BIND 9 not transferring zone files

[skotman]

I build a fedora redhat box with bind 9 installed etc etc. My intention is to use it as a secondary external DNS server in a remote office.

When I start named it starts like its suposed to, except for the fact that it won't transfer my zone file over from my master. the Master DNS Server is a windows 2003 server and I see log file entries saying that it successfully was transferred. I can not find the zone files on the fedora box, and when I do an nslookup against the domain it returns with:

>domain.com
server: [192.168.1.69]
address: 192.168.1.69

***[192.168.1.69] can't find domain.com: Server Failed
>

when I do it from the fedora box I get the same thing. NAMED starts so I dont think it's a config issue, although it could be.

Thanks!

Scott Heath

http://www.scottspad.com

AIM: orange7288
SprintPCS ReadyLink? IM ME

 

[skotman]

Update: I went looking in /var/logs/messages and found the following:

Jan 28 12:56:47 newDNS named[3771]: transfer of 'domain.com/IN' from 192.168.1.14#53: failed while receiving responses: permission denied
Jan 28 12:56:47 newDNS named[3771]: transfer of 'domain.com/IN' from 192.168.1.14#53: end of transfer

the /var/named directory has the following permissions on it:
Owner: DRWE (777)
Group: DRE (755)

The owner was root the group was named. I set the owner to named and it worked perfectly.

Scott Heath

http://www.scottspad.com

AIM: orange7288
SprintPCS ReadyLink? IM ME

 

[ITPangaeaArchitect]

be prepared for problems if using BIND in a Win2000 or Win2003 domain. Especially if you need to build trusts...BIND and QIP DNS will both break trusts in unusual fashions...the trust will be good, but some security principals may show up as SIDs, etc.

Anyways...make sure your zone is set to secure and non-secure dynamic updates.

also be sure your BIND supports SRV records and dynamic updates as well, which it should in your version or Linux...I believe the BIND version you need is 9.2.1 if I remember correctly. I do see you said BIND 9, but no sub versions there.

-Brandon Wilson
MCSE00/03, MCSA:Messaging, MCSA03, A+
almost got a paragraph there

 

[skotman]

I'm just using BIND for external DNS with out any fancy features like trusts. Server A is replicating to Server B, just like in the old days of DNS. It just so happens that Server A is a win2k3 server that is doubling as a DNS server for the outside world.

Scott Heath

http://www.scottspad.com

AIM: orange7288
SprintPCS ReadyLink? IM ME

 

[skotman]

I'm just using BIND for external DNS with out any fancy features like trusts. Server A is replicating to Server B, just like in the old days of DNS. It just so happens that Server A is a win2k3 server that is doubling as a DNS server for the outside world.

All of this is outside my Active Directory Domain.


Scott Heath

http://www.scottspad.com

AIM: orange7288
SprintPCS ReadyLink? IM ME

 

[skotman]

This particular win2k3 server is doing most of my external facing services (IIS,DNS,VPN etc) for my network. I have two other servers inside my firewall that do DNS for my 2003 AD domain, as well as a 3rd domain controller at a remote site.

The bind server is just performing secondary DNS to outside requests (people trying to hit internet facing services) so no worries about breaking trusts there.

Scott Heath

http://www.scottspad.com

AIM: orange7288
SprintPCS ReadyLink? IM ME

 

[ITPangaeaArchitect]

ah I gotcha.

So same deal...just be sure that non-secure and secure dynamic updates are enabled. Sounds like it is set to secure only. Looks like it from the error you posted as well. BIND cannot authenticate to an AD integrated zone set for secure only updates, which is the default. What is the current security settings on the zone as far as dynamic updates?

-Brandon Wilson
MCSE00/03, MCSA:Messaging, MCSA03, A+
almost got a paragraph there

 

[skotman]

The issue has been solved. Read the 2nd post. I'm not doing anything with AD in this circumstance because I don't want to have AD facing the internet. The issue was with BIND not being able to write out the zone files locally it copied off the w2k3 server.

Scott Heath

http://www.scottspad.com

AIM: orange7288
SprintPCS ReadyLink? IM ME

 

[ITPangaeaArchitect]

gotcha...musta misread.


Just FYI...AD DNS zones handling internet requests is not a problem providing the zone is set to secure only.

-Brandon Wilson
MCSE00/03, MCSA:Messaging, MCSA03, A+
almost got a paragraph there