cancel
Showing results for 
Search instead for 
Did you mean: 

nsupdate error

 
SOLVED
Go to solution
Highlighted
Super Advisor

nsupdate error

Hi there
My zone file gets updated by the dhcpd fine except for one host. I know I can update the zone manually using nasupdate but every time i try I get the following error:


[root@ddns named]# nsupdate -k /etc/rndc.key
could not read key from /etc/rndc.key: unexpected token

Any idea why would that be ?

Reagrds

Peter
Jesus is the King
3 REPLIES 3
Highlighted
Honored Contributor

Re: nsupdate error

> Any idea why would that be ?

Between the two of us, which, do you think,
can see what's in your "/etc/rndc.key" file?
(Hint: It's not I.)
Highlighted
Super Advisor

Re: nsupdate error

key "rndckey" {
algorithm hmac-md5;
secret "6aTlgWGyZe83DXZbdRzwbu2j87RPOxWOq9FJml6ik0Dl50V6w2xlroXSchgK";
};
Jesus is the King
Highlighted
Honored Contributor
Solution

Re: nsupdate error

The /etc/rndc.key file is not in the correct format for nsupdate. That format is suitable for BIND itself, the rndc tool and the ISC dhcpd only. These will use ISC's proprietary protocol for controlling BIND, typically using port TCP/953 for that.

On the other hand, nsupdate uses standardized TSIG which is somewhat different and uses the standard DNS port 53 for communication. It is supposed to work with all DNS servers that support TSIG-protected dynamic updates.

The man page for nsupdate tells this about the name of the key file:
----quote----
nsupdate uses the -y or -k option to provide the shared secret needed to generate a TSIG record for authenticating Dynamic DNS update requests, default type HMAC-MD5. These options are mutually exclusive.

With the -k option, nsupdate reads the shared secret from the file keyfile, whose name is of the form K{name}.+157.+{random}.private. For historical reasons, the file K{name}.+157.+{random}.key must also be present.
----end quote----

The expected format of the .private file looks like this:
----example----
Private-key-format: v1.2
Algorithm: 157 (HMAC_MD5)
Key: 6aTlgWGyZe83DXZbdRzwbu2j87RPOxWOq9FJml6ik0Dl50V6w2xlroXSchgK
----end example----

This command will create a key in the correct format:

dnssec-keygen -a HMAC-MD5 -b 512 -n HOST -k -r /dev/urandom -v 5

It will create two files: a .key file that contains a DNS record of type "IN KEY", which you should add to the appropriate zone file (either by copy-pasting or by adding a $INCLUDE statement), and a .private file to be used with nsupdate.

MK
MK