Framapiaf

0 message0 participant0 message aujourd’hui

Ansgar HegerfeldSchöner DNS-Workaround, den ich bis jetzt noch nicht kannte/brauchte: Um die (z.B. aus versehen zu weit in die Zukunft gesetzte) serial number eines Eintrags zurückzusetzen, muss man einfach nur das 32-bit große Feld zum Überlauf und damit wieder auf 0 bringen. Anschließend kann man es neu auf den Wunschwert setzen 😅<a href="https://www.zytrax.com/books/dns/ch9/serial.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.zytrax.com/books/dns/ch9/serial.html</a><a href="https://digitalcourage.social/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNS</a> <a href="https://digitalcourage.social/tags/bind9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bind9</a>

Felix Palmen :freebsd: :c64:Adventures getting <a href="https://mastodon.bsd.cafe/tags/Netflix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Netflix</a> to work in a somewhat complex home <a href="https://mastodon.bsd.cafe/tags/network" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#network</a> 🤯I decided to give their plan with ads a chance, sounding like a somewhat fair deal. First issue was, I couldn't even register. It only offered me US plans. Figured that's because my <a href="https://mastodon.bsd.cafe/tags/IPv6" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IPv6</a> connectivity is tunnelled through <a href="https://mastodon.bsd.cafe/tags/HE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#HE</a> (for reasons, different story). Of course using an endpoint here in Germany, but nevertheless, Netflix seemed to think it's a US located address.Running my own <a href="https://mastodon.bsd.cafe/tags/bind9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bind9</a> instance, I found a way to hide relevant AAAA records (netflix' own domain and also amazonws) by adding a view only operating on local loopback and filtering out ALL AAAA records, and then adding forward-only zones for these domains to this local view. Horrible, but works, now I could register, forcing <a href="https://mastodon.bsd.cafe/tags/IPv4" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IPv4</a>.One particularly cheap "smart-tv" still couldn't connect to netflix, always showing me an error that I was using some "VPN". 🤨 No way to analyze what exactly was happening there, but I finally found a solution for that as well: I created an entirely new network segment (with its own <a href="https://mastodon.bsd.cafe/tags/vlan" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vlan</a> on the switch). I don't offer IPv6 in this segment at all, and only allow it to access the internet as well as my local <a href="https://mastodon.bsd.cafe/tags/dns" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dns</a> server. Putting all tv sets and my <a href="https://mastodon.bsd.cafe/tags/minidlna" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#minidlna</a> instance into this segment, everything finally works.The nice thing is, I always wanted to isolate the tv sets anyways, and this is now finally done, they're unable to see the rest of my home network! 🥳 Still a bit sad I have to restrict them to IPv4 for now, just to work around netflix' geolocation stuff... 🫤

x0rI’m currently playing around with DNSSEC. I have a hidden primary BIND server sign my zone and push it to publicly-visible secondaries.But for KSK rollovers, I have to use my registrar’s REST API to publish a new DS record set.With opendnssec, when it’s time to publish a new set of DS records, it can call a script to that effect. Can BIND also run such custom commands?<a href="https://mamot.fr/tags/BIND" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BIND</a> <a href="https://mamot.fr/tags/BIND9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BIND9</a> <a href="https://mamot.fr/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNS</a> <a href="https://mamot.fr/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSSEC</a>

Fink :antifa:Someone here know their way around <a href="https://chaos.social/tags/bind9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bind9</a> releases? I expected v9.20 end of March 2024 as documented in <a href="https://kb.isc.org/docs/aa-00896" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://kb.isc.org/docs/aa-00896</a> :/<a href="https://gitlab.isc.org/isc-projects/bind9/-/milestones/69#tab-issues" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://gitlab.isc.org/isc-projects/bind9/-/milestones/69#tab-issues</a> also does not really help with an ETA<a href="https://chaos.social/tags/dns" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dns</a> <a href="https://fosstodon.org/@iscdotorg" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@iscdotorg</a>Edit: release will be on 17.7.2024: <a href="https://lists.isc.org/pipermail/bind-announce/2024-July/001251.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://lists.isc.org/pipermail/bind-announce/2024-July/001251.html</a> And the boxes in the Timeline are not to be read as "release beginning of that box" but "release within that box". The linked project milestones might hint to when something will happen in that direction :)

Petr Menšík :fedora:<a href="https://mastodon.gougere.fr/@bortzmeyer" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@bortzmeyer</a> <a href="https://social.sdf.org/@draeath" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@draeath</a> <a href="https://qoto.org/@Shamar" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Shamar</a> it depends. No stable <a href="https://fosstodon.org/tags/bind9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bind9</a> release can forward over DoT (yet). None of them can forward over <a href="https://fosstodon.org/tags/DoH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DoH</a> even on the latest commit afaik.

Petr Menšík :fedora:<a href="https://social.sdf.org/@draeath" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@draeath</a> <a href="https://qoto.org/@Shamar" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Shamar</a> no, both <a href="https://fosstodon.org/tags/bind9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bind9</a> and <a href="https://fosstodon.org/tags/unbound" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#unbound</a> implement only server side. They can accept queries over DoH, but cannot forward them to DoH remote server. I am not sure about Knot, but might have the same problem. Forwarding over DoH is rare ability. Dnsdist is one of few capable of it.

ISC.orgISC's Matthijs Mekking recently spoke on an Encrypted DNS Policy call about the <a href="https://fosstodon.org/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSSEC</a> multi-signer model. His presentation covered best practices, rollovers, automation, and <a href="https://fosstodon.org/tags/BIND9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BIND9</a> configuration.Slides and recording available at <a href="https://www.isc.org/presentations/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.isc.org/presentations/</a>

Felix Palmen 📯<a href="https://mastodon.bsd.cafe/@jhx" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@jhx</a> For writing some kind of "howto", I'll have to find a sane scope ... otherwise there would be just too much to describe I guess 😮 I could of course assume you already have- network segmentation with a <a href="https://techhub.social/tags/DMZ" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DMZ</a> - a working "domain" setup with a directory and <a href="https://techhub.social/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNS</a> (e.g. <a href="https://techhub.social/tags/samba" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#samba</a>, but could be <a href="https://techhub.social/tags/OpenLDAP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenLDAP</a> with <a href="https://techhub.social/tags/bind9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bind9</a> as well) - (virtual) machines providing <a href="https://techhub.social/tags/RDP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RDP</a> (with <a href="https://techhub.social/tags/xrdp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#xrdp</a> in case of <a href="https://techhub.social/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> or <a href="https://techhub.social/tags/FreeBSD" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FreeBSD</a>) - a working mechanism to distribute X.509 <a href="https://techhub.social/tags/TLS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TLS</a> <a href="https://techhub.social/tags/certificates" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#certificates</a> (I request them from <a href="https://techhub.social/tags/letsencrypt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#letsencrypt</a> using <a href="https://techhub.social/tags/uacme" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#uacme</a> and distribute them with simple shell scripts using special-purpose restricted <a href="https://techhub.social/tags/SSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SSH</a> keys)With all that in place, it would "just" be describing the setup of <a href="https://techhub.social/tags/guacamole" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#guacamole</a> in a <a href="https://techhub.social/tags/FreeBSD" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FreeBSD</a> <a href="https://techhub.social/tags/jail" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#jail</a>, enabling <a href="https://techhub.social/tags/TLS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TLS</a> on all connection paths...

Petr Menšík :fedora:<a href="https://mastodon.social/@krcmar" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@krcmar</a> <a href="https://mastodon.rfc1925.org/@ondrej" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@ondrej</a> musím poděkovat úžasné práci, kterou <a href="https://fosstodon.org/@iscdotorg" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@iscdotorg</a> na kódu <a href="https://fosstodon.org/tags/bind9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bind9</a> dělá. Na codebase podobného stáří, jako já sám, je úžasně svěží. Nicméně tohle je dávná historie a nová sada zranitelností zase na světě. Díky!

Pilou 🐧⚔️<a href="https://gts.lapidak.is/@mike" class="u-url mention">@mike</a> <a href="https://framapiaf.org/tags/DNSmasq" class="mention hashtag" rel="tag">#DNSmasq</a> on <a href="https://framapiaf.org/tags/OpenWRT" class="mention hashtag" rel="tag">#OpenWRT</a> (<a href="https://framapiaf.org/tags/TurrisOmnia" class="mention hashtag" rel="tag">#TurrisOmnia</a>) and <a href="https://framapiaf.org/tags/Bind9" class="mention hashtag" rel="tag">#Bind9</a> to define my own public NS.

#Pfleger aus #Münster🏳️‍🌈🇪🇺Bild ich mir das ein? Am <a href="https://muenster.im/tags/Debian" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Debian</a> <a href="https://muenster.im/tags/Laptop" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Laptop</a> vorhin an den <a href="https://muenster.im/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNS</a> Einstellungen gebastelt. Browsen geht nun etwas fixer als zuvor...<a href="https://muenster.im/tags/Bind9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Bind9</a> installilerensudo nano /etc/systemd/resolved.conf DNS=IP Adresse vom DNS anbieter ;-) FallbackDNS=alternativ IP DNSSEC=yes DNSOverTLS=yes ReadEtcHosts=yessudo systemctl restart systemd-resolved fertig

mkj<a href="https://mastodon.murkworks.net/@moira" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@moira</a> <a href="https://infosec.exchange/@paul_ipv6" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@paul_ipv6</a> That glue NS RRs and authoritative NS RRs point at different domains isn't *necessarily* a problem (though it's still not good), as long as everything eventually resolves to IP addresses on which there are DNS servers authoritative for the zone you're trying to resolve names in.In recursive mode BIND should be determining that one IP address isn't responding and resort to the second one. Maybe check resolver-query-timeout?<a href="https://social.linux.pizza/tags/BIND" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BIND</a> <a href="https://social.linux.pizza/tags/BIND9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BIND9</a>

Solarbird :flag_cascadia:ugh i don't even know how to search for this properlythere's a domain that lists two DNS servers, one is fine, the second is a non-resolving hostname. it's not just not answering: it doesn't even resolve to an IP address.(no, it's not just me, google DNS can't resolve the broken one either.)if _my_ instance of bind9 on _my_ domain's DNS server tries the broken nameserver first, it obviously fails to resolve in any form.the problem is that it does _not_ proceed to try the server that I know is working, and it should.i've told the domain's owner that their DNS is fucked up and how, but really, I shouldn't've ever noticed.anybody got any ideas why bind9 isn't trying the second server? because this is dumb.<a href="https://mastodon.murkworks.net/tags/dns" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dns</a> <a href="https://mastodon.murkworks.net/tags/bind9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bind9</a> <a href="https://mastodon.murkworks.net/tags/debian" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#debian</a>

Colin Cogle 🔵<a href="https://social.anoxinon.de/@jabberati" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@jabberati</a> <a href="https://framapiaf.org/@debacle" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@debacle</a> For what it’s worth, I use a hidden master running BIND. Hurricane Electric provides my public-facing nameservers. <a href="https://mastodon.social/tags/BIND9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BIND9</a> <a href="https://mastodon.social/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNS</a> <a href="https://mastodon.social/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSSEC</a> <a href="https://dns.he.net" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://dns.he.net</a>

Uhurudear <a href="https://electricrequiem.com/tags/lazyweb" rel="nofollow noopener noreferrer" target="_blank">#lazyweb</a> , any (automated) script for rotating DKIM keys in <a href="https://electricrequiem.com/tags/rspamd" rel="nofollow noopener noreferrer" target="_blank">#rspamd</a> and <a href="https://electricrequiem.com/tags/bind9" rel="nofollow noopener noreferrer" target="_blank">#bind9</a> , out there ? <a href="https://electricrequiem.com/tags/dkim" rel="nofollow noopener noreferrer" target="_blank">#dkim</a>

ADMIN magazineDid you miss last week's ADMIN Update newsletter? Read it now and subscribe free to get it every Wednesday <a href="https://mailchi.mp/admin-magazine/admin-update-querying-sensors-for-metrics" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://mailchi.mp/admin-magazine/admin-update-querying-sensors-for-metrics</a> <a href="https://hachyderm.io/tags/metrics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#metrics</a> <a href="https://hachyderm.io/tags/sensors" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sensors</a> <a href="https://hachyderm.io/tags/DevSecOps" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DevSecOps</a> <a href="https://hachyderm.io/tags/Cisco" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cisco</a> <a href="https://hachyderm.io/tags/Splunk" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Splunk</a> <a href="https://hachyderm.io/tags/BIND9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BIND9</a> <a href="https://hachyderm.io/tags/KeePass" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#KeePass</a> <a href="https://hachyderm.io/tags/Matrix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Matrix</a> <a href="https://hachyderm.io/tags/ZeroTrust" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ZeroTrust</a>

Shane Kerr"apt update" on a Sunday night and my e-mail starts filling up with cron errors:"Use of K* file pairs for HMAC is deprecated"That -k syntax is still in the manual page, so I have no idea what happened. Looking at BIND 9 release notes the only thing which seems possibly related is this:"The ability to read HMAC-MD5 key files, which was accidentally lost in BIND 9.18.8, has been restored."But that is about *restoring* access, and Debian is at 9.18.19, so it should be fixed? 😭 <a href="https://fosstodon.org/tags/bind9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bind9</a>

VftdanHow to completely disable DNSSEC in bind9 for exactly one zone?<a href="https://mastodon.ml/tags/dns" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dns</a> <a href="https://mastodon.ml/tags/bind9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bind9</a> <a href="https://mastodon.ml/tags/named" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#named</a>

Recherches récentes

Options de recherche

Administré par :

Statistiques du serveur :

#bind9