bind9: rndc freeze: key redefined?

Question

I have this rnd.key file on my system:

key "rndc-key1" {
    algorithm hmac-md5;
    secret "xxxxxxxxxxxxxxx==";
};
key "rndc-key2" {
        algorithm hmac-md5;
        secret "yyyyyyyyyyy==";
};

Then I use them for different zones:

zone "somedomain1.com" {
    type master;
    file "/etc/bind/master/db.somedomain1.com";
    allow-update {
    key rndc-key1;
    };
};


zone "somedomain2.com" {
    type master;
    file "/etc/bind/master/db.somedomain2.com";
    allow-update {
    key rndc-key2;
    };
};

When I try to run "rndc freeze" then I get this error:

rndc: error: /etc/bind/rndc.key:5: 'key' redefined near 'key'
rndc: could not load rndc configuration

What does it mean? What is the problem here? Is it not possible to use different keys for different zones?

score 2 · Accepted Answer · answered Sep 17 '17 at 15:03

It appears that you have misunderstood the purpose of the rndc key.
Quite possibly this misunderstanding stems from reading one of many sloppily written tutorials that cuts corners by misusing an already existing key (the rndc key) created for one specific purpose in a wildly different context without even commenting on that misuse.

The rndc key is supposed to have ONE purpose, it is to be used by the rndc utility and named so that rndc can send control commands to named (eg rndc reload, rndc freeze or whatever).

This key is NOT supposed to be used for dynamic updates (as in allow-update).

There should NOT be multiple keys in the rndc.key file.

You are however free, encouraged if you will, to add any number of key statements for your TSIG keys to the named configuration (named.conf). These are what you are supposed to use for purposes such as dynamic updates, zone transfers, etc.
I would suggest that you name these keys something that reflects their usage.

If you have a modern version of BIND, simply use tsig-keygen foo to create a new key. It's both more convenient and has sensible defaults (hmac-sha256 rather than the hmac-md5 keys you have created).

There is no tsig-keygen command on my system. Bind version is 9. What should I do? Can I use dnssec-keygen instead? How? — nagylzs, Sep 18 '17 at 05:26
@nagylzs "version 9" doesn't actually say all that much, 9.0 was released in 2000 and BIND has obviously evolved between that version and the current 9.11 version. You could do eg `dnssec-keygen -a HMAC-SHA256 -b 256 -n USER foo` and piece together the resulting files into a `key` entry. — Håkan Lindqvist, Sep 18 '17 at 05:34

bind9: rndc freeze: key redefined?

1 Answers1