allow-query { any; } question....
Chris Collins
z0cool at gmail.com
Sun Mar 13 02:55:20 UTC 2005
Hello
I am having some troubles getting the allow-query { any; }; to work
for "mydomain.ca"
The message I get back is query refused and in the syslog of the
server running named I get.
Mar 12 21:48:07 wolfgang named[80444]: denied query from
[xxx.xxx.xxx.xxx].62799 for "xxx.xxx.xxx.xxx.in-addr.arpa" PTR/IN
I can get the to query work if I remove the allow-query { 127.0.0.1;
}; from the options sections. I have searched the mail archives and I
am under the impression if I add allow-query { any; }; to the zone
definition it will work. Is this correct to assume?
Below is a complete copy of my named.conf config with only the domain
name changed.
Can anybody offer any suggestions?
I am running ver 8.3.7-REL on FreeBSD 4.10
// $FreeBSD: src/etc/namedb/named.conf,v 1.6.2.7 2003/02/13 13:16:51
keramida Exp $
//
// Refer to the named.conf(5) and named(8) man pages for details. If
// you are ever going to set up a primary server, make sure you
// understand the hairy details of how DNS works. Even with
// simple mistakes, you can break connectivity for affected parties,
// or cause huge amounts of useless Internet traffic.
options {
directory "/etc/namedb";
allow-query { 127.0.0.1; };
allow-transfer { localhost; };
allow-recursion { localhost; };
version "[Secured]";
// In addition to the "forwarders" clause, you can force your name
// server to never initiate queries of its own, but always ask its
// forwarders only, by enabling the following line:
//
// forward only;
// If you've got a DNS server around at your upstream provider, enter
// its IP address here, and enable the line below. This will make you
// benefit from its cache, thus reduce overall DNS traffic in the Internet.
forwarders {
myispdns;
};
/*
* If there is a firewall between you and nameservers you want
* to talk to, you might need to uncomment the query-source
* directive below. Previous versions of BIND always asked
* questions using port 53, but BIND 8.1 uses an unprivileged
* port by default.
*/
// query-source address * port 53;
/*
* If running in a sandbox, you may have to specify a different
* location for the dumpfile.
*/
// dump-file "s/named_dump.db";
};
// Note: the following will be supported in a future release.
/*
host { any; } {
topology {
127.0.0.0/8;
};
};
*/
// Setting up secondaries is way easier and a rough example for this
// is provided below.
//
// If you enable a local name server, don't forget to enter 127.0.0.1
// first in your /etc/resolv.conf so this server will be queried.
// Also, make sure to enable it in /etc/rc.conf.
zone "." {
type hint;
file "named.root";
};
zone "0.0.127.IN-ADDR.ARPA" {
type master;
file "localhost.rev";
};
// RFC 3152
zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA"
{
type master;
file "localhost-v6.rev";
};
// RFC 1886 -- deprecated
zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.INT" {
type master;
file "localhost-v6.rev";
};
// NB: Do not use the IP addresses below, they are faked, and only
// serve demonstration/documentation purposes!
//
// Example secondary config entries. It can be convenient to become
// a secondary at least for the zone your own domain is in. Ask
// your network administrator for the IP address of the responsible
// primary.
//
// Never forget to include the reverse lookup (IN-ADDR.ARPA) zone!
// (This is named after the first bytes of the IP address, in reverse
// order, with ".IN-ADDR.ARPA" appended.)
//
// Before starting to set up a primary zone, make sure you fully
// understand how DNS and BIND works. There are sometimes
// non-obvious pitfalls. Setting up a secondary is simpler.
//
// NB: Don't blindly enable the examples below. :-) Use actual names
// and addresses instead.
//
// NOTE!!! FreeBSD can run bind in a sandbox (see named_flags in rc.conf).
// The directory containing the secondary zones must be write accessible
// to bind. The following sequence is suggested:
//
// mkdir /etc/namedb/s
// chown bind:bind /etc/namedb/s
// chmod 750 /etc/namedb/s
/*
zone "domain.com" {
type slave;
file "s/domain.com.bak";
masters {
192.168.1.1;
};
};
zone "0.168.192.in-addr.arpa" {
type slave;
file "s/0.168.192.in-addr.arpa.bak";
masters {
192.168.1.1;
};
};
*/
zone "mydomain.ca" {
type master;
file "/etc/namedb/mydomain.ca.hosts";
allow-query { any; };
};
More information about the bind-users
mailing list