Bv9ARM.ch04.html revision cedb0bd0c1e3c461b7e479a16d3adfd5b150f1f4
2f072c2982861ec2e86e97f8a3ed199fe45c1f70Michael Graff - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
2f072c2982861ec2e86e97f8a3ed199fe45c1f70Michael Graff - Copyright (C) 2000-2003 Internet Software Consortium.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews - Permission to use, copy, modify, and distribute this software for any
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews - purpose with or without fee is hereby granted, provided that the above
2f072c2982861ec2e86e97f8a3ed199fe45c1f70Michael Graff - copyright notice and this permission notice appear in all copies.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews - PERFORMANCE OF THIS SOFTWARE.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<!-- $Id: Bv9ARM.ch04.html,v 1.60 2005/10/13 03:14:03 marka Exp $ -->
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
854d0238dbc2908490197984b3b9d558008a53dfMark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
854d0238dbc2908490197984b3b9d558008a53dfMark Andrews<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
4529cdaedaf1a0a5f8ff89aeca510b7a4475446cBob Halley<link rel="prev" href="Bv9ARM.ch03.html" title="Chapter�3.�Name Server Configuration">
d981ca645597116d227a48bf37cc5edc061c854dBob Halley<link rel="next" href="Bv9ARM.ch05.html" title="Chapter�5.�The BIND 9 Lightweight Resolver">
0e8cf9a887c70f96ac448b06c069d90b830215ccMark Andrews<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<table width="100%" summary="Navigation header">
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<tr><th colspan="3" align="center">Chapter�4.�Advanced DNS Features</th></tr>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<a accesskey="p" href="Bv9ARM.ch03.html">Prev</a>�</td>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch05.html">Next</a>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<div class="titlepage"><div><div><h2 class="title">
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<a name="Bv9ARM.ch04"></a>Chapter�4.�Advanced DNS Features</h2></div></div></div>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<dt><span class="sect1"><a href="Bv9ARM.ch04.html#notify">Notify</a></span></dt>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<dt><span class="sect1"><a href="Bv9ARM.ch04.html#dynamic_update">Dynamic Update</a></span></dt>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#journal">The journal file</a></span></dt></dl></dd>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<dt><span class="sect1"><a href="Bv9ARM.ch04.html#incremental_zone_transfers">Incremental Zone Transfers (IXFR)</a></span></dt>
5d15501996f597d9bbb734d88d4549828e28000bMark Andrews<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2552139">Split DNS</a></span></dt>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<dt><span class="sect1"><a href="Bv9ARM.ch04.html#tsig">TSIG</a></span></dt>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2552932">Generate Shared Keys for Each Pair of Hosts</a></span></dt>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2553005">Copying the Shared Secret to Both Machines</a></span></dt>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2553016">Informing the Servers of the Key's Existence</a></span></dt>
3ddd92da6651bc72aa79a04195ad389d86fd1a66Andreas Gustafsson<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2553056">Instructing the Server to Use the Key</a></span></dt>
3ddd92da6651bc72aa79a04195ad389d86fd1a66Andreas Gustafsson<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2553113">TSIG Key Based Access Control</a></span></dt>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2553158">Errors</a></span></dt>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2553172">TKEY</a></span></dt>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2553221">SIG(0)</a></span></dt>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<dt><span class="sect1"><a href="Bv9ARM.ch04.html#DNSSEC">DNSSEC</a></span></dt>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2553357">Generating Keys</a></span></dt>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2553563">Signing the Zone</a></span></dt>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2553642">Configuring Servers</a></span></dt>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2553666">IPv6 Support in <span class="acronym">BIND</span> 9</a></span></dt>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2553796">Address Lookups Using AAAA Records</a></span></dt>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2553817">Address to Name Lookups Using Nibble Format</a></span></dt>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<div class="titlepage"><div><div><h2 class="title" style="clear: both">
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<a name="notify"></a>Notify</h2></div></div></div>
5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson <span class="acronym">DNS</span> NOTIFY is a mechanism that allows master
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews servers to notify their slave servers of changes to a zone's data. In
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews response to a <span><strong class="command">NOTIFY</strong></span> from a master server, the
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews slave will check to see that its version of the zone is the
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews current version and, if not, initiate a zone transfer.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews For more information about <span class="acronym">DNS</span>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews <span><strong class="command">NOTIFY</strong></span>, see the description of the
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews <span><strong class="command">notify</strong></span> option in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a> and
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews the description of the zone option <span><strong class="command">also-notify</strong></span> in
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>. The <span><strong class="command">NOTIFY</strong></span>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews protocol is specified in RFC 1996.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews As slave zone can also be a master to other slaves, named,
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews by default, sends <span><strong class="command">NOTIFY</strong></span> messages for every zone
4529cdaedaf1a0a5f8ff89aeca510b7a4475446cBob Halley it loads. Specifying <span><strong class="command">notify master-only;</strong></span> will
5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson cause named to only send <span><strong class="command">NOTIFY</strong></span> for master
5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson zones that it loads.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<div class="titlepage"><div><div><h2 class="title" style="clear: both">
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<a name="dynamic_update"></a>Dynamic Update</h2></div></div></div>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews Dynamic Update is a method for adding, replacing or deleting
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews records in a master server by sending it a special form of DNS
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews messages. The format and meaning of these messages is specified
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews in RFC 2136.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews Dynamic update is enabled by
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews including an <span><strong class="command">allow-update</strong></span> or
5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson <span><strong class="command">update-policy</strong></span> clause in the
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews <span><strong class="command">zone</strong></span> statement.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews Updating of secure zones (zones using DNSSEC) follows
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews RFC 3007: RRSIG and NSEC records affected by updates are automatically
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews regenerated by the server using an online zone key.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews Update authorization is based
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews on transaction signatures and an explicit server policy.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<div class="titlepage"><div><div><h3 class="title">
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<a name="journal"></a>The journal file</h3></div></div></div>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews All changes made to a zone using dynamic update are stored
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews in the zone's journal file. This file is automatically created
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews by the server when the first dynamic update takes place.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews The name of the journal file is formed by appending the extension
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews <code class="filename">.jnl</code> to the name of the
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews corresponding zone
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews file unless specifically overridden. The journal file is in a
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews binary format and should not be edited manually.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews The server will also occasionally write ("dump")
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews the complete contents of the updated zone to its zone file.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews This is not done immediately after
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews each dynamic update, because that would be too slow when a large
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews zone is updated frequently. Instead, the dump is delayed by
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews up to 15 minutes, allowing additional updates to take place.
5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson When a server is restarted after a shutdown or crash, it will replay
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews the journal file to incorporate into the zone any updates that
fad44a20eede1bbc66716241dede225500c91caaAndreas Gustafsson place after the last zone dump.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews Changes that result from incoming incremental zone transfers are
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews journalled in a similar way.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews The zone files of dynamic zones cannot normally be edited by
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews hand because they are not guaranteed to contain the most recent
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews dynamic changes - those are only in the journal file.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews The only way to ensure that the zone file of a dynamic zone
b5da378f2987a115491c291d062252f3152d8db8Brian Wellington is up to date is to run <span><strong class="command">rndc stop</strong></span>.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews If you have to make changes to a dynamic zone
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews manually, the following procedure will work: Disable dynamic updates
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews to the zone using
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews <span><strong class="command">rndc freeze <em class="replaceable"><code>zone</code></em></strong></span>.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews This will also remove the zone's <code class="filename">.jnl</code> file
2bc0da0cd874b15593d65338ba96e90ceed13072Mark Andrews and update the master file. Edit the zone file. Run
5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson <span><strong class="command">rndc thaw <em class="replaceable"><code>zone</code></em></strong></span>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews to reload the changed zone and re-enable dynamic updates.
5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson<div class="titlepage"><div><div><h2 class="title" style="clear: both">
fad44a20eede1bbc66716241dede225500c91caaAndreas Gustafsson<a name="incremental_zone_transfers"></a>Incremental Zone Transfers (IXFR)</h2></div></div></div>
5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson The incremental zone transfer (IXFR) protocol is a way for
5fc7ba3e1ac5d72239e9971e0f469dd5796738f9Andreas Gustafsson slave servers to transfer only changed data, instead of having to
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews transfer the entire zone. The IXFR protocol is specified in RFC
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews 1995. See <a href="Bv9ARM.ch09.html#proposed_standards">Proposed Standards</a>.
0e8cf9a887c70f96ac448b06c069d90b830215ccMark Andrews When acting as a master, <span class="acronym">BIND</span> 9
0e8cf9a887c70f96ac448b06c069d90b830215ccMark Andrews supports IXFR for those zones
0e8cf9a887c70f96ac448b06c069d90b830215ccMark Andrews where the necessary change history information is available. These
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews include master zones maintained by dynamic update and slave zones
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews whose data was obtained by IXFR. For manually maintained master
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews zones, and for slave zones obtained by performing a full zone
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews transfer (AXFR), IXFR is supported only if the option
1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews <span><strong class="command">ixfr-from-differences</strong></span> is set
1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews to <strong class="userinput"><code>yes</code></strong>.
1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews When acting as a slave, <span class="acronym">BIND</span> 9 will
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews attempt to use IXFR unless
d981ca645597116d227a48bf37cc5edc061c854dBob Halley it is explicitly disabled. For more information about disabling
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews IXFR, see the description of the <span><strong class="command">request-ixfr</strong></span> clause
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews of the <span><strong class="command">server</strong></span> statement.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<div class="titlepage"><div><div><h2 class="title" style="clear: both">
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<a name="id2552139"></a>Split DNS</h2></div></div></div>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews Setting up different views, or visibility, of the DNS space to
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews internal and external resolvers is usually referred to as a
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews <span class="emphasis"><em>Split DNS</em></span> setup. There are several
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews reasons an organization would want to set up its DNS this way.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews One common reason for setting up a DNS system this way is
2bc0da0cd874b15593d65338ba96e90ceed13072Mark Andrews to hide "internal" DNS information from "external" clients on the
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews Internet. There is some debate as to whether or not this is actually
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews Internal DNS information leaks out in many ways (via email headers,
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews for example) and most savvy "attackers" can find the information
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews they need using other means.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews However, since listing addresses of internal servers that
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews external clients cannot possibly reach can result in
2bc0da0cd874b15593d65338ba96e90ceed13072Mark Andrews connection delays and other annoyances, an organization may
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews choose to use a Split DNS to present a consistant view of itself
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews to the outside world.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews Another common reason for setting up a Split DNS system is
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews to allow internal networks that are behind filters or in RFC 1918
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews space (reserved IP space, as documented in RFC 1918) to resolve DNS
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews on the Internet. Split DNS can also be used to allow mail from outside
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews back in to the internal network.
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews Here is an example of a split DNS setup:
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews Let's say a company named <span class="emphasis"><em>Example, Inc.</em></span>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews has several corporate sites that have an internal network with
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews Internet Protocol (IP) space and an external demilitarized zone (DMZ),
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews or "outside" section of a network, that is available to the public.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews <span class="emphasis"><em>Example, Inc.</em></span> wants its internal clients
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews to be able to resolve external hostnames and to exchange mail with
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews people on the outside. The company also wants its internal resolvers
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews to have access to certain internal-only zones that are not available
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews at all outside of the internal network.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews In order to accomplish this, the company will set up two sets
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews of name servers. One set will be on the inside network (in the
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews IP space) and the other set will be on bastion hosts, which are
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews hosts that can talk to both sides of its network, in the DMZ.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews The internal servers will be configured to forward all queries,
4529cdaedaf1a0a5f8ff89aeca510b7a4475446cBob Halley except queries for <code class="filename">site1.internal</code>, <code class="filename">site2.internal</code>, <code class="filename">site1.example.com</code>,
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews and <code class="filename">site2.example.com</code>, to the servers
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews DMZ. These internal servers will have complete sets of information
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews for <code class="filename">site1.example.com</code>, <code class="filename">site2.example.com</code>,<span class="emphasis"><em></em></span> <code class="filename">site1.internal</code>,
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews and <code class="filename">site2.internal</code>.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews To protect the <code class="filename">site1.internal</code> and <code class="filename">site2.internal</code> domains,
d981ca645597116d227a48bf37cc5edc061c854dBob Halley the internal name servers must be configured to disallow all queries
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews to these domains from any external hosts, including the bastion
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews The external servers, which are on the bastion hosts, will
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews be configured to serve the "public" version of the <code class="filename">site1</code> and <code class="filename">site2.example.com</code> zones.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews This could include things such as the host records for public servers
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews (<code class="filename">www.example.com</code> and <code class="filename">ftp.example.com</code>),
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews and mail exchange (MX) records (<code class="filename">a.mx.example.com</code> and <code class="filename">b.mx.example.com</code>).
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews In addition, the public <code class="filename">site1</code> and <code class="filename">site2.example.com</code> zones
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews should have special MX records that contain wildcard (`*') records
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews pointing to the bastion hosts. This is needed because external mail
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews servers do not have any other way of looking up how to deliver mail
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews to those internal hosts. With the wildcard records, the mail will
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews be delivered to the bastion host, which can then forward it on to
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews internal hosts.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews Here's an example of a wildcard MX record:
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews<pre class="programlisting">* IN MX 10 external1.example.com.</pre>
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews Now that they accept mail on behalf of anything in the internal
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews network, the bastion hosts will need to know how to deliver mail
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews to internal hosts. In order for this to work properly, the resolvers
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews the bastion hosts will need to be configured to point to the internal
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews name servers for DNS resolution.
0e8cf9a887c70f96ac448b06c069d90b830215ccMark Andrews Queries for internal hostnames will be answered by the internal
0e8cf9a887c70f96ac448b06c069d90b830215ccMark Andrews servers, and queries for external hostnames will be forwarded back
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington out to the DNS servers on the bastion hosts.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews In order for all this to work properly, internal clients will
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews need to be configured to query <span class="emphasis"><em>only</em></span> the internal
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews name servers for DNS queries. This could also be enforced via
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews filtering on the network.
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews If everything has been set properly, <span class="emphasis"><em>Example, Inc.</em></span>'s
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington internal clients will now be able to:
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington Look up any hostnames in the <code class="literal">site1</code>
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington <code class="literal">site2.example.com</code> zones.
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington Look up any hostnames in the <code class="literal">site1.internal</code> and
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington <code class="literal">site2.internal</code> domains.
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington<li>Look up any hostnames on the Internet.</li>
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington<li>Exchange mail with internal AND external people.</li>
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington Hosts on the Internet will be able to:
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington Look up any hostnames in the <code class="literal">site1</code>
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington <code class="literal">site2.example.com</code> zones.
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington Exchange mail with anyone in the <code class="literal">site1</code> and
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington <code class="literal">site2.example.com</code> zones.
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington Here is an example configuration for the setup we just
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington described above. Note that this is only configuration information;
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington for information on how to configure your zone files, see <a href="Bv9ARM.ch03.html#sample_configuration" title="Sample Configurations">the section called “Sample Configurations”</a>
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington Internal DNS server config:
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellingtonacl internals { 172.16.72.0/24; 192.168.1.0/24; };
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrewsacl externals { <code class="varname">bastion-ips-go-here</code>; };
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington forward only;
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews forwarders { // forward to external servers
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews <code class="varname">bastion-ips-go-here</code>;
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews allow-transfer { none; }; // sample allow-transfer (no one)
94a3bcd132e515b4baa0884ba9dd0f361d2e17bcMark Andrews allow-query { internals; externals; }; // restrict query access
ffe74cc719aa0f10c38fbc1f2f3ea7db0960cb8fMark Andrews allow-recursion { internals; }; // restrict recursion
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellingtonzone "site1.example.com" { // sample master zone
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington forwarders { }; // do normal iterative
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington // resolution (do not forward)
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington allow-query { internals; externals; };
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington allow-transfer { internals; };
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellingtonzone "site2.example.com" { // sample slave zone
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington masters { 172.16.72.3; };
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington forwarders { };
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington allow-query { internals; externals; };
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington allow-transfer { internals; };
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington forwarders { };
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington allow-query { internals; };
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington allow-transfer { internals; }
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington masters { 172.16.72.3; };
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington forwarders { };
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington allow-query { internals };
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington allow-transfer { internals; }
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington External (bastion host) DNS server config:
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellingtonacl internals { 172.16.72.0/24; 192.168.1.0/24; };
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellingtonacl externals { bastion-ips-go-here; };
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington allow-transfer { none; }; // sample allow-transfer (no one)
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington allow-query { any; }; // default query access
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington allow-query-cache { internals; externals; }; // restrict cache access
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington allow-recursion { internals; externals; }; // restrict recursion
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellingtonzone "site1.example.com" { // sample slave zone
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington allow-transfer { internals; externals; };
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington masters { another_bastion_host_maybe; };
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington allow-transfer { internals; externals; }
94a3bcd132e515b4baa0884ba9dd0f361d2e17bcMark Andrews In the <code class="filename">resolv.conf</code> (or equivalent) on
4529cdaedaf1a0a5f8ff89aeca510b7a4475446cBob Halley the bastion host(s):
94a3bcd132e515b4baa0884ba9dd0f361d2e17bcMark Andrewsnameserver 172.16.72.2
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellingtonnameserver 172.16.72.3
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellingtonnameserver 172.16.72.4
d8813e2ceee2f4adaf697931c2491de265ce5eb9Brian Wellington<div class="titlepage"><div><div><h2 class="title" style="clear: both">
4529cdaedaf1a0a5f8ff89aeca510b7a4475446cBob Halley This is a short guide to setting up Transaction SIGnatures
d981ca645597116d227a48bf37cc5edc061c854dBob Halley (TSIG) based transaction security in <span class="acronym">BIND</span>. It describes changes
d981ca645597116d227a48bf37cc5edc061c854dBob Halley to the configuration file as well as what changes are required for
d981ca645597116d227a48bf37cc5edc061c854dBob Halley different features, including the process of creating transaction
d981ca645597116d227a48bf37cc5edc061c854dBob Halley keys and using transaction signatures with <span class="acronym">BIND</span>.
d981ca645597116d227a48bf37cc5edc061c854dBob Halley <span class="acronym">BIND</span> primarily supports TSIG for server
d981ca645597116d227a48bf37cc5edc061c854dBob Halley to server communication.
d981ca645597116d227a48bf37cc5edc061c854dBob Halley This includes zone transfer, notify, and recursive query messages.
d981ca645597116d227a48bf37cc5edc061c854dBob Halley Resolvers based on newer versions of <span class="acronym">BIND</span> 8 have limited support
e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley TSIG can also be useful for dynamic update. A primary
e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley server for a dynamic zone should control access to the dynamic
e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley update service, but IP-based access control is insufficient.
e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley The cryptographic access control provided by TSIG
e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley is far superior. The <span><strong class="command">nsupdate</strong></span>
e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley program supports TSIG via the <code class="option">-k</code> and
e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley <code class="option">-y</code> command line options or inline by use
e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley of the <span><strong class="command">key</strong></span>.
e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley<div class="titlepage"><div><div><h3 class="title">
e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley<a name="id2552932"></a>Generate Shared Keys for Each Pair of Hosts</h3></div></div></div>
e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley A shared secret is generated to be shared between <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host2</em></span>.
e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley An arbitrary key name is chosen: "host1-host2.". The key name must
e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley be the same on both hosts.
e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley<div class="titlepage"><div><div><h4 class="title">
e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley<a name="id2552949"></a>Automatic Generation</h4></div></div></div>
e27a69f8bd9538e08f775265167ba6cc5f47c587Bob Halley The following command will generate a 128 bit (16 byte) HMAC-MD5
854d0238dbc2908490197984b3b9d558008a53dfMark Andrews key as described above. Longer keys are better, but shorter keys
<strong class="userinput"><code>dnssec-keygen -a hmac-md5 -b 128 -n HOST host1-host2.</code></strong>
Imagine <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host 2</em></span>
both servers. The following is added to each server's <code class="filename">named.conf</code> file:
be told when keys are to be used. The following is added to the <code class="filename">named.conf</code> file
for <span class="emphasis"><em>host1</em></span>, if the IP address of <span class="emphasis"><em>host2</em></span> is
to that address, the message will be signed with the specified key. <span class="emphasis"><em>host1</em></span> will
configuration file (with <span class="emphasis"><em>host1</em></span>'s address) for <span class="emphasis"><em>host2</em></span> to
powerful <span><strong class="command">update-policy</strong></span> statement in <a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a>.
that the tools shipped with BIND 9.2.x and earlier are not compatible
<strong class="userinput"><code>dnssec-keygen -a RSASHA1 -b 768 -n ZONE child.example.</code></strong>
see <a href="Bv9ARM.ch09.html#ipv6addresses" title="IPv6 addresses (AAAA)">the section called “IPv6 addresses (AAAA)”</a>.
$ORIGIN example.com.
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 14400 IN PTR host.example.com.