From owner-freebsd-questions  Tue Oct 15 11:35:13 2002
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id BE09F37B401
	for <freebsd-questions@freebsd.org>; Tue, 15 Oct 2002 11:35:11 -0700 (PDT)
Received: from bast.unixathome.org (bast.unixathome.org [216.187.105.150])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 46E2B43EAA
	for <freebsd-questions@freebsd.org>; Tue, 15 Oct 2002 11:35:11 -0700 (PDT)
	(envelope-from dan@langille.org)
Received: from wocker (wocker.unixathome.org [192.168.0.99])
	by bast.unixathome.org (Postfix) with ESMTP id 86E633F4B
	for <freebsd-questions@freebsd.org>; Tue, 15 Oct 2002 14:35:10 -0400 (EDT)
From: "Dan Langille" <dan@langille.org>
To: freebsd-questions@freebsd.org
Date: Tue, 15 Oct 2002 14:35:49 -0400
MIME-Version: 1.0
Subject: bind with TSIG needs chgrp bind /etc/namedb
Message-ID: <3DAC27C5.23526.3E9077@localhost>
X-mailer: Pegasus Mail for Windows (v4.02a)
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Content-description: Mail message body
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

I've been adding TSIG to varioius domains.  But I've found that on my 
slavee servers, I've had to set the directory permissions as this:

$ ls -ld /etc/namedb/
drwxrwxr-x  4 root  bind  512 Oct 15 09:26 /etc/namedb/
$ ls -ld /etc/namedb/secondary/
drwxr-x---  2 bind  bind  512 Oct 15 09:25 /etc/namedb/secondary/

named is running as:  /usr/sbin/named -u bind -g bind

Some bits from /etc/namedb/named.conf:

options {
        directory "/etc/namedb";

...


An example TSIG'd domain is:

key 2002100400.katy.com.tsigkey. {
    algorithm "hmac-md5";
    secret "DpTh3OpfpeZrbvV6kwDKcDaPIOeWn0b5MmUc/kqD57Q=";
};


zone "example.org" {
        type slave;
        file "secondary/example.org.db";
        masters { 192.168.0.98 key 2002100400.katy.com.tsigkey.; };
};

Without setting the chmod, I will get these errors upon ndc reload:

named[89]: write_tsig_info: mkstemp(tsigs.RTdOEg) for TSIG info 
failed
named[89]: unable to write tsig info: 'example.org'

I don't like having to put change the permissions on /etc/namedb.  
Any other ideas?
-- 
Dan Langille


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message