Bind9 internal/external no AXFR

Discussion in 'Server Operation' started by dropje4, Sep 20, 2013.

  1. dropje4

    dropje4 New Member

    Hi all, hope you can help.
    I previously had a server running and backed up my files. So installing a new server would be at a glance (I thought).

    But i can't seem to start transfers :mad:
    here are the different files:
    root@fjodor:~# cat /etc/bind/named.conf
    include "/etc/bind/named.conf.options";
    include "/etc/bind/named.conf.local";
    # make it comment
    # include "/etc/bind/named.conf.default-zones";
    # add
    include "/etc/bind/named.conf.internal-zones";
    include "/etc/bind/named.conf.external-zones";

    root@fjodor:~# cat /etc/bind/named.conf.internal-zones
    # define for internal section
    view "internal" {
    allow-transfer { localhost; 192.168.1.0/24; };
    match-destinations { localhost; 192.168.1.0/24; };
    recursion no;
    match-clients {
    localhost;
    192.168.1.0/24;
    };
    zone "." {
    type hint;
    file "named.ca";
    # define for internal section
    };
    # set zone for internal
    zone "myhost.net" {
    type master;
    file "myhost.net.int";
    allow-update { none; };
    };
    # set zone for internal *note
    zone "1.168.192.in-addr.arpa" {
    type master;
    file "192.168.1";
    allow-update { none; };
    };
    zone "0.0.127.in-addr.arpa" {
    type master;
    view "internal" {
    file "127.0.0";
    };
    zone "localhost" {
    type master;
    file "db.local";
    };allow-transfer { localhost; 192.168.1.0/24; };

    # zone "127.in-addr.arpa" {
    # type master;
    # file "db.127";
    # };
    zone "0.in-addr.arpa" {
    type master;
    file "db.0";
    };
    zone "255.in-addr.arpa" {
    type master;
    file "db.255";
    };

    root@fjodor:~# cat /etc/bind/named.conf.external-zones
    # define for external section
    view "external" {
    match-clients { any; };
    match-destinations { any; };
    # allo any query
    # allow-query { any; };
    # prohibit recursion
    recursion no;
    # allow transfer
    allow-transfer { any; };
    # set zone for external
    zone "myhost.net" {
    type master;
    file "myhost.net.ext";
    allow-update { none; };
    allow-query { any; };
    };
    zone "slave.com" {
    type slave;
    masters {
    an.ip.ad.ress;
    };
    file "slave.com";
    };
    # set zone for external *note
    };
    cat /etc/bind/named.conf.options
    options {
    # change
    directory "/etc/bind/namedb";

    // If there is a firewall between you and nameservers you want
    // to talk to, you may need to fix the firewall to allow multiple
    // ports to talk. See http://www.kb.cert.org/vuls/id/800113
    // If your ISP provided one or more IP addresses for stable
    // nameservers, you probably want to use them as forwarders.
    // Uncomment the following block, and insert the addresses replacing
    // the all-0's placeholder.
    forwarders {
    8.8.8.8;
    };
    # query range you allow
    allow-query { any; localhost; 192.168.1.0/24;};
    # the range to transfer zone files
    allow-transfer { any; };
    # recursion range you allow
    allow-recursion { any; localhost; 192.168.1.0/24; };
    dnssec-validation auto;
    auth-nxdomain no; # conform to RFC1035
    # make it comment if not use IPV6
    listen-on {
    any;
    #127.0.0.1;
    #192.168.1.47;
    };
    listen-on-v6 { any; };
    };
    logging {
    channel default_syslog {
    // Send most of the named messages to syslog.
    file "/var/log/named.log";
    severity debug;
    print-time yes;

    };

    channel audit_log {
    // Send the security related messages to a separate file.
    file "/var/log/named.log";
    severity debug;
    print-time yes;

    };
    channel querylog {
    file "/var/log/query.log"; print-time yes;
    };
    category queries { querylog; };
    category default { default_syslog; };
    category general { default_syslog; };
    category security { audit_log; default_syslog; };
    category config { default_syslog; };
    category resolver { audit_log; };
    category xfer-in { audit_log; };
    category xfer-out { audit_log; };
    category notify { audit_log; };
    category client { audit_log; };
    category network { audit_log; };
    category update { audit_log; };
    #category queries { audit_log; };
    category lame-servers { audit_log; };

    };
    the zones in nameddb are OK, I trust that.
    AXFR gives:
    root@fjodor:~# dig myhost.net twisted4life.com axfr

    ; <<>> DiG 9.8.1-P1 <<>> myhost.net twisted4life.com axfr
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10646
    ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
    ;; WARNING: recursion requested but not available

    ;; QUESTION SECTION:
    ;myhost.net. IN A

    ;; ANSWER SECTION:
    myhost.net. 86400 IN A int.ern.nal.ip

    ;; AUTHORITY SECTION:
    myhost.net. 86400 IN NS ns.myhost.net.

    ;; ADDITIONAL SECTION:
    ns.myhost.net. 86400 IN A int.ern.nal.ip

    ;; Query time: 3 msec
    ;; SERVER: int.ern.nal.ip#53(int.er.nal.ip)
    ;; WHEN: Fri Sep 20 19:28:13 2013
    ;; MSG SIZE rcvd: 79

    ; Transfer failed.
    root@fjodor:~#

    From the query.log
    20-Sep-2013 17:28:13.040 client int.er.nal.ip#45511: view internal: query: twisted4life.com IN AXFR -T (int.er.nal.ip)

    Some items are tested/changed for testing purposes.
    Oh before i forget:
    root@fjodor:~# cat /etc/resolv.conf
    # Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
    # DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
    domain myhost.net
    search myhost.net www.myhost.net mail.myhost.net
    nameserver int.er.nal.ip

    Can somebody please give me a clue what to due?

    Thanks!

    John.
     
    Last edited: Sep 20, 2013
    dropje4, Sep 20, 2013
    #1

Share This Page