Bind query denied after update

Discussion in 'General' started by SamTzu, Jun 17, 2008.

  1. SamTzu

    SamTzu Member HowtoForge Supporter

    Ok. I'm in a picle now.
    I recently update my ISPConfig server because of the certificate hassle in Ubuntu/Debian. Now I realise that my ISPConfig server log is full of this message...

    In short after updating to the Bind 9.4 the "allow-query-cache" seems to be screwed up pretty tightly.


    What configuration changes would I need to do to allow any clinet to access the 9.4 DNS cache and make queries of the sites on my server?

    Edit-> Found this... I will try this now.

    Edit-> That did not help. Seems only local networks can make queries to the Bind.
     
    Last edited: Jun 18, 2008
  2. falko

    falko Super Moderator ISPConfig Developer

    What's in your named.conf?
     
  3. SamTzu

    SamTzu Member HowtoForge Supporter

    Havent changed any of it. (No manual changes seem to stay there anyway.)
    I chrooted the user bind for ISPConfig.
    (Also I noticed that bind does not log to /var/log/bind9/ but I still see in "logwatch" mail report what happens with bind.)

     
  4. falko

    falko Super Moderator ISPConfig Developer

    And
    Code:
     options {
         allow-recursion { any; };
         allow-query { any; };
         allow-query-cache { any; };
     };
    did not work?
     
  5. SamTzu

    SamTzu Member HowtoForge Supporter

    It doesnt seem to want to stay there. All changes seem to dissappear after a while. I think that...

    options {
    allow-recursion { any; };
    allow-query { any; };
    allow-query-cache { any; };
    };
    worked but it wont stay. Maybe ISPConfig overwrites the configuration?
     
  6. falko

    falko Super Moderator ISPConfig Developer

    Yes, but you can change the named.conf template in /root/ispconfig/isp/conf. Save the modified template in the /root/ispconfig/isp/conf/customized_templates directory.
     
  7. SamTzu

    SamTzu Member HowtoForge Supporter

    Ok. I'm now officially unbind :)
    The problem was not it the servers DNS/Bind settings.

    I could not belive what my tests showed me so I took Wireshark and looked at the traffic between my Vista & 2 different DNS servers.

    Apparantly ALL the name queries to the ns1 work from my Vista but NO query for ns2 (different network) so I assumed that the problem was with the newer ns2 that had been upgraded.

    The REASON why no query worked for the ns2 was that no query LEFT my wonderfull Vista. Yes its true. All the queries to ns2 NEVER leave my PC. All other traffic to ns2 works just fine.

    Apparently this has something to do with the fact that ns2 address was changed recently to other network for security and loadbalance reasons.


    Sam

    "You can start laughing now."
     

Share This Page