2026-10-31 06:39 UTC
BIND's "session-keyfile" is a clever idea: it generates a temporary TSIG key at startup, stores it somewhere like /run/named/session.key, and you can use "nsupdate -l" to use that key to update zones that specify "update-policy local".
But there's no way to control the permissions of the key file, so it's always mode 0600 owned by bind/bind, which foils my plan to add my acme.sh user to group bind so that it can use nsupdate.
(Also, why does the "frowning" emoji 😦 look nothing like frowning?)
Replies (1)
-
@amenonsen@flipping.rocks 2026-10-31 06:44
In other annoyances related to TSIG keys, Hetzner's DNS interface allows you to specify a key and algorithm to authenticate zone transfers, but there's no way to specify the key _name_; instead, they generate a zone-specific name whenever you add a key. So if you just want to use a single key to authenticate transfers of several zones to Hetzner's secondary name servers (e.g., "allow-transfer { key hetzner_secondaries; }")… forget it. You need one key per zone, and you have to go back to your own configuration and update the key names before it'll work. Support confirmed that's how it's meant to work. :blobcatangry: