Hello everyone,
I've been having problems these past few weeks with the transfer of zone files between i-MSCP 1.5.3 latest version master servers and their very old ispCP slave servers. Every week or so, the domains stop working on the slave servers (ispCP) until i manually edit the zone file on the slave and change the serial number of the zone. Then I manually restart bind and the zone transfer begins again and the domains work. Needless to say this is very bad, having to manually edit all the zone files each week is becoming a nightmare. Any ideas how to fix this ?
Bellow is the setup :
- All domains have ns1 & ns2 setup as NS servers.
- ns1 & ns2 are the SLAVE servers running an outdated ispCP version.
- All domains are setup as MASTER on the specific server where they are hosted with websites / e-mails on i-MSCP 1.5.3 latest version.
Slave 1 /etc/bind/named.conf.options :
- acl "masters" {
- master_ip; //server1
- master_ip; //server2
- master_ip; //server3
- master_ip; //server4
- };
- options {
- directory "/var/cache/bind";
- transfer-format many-answers;
- // allow-query { 127.0.0.1; masters; };
- allow-notify { masters; };
- // allow-recursion { 127.0.0.1; masters; };
- listen-on { any; };
- dnssec-enable yes;
- allow-transfer { key MasterKey; };
- auth-nxdomain no; # conform to RFC1035
- recursion yes;
- version "private";
- };
- //logging {
- // category "general" { "general"; };
- // category lame-servers { null; };
- // category security { null; };
- // category edns-disabled { null; };
- // channel "general" {
- // file "/var/log/named.log";
- // print-time yes;
- // };
- //};
Slave 1 /etc/bind/named.conf.local
QuoteDisplay Moreinclude "/etc/bind/bind.keys";
include "/etc/bind/rndc.key";
include "/etc/bind/named.server1.secondary";
include "/etc/bind/named.server4.secondary";
include "/etc/bind/named.server9.secondary";
server ......... { keys { MasterKey; }; }; //server1
server .......... { keys { MasterKey; }; };
And /etc/bind/named.serverXX.secondary :
zone "blabla.com" {
type slave;
masters {
............; <- IP of the i-MSCP 1.5.3 hosted domain and master DNS
};
file "/var/cache/bind/secondary/server9/blabla.com.hosts";
allow-query{ any; };
};
Master of a zone with problems running on i-MSCP 1.5.3 latest :
- named.conf.options :
- acl "masters"{
- ............; // server 1
- ............; // server 2
- };
- options {
- directory "/var/cache/bind";
- // If there is a firewall between you and nameservers you want
- // to talk to, you may need to fix the firewall to allow multiple
- // ports to talk. See http://www.kb.cert.org/vuls/id/800113
- // If your ISP provided one or more IP addresses for stable
- // nameservers, you probably want to use them as forwarders.
- // Uncomment the following block, and insert the addresses replacing
- // the all-0's placeholder.
- // forwarders {
- // 0.0.0.0;
- // };
- auth-nxdomain no; # conform to RFC1035
- dnssec-enable no;
- dnssec-validation no;
- // Listen to all IPv4 and IPv6 interfaces
- listen-on { any; };
- listen-on-v6 { none; };
- // Improving server performances by reducing outgoing data volumes
- minimal-responses yes;
- // Protecting server against common attacks
- allow-recursion { localhost; };
- allow-query-cache { localhost; };
- allow-transfer { masters; };
- allow-notify { masters; };
- version "i-MSCP DNS Server";
- // As per RFC 7208, SPF DNS record are deprecated
- check-spf ignore;
- // imscp [{ENTRY_ID}] entry BEGIN
- // imscp [{ENTRY_ID}] entry ENDING
- };
- key "MasterKey" {
- algorithm hmac-md5;
- secret "jdfynf+LXkdFukRzhnYdfTLDzoSWjSCfBOzyFKn2BfCmntL0AusxbAdoG7MgOCiTfasahI3K5rOwp3fw==";
- };
Master named.conf.local on i-MSCP 1.5.3 latest :
Logs from bind :
The old ispCP slave servers are running on Debian 6
The latest i-MSCP 1.5.3 2018 servers are running on Ubuntu 18.04
Can anyone tell me what's wrong with this config and why I have to manually change the serial number of each zone in order to get it to work ?
When the logs say that the zone is expired if I dig @localhost zone.com it doesn't resolve, if i change 1 number from the serial, restart bind and dig @localhost zone.com it rezolves without problem for about 1 week. After that it stops working and says the serial expired again.
I'm going crazy here with this, please help!
