Bv9ARM.ch04.html revision 3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892
11e9368a226272085c337e9e74b79808c16fbdbaTinderbox User - Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
75c0816e8295e180f4bc7f10db3d0d880383bc1cMark Andrews - Copyright (C) 2000-2003 Internet Software Consortium.
4a14ce5ba00ab7bc55c99ffdcf59c7a4ab902721Automatic Updater - Permission to use, copy, modify, and/or distribute this software for any
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - purpose with or without fee is hereby granted, provided that the above
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - copyright notice and this permission notice appear in all copies.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - PERFORMANCE OF THIS SOFTWARE.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<!-- $Id: Bv9ARM.ch04.html,v 1.113 2010/08/17 01:15:30 tbox Exp $ -->
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<title>Chapter�4.�Advanced DNS Features</title>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User<link rel="prev" href="Bv9ARM.ch03.html" title="Chapter�3.�Name Server Configuration">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="next" href="Bv9ARM.ch05.html" title="Chapter�5.�The BIND 9 Lightweight Resolver">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User<table width="100%" summary="Navigation header">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<tr><th colspan="3" align="center">Chapter�4.�Advanced DNS Features</th></tr>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="Bv9ARM.ch03.html">Prev</a>�</td>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch05.html">Next</a>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<div class="titlepage"><div><div><h2 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="Bv9ARM.ch04"></a>Chapter�4.�Advanced DNS Features</h2></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect1"><a href="Bv9ARM.ch04.html#notify">Notify</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect1"><a href="Bv9ARM.ch04.html#dynamic_update">Dynamic Update</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#journal">The journal file</a></span></dt></dl></dd>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect1"><a href="Bv9ARM.ch04.html#incremental_zone_transfers">Incremental Zone Transfers (IXFR)</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2570825">Split DNS</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570843">Example split DNS setup</a></span></dt></dl></dd>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect1"><a href="Bv9ARM.ch04.html#tsig">TSIG</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571345">Generate Shared Keys for Each Pair of Hosts</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571555">Copying the Shared Secret to Both Machines</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571565">Informing the Servers of the Key's Existence</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571602">Instructing the Server to Use the Key</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571659">TSIG Key Based Access Control</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571708">Errors</a></span></dt>
9b3ef7211c28f97f5ecb507d2e2d474397238b44Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571722">TKEY</a></span></dt>
f9ce6280cec79deb16ff6d9807aa493ff23e10d9Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2563989">SIG(0)</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect1"><a href="Bv9ARM.ch04.html#DNSSEC">DNSSEC</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2564057">Generating Keys</a></span></dt>
46472a450e043434d78fa18edc73bca8c47f3981Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572192">Signing the Zone</a></span></dt>
46472a450e043434d78fa18edc73bca8c47f3981Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572273">Configuring Servers</a></span></dt>
46472a450e043434d78fa18edc73bca8c47f3981Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch04.html#dnssec.dynamic.zones">DNSSEC, Dynamic Zones, and Automatic Signing</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2606210">Converting from insecure to secure</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563512">Dynamic DNS update method</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563548">Fully automatic zone signing</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563835">Private-type records</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563873">DNSKEY rollovers</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563885">Dynamic DNS update method</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571837">Automatic key rollovers</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571864">NSEC3PARAM rollovers via UPDATE</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571874">Converting from NSEC to NSEC3</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571952">Converting from NSEC3 to NSEC</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571964">Converting from secure to insecure</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572002">Periodic re-signing</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572011">NSEC3 and OPTOUT</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect1"><a href="Bv9ARM.ch04.html#rfc5011.support">Dynamic Trust Anchor Management</a></span></dt>
6b7cba2b10d6cb5363d94b434b0d22ecfb33a6f3Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572065">Validating Resolver</a></span></dt>
6b7cba2b10d6cb5363d94b434b0d22ecfb33a6f3Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2605947">Authoritative Server</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch04.html#pkcs11">PKCS #11 (Cryptoki) support</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2608314">Prerequisites</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2606674">Building BIND 9 with PKCS#11</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2608475">PKCS #11 Tools</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2608506">Using the HSM</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2608978">Specifying the engine on the command line</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2609024">Running named with automatic zone re-signing</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2572468">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572734">Address Lookups Using AAAA Records</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572756">Address to Name Lookups Using Nibble Format</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h2 class="title" style="clear: both">
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <acronym class="acronym">DNS</acronym> NOTIFY is a mechanism that allows master
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt servers to notify their slave servers of changes to a zone's data. In
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt response to a <span><strong class="command">NOTIFY</strong></span> from a master server, the
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt slave will check to see that its version of the zone is the
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt current version and, if not, initiate a zone transfer.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User For more information about <acronym class="acronym">DNS</acronym>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">NOTIFY</strong></span>, see the description of the
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <span><strong class="command">notify</strong></span> option in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a> and
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt the description of the zone option <span><strong class="command">also-notify</strong></span> in
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>. The <span><strong class="command">NOTIFY</strong></span>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt protocol is specified in RFC 1996.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt As a slave zone can also be a master to other slaves, <span><strong class="command">named</strong></span>,
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt by default, sends <span><strong class="command">NOTIFY</strong></span> messages for every zone
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User it loads. Specifying <span><strong class="command">notify master-only;</strong></span> will
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User cause <span><strong class="command">named</strong></span> to only send <span><strong class="command">NOTIFY</strong></span> for master
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt zones that it loads.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h2 class="title" style="clear: both">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="dynamic_update"></a>Dynamic Update</h2></div></div></div>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Dynamic Update is a method for adding, replacing or deleting
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User records in a master server by sending it a special form of DNS
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt messages. The format and meaning of these messages is specified
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt in RFC 2136.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Dynamic update is enabled by including an
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">allow-update</strong></span> or an <span><strong class="command">update-policy</strong></span>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User clause in the <span><strong class="command">zone</strong></span> statement.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt If the zone's <span><strong class="command">update-policy</strong></span> is set to
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <strong class="userinput"><code>local</code></strong>, updates to the zone
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt will be permitted for the key <code class="varname">local-ddns</code>,
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User which will be generated by <span><strong class="command">named</strong></span> at startup.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt See <a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a> for more details.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The <span><strong class="command">tkey-gssapi-credential</strong></span> and
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">tkey-domain</strong></span> clauses in the
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <span><strong class="command">options</strong></span> statement enable the
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User server to negotiate keys that can be matched against those
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt in <span><strong class="command">update-policy</strong></span> or
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">allow-update</strong></span>.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Updating of secure zones (zones using DNSSEC) follows RFC
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt 3007: RRSIG, NSEC and NSEC3 records affected by updates are
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt automatically regenerated by the server using an online
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt zone key. Update authorization is based on transaction
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt signatures and an explicit server policy.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<div class="titlepage"><div><div><h3 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="journal"></a>The journal file</h3></div></div></div>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User All changes made to a zone using dynamic update are stored
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt in the zone's journal file. This file is automatically created
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt by the server when the first dynamic update takes place.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The name of the journal file is formed by appending the extension
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <code class="filename">.jnl</code> to the name of the
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt corresponding zone
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt file unless specifically overridden. The journal file is in a
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt binary format and should not be edited manually.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User The server will also occasionally write ("dump")
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User the complete contents of the updated zone to its zone file.
3241ddcf9354c5ab50f4df5a656e72a5c68e172bTinderbox User This is not done immediately after
3241ddcf9354c5ab50f4df5a656e72a5c68e172bTinderbox User each dynamic update, because that would be too slow when a large
3241ddcf9354c5ab50f4df5a656e72a5c68e172bTinderbox User zone is updated frequently. Instead, the dump is delayed by
3241ddcf9354c5ab50f4df5a656e72a5c68e172bTinderbox User up to 15 minutes, allowing additional updates to take place.
3241ddcf9354c5ab50f4df5a656e72a5c68e172bTinderbox User During the dump process, transient files will be created
3241ddcf9354c5ab50f4df5a656e72a5c68e172bTinderbox User with the extensions <code class="filename">.jnw</code> and
3241ddcf9354c5ab50f4df5a656e72a5c68e172bTinderbox User <code class="filename">.jbk</code>; under ordinary circumstances, these
3241ddcf9354c5ab50f4df5a656e72a5c68e172bTinderbox User will be removed when the dump is complete, and can be safely
3241ddcf9354c5ab50f4df5a656e72a5c68e172bTinderbox User When a server is restarted after a shutdown or crash, it will replay
3241ddcf9354c5ab50f4df5a656e72a5c68e172bTinderbox User the journal file to incorporate into the zone any updates that
3241ddcf9354c5ab50f4df5a656e72a5c68e172bTinderbox User place after the last zone dump.
3241ddcf9354c5ab50f4df5a656e72a5c68e172bTinderbox User Changes that result from incoming incremental zone transfers are
3241ddcf9354c5ab50f4df5a656e72a5c68e172bTinderbox User journalled in a similar way.
3241ddcf9354c5ab50f4df5a656e72a5c68e172bTinderbox User The zone files of dynamic zones cannot normally be edited by
3241ddcf9354c5ab50f4df5a656e72a5c68e172bTinderbox User hand because they are not guaranteed to contain the most recent
3241ddcf9354c5ab50f4df5a656e72a5c68e172bTinderbox User dynamic changes — those are only in the journal file.
3241ddcf9354c5ab50f4df5a656e72a5c68e172bTinderbox User The only way to ensure that the zone file of a dynamic zone
3241ddcf9354c5ab50f4df5a656e72a5c68e172bTinderbox User is up to date is to run <span><strong class="command">rndc stop</strong></span>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt If you have to make changes to a dynamic zone
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt manually, the following procedure will work: Disable dynamic updates
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt to the zone using
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">rndc freeze <em class="replaceable"><code>zone</code></em></strong></span>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt This will also remove the zone's <code class="filename">.jnl</code> file
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt and update the master file. Edit the zone file. Run
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">rndc thaw <em class="replaceable"><code>zone</code></em></strong></span>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User to reload the changed zone and re-enable dynamic updates.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h2 class="title" style="clear: both">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="incremental_zone_transfers"></a>Incremental Zone Transfers (IXFR)</h2></div></div></div>
e2b184f84e846bbcb764b6f0aef5dcd583d3d7a1Tinderbox User The incremental zone transfer (IXFR) protocol is a way for
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt slave servers to transfer only changed data, instead of having to
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User transfer the entire zone. The IXFR protocol is specified in RFC
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User 1995. See <a href="Bv9ARM.ch09.html#proposed_standards">Proposed Standards</a>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt When acting as a master, <acronym class="acronym">BIND</acronym> 9
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt supports IXFR for those zones
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt where the necessary change history information is available. These
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt include master zones maintained by dynamic update and slave zones
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt whose data was obtained by IXFR. For manually maintained master
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt zones, and for slave zones obtained by performing a full zone
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt transfer (AXFR), IXFR is supported only if the option
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">ixfr-from-differences</strong></span> is set
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt to <strong class="userinput"><code>yes</code></strong>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt When acting as a slave, <acronym class="acronym">BIND</acronym> 9 will
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt attempt to use IXFR unless
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt it is explicitly disabled. For more information about disabling
6b7cba2b10d6cb5363d94b434b0d22ecfb33a6f3Tinderbox User IXFR, see the description of the <span><strong class="command">request-ixfr</strong></span> clause
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt of the <span><strong class="command">server</strong></span> statement.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h2 class="title" style="clear: both">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="id2570825"></a>Split DNS</h2></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Setting up different views, or visibility, of the DNS space to
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User internal and external resolvers is usually referred to as a
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <span class="emphasis"><em>Split DNS</em></span> setup. There are several
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt reasons an organization would want to set up its DNS this way.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt One common reason for setting up a DNS system this way is
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User to hide "internal" DNS information from "external" clients on the
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Internet. There is some debate as to whether or not this is actually
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Internal DNS information leaks out in many ways (via email headers,
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User for example) and most savvy "attackers" can find the information
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User they need using other means.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt However, since listing addresses of internal servers that
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt external clients cannot possibly reach can result in
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User connection delays and other annoyances, an organization may
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User choose to use a Split DNS to present a consistent view of itself
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt to the outside world.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Another common reason for setting up a Split DNS system is
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt to allow internal networks that are behind filters or in RFC 1918
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt space (reserved IP space, as documented in RFC 1918) to resolve DNS
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User on the Internet. Split DNS can also be used to allow mail from outside
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User back in to the internal network.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h3 class="title">
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<a name="id2570843"></a>Example split DNS setup</h3></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Let's say a company named <span class="emphasis"><em>Example, Inc.</em></span>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User has several corporate sites that have an internal network with
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Internet Protocol (IP) space and an external demilitarized zone (DMZ),
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt or "outside" section of a network, that is available to the public.
0226754d9e537fd56b690d5890cfe215a6c59f89Tinderbox User <span class="emphasis"><em>Example, Inc.</em></span> wants its internal clients
0226754d9e537fd56b690d5890cfe215a6c59f89Tinderbox User to be able to resolve external hostnames and to exchange mail with
0226754d9e537fd56b690d5890cfe215a6c59f89Tinderbox User people on the outside. The company also wants its internal resolvers
0226754d9e537fd56b690d5890cfe215a6c59f89Tinderbox User to have access to certain internal-only zones that are not available
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User at all outside of the internal network.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt In order to accomplish this, the company will set up two sets
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User of name servers. One set will be on the inside network (in the
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt IP space) and the other set will be on bastion hosts, which are
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User hosts that can talk to both sides of its network, in the DMZ.
6b7cba2b10d6cb5363d94b434b0d22ecfb33a6f3Tinderbox User The internal servers will be configured to forward all queries,
6b7cba2b10d6cb5363d94b434b0d22ecfb33a6f3Tinderbox User except queries for <code class="filename">site1.internal</code>, <code class="filename">site2.internal</code>, <code class="filename">site1.example.com</code>,
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User and <code class="filename">site2.example.com</code>, to the servers
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt DMZ. These internal servers will have complete sets of information
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt for <code class="filename">site1.example.com</code>, <code class="filename">site2.example.com</code>, <code class="filename">site1.internal</code>,
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt To protect the <code class="filename">site1.internal</code> and <code class="filename">site2.internal</code> domains,
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt the internal name servers must be configured to disallow all queries
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User to these domains from any external hosts, including the bastion
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The external servers, which are on the bastion hosts, will
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt be configured to serve the "public" version of the <code class="filename">site1</code> and <code class="filename">site2.example.com</code> zones.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt This could include things such as the host records for public servers
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User (<code class="filename">www.example.com</code> and <code class="filename">ftp.example.com</code>),
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User and mail exchange (MX) records (<code class="filename">a.mx.example.com</code> and <code class="filename">b.mx.example.com</code>).
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User In addition, the public <code class="filename">site1</code> and <code class="filename">site2.example.com</code> zones
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User should have special MX records that contain wildcard (`*') records
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt pointing to the bastion hosts. This is needed because external mail
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt servers do not have any other way of looking up how to deliver mail
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User to those internal hosts. With the wildcard records, the mail will
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User be delivered to the bastion host, which can then forward it on to
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt internal hosts.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Here's an example of a wildcard MX record:
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<pre class="programlisting">* IN MX 10 external1.example.com.</pre>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Now that they accept mail on behalf of anything in the internal
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt network, the bastion hosts will need to know how to deliver mail
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt to internal hosts. In order for this to work properly, the resolvers
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User the bastion hosts will need to be configured to point to the internal
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User name servers for DNS resolution.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Queries for internal hostnames will be answered by the internal
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt servers, and queries for external hostnames will be forwarded back
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt out to the DNS servers on the bastion hosts.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User In order for all this to work properly, internal clients will
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User need to be configured to query <span class="emphasis"><em>only</em></span> the internal
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt name servers for DNS queries. This could also be enforced via
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User filtering on the network.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt If everything has been set properly, <span class="emphasis"><em>Example, Inc.</em></span>'s
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User internal clients will now be able to:
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Look up any hostnames in the <code class="literal">site1</code>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <code class="literal">site2.example.com</code> zones.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Look up any hostnames in the <code class="literal">site1.internal</code> and
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <code class="literal">site2.internal</code> domains.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<li>Exchange mail with both internal and external people.</li>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Hosts on the Internet will be able to:
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Look up any hostnames in the <code class="literal">site1</code>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <code class="literal">site2.example.com</code> zones.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Exchange mail with anyone in the <code class="literal">site1</code> and
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <code class="literal">site2.example.com</code> zones.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Here is an example configuration for the setup we just
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt described above. Note that this is only configuration information;
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt for information on how to configure your zone files, see <a href="Bv9ARM.ch03.html#sample_configuration" title="Sample Configurations">the section called “Sample Configurations”</a>.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Internal DNS server config:
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox Useracl externals { <code class="varname">bastion-ips-go-here</code>; };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt forward only;
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt // forward to external servers
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt forwarders {
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt // sample allow-transfer (no one)
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User allow-transfer { none; };
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User // restrict query access
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt allow-query { internals; externals; };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt // restrict recursion
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User allow-recursion { internals; };
e62b9c9ce6413fb183c8116381e75dcd07ca5517Tinderbox User// sample master zone
6b7cba2b10d6cb5363d94b434b0d22ecfb33a6f3Tinderbox User // do normal iterative resolution (do not forward)
6b7cba2b10d6cb5363d94b434b0d22ecfb33a6f3Tinderbox User forwarders { };
d7a61cfbe56ebfa1682e949e48b4d08840234d8fTinderbox User allow-query { internals; externals; };
6b7cba2b10d6cb5363d94b434b0d22ecfb33a6f3Tinderbox User allow-transfer { internals; };
6b7cba2b10d6cb5363d94b434b0d22ecfb33a6f3Tinderbox User// sample slave zone
6b7cba2b10d6cb5363d94b434b0d22ecfb33a6f3Tinderbox User masters { 172.16.72.3; };
6b7cba2b10d6cb5363d94b434b0d22ecfb33a6f3Tinderbox User forwarders { };
6b7cba2b10d6cb5363d94b434b0d22ecfb33a6f3Tinderbox User allow-query { internals; externals; };
6b7cba2b10d6cb5363d94b434b0d22ecfb33a6f3Tinderbox User allow-transfer { internals; };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt forwarders { };
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User allow-query { internals; };
006283c42350464bc285c4481bce0a3b5a3dd8d0Tinderbox User allow-transfer { internals; }
006283c42350464bc285c4481bce0a3b5a3dd8d0Tinderbox User masters { 172.16.72.3; };
6758b59e57af88bdf466e63c0856043df44f8dd0Tinderbox User forwarders { };
6758b59e57af88bdf466e63c0856043df44f8dd0Tinderbox User allow-query { internals };
6758b59e57af88bdf466e63c0856043df44f8dd0Tinderbox User allow-transfer { internals; }
6b7cba2b10d6cb5363d94b434b0d22ecfb33a6f3Tinderbox User External (bastion host) DNS server config:
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox Useracl internals { 172.16.72.0/24; 192.168.1.0/24; };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Huntacl externals { bastion-ips-go-here; };
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User // sample allow-transfer (no one)
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User allow-transfer { none; };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt // default query access
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt allow-query { any; };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt // restrict cache access
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User allow-query-cache { internals; externals; };
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User // restrict recursion
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt allow-recursion { internals; externals; };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt// sample slave zone
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt type master;
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User allow-transfer { internals; externals; };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt masters { another_bastion_host_maybe; };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt allow-transfer { internals; externals; }
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User In the <code class="filename">resolv.conf</code> (or equivalent) on
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt the bastion host(s):
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Huntnameserver 172.16.72.2
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Huntnameserver 172.16.72.3
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Huntnameserver 172.16.72.4
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h2 class="title" style="clear: both">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt This is a short guide to setting up Transaction SIGnatures
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User (TSIG) based transaction security in <acronym class="acronym">BIND</acronym>. It describes changes
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User to the configuration file as well as what changes are required for
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt different features, including the process of creating transaction
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt keys and using transaction signatures with <acronym class="acronym">BIND</acronym>.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <acronym class="acronym">BIND</acronym> primarily supports TSIG for server
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User to server communication.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt This includes zone transfer, notify, and recursive query messages.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Resolvers based on newer versions of <acronym class="acronym">BIND</acronym> 8 have limited support
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt TSIG can also be useful for dynamic update. A primary
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt server for a dynamic zone should control access to the dynamic
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt update service, but IP-based access control is insufficient.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The cryptographic access control provided by TSIG
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt is far superior. The <span><strong class="command">nsupdate</strong></span>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User program supports TSIG via the <code class="option">-k</code> and
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <code class="option">-y</code> command line options or inline by use
e285c11870c6263cd79b418e104c7eb3e2d96952Tinderbox User of the <span><strong class="command">key</strong></span>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h3 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="id2571345"></a>Generate Shared Keys for Each Pair of Hosts</h3></div></div></div>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User A shared secret is generated to be shared between <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host2</em></span>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt An arbitrary key name is chosen: "host1-host2.". The key name must
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt be the same on both hosts.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h4 class="title">
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<a name="id2571362"></a>Automatic Generation</h4></div></div></div>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User The following command will generate a 128-bit (16 byte) HMAC-SHA256
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt key as described above. Longer keys are better, but shorter keys
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt are easier to read. Note that the maximum key length is the digest
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt length, here 256 bits.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <strong class="userinput"><code>dnssec-keygen -a hmac-sha256 -b 128 -n HOST host1-host2.</code></strong>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The key is in the file <code class="filename">Khost1-host2.+163+00000.private</code>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Nothing directly uses this file, but the base-64 encoded string
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User following "<code class="literal">Key:</code>"
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User can be extracted from the file and used as a shared secret:
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<pre class="programlisting">Key: La/E5CjG9O+os1jq0a2jdA==</pre>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The string "<code class="literal">La/E5CjG9O+os1jq0a2jdA==</code>" can
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt be used as the shared secret.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h4 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="id2571537"></a>Manual Generation</h4></div></div></div>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User The shared secret is simply a random sequence of bits, encoded
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User in base-64. Most ASCII strings are valid base-64 strings (assuming
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt the length is a multiple of 4 and only valid characters are used),
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt so the shared secret can be manually generated.
f33abec8a62ab6f2b867d7189dfffa72592c027bTinderbox User Also, a known string can be run through <span><strong class="command">mmencode</strong></span> or
f33abec8a62ab6f2b867d7189dfffa72592c027bTinderbox User a similar program to generate base-64 encoded data.
f33abec8a62ab6f2b867d7189dfffa72592c027bTinderbox User<div class="titlepage"><div><div><h3 class="title">
f33abec8a62ab6f2b867d7189dfffa72592c027bTinderbox User<a name="id2571555"></a>Copying the Shared Secret to Both Machines</h3></div></div></div>
f33abec8a62ab6f2b867d7189dfffa72592c027bTinderbox User This is beyond the scope of DNS. A secure transport mechanism
f33abec8a62ab6f2b867d7189dfffa72592c027bTinderbox User should be used. This could be secure FTP, ssh, telephone, etc.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h3 class="title">
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<a name="id2571565"></a>Informing the Servers of the Key's Existence</h3></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Imagine <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host 2</em></span>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User both servers. The following is added to each server's <code class="filename">named.conf</code> file:
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Huntkey host1-host2. {
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt algorithm hmac-sha256;
a179cbdf652095d00e7774320592f25eab0210d8Tinderbox User The secret is the one generated above. Since this is a secret, it
f33abec8a62ab6f2b867d7189dfffa72592c027bTinderbox User is recommended that either <code class="filename">named.conf</code> be
f33abec8a62ab6f2b867d7189dfffa72592c027bTinderbox User non-world readable, or the key directive be added to a non-world
6b7cba2b10d6cb5363d94b434b0d22ecfb33a6f3Tinderbox User readable file that is included by <code class="filename">named.conf</code>.
f33abec8a62ab6f2b867d7189dfffa72592c027bTinderbox User At this point, the key is recognized. This means that if the
f33abec8a62ab6f2b867d7189dfffa72592c027bTinderbox User server receives a message signed by this key, it can verify the
f33abec8a62ab6f2b867d7189dfffa72592c027bTinderbox User signature. If the signature is successfully verified, the
f33abec8a62ab6f2b867d7189dfffa72592c027bTinderbox User response is signed by the same key.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<div class="titlepage"><div><div><h3 class="title">
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<a name="id2571602"></a>Instructing the Server to Use the Key</h3></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Since keys are shared between two hosts only, the server must
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User be told when keys are to be used. The following is added to the <code class="filename">named.conf</code> file
46472a450e043434d78fa18edc73bca8c47f3981Tinderbox User for <span class="emphasis"><em>host1</em></span>, if the IP address of <span class="emphasis"><em>host2</em></span> is
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Huntserver 10.1.2.3 {
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt keys { host1-host2. ;};
221870ba7bf08daf55db5a69a4de4bbdc4f2a93cTinderbox User Multiple keys may be present, but only the first is used.
221870ba7bf08daf55db5a69a4de4bbdc4f2a93cTinderbox User This directive does not contain any secrets, so it may be in a
221870ba7bf08daf55db5a69a4de4bbdc4f2a93cTinderbox User world-readable
221870ba7bf08daf55db5a69a4de4bbdc4f2a93cTinderbox User If <span class="emphasis"><em>host1</em></span> sends a message that is a request
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User to that address, the message will be signed with the specified key. <span class="emphasis"><em>host1</em></span> will
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User expect any responses to signed messages to be signed with the same
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt A similar statement must be present in <span class="emphasis"><em>host2</em></span>'s
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt configuration file (with <span class="emphasis"><em>host1</em></span>'s address) for <span class="emphasis"><em>host2</em></span> to
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User sign request messages to <span class="emphasis"><em>host1</em></span>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h3 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="id2571659"></a>TSIG Key Based Access Control</h3></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <acronym class="acronym">BIND</acronym> allows IP addresses and ranges
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt to be specified in ACL
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt definitions and
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <span><strong class="command">allow-{ query | transfer | update }</strong></span>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt This has been extended to allow TSIG keys also. The above key would
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User be denoted <span><strong class="command">key host1-host2.</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein An example of an <span><strong class="command">allow-update</strong></span> directive would be:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinallow-update { key host1-host2. ;};
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews This allows dynamic updates to succeed only if the request
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews was signed by a key named "<span><strong class="command">host1-host2.</strong></span>".
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein See <a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a> for a discussion of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the more flexible <span><strong class="command">update-policy</strong></span> statement.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="id2571708"></a>Errors</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The processing of TSIG signed messages can result in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein several errors. If a signed message is sent to a non-TSIG aware
that the tools shipped with BIND 9.2.x and earlier are not compatible
<strong class="userinput"><code>dnssec-keygen -a RSASHA1 -b 768 -n ZONE child.example.</code></strong>
example.com. 257 3 5 "AwEAAaxPMcR2x0HbQV4WeZB6oEDX+r0QM6
<a name="dnssec.dynamic.zones"></a>DNSSEC, Dynamic Zones, and Automatic Signing</h2></div></div></div>
zone example.net {
> update add example.net DNSKEY 256 3 7 AwEAAZn17pUF0KpbPA2c7Gz76Vb18v0teKT3EyAGfBfL8eQ8al35zz3Y I1m/SAQBxIqMfLtIwqWPdgthsu36azGQAX8=
> update add example.net DNSKEY 257 3 7 AwEAAd/7odU/64o2LGsifbLtQmtO8dFDtTAZXSX2+X3e/UNlq9IHq3Y0 XtC0Iuawl/qkaKVxXe2lo8Ct+dM6UehyCqk=
> update add example.net DNSKEY 256 3 7 AwEAAZn17pUF0KpbPA2c7Gz76Vb18v0teKT3EyAGfBfL8eQ8al35zz3Y I1m/SAQBxIqMfLtIwqWPdgthsu36azGQAX8=
> update add example.net DNSKEY 257 3 7 AwEAAd/7odU/64o2LGsifbLtQmtO8dFDtTAZXSX2+X3e/UNlq9IHq3Y0 XtC0Iuawl/qkaKVxXe2lo8Ct+dM6UehyCqk=
> update add example.net NSEC3PARAM 1 1 100 1234567890
(See <a href="man.dnssec-keygen.html" title="dnssec-keygen"><span class="refentrytitle"><span class="application">dnssec-keygen</span></span>(8)</a> and
<a href="man.dnssec-settime.html" title="dnssec-settime"><span class="refentrytitle"><span class="application">dnssec-settime</span></span>(8)</a> for more information.)
<span><strong class="command">rndc sign</strong></span> or <span><strong class="command">rndc loadkeys</strong></span>
<span><strong class="command">dnssec-keygen</strong></span> or <span><strong class="command">dnssec-settime</strong></span>),
and Usage">the section called “<span><strong class="command">managed-keys</strong></span> Statement Definition
$ <strong class="userinput"><code>dnssec-keygen -K keys -f KSK -P now -A now+2y example.net</code></strong>
$ <strong class="userinput"><code>wget <a href="" target="_top">http://www.openssl.org/source/openssl-0.9.8l.tar.gz</a></code></strong>
$ <strong class="userinput"><code>cp pkcs11.GCC4.0.2.so.4.05 /opt/pkcs11/usr/lib/libpkcs11.so</code></strong>
and "<span><strong class="command">make test</strong></span>". If "<span><strong class="command">make
$ <strong class="userinput"><code>export LD_LIBRARY_PATH=/opt/pkcs11/usr/lib:${LD_LIBRARY_PATH}</code></strong>
$ <strong class="userinput"><code>export KEYPER_LIBRARY_PATH=/opt/Keyper/PKCS11Provider</code></strong>
$ <strong class="userinput"><code>dnssec-keyfromlabel -l sample-ksk -f KSK example.net</code></strong>
by placing the PIN into the openssl.cnf file (in the above
<a name="id2572468"></a>IPv6 Support in <acronym class="acronym">BIND</acronym> 9</h2></div></div></div>
see <a href="Bv9ARM.ch09.html#ipv6addresses" title="IPv6 addresses (AAAA)">the section called “IPv6 addresses (AAAA)”</a>.
$ORIGIN example.com.