DDNS Updates on lease expire.

classic Classic list List threaded Threaded
6 messages Options
Reply | Threaded
Open this post in threaded view
|

DDNS Updates on lease expire.

Mark Mc Nicholas
Hi All,
Sorry in advance if this has been answered before but I can't seem to find a clear answer.
I'm using

dhcpd 4.11 & bind9.8

I have forward and reverse zones being updated when a host takes a lease without an issue.
and if a host takes a lease and the IP changes from the last time dns is updated to reflect this.
But when a lease expires the DNS entries remain. I don't know is this by design or an error in my config.
I'm wondering should DHCPD update DNS to remove an expired entry?
Thanks for any input and help on this
Kind Regards

Mark
--
Begin at the beginning,and go on till you come to the end: then stop.

_______________________________________________
dhcp-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/dhcp-users
Reply | Threaded
Open this post in threaded view
|

Re: DDNS Updates on lease expire.

Simon Hobson
Mark Mc Nicholas <[hidden email]> wrote:

> I'm wondering should DHCPD update DNS to remove an expired entry?

Yes it should.
It might help if you posted your config, and log file entries relevant to an event.

_______________________________________________
dhcp-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/dhcp-users
Reply | Threaded
Open this post in threaded view
|

Re: DDNS Updates on lease expire.

Mark Mc Nicholas
Hi Simon,
Thanks, I didn't want to waste people's time with config's until I confirmed if this was normal.
Below are the config's of DHCPD & Bind,
I've edited the keys since posting publicly.
I have no logs from DHCPD indicating a release of an IP. DHCP & DNS are running on different boxes however there is no known communication issue between them.
The only proof I can show from logs is that it updates A records and PTR records.
Please let me know if I have missed something
Thanks for the help
Kind Regards
Mark 


====DHCPD Config====

ddns-updates on;
ddns-update-style interim;
update-static-leases    on;
key sun-key { algorithm hmac-md5; secret "123456789";}
allow unknown-clients;
use-host-decl-names on;

zone    i.home.ie.{
        primary moto.i.home.ie;
        key sun-key;
}

# Common to all subnets
option domain-name "home.ie";
default-lease-time 1800;
max-lease-time 14400;
authoritative;
allow unknown-clients;

subnet 172.17.2.0 netmask 255.255.255.128 {
        range 172.17.2.41 172.17.2.100;
        default-lease-time 1800;
        max-lease-time 14400;
        authoritative;
        option routers 172.17.2.1;
        option domain-name-servers 172.17.2.4,192.168.252.1 ;
        option domain-name "i.home.ie";
        option domain-search "i.home.ie";
        option ntp-servers 193.1.219.116,193.1.31.66;
        ddns-domainname "i.home.ie.";
        ddns-rev-domainname "in-addr.arpa.";
 
        host skynet09{
                hardware ethernet AC:CF:23:8D:10:60;
                fixed-address 172.17.2.39;
                ddns-hostname "skynet009";
        }
}



====Bind Config====
key "sun-key" {
      algorithm hmac-md5;
      secret "123456789";
};


options {
        listen-on port 53 { 192.168.252.1; };
        #listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { any; };
        allow-recursion { PermitRecursion; };
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;
        dnssec-lookaside auto;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";

        managed-keys-directory "/var/named/dynamic";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

        zone "i.home.ie" {
                type master;
                file "/etc/named/i.home.ie";
                allow-update { key sun-key; };
                allow-transfer { RFC1918; };
                notify yes;
        };


Bind Logs of an Update

named[1563]: client 172.17.2.4#28949: updating zone 'i.home.ie/IN': update unsuccessful: skynet001.i.home.ie: 'name not in use' prerequisite not satisfied (YXDOMAIN)
named[1563]: client 172.17.2.4#28949: signer "sun-key" approved
named[1563]: client 172.17.2.4#28949: updating zone 'i.home.ie/IN': deleting rrset at 'skynet001.i.home.ie' A
named[1563]: client 172.17.2.4#28949: updating zone 'i.home.ie/IN': adding an RR at 'skynet001.i.home.ie' A
named[1563]: client 172.17.2.4#28949: signer "sun-key" approved

DHCP Logs for the same device
dhcpd[6271]: DHCPREQUEST for 172.17.2.31 from ac:cf:23:8d:77:56 via eth0
dhcpd[6271]: DHCPACK on 172.17.2.31 to ac:cf:23:8d:77:56 via eth0
dhcpd[6271]: Added new forward map from skynet001.i.home.ie. to 172.17.2.31
dhcpd[6271]: Added reverse map from 31.2.17.172.in-addr.arpa. to skynet001.i.home.ie.



On Wed, Aug 17, 2016 at 12:34 PM, Simon Hobson <[hidden email]> wrote:
Mark Mc Nicholas <[hidden email]> wrote:

> I'm wondering should DHCPD update DNS to remove an expired entry?

Yes it should.
It might help if you posted your config, and log file entries relevant to an event.

_______________________________________________
dhcp-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/dhcp-users



--
Begin at the beginning,and go on till you come to the end: then stop.

_______________________________________________
dhcp-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/dhcp-users
Reply | Threaded
Open this post in threaded view
|

Re: DDNS Updates on lease expire.

Simon Hobson
Mark Mc Nicholas <[hidden email]> wrote:

> Below are the config's of DHCPD & Bind,


> ====DHCPD Config====
>
> ddns-updates on;
> ddns-update-style interim;
> update-static-leases    on;
> key sun-key { algorithm hmac-md5; secret "123456789";}
> allow unknown-clients;
> use-host-decl-names on;
>
> zone    i.home.ie.{
>         primary moto.i.home.ie;
>         key sun-key;
> }
>
> # Common to all subnets
> option domain-name "home.ie";
> default-lease-time 1800;
> max-lease-time 14400;
> authoritative;
> allow unknown-clients;
>
> subnet 172.17.2.0 netmask 255.255.255.128 {
>         range 172.17.2.41 172.17.2.100;
>         default-lease-time 1800;
>         max-lease-time 14400;
>         authoritative;
>         option routers 172.17.2.1;
>         option domain-name-servers 172.17.2.4,192.168.252.1 ;
>         option domain-name "i.home.ie";
>         option domain-search "i.home.ie";
>         option ntp-servers 193.1.219.116,193.1.31.66;
>         ddns-domainname "i.home.ie.";
>         ddns-rev-domainname "in-addr.arpa.";
>  
>         host skynet09{
>                 hardware ethernet AC:CF:23:8D:10:60;
>                 fixed-address 172.17.2.39;
>                 ddns-hostname "skynet009";
>         }
> }

The first thing to note is that you have a host declaration within a subnet. Host declarations are always global in scope, but do have inheritance - this can cause some "interesting" effects if the client pops up on another subnet. So, while it's not directly relevant to the problem you are enquiring about - put your host declarations in the global scope and save yourself some pain later on ;-)



> Bind Logs of an Update
>
> named[1563]: client 172.17.2.4#28949: updating zone 'i.home.ie/IN': update unsuccessful: skynet001.i.home.ie: 'name not in use' prerequisite not satisfied (YXDOMAIN)
> named[1563]: client 172.17.2.4#28949: signer "sun-key" approved
> named[1563]: client 172.17.2.4#28949: updating zone 'i.home.ie/IN': deleting rrset at 'skynet001.i.home.ie' A
> named[1563]: client 172.17.2.4#28949: updating zone 'i.home.ie/IN': adding an RR at 'skynet001.i.home.ie' A
> named[1563]: client 172.17.2.4#28949: signer "sun-key" approved
>
> DHCP Logs for the same device
> dhcpd[6271]: DHCPREQUEST for 172.17.2.31 from ac:cf:23:8d:77:56 via eth0
> dhcpd[6271]: DHCPACK on 172.17.2.31 to ac:cf:23:8d:77:56 via eth0
> dhcpd[6271]: Added new forward map from skynet001.i.home.ie. to 172.17.2.31
> dhcpd[6271]: Added reverse map from 31.2.17.172.in-addr.arpa. to skynet001.i.home.ie.

OK, that's all normal.
But, I see 172.17.2.31 is not in the range (172.17.2.41 to 172.17.2.100) defined for dynamic clients, so I'm guessing that you have trimmed out a host declaration for skynet001 ? If so, then the answer is simple - DNS entries for these hosts are not automatically removed, because there is no mechanism to do so.

More detail on that.
When a host gets a lease from a static address assignment in a host declaration, there is no lease created by the server to go with it. Because it's a static assignment, there's no need to track it, and so there's a shortcut where from the client PoV it gets a lease, but the server doesn't bother recording it.
As there is no lease recorded by the server, there's nothing to expire, and so nothing to trigger removal of the corresponding DDNS entries.
Also, without the "update-static-leases on;" statement, you also would not get DNS updates on "lease" issue.

If you need DDNS updates to remove the entries, then you'll have to use "real" leases. You can get much the same effect by creating a "reserved" lease. You can do this (AIUI) on a running server via OMAPI, or after stopping the server you can do it by editing the leases file to add/edit a lease with the "Reserved" keyword.
A reserved lease acts just like any other dynamic lease (gets issued, renewed, expires, etc) except that it will never be re-assigned to another client.

_______________________________________________
dhcp-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/dhcp-users
Reply | Threaded
Open this post in threaded view
|

Re: DDNS Updates on lease expire.

Mark Mc Nicholas
Hi Simon,
Thanks for pointing that out,
That is an artifact of some late night troubleshooting :)
Kind Regards
Mark

On Wed, Aug 17, 2016 at 1:54 PM, Simon Hobson <[hidden email]> wrote:
Mark Mc Nicholas <[hidden email]> wrote:

> Below are the config's of DHCPD & Bind,


> ====DHCPD Config====
>
> ddns-updates on;
> ddns-update-style interim;
> update-static-leases    on;
> key sun-key { algorithm hmac-md5; secret "123456789";}
> allow unknown-clients;
> use-host-decl-names on;
>
> zone    i.home.ie.{
>         primary moto.i.home.ie;
>         key sun-key;
> }
>
> # Common to all subnets
> option domain-name "home.ie";
> default-lease-time 1800;
> max-lease-time 14400;
> authoritative;
> allow unknown-clients;
>
> subnet 172.17.2.0 netmask 255.255.255.128 {
>         range 172.17.2.41 172.17.2.100;
>         default-lease-time 1800;
>         max-lease-time 14400;
>         authoritative;
>         option routers 172.17.2.1;
>         option domain-name-servers 172.17.2.4,192.168.252.1 ;
>         option domain-name "i.home.ie";
>         option domain-search "i.home.ie";
>         option ntp-servers 193.1.219.116,193.1.31.66;
>         ddns-domainname "i.home.ie.";
>         ddns-rev-domainname "in-addr.arpa.";
>
>         host skynet09{
>                 hardware ethernet AC:CF:23:8D:10:60;
>                 fixed-address 172.17.2.39;
>                 ddns-hostname "skynet009";
>         }
> }

The first thing to note is that you have a host declaration within a subnet. Host declarations are always global in scope, but do have inheritance - this can cause some "interesting" effects if the client pops up on another subnet. So, while it's not directly relevant to the problem you are enquiring about - put your host declarations in the global scope and save yourself some pain later on ;-)



> Bind Logs of an Update
>
> named[1563]: client 172.17.2.4#28949: updating zone 'i.home.ie/IN': update unsuccessful: skynet001.i.home.ie: 'name not in use' prerequisite not satisfied (YXDOMAIN)
> named[1563]: client 172.17.2.4#28949: signer "sun-key" approved
> named[1563]: client 172.17.2.4#28949: updating zone 'i.home.ie/IN': deleting rrset at 'skynet001.i.home.ie' A
> named[1563]: client 172.17.2.4#28949: updating zone 'i.home.ie/IN': adding an RR at 'skynet001.i.home.ie' A
> named[1563]: client 172.17.2.4#28949: signer "sun-key" approved
>
> DHCP Logs for the same device
> dhcpd[6271]: DHCPREQUEST for 172.17.2.31 from ac:cf:23:8d:77:56 via eth0
> dhcpd[6271]: DHCPACK on 172.17.2.31 to ac:cf:23:8d:77:56 via eth0
> dhcpd[6271]: Added new forward map from skynet001.i.home.ie. to 172.17.2.31
> dhcpd[6271]: Added reverse map from 31.2.17.172.in-addr.arpa. to skynet001.i.home.ie.

OK, that's all normal.
But, I see 172.17.2.31 is not in the range (172.17.2.41 to 172.17.2.100) defined for dynamic clients, so I'm guessing that you have trimmed out a host declaration for skynet001 ? If so, then the answer is simple - DNS entries for these hosts are not automatically removed, because there is no mechanism to do so.

More detail on that.
When a host gets a lease from a static address assignment in a host declaration, there is no lease created by the server to go with it. Because it's a static assignment, there's no need to track it, and so there's a shortcut where from the client PoV it gets a lease, but the server doesn't bother recording it.
As there is no lease recorded by the server, there's nothing to expire, and so nothing to trigger removal of the corresponding DDNS entries.
Also, without the "update-static-leases on;" statement, you also would not get DNS updates on "lease" issue.

If you need DDNS updates to remove the entries, then you'll have to use "real" leases. You can get much the same effect by creating a "reserved" lease. You can do this (AIUI) on a running server via OMAPI, or after stopping the server you can do it by editing the leases file to add/edit a lease with the "Reserved" keyword.
A reserved lease acts just like any other dynamic lease (gets issued, renewed, expires, etc) except that it will never be re-assigned to another client.

_______________________________________________
dhcp-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/dhcp-users



--
Begin at the beginning,and go on till you come to the end: then stop.

_______________________________________________
dhcp-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/dhcp-users
Reply | Threaded
Open this post in threaded view
|

Re: DDNS Updates on lease expire.

Mark Mc Nicholas
So Donno how but it's working now. 
I've rebooted both systems, Something I hate to do to solve a problem as it usually only ever removes a symptom. However logs now show RR's being removed. I'm going to monitor the situation.
Simon thanks for the time. It's appreciated. First time ever having to mail out to the dhcpd community and have to say it's been very welcoming thank you.
Kind Regards
Mark

On Wed, Aug 17, 2016 at 2:02 PM, Mark Mc Nicholas <[hidden email]> wrote:
Hi Simon,
Thanks for pointing that out,
That is an artifact of some late night troubleshooting :)
Kind Regards
Mark

On Wed, Aug 17, 2016 at 1:54 PM, Simon Hobson <[hidden email]> wrote:
Mark Mc Nicholas <[hidden email]> wrote:

> Below are the config's of DHCPD & Bind,


> ====DHCPD Config====
>
> ddns-updates on;
> ddns-update-style interim;
> update-static-leases    on;
> key sun-key { algorithm hmac-md5; secret "123456789";}
> allow unknown-clients;
> use-host-decl-names on;
>
> zone    i.home.ie.{
>         primary moto.i.home.ie;
>         key sun-key;
> }
>
> # Common to all subnets
> option domain-name "home.ie";
> default-lease-time 1800;
> max-lease-time 14400;
> authoritative;
> allow unknown-clients;
>
> subnet 172.17.2.0 netmask 255.255.255.128 {
>         range 172.17.2.41 172.17.2.100;
>         default-lease-time 1800;
>         max-lease-time 14400;
>         authoritative;
>         option routers 172.17.2.1;
>         option domain-name-servers 172.17.2.4,192.168.252.1 ;
>         option domain-name "i.home.ie";
>         option domain-search "i.home.ie";
>         option ntp-servers 193.1.219.116,193.1.31.66;
>         ddns-domainname "i.home.ie.";
>         ddns-rev-domainname "in-addr.arpa.";
>
>         host skynet09{
>                 hardware ethernet AC:CF:23:8D:10:60;
>                 fixed-address 172.17.2.39;
>                 ddns-hostname "skynet009";
>         }
> }

The first thing to note is that you have a host declaration within a subnet. Host declarations are always global in scope, but do have inheritance - this can cause some "interesting" effects if the client pops up on another subnet. So, while it's not directly relevant to the problem you are enquiring about - put your host declarations in the global scope and save yourself some pain later on ;-)



> Bind Logs of an Update
>
> named[1563]: client 172.17.2.4#28949: updating zone 'i.home.ie/IN': update unsuccessful: skynet001.i.home.ie: 'name not in use' prerequisite not satisfied (YXDOMAIN)
> named[1563]: client 172.17.2.4#28949: signer "sun-key" approved
> named[1563]: client 172.17.2.4#28949: updating zone 'i.home.ie/IN': deleting rrset at 'skynet001.i.home.ie' A
> named[1563]: client 172.17.2.4#28949: updating zone 'i.home.ie/IN': adding an RR at 'skynet001.i.home.ie' A
> named[1563]: client 172.17.2.4#28949: signer "sun-key" approved
>
> DHCP Logs for the same device
> dhcpd[6271]: DHCPREQUEST for 172.17.2.31 from ac:cf:23:8d:77:56 via eth0
> dhcpd[6271]: DHCPACK on 172.17.2.31 to ac:cf:23:8d:77:56 via eth0
> dhcpd[6271]: Added new forward map from skynet001.i.home.ie. to 172.17.2.31
> dhcpd[6271]: Added reverse map from 31.2.17.172.in-addr.arpa. to skynet001.i.home.ie.

OK, that's all normal.
But, I see 172.17.2.31 is not in the range (172.17.2.41 to 172.17.2.100) defined for dynamic clients, so I'm guessing that you have trimmed out a host declaration for skynet001 ? If so, then the answer is simple - DNS entries for these hosts are not automatically removed, because there is no mechanism to do so.

More detail on that.
When a host gets a lease from a static address assignment in a host declaration, there is no lease created by the server to go with it. Because it's a static assignment, there's no need to track it, and so there's a shortcut where from the client PoV it gets a lease, but the server doesn't bother recording it.
As there is no lease recorded by the server, there's nothing to expire, and so nothing to trigger removal of the corresponding DDNS entries.
Also, without the "update-static-leases on;" statement, you also would not get DNS updates on "lease" issue.

If you need DDNS updates to remove the entries, then you'll have to use "real" leases. You can get much the same effect by creating a "reserved" lease. You can do this (AIUI) on a running server via OMAPI, or after stopping the server you can do it by editing the leases file to add/edit a lease with the "Reserved" keyword.
A reserved lease acts just like any other dynamic lease (gets issued, renewed, expires, etc) except that it will never be re-assigned to another client.

_______________________________________________
dhcp-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/dhcp-users



--
Begin at the beginning,and go on till you come to the end: then stop.



--
Begin at the beginning,and go on till you come to the end: then stop.

_______________________________________________
dhcp-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/dhcp-users