DNS Cluster and DNSSEC Questions

Community Support DNS
21

You need to make some changes in bind configuration:

22

Yes, bind and sync is working without dnssec. and thats the problem with this FAQ.

on Master i dont have changed hestia.conf setting DNS_CLUSTER_SYSTEM
on slave i have changed ist to hestia-zone

so the sync is working.

BUT:

i can not activate DNSSEC on master only on slave. so should i change this setting on both? Master ans Slave?

and if i do so, i can not sync to salve anymore.

23

You should activate it on the master.

How ever you need to make the changes:

Mainly:

  1. In /usr/local/hestia/conf/hestia.conf, change DNS_CLUSTER_SYSTEM='hestia' to DNS_CLUSTER_SYSTEM='hestia-zone'.
  2. On the master server, open /etc/bind/named.conf.options, do the following changes, then restart bind9 with systemctl restart bind9.

bash

# Change this line
allow-transfer { "none"; };
# To this
allow-transfer { your.slave.ip.address; };
# Or this, if adding multiple slaves
allow-transfer { first.slave.ip.address; second.slave.ip.address; };
# Add this line, if adding multiple slaves
also-notify { second.slave.ip.address; };
  1. On the slave server, open /etc/bind/named.conf.options, do the following changes, then restart bind9 with systemctl restart bind9:

bash

# Change this line
allow-recursion { 127.0.0.1; ::1; };
# To this
allow-recursion { 127.0.0.1; ::1; your.master.ip.address; };
# Add this line
allow-notify{ your.master.ip.address; };

Also make sure you OS is Ubuntu 22.04 or Debian 11 or higher

24

Yes,

should i do this on master, slave or both?

  1. In /usr/local/hestia/conf/hestia.conf, change DNS_CLUSTER_SYSTEM='hestia' to DNS_CLUSTER_SYSTEM='hestia-zone'.
25

Only master is enough

26

okay, so on master i change it to hestia-zone and on slave it is hestia.

if i change it all zones on slave are empty. i have removed cluster and reenabled it and it ist also empty on slave

27

image
image1021×288 25.4 KB

28

That is correct

If you run:

rndc notify domain.com on the master

It will sync up with the slave

Just create a new DNS record and verify if it is working via

nslookup domain.com ns2.server.com

29

okay. ist seems to work, but in webinterface i see no records on slave. is this correct?

on master i have 34 Records

30

That is correct we don’t store the records in hestia config any more

31

oh. than it is all fine