Hi There,
I was not using a stock rndc.conf file, it had references to my own
generated external key file
snip....
options {
default-server localhost;
default-key "farrowkey";
};
server localhost {
key "farrowkey";
};
include "/etc/farrowkey";
snip....
It still blew it away on both my own nameservers....
Regards
Pete
Jim Perrin wrote:
It only happened on one of mine, and it was
the new server I hadn't put in
service yet. Otherwise, I always re-generate the rndc.conf and rndc.key
before
a server goes live. I wonder if that has anything to do with it?
It does. The spec file for the bind rpm looks at rndc.conf in this way
->
%verify(not size,not md5) %config(noreplace) %attr(0640,root,named)
/etc/rndc.conf
Which means that it doesn't check the size of the file or the md5sum,
but it will not replace the file if it has changed. So everyone using
a stock rndc.conf got smacked, those who modified the file or
generated a new key should have the appropriate .rpmnew for rndc.conf.
The key in /etc/rndc.conf defined as 'key' is the same in all the
rpms, so people really should be generating their own keys. I view
this much like the snake oil localhost cert for apache. It's fine for
testing, but make your own. The key in /etc/rndc.key is autogenerated
during the %post section and should be different for every install.
1. Should rndc.conf be replaced the way it is? IMNSHO, yes.
2. Should people be using the default /etc/rndc.conf file? probably
not.
3. Should this be a far more documented issue than it is? Yes. It's
the configuration killing people here. If rndc.conf is included
everywhere it shouldn't make a difference, restarting the offending
service will reload the same .conf everything else is using and life
moves on. If someone copies the key out of the file and uses that,
they get smacked as has been documented here on the list.
--
This message has been scanned for viruses and
dangerous content by the
Enhancion system scanner,
and is believed to be clean.
|
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
