BIND 9的nsupdate dyndns更新提供：“tsigvalidation失败（BADKEY）”

我已经浏览了很多DDNS上的HOWTO页面，试图解决这个问题…我不知所措。

WorkstationX = CentOS 6.2 x64 ServerX = Ubuntu 12.04 LTS x64

我不明白为什么它不工作…我真的没有想法。我已经重新生成并重新configuration了几次。

我已经确定：

在两台主机上运行NTPD，我已经validationNTP正在工作
TZ是正确的两个节点（硬件是UTC）
我遵循这些指南：
- linux.yyz.us/nsupdate/
- agiletesting.blogspot.com.au/2012/03/dynamic-dns-updates-with-nsupdate-and.html
- www.cheshirekow.com/wordpress/?p=457
- www.erianna.com/nsupdate-dynamic-dns-updates-with-bind9
- consultancy.edvoncken.net/index.php/HOWTO_Manage_Dynamic_DNS_with_nsupdate
- blog.philippklaus.de/2013/01/updating-dns-entries-with-nsupdate-or-alternative-implementations-your-own-ddns/

其中一些有不同的方式来生成密钥，但其余的是相同的…当我尝试nsupdate – 即使在运行dnssec-keygen的服务器（以及绑定的位置）时，我也会得到相同的日志项：

Aug 14 11:20:38 vps named[31247]: 14-Aug-2013 11:20:38.032 security: error: client 127.0.0.1#29403: view public: request has invalid signature: TSIG domain2.com.au.: tsig verify failure (BADKEY)

从这个nsupdate：

 nsupdate -k Kdomain2.com.au.+157+35454.key server localhost zone domain2.com.au. update add test.domain2.com.au. 86400 IN A 10.20.30.40 show send

我收集的是正确的生成方法：

 dnssec-keygen -a HMAC-MD5 -b 512 -n HOST domain2.com.au.

named.conf（IP已被更改为隐私）：

 acl ipv4 { 0.0.0.0/0; }; acl ipv6 { 2000::/3; ::1; fe80::/10; fec0::/10; }; acl safehosts { 127.0.0.0/8; 3.2.2.40; 44.44.14.12; }; include "/etc/bind/rndc.key"; controls { inet * port 953 allow { safehosts; } keys { "rndc-key"; }; }; options { auth-nxdomain yes; empty-zones-enable no; zone-statistics yes; dnssec-enable yes; listen-on { any; }; listen-on-v6 { any; }; directory "/etc/bind/db"; managed-keys-directory "/etc/bind/keys"; memstatistics-file "/etc/bind/data/bind.memstats"; statistics-file "/etc/bind/data/bind.qstats"; }; logging { ## CUT ## }; view "public" { recursion yes; allow-query-cache { safehosts; }; allow-recursion { safehosts; }; zone "." IN { type hint; file "root.zone"; }; zone "0.0.127.in-addr.arpa" { type master; allow-update { none; }; allow-transfer { none; }; file "0.0.127.in-addr.arpa.zone"; }; zone "localhost" { type master; allow-update { none; }; allow-transfer { none; }; file "localhost.zone"; }; zone "3.2.2.in-addr.arpa" { type master; allow-update { none; }; allow-transfer { none; }; file "3.2.2.in-addr.arpa.zone"; }; zone "domain1.com.au" { type master; notify yes; allow-update { key "rndc-key"; }; allow-transfer { key "rndc-key"; }; file "domain1.com.au.zone"; }; zone "domain2.com.au" { type master; notify yes; allow-update { key "rndc-key"; }; allow-transfer { key "rndc-key"; }; file "doomain2.com.au.zone"; }; };

/etc/bind/rndc.key：

 key "rndc-key" { algorithm hmac-md5; secret "vZwCYBx4OAOsBrbdlooUfBaQx+kwEi2eLDXdr+JMs4ykrwXKQTtDSg/jp7eHnw39IehVLMtuVECTqfOwhXBm0A=="; };

Kdomain1.com.au。+ 157 + 35454.private

 Private-key-format: v1.3 Algorithm: 157 (HMAC_MD5) Key: vZwCYBx4OAOsBrbdlooUfBaQx+kwEi2eLDXdr+JMs4ykrwXKQTtDSg/jp7eHnw39IehVLMtuVECTqfOwhXBm0A== Bits: AAA= Created: 20130814144733 Publish: 20130814144733 Activate: 20130814144733

nsupdate有一些怪癖，并假定用-k调用一些命名约定。从手册页，我认为你的关键名称可能被称为domain2.com.au 。

你可以试试以下吗？

 nsupdate -y \ 'rndc-key:vZwCYBx4OAOsBrbdlooUfBaQx+kwEi2eLDXdr+JMs4ykrwXKQTtDSg/jp7eHnw39IehVLMtuVECTqfOwhXBm0A=='

你有allow-update {key“rndc-key”; }; 而不是你生成的密钥。你应该在某个地方有一个关键语句： key "ddns_key" { algorithm hmac-md5; secret "vZwCYBx4OAOsBrbdlooUfBaQx+kwEi2eLDXdr+JMs4ykrwXKQTtDSg/jp7eHnw39IehVLMtuVECTqfOwhXBm0A=="; }; key "ddns_key" { algorithm hmac-md5; secret "vZwCYBx4OAOsBrbdlooUfBaQx+kwEi2eLDXdr+JMs4ykrwXKQTtDSg/jp7eHnw39IehVLMtuVECTqfOwhXBm0A=="; }; 你应该添加allow-update { key "ddns_key" };