Plesk as hidden master

[GertjanH]

Hi there,

I've been trying to configure Plesk as a hidden (super)master for a domain and I've run into some problems.

First off, for those who don't know, a hidden master is a nameserver that is actually the master server, yet does not list in the NS records of the domain.
The servers listed as NS in the zone have accepted the server as their master, but the rest of the world does not know it exists. Hence the term hidden master. The slaves consist of two PowerDNS servers that acknowledge the Plesk server as a supermaster, thus enabling automatic zone configuration and the like upon receiving a notify from the Plesk server.

However, the Plesk server refuses to send automatic notify messages to the slaves (listed in the NS records, also added to the ACL / transfer restrictions template). When requesting an AXFR by hand the Plesk server happily transfers the requested zone to the PowerDNS slaves, but upon changing the zone files through the Plesk panel's DNS management system, no notify goes out to the slaves, which thus don't know anything has changed. I've tried adding an also-notify clause to named.conf (which was suggested elsewhere), but it appears Plesk overwrites the entire named.conf upon zone changes, thus erasing the also-notify clause, subsequently refusing to send out a notify.

Further research into the workings of Bind (the nameserver used by Plesk in this setup) suggests that, by default, it should send notify messages to all servers listed in the NS records part of a given zone. This is clearly not the case in this particular setup, but I can't seem to find where exactly notify messages have been disabled (there is no mention of notify in named.conf).

My questions therefore are:
1) Why doesn't Plesk / Bind send automatic notify messages to its slaves, which is the default behavior of Bind? Where and how has this been disabled?
2) Should 1 turn out to be impossible to fix, how do I override named.conf on a per-domain basis?

Thanks in advance,
Regards,
Gertjan

 

[jprince]

Hi.
(Editing, after reading your post again.. )...

This does work..
Sounds like your zone transfers are denied.
Try adding the IP block to the transfer restrictions template as a quick test?
What do the log files show??

--john

 

[GertjanH]

The IPs are already in the transfer restrictions template, that's the odd thing. The problem isn't that the zone transfers are denied: as you can see from the excerpt below, the AXFR works just fine, but only if I request it by hand on the slave ("pdns_control retrieve mydomain.com"). The problem is that, upon changing the zone, Plesk / Bind doesn't send a notify to the slave, so the slave doesn't know anything has changed and subsequently does not request an AXFR.

Log from the slave (IPs sanitized):
Jun 27 11:12:02 mojave pdns[15224]: gmysql Connection succesful
Jun 27 11:12:03 mojave pdns[15224]: Initiating transfer of 'mydomain.com' from remote '192.168.145.174'
Jun 27 11:12:03 mojave pdns[15224]: gmysql Connection succesful
Jun 27 11:12:03 mojave pdns[15224]: AXFR started for 'mydomain.com', transaction started
Jun 27 11:12:03 mojave pdns[15224]: AXFR done for 'mydomain.com', zone committed

Logs from the Plesk / Bind master:
Jun 27 11:12:03 belinda named[32757]: client 192.168.145.50#50437: transfer of 'mydomain.com/IN': AXFR started
Jun 27 11:12:03 belinda named[32757]: client 192.168.145.50#50437: transfer of 'mydomain.com/IN': AXFR ended

As you can see, the AXFR works perfectly, as it should, because 192.168.145.50 is listed in the transfer restrictions template and it's the IP of one of the NS records in the zone. But it only works if I request an AXFR by hand,
so to return to the problem at hand, why doesn't Plesk / Bind send out a notify when I change the zone? This is doubly important because in order to do a pdns_control retrieve I first had to add the zone by hand to the pdns backend, because otherwise pdns won't do a retrieve (because it doesn't recognize the zone).

 

[GertjanH]

Update: if the Plesk server is listed as an NS record for the zone, it sends out notify messages to all NS records. In other words, it works as a non-hidden setup, but not as a hidden setup (ie. without Plesk / Bind listed in the NS records).

 

[alix1]

I know this is an old thread but maybe it can help someone with a similar configuration to the one mentioned here.

I've managed to solve this situation in Plesk 12 on CentOS 6 modifying the file "/var/named/chroot/etc/named.conf" and including inside the "options" section:

notify yes;
also-notify { x.x.x.x; y.y.y.y; z.z.z.z; };​

where x.x.x.x, y.y.y.y and z.z.z.z are the slave DNS ips that should get the NOTIFY of a zone change from the hidden master (the Plesk server).