nsupdate error

[Piotr Kirklewski]

Hi there
My zone file gets updated by the dhcpd fine except for one host. I know I can update the zone manually using nasupdate but every time i try I get the following error:


[root@ddns named]# nsupdate -k /etc/rndc.key
could not read key from /etc/rndc.key: unexpected token

Any idea why would that be ?

Reagrds

Peter

[Steven Schweda]

> Any idea why would that be ?

Between the two of us, which, do you think,
can see what's in your "/etc/rndc.key" file?
(Hint: It's not I.)

[Piotr Kirklewski]

key "rndckey" {
algorithm hmac-md5;
secret "6aTlgWGyZe83DXZbdRzwbu2j87RPOxWOq9FJml6ik0Dl50V6w2xlroXSchgK";
};

[Matti_Kurkela · Accepted solution]

The /etc/rndc.key file is not in the correct format for nsupdate. That format is suitable for BIND itself, the rndc tool and the ISC dhcpd only. These will use ISC's proprietary protocol for controlling BIND, typically using port TCP/953 for that.

On the other hand, nsupdate uses standardized TSIG which is somewhat different and uses the standard DNS port 53 for communication. It is supposed to work with all DNS servers that support TSIG-protected dynamic updates.

The man page for nsupdate tells this about the name of the key file:
----quote----
nsupdate uses the -y or -k option to provide the shared secret needed to generate a TSIG record for authenticating Dynamic DNS update requests, default type HMAC-MD5. These options are mutually exclusive.

With the -k option, nsupdate reads the shared secret from the file keyfile, whose name is of the form K{name}.+157.+{random}.private. For historical reasons, the file K{name}.+157.+{random}.key must also be present.
----end quote----

The expected format of the .private file looks like this:
----example----
Private-key-format: v1.2
Algorithm: 157 (HMAC_MD5)
Key: 6aTlgWGyZe83DXZbdRzwbu2j87RPOxWOq9FJml6ik0Dl50V6w2xlroXSchgK
----end example----

This command will create a key in the correct format:

dnssec-keygen -a HMAC-MD5 -b 512 -n HOST -k -r /dev/urandom -v 5

It will create two files: a .key file that contains a DNS record of type "IN KEY", which you should add to the appropriate zone file (either by copy-pasting or by adding a $INCLUDE statement), and a .private file to be used with nsupdate.

MK