Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

os-bind: Improve RNDC Key functionality and fix out of sync journals #4352

Open
3 tasks done
Jeremy-Boyle opened this issue Nov 14, 2024 · 2 comments · May be fixed by #4353
Open
3 tasks done

os-bind: Improve RNDC Key functionality and fix out of sync journals #4352

Jeremy-Boyle opened this issue Nov 14, 2024 · 2 comments · May be fixed by #4353

Comments

@Jeremy-Boyle
Copy link

Jeremy-Boyle commented Nov 14, 2024

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

Is your feature request related to a problem? Please describe.

  1. Currently there is no way to assign / create more keys within the ui, there is only a single key which you can edit. Suggestion is a new page where keys can be created and individually selected within domain.

  2. Currently with the added functionality in dns/bind: Add option to allow the rndc-key for zone transfers #4177 , if this is turned on it bind will create a .jnl file, this causes issues when a user edits / updates a new record in the UI. This causes two issues, one, the zone will no longer load, and two, transfers will not work until the effected .jnl file is deleted manually and bind is restarted.

  3. Additionally when reloading bind, all transfers are lost, and the main db file is overwritten.

Describe the solution you'd like

  1. Creation of a new keys tab that will work similar to how ACLs work, and can be selected for the domain.
  2. Fix the issue with the out of sync journals
  3. Populate Transfers into the UI, that way they aren't lost when the configuration resets.

Describe alternatives you've considered

  1. Manually maintaining, and creating keys with a override target.
  2. Cron job that properly freezes rndc and thaws the zone at a interval.

Additional context
Small discussion had in #4177

@Jeremy-Boyle
Copy link
Author

For fixing the journal out of sync it can be done with the following:

How to fix BIND's journal out of sync error

If you are running a BIND name server with an dynamic zone updating from from DHCP or similar, you'll find that if the zone is manually updated the zone will no longer load correctly, giving the following error:

zone example.com/IN: journal rollforward failed: journal out of sync with zone
zone example.com/IN: not loaded due to errors.

The error can be clearing seen by running BIND from command line as follows:

named -g

To resolve this stop BIND, then remove the journal file for problem zone, these exist in the same directory as the zone files but end in ".jnl". Once the file has been deleted BIND can be restarted and all will be back to normal.

If you have dynamic zones it is best to "freeze" them first before editing and "thaw" them after to avoid this problem in the first place. The commands for this are:

rndc freeze example.com
rndc reload example.com
rndc thaw sxample.com

@Jeremy-Boyle Jeremy-Boyle linked a pull request Nov 14, 2024 that will close this issue
@cpw
Copy link

cpw commented Nov 15, 2024

I just bumped into a related problem. I migrated my BIND from a different system onto OPNsense, using this plugin to rebuild a (mostly) static public dns master. Unfortunately, occasionally, some exposed IPs do update, and I've been using the RFC2136 plugin to push those updates to BIND. This triggered the "sync" problem because the config and the db file are out of sync. It'd be useful to be able to re-import those records that are dynamic.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging a pull request may close this issue.

2 participants