Bv9ARM.ch04.html revision 47012ae6dbf18a2503d7b33c1c9583dc38625cb7
11e9368a226272085c337e9e74b79808c16fbdbaTinderbox User - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
75c0816e8295e180f4bc7f10db3d0d880383bc1cMark Andrews - Copyright (C) 2000-2003 Internet Software Consortium.
4a14ce5ba00ab7bc55c99ffdcf59c7a4ab902721Automatic Updater - Permission to use, copy, modify, and distribute this software for any
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - purpose with or without fee is hereby granted, provided that the above
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - copyright notice and this permission notice appear in all copies.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - PERFORMANCE OF THIS SOFTWARE.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<!-- $Id: Bv9ARM.ch04.html,v 1.67 2006/05/17 02:39:16 marka Exp $ -->
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<title>Chapter�4.�Advanced DNS Features</title>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User<link rel="prev" href="Bv9ARM.ch03.html" title="Chapter�3.�Name Server Configuration">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="next" href="Bv9ARM.ch05.html" title="Chapter�5.�The BIND 9 Lightweight Resolver">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User<table width="100%" summary="Navigation header">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<tr><th colspan="3" align="center">Chapter�4.�Advanced DNS Features</th></tr>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="Bv9ARM.ch03.html">Prev</a>�</td>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch05.html">Next</a>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<div class="titlepage"><div><div><h2 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="Bv9ARM.ch04"></a>Chapter�4.�Advanced DNS Features</h2></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect1"><a href="Bv9ARM.ch04.html#notify">Notify</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect1"><a href="Bv9ARM.ch04.html#dynamic_update">Dynamic Update</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#journal">The journal file</a></span></dt></dl></dd>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect1"><a href="Bv9ARM.ch04.html#incremental_zone_transfers">Incremental Zone Transfers (IXFR)</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2551297">Split DNS</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect1"><a href="Bv9ARM.ch04.html#tsig">TSIG</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2551816">Generate Shared Keys for Each Pair of Hosts</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2551890">Copying the Shared Secret to Both Machines</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2551900">Informing the Servers of the Key's Existence</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2551940">Instructing the Server to Use the Key</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2551997">TSIG Key Based Access Control</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2552042">Errors</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2552056">TKEY</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2552173">SIG(0)</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect1"><a href="Bv9ARM.ch04.html#DNSSEC">DNSSEC</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2552310">Generating Keys</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2552448">Signing the Zone</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2552595">Configuring Servers</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2552669">IPv6 Support in <span class="acronym">BIND</span> 9</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2552800">Address Lookups Using AAAA Records</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2552821">Address to Name Lookups Using Nibble Format</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h2 class="title" style="clear: both">
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <span class="acronym">DNS</span> NOTIFY is a mechanism that allows master
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User servers to notify their slave servers of changes to a zone's data. In
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt response to a <span><strong class="command">NOTIFY</strong></span> from a master server, the
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt slave will check to see that its version of the zone is the
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User current version and, if not, initiate a zone transfer.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt For more information about <span class="acronym">DNS</span>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">NOTIFY</strong></span>, see the description of the
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <span><strong class="command">notify</strong></span> option in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a> and
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt the description of the zone option <span><strong class="command">also-notify</strong></span> in
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>. The <span><strong class="command">NOTIFY</strong></span>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt protocol is specified in RFC 1996.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt As a slave zone can also be a master to other slaves, named,
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt by default, sends <span><strong class="command">NOTIFY</strong></span> messages for every zone
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt it loads. Specifying <span><strong class="command">notify master-only;</strong></span> will
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User cause named to only send <span><strong class="command">NOTIFY</strong></span> for master
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt zones that it loads.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h2 class="title" style="clear: both">
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<a name="dynamic_update"></a>Dynamic Update</h2></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Dynamic Update is a method for adding, replacing or deleting
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt records in a master server by sending it a special form of DNS
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User messages. The format and meaning of these messages is specified
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt in RFC 2136.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Dynamic update is enabled by
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt including an <span><strong class="command">allow-update</strong></span> or
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">update-policy</strong></span> clause in the
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <span><strong class="command">zone</strong></span> statement.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Updating of secure zones (zones using DNSSEC) follows
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User RFC 3007: RRSIG and NSEC records affected by updates are automatically
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt regenerated by the server using an online zone key.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Update authorization is based
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt on transaction signatures and an explicit server policy.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h3 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="journal"></a>The journal file</h3></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt All changes made to a zone using dynamic update are stored
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt in the zone's journal file. This file is automatically created
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt by the server when the first dynamic update takes place.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The name of the journal file is formed by appending the extension
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <code class="filename">.jnl</code> to the name of the
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt corresponding zone
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User file unless specifically overridden. The journal file is in a
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt binary format and should not be edited manually.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User The server will also occasionally write ("dump")
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt the complete contents of the updated zone to its zone file.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User This is not done immediately after
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt each dynamic update, because that would be too slow when a large
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt zone is updated frequently. Instead, the dump is delayed by
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt up to 15 minutes, allowing additional updates to take place.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt When a server is restarted after a shutdown or crash, it will replay
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt the journal file to incorporate into the zone any updates that
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt place after the last zone dump.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Changes that result from incoming incremental zone transfers are
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt journalled in a similar way.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The zone files of dynamic zones cannot normally be edited by
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt hand because they are not guaranteed to contain the most recent
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User dynamic changes - those are only in the journal file.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The only way to ensure that the zone file of a dynamic zone
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User is up to date is to run <span><strong class="command">rndc stop</strong></span>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt If you have to make changes to a dynamic zone
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt manually, the following procedure will work: Disable dynamic updates
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt to the zone using
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">rndc freeze <em class="replaceable"><code>zone</code></em></strong></span>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt This will also remove the zone's <code class="filename">.jnl</code> file
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User and update the master file. Edit the zone file. Run
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">rndc thaw <em class="replaceable"><code>zone</code></em></strong></span>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt to reload the changed zone and re-enable dynamic updates.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<div class="titlepage"><div><div><h2 class="title" style="clear: both">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="incremental_zone_transfers"></a>Incremental Zone Transfers (IXFR)</h2></div></div></div>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User The incremental zone transfer (IXFR) protocol is a way for
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt slave servers to transfer only changed data, instead of having to
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt transfer the entire zone. The IXFR protocol is specified in RFC
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User 1995. See <a href="Bv9ARM.ch09.html#proposed_standards">Proposed Standards</a>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt When acting as a master, <span class="acronym">BIND</span> 9
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt supports IXFR for those zones
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt where the necessary change history information is available. These
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt include master zones maintained by dynamic update and slave zones
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt whose data was obtained by IXFR. For manually maintained master
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User zones, and for slave zones obtained by performing a full zone
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt transfer (AXFR), IXFR is supported only if the option
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">ixfr-from-differences</strong></span> is set
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt to <strong class="userinput"><code>yes</code></strong>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt When acting as a slave, <span class="acronym">BIND</span> 9 will
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt attempt to use IXFR unless
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User it is explicitly disabled. For more information about disabling
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt IXFR, see the description of the <span><strong class="command">request-ixfr</strong></span> clause
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt of the <span><strong class="command">server</strong></span> statement.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h2 class="title" style="clear: both">
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<a name="id2551297"></a>Split DNS</h2></div></div></div>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Setting up different views, or visibility, of the DNS space to
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt internal and external resolvers is usually referred to as a
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span class="emphasis"><em>Split DNS</em></span> setup. There are several
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt reasons an organization would want to set up its DNS this way.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt One common reason for setting up a DNS system this way is
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt to hide "internal" DNS information from "external" clients on the
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Internet. There is some debate as to whether or not this is actually
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Internal DNS information leaks out in many ways (via email headers,
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt for example) and most savvy "attackers" can find the information
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt they need using other means.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt However, since listing addresses of internal servers that
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt external clients cannot possibly reach can result in
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt connection delays and other annoyances, an organization may
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt choose to use a Split DNS to present a consistant view of itself
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt to the outside world.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Another common reason for setting up a Split DNS system is
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt to allow internal networks that are behind filters or in RFC 1918
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt space (reserved IP space, as documented in RFC 1918) to resolve DNS
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt on the Internet. Split DNS can also be used to allow mail from outside
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User back in to the internal network.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Here is an example of a split DNS setup:
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Let's say a company named <span class="emphasis"><em>Example, Inc.</em></span>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User has several corporate sites that have an internal network with
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Internet Protocol (IP) space and an external demilitarized zone (DMZ),
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt or "outside" section of a network, that is available to the public.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <span class="emphasis"><em>Example, Inc.</em></span> wants its internal clients
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt to be able to resolve external hostnames and to exchange mail with
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt people on the outside. The company also wants its internal resolvers
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt to have access to certain internal-only zones that are not available
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt at all outside of the internal network.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt In order to accomplish this, the company will set up two sets
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt of name servers. One set will be on the inside network (in the
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt IP space) and the other set will be on bastion hosts, which are
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt hosts that can talk to both sides of its network, in the DMZ.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User The internal servers will be configured to forward all queries,
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User except queries for <code class="filename">site1.internal</code>, <code class="filename">site2.internal</code>, <code class="filename">site1.example.com</code>,
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt and <code class="filename">site2.example.com</code>, to the servers
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt DMZ. These internal servers will have complete sets of information
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt for <code class="filename">site1.example.com</code>, <code class="filename">site2.example.com</code>,<span class="emphasis"><em></em></span> <code class="filename">site1.internal</code>,
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User To protect the <code class="filename">site1.internal</code> and <code class="filename">site2.internal</code> domains,
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt the internal name servers must be configured to disallow all queries
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User to these domains from any external hosts, including the bastion
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The external servers, which are on the bastion hosts, will
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt be configured to serve the "public" version of the <code class="filename">site1</code> and <code class="filename">site2.example.com</code> zones.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt This could include things such as the host records for public servers
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt (<code class="filename">www.example.com</code> and <code class="filename">ftp.example.com</code>),
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt and mail exchange (MX) records (<code class="filename">a.mx.example.com</code> and <code class="filename">b.mx.example.com</code>).
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User In addition, the public <code class="filename">site1</code> and <code class="filename">site2.example.com</code> zones
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt should have special MX records that contain wildcard (`*') records
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt pointing to the bastion hosts. This is needed because external mail
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt servers do not have any other way of looking up how to deliver mail
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt to those internal hosts. With the wildcard records, the mail will
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt be delivered to the bastion host, which can then forward it on to
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt internal hosts.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Here's an example of a wildcard MX record:
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<pre class="programlisting">* IN MX 10 external1.example.com.</pre>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Now that they accept mail on behalf of anything in the internal
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt network, the bastion hosts will need to know how to deliver mail
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt to internal hosts. In order for this to work properly, the resolvers
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt the bastion hosts will need to be configured to point to the internal
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt name servers for DNS resolution.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Queries for internal hostnames will be answered by the internal
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User servers, and queries for external hostnames will be forwarded back
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User out to the DNS servers on the bastion hosts.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt In order for all this to work properly, internal clients will
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt need to be configured to query <span class="emphasis"><em>only</em></span> the internal
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt name servers for DNS queries. This could also be enforced via
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User filtering on the network.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt If everything has been set properly, <span class="emphasis"><em>Example, Inc.</em></span>'s
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt internal clients will now be able to:
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Look up any hostnames in the <code class="literal">site1</code>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <code class="literal">site2.example.com</code> zones.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Look up any hostnames in the <code class="literal">site1.internal</code> and
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <code class="literal">site2.internal</code> domains.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<li>Look up any hostnames on the Internet.</li>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<li>Exchange mail with internal AND external people.</li>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Hosts on the Internet will be able to:
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Look up any hostnames in the <code class="literal">site1</code>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <code class="literal">site2.example.com</code> zones.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Exchange mail with anyone in the <code class="literal">site1</code> and
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <code class="literal">site2.example.com</code> zones.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Here is an example configuration for the setup we just
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt described above. Note that this is only configuration information;
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt for information on how to configure your zone files, see <a href="Bv9ARM.ch03.html#sample_configuration" title="Sample Configurations">the section called “Sample Configurations”</a>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Internal DNS server config:
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox Useracl internals { 172.16.72.0/24; 192.168.1.0/24; };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Huntacl externals { <code class="varname">bastion-ips-go-here</code>; };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt forward only;
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User forwarders { // forward to external servers
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <code class="varname">bastion-ips-go-here</code>;
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt allow-transfer { none; }; // sample allow-transfer (no one)
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt allow-query { internals; externals; }; // restrict query access
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User allow-recursion { internals; }; // restrict recursion
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Huntzone "site1.example.com" { // sample master zone
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt type master;
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt forwarders { }; // do normal iterative
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User // resolution (do not forward)
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User allow-query { internals; externals; };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt allow-transfer { internals; };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Huntzone "site2.example.com" { // sample slave zone
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User masters { 172.16.72.3; };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt forwarders { };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt allow-query { internals; externals; };
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User allow-transfer { internals; };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt forwarders { };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt allow-query { internals; };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt allow-transfer { internals; }
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt masters { 172.16.72.3; };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt forwarders { };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt allow-query { internals };
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User allow-transfer { internals; }
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt External (bastion host) DNS server config:
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox Useracl externals { bastion-ips-go-here; };
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User allow-transfer { none; }; // sample allow-transfer (no one)
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt allow-query { any; }; // default query access
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt allow-query-cache { internals; externals; }; // restrict cache access
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User allow-recursion { internals; externals; }; // restrict recursion
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Huntzone "site1.example.com" { // sample slave zone
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt type master;
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt allow-transfer { internals; externals; };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt masters { another_bastion_host_maybe; };
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User allow-transfer { internals; externals; }
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt In the <code class="filename">resolv.conf</code> (or equivalent) on
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt the bastion host(s):
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Huntnameserver 172.16.72.2
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Huntnameserver 172.16.72.3
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Huntnameserver 172.16.72.4
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h2 class="title" style="clear: both">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt This is a short guide to setting up Transaction SIGnatures
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt (TSIG) based transaction security in <span class="acronym">BIND</span>. It describes changes
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User to the configuration file as well as what changes are required for
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User different features, including the process of creating transaction
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt keys and using transaction signatures with <span class="acronym">BIND</span>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span class="acronym">BIND</span> primarily supports TSIG for server
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User to server communication.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User This includes zone transfer, notify, and recursive query messages.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Resolvers based on newer versions of <span class="acronym">BIND</span> 8 have limited support
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt TSIG can also be useful for dynamic update. A primary
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt server for a dynamic zone should control access to the dynamic
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt update service, but IP-based access control is insufficient.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The cryptographic access control provided by TSIG
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt is far superior. The <span><strong class="command">nsupdate</strong></span>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User program supports TSIG via the <code class="option">-k</code> and
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <code class="option">-y</code> command line options or inline by use
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt of the <span><strong class="command">key</strong></span>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h3 class="title">
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<a name="id2551816"></a>Generate Shared Keys for Each Pair of Hosts</h3></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt A shared secret is generated to be shared between <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host2</em></span>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt An arbitrary key name is chosen: "host1-host2.". The key name must
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User be the same on both hosts.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h4 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="id2551833"></a>Automatic Generation</h4></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The following command will generate a 128 bit (16 byte) HMAC-MD5
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt key as described above. Longer keys are better, but shorter keys
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User are easier to read. Note that the maximum key length is 512 bits;
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User keys longer than that will be digested with MD5 to produce a 128
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <strong class="userinput"><code>dnssec-keygen -a hmac-md5 -b 128 -n HOST host1-host2.</code></strong>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The key is in the file <code class="filename">Khost1-host2.+157+00000.private</code>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Nothing directly uses this file, but the base-64 encoded string
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt can be extracted from the file and used as a shared secret:
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<pre class="programlisting">Key: La/E5CjG9O+os1jq0a2jdA==</pre>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The string "<code class="literal">La/E5CjG9O+os1jq0a2jdA==</code>" can
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User be used as the shared secret.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<div class="titlepage"><div><div><h4 class="title">
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<a name="id2551872"></a>Manual Generation</h4></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The shared secret is simply a random sequence of bits, encoded
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt in base-64. Most ASCII strings are valid base-64 strings (assuming
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt the length is a multiple of 4 and only valid characters are used),
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User so the shared secret can be manually generated.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Also, a known string can be run through <span><strong class="command">mmencode</strong></span> or
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User a similar program to generate base-64 encoded data.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h3 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="id2551890"></a>Copying the Shared Secret to Both Machines</h3></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt This is beyond the scope of DNS. A secure transport mechanism
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt should be used. This could be secure FTP, ssh, telephone, etc.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<div class="titlepage"><div><div><h3 class="title">
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<a name="id2551900"></a>Informing the Servers of the Key's Existence</h3></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Imagine <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host 2</em></span>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt both servers. The following is added to each server's <code class="filename">named.conf</code> file:
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Huntkey host1-host2. {
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt algorithm hmac-md5;
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The algorithm, hmac-md5, is the only one supported by <span class="acronym">BIND</span>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The secret is the one generated above. Since this is a secret, it
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt is recommended that either <code class="filename">named.conf</code> be non-world
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt readable, or the key directive be added to a non-world readable
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User file that is included by
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt At this point, the key is recognized. This means that if the
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt server receives a message signed by this key, it can verify the
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt signature. If the signature is successfully verified, the
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User response is signed by the same key.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h3 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="id2551940"></a>Instructing the Server to Use the Key</h3></div></div></div>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Since keys are shared between two hosts only, the server must
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt be told when keys are to be used. The following is added to the <code class="filename">named.conf</code> file
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User for <span class="emphasis"><em>host1</em></span>, if the IP address of <span class="emphasis"><em>host2</em></span> is
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Huntserver 10.1.2.3 {
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt keys { host1-host2. ;};
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Multiple keys may be present, but only the first is used.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt This directive does not contain any secrets, so it may be in a
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User world-readable
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt If <span class="emphasis"><em>host1</em></span> sends a message that is a request
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt to that address, the message will be signed with the specified key. <span class="emphasis"><em>host1</em></span> will
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt expect any responses to signed messages to be signed with the same
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt A similar statement must be present in <span class="emphasis"><em>host2</em></span>'s
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt configuration file (with <span class="emphasis"><em>host1</em></span>'s address) for <span class="emphasis"><em>host2</em></span> to
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt sign request messages to <span class="emphasis"><em>host1</em></span>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h3 class="title">
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<a name="id2551997"></a>TSIG Key Based Access Control</h3></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span class="acronym">BIND</span> allows IP addresses and ranges
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt to be specified in ACL
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt definitions and
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <span><strong class="command">allow-{ query | transfer | update }</strong></span>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt This has been extended to allow TSIG keys also. The above key would
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt be denoted <span><strong class="command">key host1-host2.</strong></span>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt An example of an allow-update directive would be:
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox Userallow-update { key host1-host2. ;};
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User This allows dynamic updates to succeed only if the request
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt was signed by a key named
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt "<span><strong class="command">host1-host2.</strong></span>".
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt You may want to read about the more
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt powerful <span><strong class="command">update-policy</strong></span> statement in <a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h3 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="id2552042"></a>Errors</h3></div></div></div>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User The processing of TSIG signed messages can result in
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User several errors. If a signed message is sent to a non-TSIG aware
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt server, a FORMERR (format error) will be returned, since the server will not
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt understand the record. This is a result of misconfiguration,
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User since the server must be explicitly configured to send a TSIG
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User signed message to a specific server.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt If a TSIG aware server receives a message signed by an
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt unknown key, the response will be unsigned with the TSIG
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt extended error code set to BADKEY. If a TSIG aware server
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User receives a message with a signature that does not validate, the
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User response will be unsigned with the TSIG extended error code set
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt to BADSIG. If a TSIG aware server receives a message with a time
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt outside of the allowed range, the response will be signed with
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt the TSIG extended error code set to BADTIME, and the time values
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt will be adjusted so that the response can be successfully
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt verified. In any of these cases, the message's rcode is set to
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User NOTAUTH (not authenticated).
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h2 class="title" style="clear: both">
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<a name="id2552056"></a>TKEY</h2></div></div></div>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<p><span><strong class="command">TKEY</strong></span>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt is a mechanism for automatically generating a shared secret
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt between two hosts. There are several "modes" of
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">TKEY</strong></span> that specify how the key is generated
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt or assigned. <span class="acronym">BIND</span> 9 implements only one of
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt these modes, the Diffie-Hellman key exchange. Both hosts are
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt required to have a Diffie-Hellman KEY record (although this
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User record is not required to be present in a zone). The
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <span><strong class="command">TKEY</strong></span> process must use signed messages,
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt signed either by TSIG or SIG(0). The result of
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">TKEY</strong></span> is a shared secret that can be used to
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt sign messages with TSIG. <span><strong class="command">TKEY</strong></span> can also be
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt used to delete shared secrets that it had previously
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The <span><strong class="command">TKEY</strong></span> process is initiated by a
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt or server by sending a signed <span><strong class="command">TKEY</strong></span>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt (including any appropriate KEYs) to a TKEY-aware server. The
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User server response, if it indicates success, will contain a
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <span><strong class="command">TKEY</strong></span> record and any appropriate keys.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt this exchange, both participants have enough information to
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt determine the shared secret; the exact process depends on the
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <span><strong class="command">TKEY</strong></span> mode. When using the
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Diffie-Hellman
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">TKEY</strong></span> mode, Diffie-Hellman keys are
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt and the shared secret is derived by both participants.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<div class="titlepage"><div><div><h2 class="title" style="clear: both">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="id2552173"></a>SIG(0)</h2></div></div></div>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <span class="acronym">BIND</span> 9 partially supports DNSSEC SIG(0)
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User transaction signatures as specified in RFC 2535 and RFC2931.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt uses public/private keys to authenticate messages. Access control
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt is performed in the same manner as TSIG keys; privileges can be
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User granted or denied based on the key name.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt When a SIG(0) signed message is received, it will only be
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User verified if the key is known and trusted by the server; the server
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User will not attempt to locate and/or validate the key.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User SIG(0) signing of multiple-message TCP streams is not
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The only tool shipped with <span class="acronym">BIND</span> 9 that
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User generates SIG(0) signed messages is <span><strong class="command">nsupdate</strong></span>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h2 class="title" style="clear: both">
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<a name="DNSSEC"></a>DNSSEC</h2></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Cryptographic authentication of DNS information is possible
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt through the DNS Security (<span class="emphasis"><em>DNSSEC-bis</em></span>) extensions,
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User defined in RFC 4033, RFC 4034 and RFC 4035.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User This section describes the creation and use of DNSSEC signed zones.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User In order to set up a DNSSEC secure zone, there are a series
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt of steps which must be followed. <span class="acronym">BIND</span>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt with several tools
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt that are used in this process, which are explained in more detail
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User below. In all cases, the <code class="option">-h</code> option prints a
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User full list of parameters. Note that the DNSSEC tools require the
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt keyset files to be in the working directory or the
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt directory specified by the <code class="option">-d</code> option, and
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt that the tools shipped with BIND 9.2.x and earlier are not compatible
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt with the current ones.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User There must also be communication with the administrators of
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User the parent and/or child zone to transmit keys. A zone's security
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt status must be indicated by the parent zone for a DNSSEC capable
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt resolver to trust its data. This is done through the presence
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt or absence of a <code class="literal">DS</code> record at the
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt For other servers to trust data in this zone, they must
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt either be statically configured with this zone's zone key or the
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt zone key of another zone above this one in the DNS tree.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h3 class="title">
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<a name="id2552310"></a>Generating Keys</h3></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The <span><strong class="command">dnssec-keygen</strong></span> program is used to
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt generate keys.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User A secure zone must contain one or more zone keys. The
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User zone keys will sign all other records in the zone, as well as
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt the zone keys of any secure delegated zones. Zone keys must
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt have the same name as the zone, a name type of
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">ZONE</strong></span>, and must be usable for
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User authentication.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt It is recommended that zone keys use a cryptographic algorithm
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User designated as "mandatory to implement" by the IETF; currently
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt the only one is RSASHA1.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The following command will generate a 768 bit RSASHA1 key for
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt the <code class="filename">child.example</code> zone:
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <strong class="userinput"><code>dnssec-keygen -a RSASHA1 -b 768 -n ZONE child.example.</code></strong>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Two output files will be produced:
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <code class="filename">Kchild.example.+005+12345.key</code> and
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <code class="filename">Kchild.example.+005+12345.private</code>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User 12345 is an example of a key tag). The key file names contain
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt the key name (<code class="filename">child.example.</code>),
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt algorithm (3
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt is DSA, 1 is RSAMD5, 5 is RSASHA1, etc.), and the key tag (12345 in
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The private key (in the <code class="filename">.private</code>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User used to generate signatures, and the public key (in the
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <code class="filename">.key</code> file) is used for signature
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein verification.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein To generate another key with the same properties (but with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a different key tag), repeat the above command.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews The public keys should be inserted into the zone file by
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews including the <code class="filename">.key</code> files using
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">$INCLUDE</strong></span> statements.
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User<div class="titlepage"><div><div><h3 class="title">
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User<a name="id2552448"></a>Signing the Zone</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The <span><strong class="command">dnssec-signzone</strong></span> program is used
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt sign a zone.
example.com. 257 3 5 "AwEAAaxPMcR2x0HbQV4WeZB6oEDX+r0QM65KbhTjrW1ZaARmPhEZZe
see <a href="Bv9ARM.ch09.html#ipv6addresses" title="IPv6 addresses (AAAA)">the section called “IPv6 addresses (AAAA)”</a>.
$ORIGIN example.com.
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 14400 IN PTR host.example.com.