e.g. via nsupdate. */
trusted;
};
/*
* If you've got a DNS server around at your upstream provider, enter its
* IP address here, and enable the line below. This will make you benefit
* from its cache, thus reduce overall DNS traffic in the Internet.
*
* Uncomment the following lines to turn on DNS forwarding, and change
* and/or update the forwarding ip address(es):
*/
/*
forward first;
forwarders {
// 123.123.123.123; // Your ISP NS
// 124.124.124.124; // Your ISP NS
// 4.2.2.1; // Level3 Public DNS
// 4.2.2.2; // Level3 Public DNS
8.8.8.8; // Google Open DNS
8.8.4.4; // Google Open DNS
};
*/
//dnssec-enable yes;
//dnssec-validation yes;
/* if you have problems and are behind a firewall: */
//query-source address * port 53;
};
/*
logging {
channel default_log {
file "/var/log/named/named.log" versions 5 size 50M;
print-time yes;
print-severity yes;
print-category yes;
};
category default { default_log; };
category general { default_log; };
};
*/
include "/etc/bind/rndc.key";
controls {
inet 127.0.0.1 port 953 allow { 127.0.0.1/32; ::1/128; } keys { "rndc-key"; };
};
zone "." in {
type hint;
file "/var/bind/root.cache";
};
zone "localhost" IN {
type master;
file "pri/localhost.zone";
notify no;
};
zone "127.in-addr.arpa" IN {
type master;
file "pri/127.zone";
notify no;
};
/*
* Briefly, a zone which has been declared delegation-only will be effectively
* limited to containing NS RRs for subdomains, but no actual data beyond its
* own apex (for example, its SOA RR and apex NS RRset). This can be used to
* filter out "wildcard" or "synthesized" data from NAT boxes or from
* authoritative name servers whose undelegated (in-zone) data is of no
* interest.
* See http://www.isc.org/software/bind/delegation-only for more info
*/
//zone "COM" { type delegation-only; };
//zone "NET" { type delegation-only; };
//zone "YOUR-DOMAIN.TLD" {
// type master;
// file "/var/bind/pri/YOUR-DOMAIN.TLD.zone";
// allow-query { any; };
// allow-transfer { xfer; };
//};
//zone "YOUR-SLAVE.TLD" {
// type slave;
// file "/var/bind/sec/YOUR-SLAVE.TLD.zone";
// masters { <MASTER>; };
/* Anybody is allowed to query but transfer should be controlled by the master. */
// allow-query { any; };
// allow-transfer { none; };
/* The master should be the only one who notifies the slaves, shouldn't it? */
// allow-notify { <MASTER>; };
// notify no;
//};
zone "exempletest.francois" {
type slave;
file "/var/bind/sec/exempletest.francois.zone";
masters { 192.168.1.104; };
allow-notify { 192.168.1.104; };
};
|
Voilà, je vous remercie d'avoir lu ce message et j'espère avoir de nombreuses réponses 
À bientôt
Last edited by Francois on Wed Jan 19, 2011 10:05 am; edited 1 time in total |
|
| Back to top |
|
 |
Francois
n00b
Joined: 10 Jan 2011
Posts: 19
Location: LE Pouliguen - 44 - France
|
| Posted: Tue Jan 11, 2011 9:48 am Post subject: |
|
|
Un petit UP??? SVP
Je cherche toujours et je dois bien avouer que je sèche un peu 
Merci d'avance. |
|
| Back to top |
|
|
guilc
Bodhisattva
Joined: 15 Nov 2003
Posts: 3326
Location: Paris - France
|
| Posted: Tue Jan 11, 2011 10:56 am Post subject: Re: Problème Mise à jour DNS secondaire BIND |
|
|
| Francois wrote: | | Mon DNS secondaire se met à jour seulement lorsque, je redémarre le service "named" (/etc/init.d/named restart) sur le DNS primaire. |
Première chose, vérifie dans les logs que le primaire émette bien la notification d'upgrade de la zone.
Bien sûr, tu n'oublies pas d'incrémenter le serial de la zone à chaque modification ? (on sait jamais...)
_________________
Merci de respecter les règles du forum.
Mon site perso : https://www.xwing.info
Mon PORTDIR_OVERLAY : https://gentoo.xwing.info ou layman -a xwing |
|
| Back to top |
|
|
Francois
n00b
Joined: 10 Jan 2011
Posts: 19
Location: LE Pouliguen - 44 - France
|
| Posted: Tue Jan 11, 2011 11:07 am Post subject: |
|
|
Ah enfin, quelqu'un me répond 
Alors, voici le rendu de mon "named.log":
| Code: |
11-Jan-2011 11:27:18.540 general: notice: exiting
11-Jan-2011 11:27:18.960 general: info: zone 127.in-addr.arpa/IN: loaded serial 2008122601
11-Jan-2011 11:27:18.970 general: info: zone exempletest.francois/IN: loaded serial 2011010647
11-Jan-2011 11:27:18.970 general: info: zone localhost/IN: loaded serial 2008122601
11-Jan-2011 11:27:18.970 general: error: managed-keys-zone ./IN: loading from master file managed-keys.bind failed: file not found
11-Jan-2011 11:27:18.970 general: info: managed-keys-zone ./IN: loaded serial 0
11-Jan-2011 11:27:18.970 general: notice: running
ICI --> 11-Jan-2011 11:27:18.970 notify: info: zone exempletest.francois/IN: sending notifies (serial 2011010647) <-- ICI
11-Jan-2011 11:27:18.990 lame-servers: info: error (network unreachable) resolving 'gentoo1/A/IN': 2001:503:ba3e::2:30#53
11-Jan-2011 11:27:18.990 lame-servers: info: error (network unreachable) resolving 'gentoo1/AAAA/IN': 2001:503:ba3e::2:30#53
11-Jan-2011 11:27:18.990 lame-servers: info: error (network unreachable) resolving './NS/IN': 2001:500:1::803f:235#53
11-Jan-2011 11:27:19.000 xfer-out: info: client 192.168.1.107#37781: transfer of 'exempletest.francois/IN': AXFR-style IXFR started
11-Jan-2011 11:27:19.000 xfer-out: info: client 192.168.1.107#37781: transfer of 'exempletest.francois/IN': AXFR-style IXFR ended
|
On voit bien que mon DNS primaire envoie une notification à mon DNS secondaire lors du rédemarrage de mon service "named" (/etc/init.d/named restart). Je n'oublie pas de modifier le "SERIAL" à chaque modification de mon fichier de zone. Mon problème est que mon DNS primaire n'envoie une notification à mon DNS secondaire seulement lorsque je redémarre le service "named". Je voudrais savoir s'il est normal que mon DNS primaire n'envoie pas de notifications quand je modifie le fichier???
Merci de vos réponses |
|
| Back to top |
|
|
guilc
Bodhisattva
Joined: 15 Nov 2003
Posts: 3326
Location: Paris - France
|
| Posted: Tue Jan 11, 2011 11:20 am Post subject: |
|
|
Ah ben oui c'est normal !
La notification est envoyée dans 3 cas :
1) tu redémarres le primaire, il détecte l'incrément de serial, et notifie le secondaire ;
2) le TTL de la zone expire, le primaire reloade la zone, détecte l'incrément de serial et notifie le secondaire ;
3) tu force manuellement le rechargement de la zone sur le primaire (rndc reload), il détecte l'incrément de serial, et notifie le secondaire
Si tu ne fais "rien", tu te trouves dans le cas 2, bind ne détecte pas tout seul en temps réel que la zone a été modifiée. C'est un comportement normal. Si tu veux accélérer le transfert, il faut faire le 3. Attention, sur un DNS avec beaucoup de zones/activité, lancer un "rndc reload" peut effondrer le serveur, il est plus "sûr" de laisser la zone expirer seule dans ces cas la (mais sur un petit serveur, ça ne pose aucun souci).
_________________
Merci de respecter les règles du forum.
Mon site perso : https://www.xwing.info
Mon PORTDIR_OVERLAY : https://gentoo.xwing.info ou layman -a xwing |
|
| Back to top |
|
|
Francois
n00b
Joined: 10 Jan 2011
Posts: 19
Location: LE Pouliguen - 44 - France
|
| Posted: Tue Jan 11, 2011 11:33 am Post subject: |
|
|
D'accord, je te remercie de ta réponse.
Problème : Lorsque je force manuellement le rechargement de la zone sur le DNS primaire avec "rndc reload", il ne notifie pas mon DNS secondaire et je ne sais pas pourquoi???
Voici mon "named.log" sur le DNS primaire:
| Code: |
11-Jan-2011 12:26:10.790 general: info: received control channel command 'reload'
11-Jan-2011 12:26:10.790 general: info: loading configuration from '/etc/bind/named.conf'
11-Jan-2011 12:26:10.790 general: info: reading built-in trusted keys from file '/etc/bind/bind.keys'
11-Jan-2011 12:26:10.790 general: info: using default UDP/IPv4 port range: [1024, 65535]
11-Jan-2011 12:26:10.790 general: info: using default UDP/IPv6 port range: [1024, 65535]
11-Jan-2011 12:26:10.790 security: warning: zone 'localhost' allows updates by IP address, which is insecure
11-Jan-2011 12:26:10.790 security: warning: zone '127.in-addr.arpa' allows updates by IP address, which is insecure
11-Jan-2011 12:26:10.790 security: warning: zone 'exempletest.francois' allows updates by IP address, which is insecure
11-Jan-2011 12:26:10.800 general: info: set up managed keys zone for view _default, file 'managed-keys.bind'
11-Jan-2011 12:26:10.800 security: warning: zone 'version.bind' allows updates by IP address, which is insecure
11-Jan-2011 12:26:10.800 security: warning: zone 'hostname.bind' allows updates by IP address, which is insecure
11-Jan-2011 12:26:10.800 security: warning: zone 'authors.bind' allows updates by IP address, which is insecure
11-Jan-2011 12:26:10.800 security: warning: zone 'id.server' allows updates by IP address, which is insecure
11-Jan-2011 12:26:10.800 general: info: reloading configuration succeeded
11-Jan-2011 12:26:10.800 general: error: managed-keys-zone ./IN: loading from master file managed-keys.bind failed: file not found
11-Jan-2011 12:26:10.800 general: info: managed-keys-zone ./IN: loaded serial 0
11-Jan-2011 12:26:10.800 general: info: reloading zones succeeded
|
Dans ces logs, je constate que mon DNS primaire n'envoie pas de notifications et je ne comprend pas pourquoi???
Si vous avez des pistes de solutions, je suis preneur... |
|
| Back to top |
|
|
guilc
Bodhisattva
Joined: 15 Nov 2003
Posts: 3326
Location: Paris - France
|
| Posted: Tue Jan 11, 2011 11:39 am Post subject: |
|
|
d'après ce log, bind n'a PAS reloadé la zone exempletest.francois/IN... (causé par un serial inchangé par exemple)
Pas de reload, pas de notify
_________________
Merci de respecter les règles du forum.
Mon site perso : https://www.xwing.info
Mon PORTDIR_OVERLAY : https://gentoo.xwing.info ou layman -a xwing |
|
| Back to top |
|
|
Francois
n00b
Joined: 10 Jan 2011
Posts: 19
Location: LE Pouliguen - 44 - France
|
| Posted: Tue Jan 11, 2011 1:04 pm Post subject: |
|
|
D'accord, je comprend très bien. Pourtant, je viens de refaire le test à l'instant (en vérifiant bien que j'ai changé le "SERIAL" de mon fichier de zone) et mon log est toujours le même. Je me demande d'où cette erreur peut venir ???  |
|
| Back to top |
|
|
Francois
n00b
Joined: 10 Jan 2011
Posts: 19
Location: LE Pouliguen - 44 - France
|
| Posted: Wed Jan 12, 2011 7:20 am Post subject: |
|
|
Un petit UP? Pour des hypothétiques solutions?
Merci d'avance |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
French
