- Community Home
- >
- Servers and Operating Systems
- >
- Operating Systems
- >
- Operating System - Linux
- >
- nsupdate error
Operating System - Linux
1822542
Members
2862
Online
109642
Solutions
Forums
Categories
Company
Local Language
юдл
back
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Forums
Discussions
Discussions
Discussions
Forums
Forums
Discussions
юдл
back
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Blogs
Information
Community
Resources
Community Language
Language
Forums
Blogs
Go to solution
Topic Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО12-25-2010 04:39 PM
тАО12-25-2010 04:39 PM
Hi there
My zone file gets updated by the dhcpd fine except for one host. I know I can update the zone manually using nasupdate but every time i try I get the following error:
[root@ddns named]# nsupdate -k /etc/rndc.key
could not read key from /etc/rndc.key: unexpected token
Any idea why would that be ?
Reagrds
Peter
My zone file gets updated by the dhcpd fine except for one host. I know I can update the zone manually using nasupdate but every time i try I get the following error:
[root@ddns named]# nsupdate -k /etc/rndc.key
could not read key from /etc/rndc.key: unexpected token
Any idea why would that be ?
Reagrds
Peter
Jesus is the King
Solved! Go to Solution.
3 REPLIES 3
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО12-25-2010 08:14 PM
тАО12-25-2010 08:14 PM
Re: nsupdate error
> Any idea why would that be ?
Between the two of us, which, do you think,
can see what's in your "/etc/rndc.key" file?
(Hint: It's not I.)
Between the two of us, which, do you think,
can see what's in your "/etc/rndc.key" file?
(Hint: It's not I.)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО12-25-2010 10:14 PM
тАО12-25-2010 10:14 PM
Re: nsupdate error
key "rndckey" {
algorithm hmac-md5;
secret "6aTlgWGyZe83DXZbdRzwbu2j87RPOxWOq9FJml6ik0Dl50V6w2xlroXSchgK";
};
algorithm hmac-md5;
secret "6aTlgWGyZe83DXZbdRzwbu2j87RPOxWOq9FJml6ik0Dl50V6w2xlroXSchgK";
};
Jesus is the King
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО12-26-2010 03:15 AM
тАО12-26-2010 03:15 AM
Solution
The /etc/rndc.key file is not in the correct format for nsupdate. That format is suitable for BIND itself, the rndc tool and the ISC dhcpd only. These will use ISC's proprietary protocol for controlling BIND, typically using port TCP/953 for that.
On the other hand, nsupdate uses standardized TSIG which is somewhat different and uses the standard DNS port 53 for communication. It is supposed to work with all DNS servers that support TSIG-protected dynamic updates.
The man page for nsupdate tells this about the name of the key file:
----quote----
nsupdate uses the -y or -k option to provide the shared secret needed to generate a TSIG record for authenticating Dynamic DNS update requests, default type HMAC-MD5. These options are mutually exclusive.
With the -k option, nsupdate reads the shared secret from the file keyfile, whose name is of the form K{name}.+157.+{random}.private. For historical reasons, the file K{name}.+157.+{random}.key must also be present.
----end quote----
The expected format of the .private file looks like this:
----example----
Private-key-format: v1.2
Algorithm: 157 (HMAC_MD5)
Key: 6aTlgWGyZe83DXZbdRzwbu2j87RPOxWOq9FJml6ik0Dl50V6w2xlroXSchgK
----end example----
This command will create a key in the correct format:
dnssec-keygen -a HMAC-MD5 -b 512 -n HOST -k -r /dev/urandom -v 5
It will create two files: a .key file that contains a DNS record of type "IN KEY", which you should add to the appropriate zone file (either by copy-pasting or by adding a $INCLUDE statement), and a .private file to be used with nsupdate.
MK
On the other hand, nsupdate uses standardized TSIG which is somewhat different and uses the standard DNS port 53 for communication. It is supposed to work with all DNS servers that support TSIG-protected dynamic updates.
The man page for nsupdate tells this about the name of the key file:
----quote----
nsupdate uses the -y or -k option to provide the shared secret needed to generate a TSIG record for authenticating Dynamic DNS update requests, default type HMAC-MD5. These options are mutually exclusive.
With the -k option, nsupdate reads the shared secret from the file keyfile, whose name is of the form K{name}.+157.+{random}.private. For historical reasons, the file K{name}.+157.+{random}.key must also be present.
----end quote----
The expected format of the .private file looks like this:
----example----
Private-key-format: v1.2
Algorithm: 157 (HMAC_MD5)
Key: 6aTlgWGyZe83DXZbdRzwbu2j87RPOxWOq9FJml6ik0Dl50V6w2xlroXSchgK
----end example----
This command will create a key in the correct format:
dnssec-keygen -a HMAC-MD5 -b 512 -n HOST -k -r /dev/urandom -v 5
It will create two files: a .key file that contains a DNS record of type "IN KEY", which you should add to the appropriate zone file (either by copy-pasting or by adding a $INCLUDE statement), and a .private file to be used with nsupdate.
MK
MK
The opinions expressed above are the personal opinions of the authors, not of Hewlett Packard Enterprise. By using this site, you accept the Terms of Use and Rules of Participation.
Company
Learn About
News and Events
Support
© Copyright 2025 Hewlett Packard Enterprise Development LP