☰

从 KNOT（主）到 BIND（从）的区域传输因 NAUTH 而失败

tag-icon • tag-icon domain-name-system bind dns-zone master-slave
从 KNOT（主）到 BIND（从）的区域传输因 NAUTH 而失败

有一个结 DNS我自己无法管理我的域的主名称服务器。我尝试在内部设置 BIND DNS 服务器作为从属服务器。BIND 无法进行区域传输并报告

31-Dec-2017 16:19:02.503 zone whka.de/IN: Transfer started.
31-Dec-2017 16:19:02.504 transfer of 'whka.de/IN' from 2001:7c7:2000:53::#53: connected using 2001:7c7:20e8:18e::2#53509
31-Dec-2017 16:19:02.505 transfer of 'whka.de/IN' from 2001:7c7:2000:53::#53: failed while receiving responses: NOTAUTH
31-Dec-2017 16:19:02.505 transfer of 'whka.de/IN' from 2001:7c7:2000:53::#53: Transfer completed: 0 messages, 0 records, 0 bytes, 0.001 secs (0 bytes/sec)

如果尝试dig（这次使用 IPv4 地址），也会失败。

# dig axfr @141.70.45.160 whka.de.

; <<>> DiG 9.9.5-9+deb8u7-Debian <<>> axfr @141.70.45.160 whka.de.
; (1 server found)
;; global options: +cmd
; Transfer failed.

Wireshark 告诉我名称服务器的回复代码是1001 Server is not an authority for domain。这是怎么回事？

尤其是，如果我向同一个名称服务器查询常见的 A 记录，它会声称自己是权威的。此外，KNOT DNS 手册称 KNOT 是仅权威的名称服务器。因此，不可能不具有权威性。

有谁已经观察到过类似的事情吗？

这是我的 BIND 配置，但目前我怀疑 BIND 是其中有问题的部分：

// *The whole IP range of HEKnet*
//
// These are allowed to query our own nameserver; see `allow-query { heknet; };`
// below
acl heknet {
  127.0.0.0/8;
  100.122.0.0/18;
  100.67.128.16/29;
  ::1/128;
  2001:7c7:20e8::0/47;
  2001:7c7:200e:2::/64;
};

// *The IP address(es) of this nameserver itself*
//
// Required for control and notify messages
acl hek-ns {
  127.0.0.0/8;
  100.122.2.2;
  ::1/128;
  2001:7c7:20e8:18e::2;
};


// *The IPs of the authoritive nameserver of `whka.de`*
//
// These are allowed to send update-notifications to our nameserver; see
// `allow-notify { whka-ns; };` below
// `dns0.whka.de` is the hidden master of `dns1.whka.de` and `dns2.whka.de`.
// It must not be used for usual name queries, but only for zone updates.
// `dns1.whka.de` and `dns2.whka.de` are the ordinary servers for daily
// operation.
acl whka-ns {
  // dns0.whka.de., dns1.whka.de., dns2.whka.de.
  141.70.45.160;
  141.70.45.161;
  141.70.45.162;
  2001:7c7:2000:53::;
  2001:7c7:2000:53::1;
  2001:7c7:2000:53::2;
};


// *The master nameserver of `whka.de`*
//
// `dns0.whka.de` is the hidden master. This means it must only be used for
// zone transfers and not for ordinary name queries. It does not claim itself
// being a nameserver of `whka.de`.
masters whka-dns0 {
  141.70.45.160;
  2001:7c7:2000:53::;
};


options {
  directory "/var/cache/bind.new";

  listen-on port 1053 { any; };

  listen-on-v6 port 1053 {  any; };

  forwarders {
    // KIT name servers, the whka-nameservers do not allow recursion
    129.13.64.5;
    129.13.96.2;
  };

  forward first;
  notify no;

  allow-query { heknet; };

  allow-recursion { heknet; };

  allow-query-cache { heknet; };

  allow-notify {
    hek-ns;
    whka-ns;
  };
}; 

controls {
  inet * port 1953 allow { hek-ns; };
};


zone "whka.de." {
  type slave;
  masters { whka-dns0; };
  file "/var/lib/bind.new/db.de.whka";
};

zone "122.100.in-addr.arpa." {
  type slave;
  masters { whka-dns0; };
  file "/var/lib/bind.new/db.100.122";
};

zone "67.100.in-addr.arpa." {
  type slave;
  masters { whka-dns0; };
  file "/var/lib/bind.new/db.100.67";
};

zone "0.2.7.c.7.0.1.0.0.2.ip6.arpa." {
  type slave;
  masters { whka-dns0; };
  file "/var/lib/bind.new/db.2001.07c7.20";
};

答案1

NOTAUTH不幸的是，标准中的代码超载了。在这种情况下，它意味着“未授权”。 https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6

相关内容