I've been trying to setup a catalog zone in BIND9 so that way I do not have to manually update my slaves each time I add or remove a domain.
I asked this question and the answer would be to use the catalog feature of the new version of BIND.
I tried to follow whatever I could find online but that wasn't much at all and nothing about debugging your catalog installation properly.
Master DNS
On my master I added the following settings in main.conf.options
:
zone "catalog.example.com" {
type master;
file "/etc/bind/catalog.example.com.db";
allow-transfer { trusted-servers; };
also-notify { slave-servers; };
notify explicit;
};
Note: the trusted_servers
and slave_servers
are ACL definitions such as:
acl trusted_servers { 10.0.0.1; 10.0.0.2; };
acl slave_servers { 10.0.0.2; };
The zone itself, /etc/bind/catalog.example.com.db
, is special as well, it includes a version and the NS entry is invalid:
; catalog.example.zone
$ORIGIN .
$TTL 86400
catalog.example.com. IN SOA . . (
1 ; serial
3H ; refresh
180 ; retry
1D ; expire
300 ; default_ttl
)
NS invalid.
$ORIGIN catalog.example.com.
version IN TXT "1"
That way the version can be checked from any BIND server.
Slave DNS
On the slave server, I added a couple of settings in the options
block:
options {
...
allow-new-zones yes;
catalog-zones {
zone "catalog.example.com" default-masters { 10.0.0.1; };
};
...
};
Just in case, I also made sure I had the following options:
allow-recursion { any; };
allow-query { any; };
allow-notify { trusted-servers; };
allow-transfer { trusted-servers; };
Would I also need to setup the controls
entry to give the master control of the slave?
Next I created a catalog zone on the slave with the following:
zone "catalog.example.com" {
type slave;
file "/var/cache/bind/catalog.example.com.db";
masters { 10.0.0.1; };
allow-notify { 10.0.0.1; };
};
That zone does transfer. I can see the data (same as what I have above appears in the cache).
Issue
As a result I get errors like this one
19-Apr-2020 13:07:39.124 notify: notice: client @0x7f42548c18b0 10.0.0.1#44622: received notify for zone 'm2osw.com': not authoritative
This happens for all the zones, except the catalog zone.
When using the regular setup, I have entries like so:
zone "m2osw.com" {
type slave;
file "/var/cache/bind/m2osw.com.zone";
masters { 10.0.0.1; };
allow-transfer { none; };
};
and I know that by not putting the masters ...
field I get that error (not authoritative).
I fail to see how I could make a zone that I want to automatically be transferred explicitly authoritative.
Can someone enlighten me in the endeavor of setting up a catalog zone?
The only one thing I can think of is that I would need to setup a key properly. I've tried that but so far I only managed to completely block my master DNS. Some clarification on this setup process would be really wonderful!
Note: The IP addresses correspond one to one to what I have on my servers, only of course my servers make use of public IPs.