How to modify "A" records on the slave when master is down?

[Jeff Lightner]

Huh?

 

sftp uses secure transport as does scp and both use the same keys as
ssh.   I can see no way in which ftps would be viewed as superior.
Exactly how are you "losing" RSA keys and if you do aren't you more
concerned that you can no longer ssh into the box?

 

________________________________

From: bind-users-bounces at lists.isc.org
[mailto:bind-users-bounces at lists.isc.org] On Behalf Of Alberto
Colosi/SI/RM/GSI/it
Sent: Wednesday, December 03, 2008 5:25 PM
To: Mike Bernhardt
Cc: comp-protocols-dns-bind at isc.org; stevehunter_1 at hotmail.com
Subject: RE: How to modify "A" records on the slave when master is down?

 


better to use an ftps then an sftp. 

use 

vsftpd with SSL compile option 
GNU lftp 

lftp is really simple and can be configured to bypass RSA CA verify sso
to allow selfsigned and many other settings. 

The difference is that if you lose RSA keys or in all cases, using the
RSA keys to allow SCP, you could have a command line session too if used
with SSH instead. 

The main difference is a bit of security more ;) 



-------------------------------
Alberto Colosi
IBM Global Business Services
Sistemi Informativi S.P.A.
IT NetWork & Security Department
*-* *-* *-*
SECURITY IS EVERYONE'S BUSINESS

Member of
IBM Information Security WW CoP






"Mike Bernhardt" <bernhardt at bart.gov> 
Sent by: bind-users-bounces at lists.isc.org 

03/12/2008 22.59 

To

<stevehunter_1 at hotmail.com>, <comp-protocols-dns-bind at isc.org> 

cc

 

Subject

RE: How to modify "A" records on the slave when master is down?

 

 

 




What we used to do is we had 2 masters. After an update was done on one
of
them, we ran a perl script that would scp the db files to the other and
then
send rndc reload to itself and the other master. That way both were
always
up to date. It seems like if you had one master and one slave at each
datacenter, this would work very well. After the down datacenter comes
back
up, simply run the script from the up-to-date master.

I can send you the perl script to save you some time if you want. The
main
trick was getting scp to work with rsa keys so no password is required
(although it could work fine with a password if you're running the
script
manually).

Mike

-----Original Message-----
From: stevehunter_1 at hotmail.com [mailto:stevehunter_1 at hotmail.com] 
Sent: Friday, November 21, 2008 9:10 PM
To: comp-protocols-dns-bind at isc.org
Subject: How to modify "A" records on the slave when master is down?

Hello.  I have two geographically different datacenters.  Each
datacenter has two instances of BIND.

There is one master out of these four.  The zones will have multiple
"A" records (pointing to the two datacenters to provide some minimal
amount of redundancy and load balancing)

What I want to do is put together a plan for when the master either
fails or the master becomes unavailable.

So if your master fails, or more likely, it becomes unavailable, and I
need to change the "A" records on the other slaves, how do you do it?

Can I have a master in each datacenter and a slave in each datacenter,
but a change made to any master propagates to all slaves?  For that
matter, can I just have four masters and be done with it?

It doesnt make sense that I could have multiple masters.. but I have
no idea how to solve this problem.  If datacenter A goes down for
three days, i want to be able to modify the slave "A" records to stop
pointing to the bad datacenter.  And when the datacenter comes back up
and the old master is alive, I want everything to work.




_______________________________________________
bind-users mailing list
bind-users at lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
----------------------------------
CONFIDENTIALITY NOTICE: This e-mail may contain privileged or confidential information and is for the sole use of the intended recipient(s). If you are not the intended recipient, any disclosure, copying, distribution, or use of the contents of this information is prohibited and may be unlawful. If you have received this electronic transmission in error, please reply immediately to the sender that you have received the message in error, and delete it. Thank you.
----------------------------------
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20081204/eb4bbd4d/attachment.html>