I'm running bind9 as DNS server, and have one zone set up to allow dynamic updates (think of my private DynDNS). IP ranges of those "dynamic hosts" cannot be foreseen, let alone specific IPs. But I want those "dynamic hosts" to be allowed recursion – while "foreign hosts" should not be allowed.
Updates take place remotely via nsupdate
and a shared key.
Now my question: How can I automatically update the corresponding ACL whenever an IP update takes place?
The allow-recursion
keyword doesn't accept a "zone" as parameter. Performing actions as root via ssh
is unwanted (not the least because the machine wouldn't permit root-logins via SSH). Thus, a "configuration approach" is strongly favored.
PS: if there is a way to include hostnames (FQDN) in acl
clauses, that might provide a viable work-around.