Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've a bind9.7.3 running on Debian squeeze. I've configured a zone to accept dynamic update using a key:

(I've replaced the key and the actual domain names ...)

key "yme" {
        algorithm hmac-md5;
        secret "topsecret";
};

zone "some-domain.de" in {
  type master;
  file "/etc/bind/zones/some-domain.de";
  allow-update {
    key yme;
  };
};

zone "some-other-domain.net" in {
  type master;
  file "/etc/bind/zones/some-other-domain.net";
  allow-update {
    key yme;
  };
};

Now, I send updates from a pfSense installation and I always get

22-Mar-2013 13:08:15.969 update-security: client 1.2.3.4#30949: update 'some-other-domain.net/IN' denied

The key is configured correctly on both sides, there is no clock skew between the both sides.

What else could be the problem, what might I have overlooked?

share|improve this question
    
You need to use the key that rndc-confgen created. The key is located in /etc/rndc.key –  midnightsteel Apr 22 '13 at 0:58
add comment

1 Answer

Having checked my own (working) configuration, the only thing I can think is whether the permissions on /etc/bind/zones/some-other-domain.net are correct. If you're running bind as a non-root user, you need to make sure that it has write permission on that file. It may also need write permission on /etc/bind/zones to write its journal file.

Failing that, you could try straceing the bind process to check if anything untoward is happening when the update is attempted.

share|improve this answer
    
I can confirm this from my side as well. Making /etc/bind group-writable solved this issue for me once before. –  Joseph R. Aug 3 '13 at 18:58
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.