Добрый день, сначала сразу опишу проблему, а далее опишу свои сервера, с которыми проблема наблюдается.
Вообщем просто slave сервера не могут скачать файлы зон с master серверов.
Теперь обо всем по порядку. Есть 2 сервера На обоих стоит BIND 9(Version: 1:9.6.ESV.R1+dfsg-0+lenny1). Оба bind'a находятся в песочнице /var/lib/named
Master сервер --
Silicium ip - a.b.c.d (Silicium находится за роутером, у которого включен DMZ, весь траффик идет всеравно на Silicium)
Slave сервер --
Krypton ip - k.l.m.n
домен -- example.com
Лог запуска
Silicium (Master):
26-Aug-2010 21:52:42.255 general: zone 0.in-addr.arpa/IN: loaded serial 1
26-Aug-2010 21:52:42.273 general: zone 127.in-addr.arpa/IN: loaded serial 1
26-Aug-2010 21:52:42.278 general: zone 255.in-addr.arpa/IN: loaded serial 1
26-Aug-2010 21:52:42.281 general: zone localhost/IN: loaded serial 2
26-Aug-2010 21:52:42.286 general: zone example.com/IN: loaded serial 2010082601
26-Aug-2010 21:52:42.290 general: running
26-Aug-2010 21:52:42.290 notify: zone example.com/IN: sending notifies (serial 2010082601)
26-Aug-2010 21:52:44.151 general: received control channel command 'reconfig'
26-Aug-2010 21:52:44.151 general: loading configuration from '/etc/bind/named.conf'
26-Aug-2010 21:52:44.152 general: using default UDP/IPv4 port range: [1024, 65535]
26-Aug-2010 21:52:44.152 general: using default UDP/IPv6 port range: [1024, 65535]
26-Aug-2010 21:52:44.155 network: listening on IPv4 interface eth1, 192.168.1.110#53
26-Aug-2010 21:52:44.178 general: reloading configuration succeeded
26-Aug-2010 21:52:44.179 general: any newly configured zones are now loaded
Aug 26 21:52:42 silicium named[2016]: starting BIND 9.6-ESV-R1 -u bind -t /var/lib/named
Aug 26 21:52:42 silicium named[2016]: built with мои_ключики_компиляции
Aug 26 21:52:42 silicium named[2016]: adjusted limit on open files from 1024 to 1048576
Aug 26 21:52:42 silicium named[2016]: found 1 CPU, using 1 worker thread
Aug 26 21:52:42 silicium named[2016]: using up to 4096 sockets
Aug 26 21:52:42 silicium named[2016]: loading configuration from '/etc/bind/named.conf'
Aug 26 21:52:42 silicium named[2016]: using default UDP/IPv4 port range: [1024, 65535]
Aug 26 21:52:42 silicium named[2016]: using default UDP/IPv6 port range: [1024, 65535]
Aug 26 21:52:42 silicium named[2016]: listening on IPv4 interface lo, 127.0.0.1#53
Aug 26 21:52:42 silicium named[2016]: automatic empty zone: 254.169.IN-ADDR.ARPA
Aug 26 21:52:42 silicium named[2016]: automatic empty zone: 2.0.192.IN-ADDR.ARPA
Aug 26 21:52:42 silicium named[2016]: automatic empty zone: 255.255.255.255.IN-ADDR.ARPA
Aug 26 21:52:42 silicium named[2016]: automatic empty zone: 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
Aug 26 21:52:42 silicium named[2016]: automatic empty zone: 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
Aug 26 21:52:42 silicium named[2016]: automatic empty zone: D.F.IP6.ARPA
Aug 26 21:52:42 silicium named[2016]: automatic empty zone: 8.E.F.IP6.ARPA
Aug 26 21:52:42 silicium named[2016]: automatic empty zone: 9.E.F.IP6.ARPA
Aug 26 21:52:42 silicium named[2016]: automatic empty zone: A.E.F.IP6.ARPA
Aug 26 21:52:42 silicium named[2016]: automatic empty zone: B.E.F.IP6.ARPA
Aug 26 21:52:42 silicium named[2016]: command channel listening on 127.0.0.1#953
Лог запуска
Krypton (Slave):
26-Aug-2010 21:47:17.937 general: zone 0.in-addr.arpa/IN: loaded serial 1
26-Aug-2010 21:47:17.937 general: zone 127.in-addr.arpa/IN: loaded serial 1
26-Aug-2010 21:47:17.938 general: zone 255.in-addr.arpa/IN: loaded serial 1
26-Aug-2010 21:47:17.938 general: zone localhost/IN: loaded serial 2
26-Aug-2010 21:47:17.943 general: running
26-Aug-2010 21:48:47.952 general: zone example.com/IN: refresh: retry limit for master a.b.c.d#53 exceeded (source 0.0.0.0#0)
26-Aug-2010 21:48:47.952 general: zone example.com/IN: Transfer started.
26-Aug-2010 21:51:56.952 xfer-in: transfer of 'example.com/IN' from a.b.c.d#53: failed to connect: timed out
26-Aug-2010 21:51:58.177 xfer-in: transfer of 'example.com/IN' from a.b.c.d#53: Transfer completed: 0 messages, 0 records, 0 bytes, 190.224 secs (0 bytes/sec)
26-Aug-2010 21:52:58.776 general: zone example.com/IN: refresh: skipping zone transfer as master a.b.c.d#53 (source 0.0.0.0#0) is unreachable (cached)
26-Aug-2010 21:55:16.194 general: zone example.com/IN: refresh: retry limit for master a.b.c.d#53 exceeded (source 0.0.0.0#0)
Aug 26 21:47:17 kr named[30191]: starting BIND 9.6-ESV-R1 -u bind -t /var/lib/named
Aug 26 21:47:17 kr named[30191]: built with мои_ключики_компиляции
Aug 26 21:47:17 kr named[30191]: adjusted limit on open files from 1024 to 1048576
Aug 26 21:47:17 kr named[30191]: found 1 CPU, using 1 worker thread
Aug 26 21:47:17 kr named[30191]: using up to 4096 sockets
Aug 26 21:47:17 kr named[30191]: loading configuration from '/etc/bind/named.conf'
Aug 26 21:47:17 kr named[30191]: using default UDP/IPv4 port range: [1024, 65535]
Aug 26 21:47:17 kr named[30191]: using default UDP/IPv6 port range: [1024, 65535]
Aug 26 21:47:17 kr named[30191]: listening on IPv4 interface lo, 127.0.0.1#53
Aug 26 21:47:17 kr named[30191]: listening on IPv4 interface venet0:0, k.l.m.n#53
Aug 26 21:47:17 kr named[30191]: automatic empty zone: 254.169.IN-ADDR.ARPA
Aug 26 21:47:17 kr named[30191]: automatic empty zone: 2.0.192.IN-ADDR.ARPA
Aug 26 21:47:17 kr named[30191]: automatic empty zone: 255.255.255.255.IN-ADDR.ARPA
Aug 26 21:47:17 kr named[30191]: automatic empty zone: 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
Aug 26 21:47:17 kr named[30191]: automatic empty zone: 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
Aug 26 21:47:17 kr named[30191]: automatic empty zone: D.F.IP6.ARPA
Aug 26 21:47:17 kr named[30191]: automatic empty zone: 8.E.F.IP6.ARPA
Aug 26 21:47:17 kr named[30191]: automatic empty zone: 9.E.F.IP6.ARPA
Aug 26 21:47:17 kr named[30191]: automatic empty zone: A.E.F.IP6.ARPA
Aug 26 21:47:17 kr named[30191]: automatic empty zone: B.E.F.IP6.ARPA
Aug 26 21:47:17 kr named[30191]: command channel listening on 127.0.0.1#953
26-Aug-2010 21:48:47.952 general: zone example.com/IN: Transfer started.
26-Aug-2010 21:51:56.952 xfer-in: transfer of 'example.com/IN' from a.b.c.d#53: failed to connect: timed out
26-Aug-2010 21:51:58.177 xfer-in: transfer of 'example.com/IN' from a.b.c.d#53: Transfer completed: 0 messages, 0 records, 0 bytes, 190.224 secs (0 bytes/sec)
26-Aug-2010 21:52:58.776 general: zone example.com/IN: refresh: skipping zone transfer as master a.b.c.d#53 (source 0.0.0.0#0) is unreachable (cached)
26-Aug-2010 21:55:16.194 general: zone example.com/IN: refresh: retry limit for master a.b.c.d#53 exceeded (source 0.0.0.0#0)
Все цепочки iptables поставлены на ACCEPT.
А теперь конфигурационные файлы. Они почти одинаковы, расходятся только файлы named.conf.local и named.conf.options.
Ключи ns0.example.com и ns1.example.com на обоих серверах одинаковы. rndc-key разные, и rndc на обоих серверах работает.
Файлы конфигурации сервера
Silicium:
include "/etc/bind/rndc.key";
include "/etc/bind/key/ns0.example.com.key";
include "/etc/bind/key/ns1.example.com.key";
server a.b.c.d { keys { ns0.example.com; }; };
server k.l.m.n { keys { ns1.example.com; }; };
acl trusted-dns { 127.0.0.1; key ns0.example.com; key ns1.example.com; };
options {
directory "/var/cache/bind";
pid-file "/var/run/bind/named.pid";
dump-file "/var/run/bind/named.dump";
statistics-file "/var/run/bind/named.stats";
version "unknown";
port 53;
listen-on { any; };
listen-on-v6 { none; };
recursion yes;
allow-recursion { any; };
allow-query { any; };
allow-transfer { trusted-dns; };
allow-update { none; };
auth-nxdomain no; # conform to RFC1035
};
controls {
inet 127.0.0.1 port 953 allow {127.0.0.1; } keys { "rndc-key"; };
};
logging {
channel default_ch {
file "/var/log/named.log" versions 3 size 1024k;
severity info;
print-time yes;
print-category yes;
};
channel security_ch {
file "/var/log/security.log" versions 3 size 1024k;
severity info;
print-time yes;
print-category yes;
};
category default { default_ch; };
category security{security_ch; };
};
zone "example.com" {
type master;
file "/etc/bind/master/example.com";
notify yes;
allow-transfer {k.l.m.n};
};
Файлы конфигурации сервера
Krypton:
include "/etc/bind/rndc.key";
include "/etc/bind/key/ns0.example.com.key";
include "/etc/bind/key/ns1.example.com.key";
server a.b.c.d { keys { ns0.example.com; }; };
server k.l.m.n { keys { ns1.example.com; }; };
acl trusted-dns { 127.0.0.1; key ns0.example.com; key ns1.example.com; };
options {
directory "/var/cache/bind";
pid-file "/var/run/bind/named.pid";
dump-file "/var/run/bind/named.dump";
statistics-file "/var/run/bind/named.stats";
version "unknown";
port 53;
listen-on { any; };
listen-on-v6 { none; };
recursion yes;
allow-recursion { any; };
allow-query { any; };
allow-transfer { trusted-dns; };
allow-update { none; };
forwarders { a.b.c.d; };
auth-nxdomain no; # conform to RFC1035
};
controls {
inet 127.0.0.1 port 953 allow {127.0.0.1; } keys { "rndc-key"; };
};
logging {
channel default_ch {
file "/var/log/named.log" versions 3 size 1024k;
severity info;
print-time yes;
print-category yes;
};
channel security_ch {
file "/var/log/security.log" versions 3 size 1024k;
severity info;
print-time yes;
print-category yes;
};
category default { default_ch; };
category security{security_ch; };
};
zone "example.com" {
type slave;
file "/etc/bind/slave/example.com";
masters {a.b.c.d;};
};
Общие файлы:
include "/etc/bind/named.conf.options";
// prime the server with knowledge of the root servers
zone "." {
type hint;
file "/etc/bind/db.root";
};
zone "localhost" {
type master;
file "/etc/bind/db.local";
};
zone "127.in-addr.arpa" {
type master;
file "/etc/bind/db.127";
};
zone "0.in-addr.arpa" {
type master;
file "/etc/bind/db.0";
};
zone "255.in-addr.arpa" {
type master;
file "/etc/bind/db.255";
};
include "/etc/bind/named.conf.local";
$TTL 1D
@ IN SOA ns0.example.com. admin.ya.ru. ( 2010082601 ;serial
3H ;refresh
15M ;retry
1W ;expiry
1D) ;minimum
...
IN NS ns0.example.com.
IN NS ns1.example.com.
...
ns0 IN A a.b.c.d ;Silicium NS
ns1 IN A k.l.m.n ;Krypton NS
В целом топик получился довольно громоздким, сори%) Вторые сутки бьюсь*wall*.
Подозреваю что грешит роутер, но вообще, слабо в это верится. Asus WL500gP v2 (Прошивка WL500gpv2-1.9.2.7-d-r1825 от энтузиастов)
P.S. Оригинальные названия доменов, ip адресов и ключи скрыты
Тема: BIND 9. Master & Slave (Прочитано 3789 раз)
