Bv9ARM.ch04.html revision 44d0f0256fbdce130a18655023c3b06bacacbd61
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
f0aad5341752aefe5059832f6cf3abc3283c6e16Tinderbox User - Copyright (C) 2000-2003 Internet Software Consortium.
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - Permission to use, copy, modify, and/or distribute this software for any
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - purpose with or without fee is hereby granted, provided that the above
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - copyright notice and this permission notice appear in all copies.
d6fa26d0adaec6c910115be34fe7a5a5f402c14fMark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - PERFORMANCE OF THIS SOFTWARE.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<!-- $Id: Bv9ARM.ch04.html,v 1.105 2010/02/04 01:14:16 tbox Exp $ -->
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="prev" href="Bv9ARM.ch03.html" title="Chapter�3.�Name Server Configuration">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="next" href="Bv9ARM.ch05.html" title="Chapter�5.�The BIND 9 Lightweight Resolver">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<tr><th colspan="3" align="center">Chapter�4.�Advanced DNS Features</th></tr>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<a accesskey="p" href="Bv9ARM.ch03.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch05.html">Next</a>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<div class="titlepage"><div><div><h2 class="title">
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<a name="Bv9ARM.ch04"></a>Chapter�4.�Advanced DNS Features</h2></div></div></div>
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch04.html#notify">Notify</a></span></dt>
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch04.html#dynamic_update">Dynamic Update</a></span></dt>
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#journal">The journal file</a></span></dt></dl></dd>
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch04.html#incremental_zone_transfers">Incremental Zone Transfers (IXFR)</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2570571">Split DNS</a></span></dt>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570658">Example split DNS setup</a></span></dt></dl></dd>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch04.html#tsig">TSIG</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571091">Generate Shared Keys for Each Pair of Hosts</a></span></dt>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571233">Copying the Shared Secret to Both Machines</a></span></dt>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571243">Informing the Servers of the Key's Existence</a></span></dt>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571348">Instructing the Server to Use the Key</a></span></dt>
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571542">TSIG Key Based Access Control</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571591">Errors</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571605">TKEY</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571654">SIG(0)</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch04.html#DNSSEC">DNSSEC</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571722">Generating Keys</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571801">Signing the Zone</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571882">Configuring Servers</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch04.html#dnssec.dynamic.zones">DNSSEC, Dynamic Zones, and Automatic Signing</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2605770">Converting from insecure to secure</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563550">Dynamic DNS update method</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563587">Fully automatic zone signing</a></span></dt>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563662">Private-type records</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563768">DNSKEY rollovers via UPDATE</a></span></dt>
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563801">NSEC3PARAM rollovers via UPDATE</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563811">Converting from NSEC to NSEC3</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563820">Converting from NSEC3 to NSEC</a></span></dt>
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563901">Converting from secure to insecure</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563939">Periodic re-signing</a></span></dt>
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563948">NSEC3 and OPTOUT</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch04.html#rfc5011.support">Dynamic Trust Anchor Management</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2605417">Validating Resolver</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2605440">Authoritative Server</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch04.html#pkcs11">PKCS #11 (Cryptoki) support</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2607939">Prerequisites</a></span></dt>
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2606230">Building BIND 9 with PKCS#11</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2606325">PKCS #11 Tools</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2606356">Using the HSM</a></span></dt>
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2608124">Specifying the engine on the command line</a></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2608443">Running named with automatic zone re-signing</a></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2572077">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt>
983df82baf1d7d0b668c98cf45928a19f175c6e7Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572344">Address Lookups Using AAAA Records</a></span></dt>
260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572434">Address to Name Lookups Using Nibble Format</a></span></dt>
260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User<div class="titlepage"><div><div><h2 class="title" style="clear: both">
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<a name="notify"></a>Notify</h2></div></div></div>
260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User <acronym class="acronym">DNS</acronym> NOTIFY is a mechanism that allows master
260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User servers to notify their slave servers of changes to a zone's data. In
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein response to a <span><strong class="command">NOTIFY</strong></span> from a master server, the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein slave will check to see that its version of the zone is the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein current version and, if not, initiate a zone transfer.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein For more information about <acronym class="acronym">DNS</acronym>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">NOTIFY</strong></span>, see the description of the
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">notify</strong></span> option in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a> and
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews the description of the zone option <span><strong class="command">also-notify</strong></span> in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>. The <span><strong class="command">NOTIFY</strong></span>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt protocol is specified in RFC 1996.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User As a slave zone can also be a master to other slaves, <span><strong class="command">named</strong></span>,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User by default, sends <span><strong class="command">NOTIFY</strong></span> messages for every zone
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews it loads. Specifying <span><strong class="command">notify master-only;</strong></span> will
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt cause <span><strong class="command">named</strong></span> to only send <span><strong class="command">NOTIFY</strong></span> for master
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt zones that it loads.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h2 class="title" style="clear: both">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<a name="dynamic_update"></a>Dynamic Update</h2></div></div></div>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Dynamic Update is a method for adding, replacing or deleting
dec590a3deb8e87380a8bd3a77d535dba3729bf6Tinderbox User records in a master server by sending it a special form of DNS
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt messages. The format and meaning of these messages is specified
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt in RFC 2136.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Dynamic update is enabled by including an
dec590a3deb8e87380a8bd3a77d535dba3729bf6Tinderbox User <span><strong class="command">allow-update</strong></span> or an <span><strong class="command">update-policy</strong></span>
dec590a3deb8e87380a8bd3a77d535dba3729bf6Tinderbox User clause in the <span><strong class="command">zone</strong></span> statement.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User If the zone's <span><strong class="command">update-policy</strong></span> is set to
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <strong class="userinput"><code>local</code></strong>, updates to the zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein will be permitted for the key <code class="varname">local-ddns</code>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein which will be generated by <span><strong class="command">named</strong></span> at startup.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User See <a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a> for more details.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The <span><strong class="command">tkey-gssapi-credential</strong></span> and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">tkey-domain</strong></span> clauses in the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">options</strong></span> statement enable the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein server to negotiate keys that can be matched against those
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User in <span><strong class="command">update-policy</strong></span> or
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">allow-update</strong></span>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Updating of secure zones (zones using DNSSEC) follows RFC
852ccdd42a71550c974111b49415204ffeca6573Automatic Updater 3007: RRSIG, NSEC and NSEC3 records affected by updates are
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User automatically regenerated by the server using an online
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User zone key. Update authorization is based on transaction
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt signatures and an explicit server policy.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h3 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="journal"></a>The journal file</h3></div></div></div>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User All changes made to a zone using dynamic update are stored
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User in the zone's journal file. This file is automatically created
66f25f2ceeb589e67efe7af2413baaa3426b0042Automatic Updater by the server when the first dynamic update takes place.
66f25f2ceeb589e67efe7af2413baaa3426b0042Automatic Updater The name of the journal file is formed by appending the extension
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <code class="filename">.jnl</code> to the name of the
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt corresponding zone
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt file unless specifically overridden. The journal file is in a
66f25f2ceeb589e67efe7af2413baaa3426b0042Automatic Updater binary format and should not be edited manually.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The server will also occasionally write ("dump")
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User the complete contents of the updated zone to its zone file.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User This is not done immediately after
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater each dynamic update, because that would be too slow when a large
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater zone is updated frequently. Instead, the dump is delayed by
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater up to 15 minutes, allowing additional updates to take place.
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater During the dump process, transient files will be created
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater with the extensions <code class="filename">.jnw</code> and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">.jbk</code>; under ordinary circumstances, these
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User will be removed when the dump is complete, and can be safely
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User When a server is restarted after a shutdown or crash, it will replay
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User the journal file to incorporate into the zone any updates that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein place after the last zone dump.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Changes that result from incoming incremental zone transfers are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein journalled in a similar way.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User The zone files of dynamic zones cannot normally be edited by
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User hand because they are not guaranteed to contain the most recent
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dynamic changes — those are only in the journal file.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The only way to ensure that the zone file of a dynamic zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is up to date is to run <span><strong class="command">rndc stop</strong></span>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein If you have to make changes to a dynamic zone
3a5fe5abf08f16b8d31ab8ee9a788063110ef000Automatic Updater manually, the following procedure will work: Disable dynamic updates
3a5fe5abf08f16b8d31ab8ee9a788063110ef000Automatic Updater to the zone using
3a5fe5abf08f16b8d31ab8ee9a788063110ef000Automatic Updater <span><strong class="command">rndc freeze <em class="replaceable"><code>zone</code></em></strong></span>.
3a5fe5abf08f16b8d31ab8ee9a788063110ef000Automatic Updater This will also remove the zone's <code class="filename">.jnl</code> file
3a5fe5abf08f16b8d31ab8ee9a788063110ef000Automatic Updater and update the master file. Edit the zone file. Run
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">rndc thaw <em class="replaceable"><code>zone</code></em></strong></span>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User to reload the changed zone and re-enable dynamic updates.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h2 class="title" style="clear: both">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="incremental_zone_transfers"></a>Incremental Zone Transfers (IXFR)</h2></div></div></div>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User The incremental zone transfer (IXFR) protocol is a way for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein slave servers to transfer only changed data, instead of having to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein transfer the entire zone. The IXFR protocol is specified in RFC
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 1995. See <a href="Bv9ARM.ch09.html#proposed_standards">Proposed Standards</a>.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User When acting as a master, <acronym class="acronym">BIND</acronym> 9
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein supports IXFR for those zones
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein where the necessary change history information is available. These
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews include master zones maintained by dynamic update and slave zones
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein whose data was obtained by IXFR. For manually maintained master
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt zones, and for slave zones obtained by performing a full zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein transfer (AXFR), IXFR is supported only if the option
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">ixfr-from-differences</strong></span> is set
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User to <strong class="userinput"><code>yes</code></strong>.
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User When acting as a slave, <acronym class="acronym">BIND</acronym> 9 will
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt attempt to use IXFR unless
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User it is explicitly disabled. For more information about disabling
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User IXFR, see the description of the <span><strong class="command">request-ixfr</strong></span> clause
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User of the <span><strong class="command">server</strong></span> statement.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<div class="titlepage"><div><div><h2 class="title" style="clear: both">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<a name="id2570571"></a>Split DNS</h2></div></div></div>
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User Setting up different views, or visibility, of the DNS space to
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User internal and external resolvers is usually referred to as a
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User <span class="emphasis"><em>Split DNS</em></span> setup. There are several
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User reasons an organization would want to set up its DNS this way.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User One common reason for setting up a DNS system this way is
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User to hide "internal" DNS information from "external" clients on the
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Internet. There is some debate as to whether or not this is actually
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Internal DNS information leaks out in many ways (via email headers,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User for example) and most savvy "attackers" can find the information
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein they need using other means.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein However, since listing addresses of internal servers that
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User external clients cannot possibly reach can result in
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User connection delays and other annoyances, an organization may
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein choose to use a Split DNS to present a consistent view of itself
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to the outside world.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Another common reason for setting up a Split DNS system is
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User to allow internal networks that are behind filters or in RFC 1918
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User space (reserved IP space, as documented in RFC 1918) to resolve DNS
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews on the Internet. Split DNS can also be used to allow mail from outside
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein back in to the internal network.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="id2570658"></a>Example split DNS setup</h3></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Let's say a company named <span class="emphasis"><em>Example, Inc.</em></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein has several corporate sites that have an internal network with
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Internet Protocol (IP) space and an external demilitarized zone (DMZ),
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews or "outside" section of a network, that is available to the public.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span class="emphasis"><em>Example, Inc.</em></span> wants its internal clients
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt to be able to resolve external hostnames and to exchange mail with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein people on the outside. The company also wants its internal resolvers
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User to have access to certain internal-only zones that are not available
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User at all outside of the internal network.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User In order to accomplish this, the company will set up two sets
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User of name servers. One set will be on the inside network (in the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein IP space) and the other set will be on bastion hosts, which are
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews hosts that can talk to both sides of its network, in the DMZ.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User The internal servers will be configured to forward all queries,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein except queries for <code class="filename">site1.internal</code>, <code class="filename">site2.internal</code>, <code class="filename">site1.example.com</code>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and <code class="filename">site2.example.com</code>, to the servers
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DMZ. These internal servers will have complete sets of information
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for <code class="filename">site1.example.com</code>, <code class="filename">site2.example.com</code>, <code class="filename">site1.internal</code>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and <code class="filename">site2.internal</code>.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews To protect the <code class="filename">site1.internal</code> and <code class="filename">site2.internal</code> domains,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews the internal name servers must be configured to disallow all queries
a1b05dea35aa30b152a47115e18bbe679d3fcf19Mark Andrews to these domains from any external hosts, including the bastion
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The external servers, which are on the bastion hosts, will
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein be configured to serve the "public" version of the <code class="filename">site1</code> and <code class="filename">site2.example.com</code> zones.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This could include things such as the host records for public servers
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (<code class="filename">www.example.com</code> and <code class="filename">ftp.example.com</code>),
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and mail exchange (MX) records (<code class="filename">a.mx.example.com</code> and <code class="filename">b.mx.example.com</code>).
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews In addition, the public <code class="filename">site1</code> and <code class="filename">site2.example.com</code> zones
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User should have special MX records that contain wildcard (`*') records
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User pointing to the bastion hosts. This is needed because external mail
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User servers do not have any other way of looking up how to deliver mail
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User to those internal hosts. With the wildcard records, the mail will
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User be delivered to the bastion host, which can then forward it on to
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User internal hosts.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User Here's an example of a wildcard MX record:
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<pre class="programlisting">* IN MX 10 external1.example.com.</pre>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User Now that they accept mail on behalf of anything in the internal
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User network, the bastion hosts will need to know how to deliver mail
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User to internal hosts. In order for this to work properly, the resolvers
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User the bastion hosts will need to be configured to point to the internal
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User name servers for DNS resolution.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User Queries for internal hostnames will be answered by the internal
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User servers, and queries for external hostnames will be forwarded back
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User out to the DNS servers on the bastion hosts.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User In order for all this to work properly, internal clients will
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User need to be configured to query <span class="emphasis"><em>only</em></span> the internal
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User name servers for DNS queries. This could also be enforced via
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User filtering on the network.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User If everything has been set properly, <span class="emphasis"><em>Example, Inc.</em></span>'s
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User internal clients will now be able to:
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User Look up any hostnames in the <code class="literal">site1</code>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <code class="literal">site2.example.com</code> zones.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User Look up any hostnames in the <code class="literal">site1.internal</code> and
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User <code class="literal">site2.internal</code> domains.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<li>Look up any hostnames on the Internet.</li>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<li>Exchange mail with both internal and external people.</li>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User Hosts on the Internet will be able to:
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User Look up any hostnames in the <code class="literal">site1</code>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <code class="literal">site2.example.com</code> zones.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Exchange mail with anyone in the <code class="literal">site1</code> and
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <code class="literal">site2.example.com</code> zones.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User Here is an example configuration for the setup we just
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User described above. Note that this is only configuration information;
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User for information on how to configure your zone files, see <a href="Bv9ARM.ch03.html#sample_configuration" title="Sample Configurations">the section called “Sample Configurations”</a>.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User Internal DNS server config:
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Useracl internals { 172.16.72.0/24; 192.168.1.0/24; };
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox Useracl externals { <code class="varname">bastion-ips-go-here</code>; };
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User forward only;
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User // forward to external servers
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User <code class="varname">bastion-ips-go-here</code>;
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt // sample allow-transfer (no one)
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User allow-transfer { none; };
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User // restrict query access
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User allow-query { internals; externals; };
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User // restrict recursion
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User allow-recursion { internals; };
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User// sample master zone
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User // do normal iterative resolution (do not forward)
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User forwarders { };
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User allow-query { internals; externals; };
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User allow-transfer { internals; };
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User// sample slave zone
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt masters { 172.16.72.3; };
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User forwarders { };
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User allow-query { internals; externals; };
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User allow-transfer { internals; };
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt type master;
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User forwarders { };
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User allow-query { internals; };
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User allow-transfer { internals; }
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User masters { 172.16.72.3; };
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User forwarders { };
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User allow-query { internals };
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User allow-transfer { internals; }
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User External (bastion host) DNS server config:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinacl externals { bastion-ips-go-here; };
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce // sample allow-transfer (no one)
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater allow-transfer { none; };
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater // default query access
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews allow-query { any; };
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce // restrict cache access
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater allow-query-cache { internals; externals; };
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater // restrict recursion
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater allow-recursion { internals; externals; };
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce// sample slave zone
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce type master;
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater allow-transfer { internals; externals; };
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce masters { another_bastion_host_maybe; };
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce allow-transfer { internals; externals; }
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce In the <code class="filename">resolv.conf</code> (or equivalent) on
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce the bastion host(s):
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Lucenameserver 172.16.72.2
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Lucenameserver 172.16.72.3
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Lucenameserver 172.16.72.4
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<div class="titlepage"><div><div><h2 class="title" style="clear: both">
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce This is a short guide to setting up Transaction SIGnatures
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce (TSIG) based transaction security in <acronym class="acronym">BIND</acronym>. It describes changes
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce to the configuration file as well as what changes are required for
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce different features, including the process of creating transaction
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce keys and using transaction signatures with <acronym class="acronym">BIND</acronym>.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce <acronym class="acronym">BIND</acronym> primarily supports TSIG for server
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce to server communication.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This includes zone transfer, notify, and recursive query messages.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Resolvers based on newer versions of <acronym class="acronym">BIND</acronym> 8 have limited support
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User TSIG can also be useful for dynamic update. A primary
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein server for a dynamic zone should control access to the dynamic
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein update service, but IP-based access control is insufficient.
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce The cryptographic access control provided by TSIG
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce is far superior. The <span><strong class="command">nsupdate</strong></span>
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce program supports TSIG via the <code class="option">-k</code> and
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce <code class="option">-y</code> command line options or inline by use
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce of the <span><strong class="command">key</strong></span>.
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater<div class="titlepage"><div><div><h3 class="title">
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater<a name="id2571091"></a>Generate Shared Keys for Each Pair of Hosts</h3></div></div></div>
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater A shared secret is generated to be shared between <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host2</em></span>.
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater An arbitrary key name is chosen: "host1-host2.". The key name must
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater be the same on both hosts.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<div class="titlepage"><div><div><h4 class="title">
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<a name="id2571108"></a>Automatic Generation</h4></div></div></div>
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater The following command will generate a 128-bit (16 byte) HMAC-SHA256
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater key as described above. Longer keys are better, but shorter keys
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce are easier to read. Note that the maximum key length is the digest
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce length, here 256 bits.
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce <strong class="userinput"><code>dnssec-keygen -a hmac-sha256 -b 128 -n HOST host1-host2.</code></strong>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce The key is in the file <code class="filename">Khost1-host2.+163+00000.private</code>.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce Nothing directly uses this file, but the base-64 encoded string
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce can be extracted from the file and used as a shared secret:
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<pre class="programlisting">Key: La/E5CjG9O+os1jq0a2jdA==</pre>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User The string "<code class="literal">La/E5CjG9O+os1jq0a2jdA==</code>" can
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User be used as the shared secret.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h4 class="title">
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<a name="id2571214"></a>Manual Generation</h4></div></div></div>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce The shared secret is simply a random sequence of bits, encoded
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in base-64. Most ASCII strings are valid base-64 strings (assuming
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User the length is a multiple of 4 and only valid characters are used),
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User so the shared secret can be manually generated.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Also, a known string can be run through <span><strong class="command">mmencode</strong></span> or
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a similar program to generate base-64 encoded data.
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User<div class="titlepage"><div><div><h3 class="title">
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User<a name="id2571233"></a>Copying the Shared Secret to Both Machines</h3></div></div></div>
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User This is beyond the scope of DNS. A secure transport mechanism
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User should be used. This could be secure FTP, ssh, telephone, etc.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<div class="titlepage"><div><div><h3 class="title">
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User<a name="id2571243"></a>Informing the Servers of the Key's Existence</h3></div></div></div>
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User Imagine <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host 2</em></span>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User both servers. The following is added to each server's <code class="filename">named.conf</code> file:
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox Userkey host1-host2. {
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User algorithm hmac-sha256;
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User The secret is the one generated above. Since this is a secret, it
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User is recommended that either <code class="filename">named.conf</code> be
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User non-world readable, or the key directive be added to a non-world
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User readable file that is included by <code class="filename">named.conf</code>.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User At this point, the key is recognized. This means that if the
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User server receives a message signed by this key, it can verify the
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User signature. If the signature is successfully verified, the
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User response is signed by the same key.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<div class="titlepage"><div><div><h3 class="title">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<a name="id2571348"></a>Instructing the Server to Use the Key</h3></div></div></div>
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User Since keys are shared between two hosts only, the server must
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User be told when keys are to be used. The following is added to the <code class="filename">named.conf</code> file
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User for <span class="emphasis"><em>host1</em></span>, if the IP address of <span class="emphasis"><em>host2</em></span> is
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox Userserver 10.1.2.3 {
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein keys { host1-host2. ;};
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User Multiple keys may be present, but only the first is used.
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User This directive does not contain any secrets, so it may be in a
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User world-readable
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User If <span class="emphasis"><em>host1</em></span> sends a message that is a request
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User to that address, the message will be signed with the specified key. <span class="emphasis"><em>host1</em></span> will
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User expect any responses to signed messages to be signed with the same
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User A similar statement must be present in <span class="emphasis"><em>host2</em></span>'s
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User configuration file (with <span class="emphasis"><em>host1</em></span>'s address) for <span class="emphasis"><em>host2</em></span> to
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User sign request messages to <span class="emphasis"><em>host1</em></span>.
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="id2571542"></a>TSIG Key Based Access Control</h3></div></div></div>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <acronym class="acronym">BIND</acronym> allows IP addresses and ranges
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User to be specified in ACL
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein definitions and
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User <span><strong class="command">allow-{ query | transfer | update }</strong></span>
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User This has been extended to allow TSIG keys also. The above key would
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User be denoted <span><strong class="command">key host1-host2.</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein An example of an <span><strong class="command">allow-update</strong></span> directive would be:
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox Userallow-update { key host1-host2. ;};
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This allows dynamic updates to succeed only if the request
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User was signed by a key named "<span><strong class="command">host1-host2.</strong></span>".
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein See <a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a> for a discussion of
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User the more flexible <span><strong class="command">update-policy</strong></span> statement.
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User<div class="titlepage"><div><div><h3 class="title">
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User<a name="id2571591"></a>Errors</h3></div></div></div>
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User The processing of TSIG signed messages can result in
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User several errors. If a signed message is sent to a non-TSIG aware
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User server, a FORMERR (format error) will be returned, since the server will not
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User understand the record. This is a result of misconfiguration,
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User since the server must be explicitly configured to send a TSIG
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User signed message to a specific server.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User If a TSIG aware server receives a message signed by an
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User unknown key, the response will be unsigned with the TSIG
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User extended error code set to BADKEY. If a TSIG aware server
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein receives a message with a signature that does not validate, the
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User response will be unsigned with the TSIG extended error code set
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User to BADSIG. If a TSIG aware server receives a message with a time
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User outside of the allowed range, the response will be signed with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the TSIG extended error code set to BADTIME, and the time values
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User will be adjusted so that the response can be successfully
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User verified. In any of these cases, the message's rcode (response code) is set to
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User NOTAUTH (not authenticated).
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User<div class="titlepage"><div><div><h2 class="title" style="clear: both">
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User<a name="id2571605"></a>TKEY</h2></div></div></div>
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User<p><span><strong class="command">TKEY</strong></span>
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User is a mechanism for automatically generating a shared secret
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User between two hosts. There are several "modes" of
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User <span><strong class="command">TKEY</strong></span> that specify how the key is generated
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User or assigned. <acronym class="acronym">BIND</acronym> 9 implements only one of
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User these modes, the Diffie-Hellman key exchange. Both hosts are
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User required to have a Diffie-Hellman KEY record (although this
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User record is not required to be present in a zone). The
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User <span><strong class="command">TKEY</strong></span> process must use signed messages,
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User signed either by TSIG or SIG(0). The result of
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User <span><strong class="command">TKEY</strong></span> is a shared secret that can be used to
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User sign messages with TSIG. <span><strong class="command">TKEY</strong></span> can also be
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User used to delete shared secrets that it had previously
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User The <span><strong class="command">TKEY</strong></span> process is initiated by a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein or server by sending a signed <span><strong class="command">TKEY</strong></span>
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User (including any appropriate KEYs) to a TKEY-aware server. The
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User server response, if it indicates success, will contain a
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User <span><strong class="command">TKEY</strong></span> record and any appropriate keys.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User this exchange, both participants have enough information to
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User determine the shared secret; the exact process depends on the
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User <span><strong class="command">TKEY</strong></span> mode. When using the
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User Diffie-Hellman
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User <span><strong class="command">TKEY</strong></span> mode, Diffie-Hellman keys are
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User and the shared secret is derived by both participants.
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User<div class="titlepage"><div><div><h2 class="title" style="clear: both">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="id2571654"></a>SIG(0)</h2></div></div></div>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <acronym class="acronym">BIND</acronym> 9 partially supports DNSSEC SIG(0)
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User transaction signatures as specified in RFC 2535 and RFC 2931.
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User uses public/private keys to authenticate messages. Access control
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User is performed in the same manner as TSIG keys; privileges can be
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User granted or denied based on the key name.
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User When a SIG(0) signed message is received, it will only be
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User verified if the key is known and trusted by the server; the server
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein will not attempt to locate and/or validate the key.
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User SIG(0) signing of multiple-message TCP streams is not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The only tool shipped with <acronym class="acronym">BIND</acronym> 9 that
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User generates SIG(0) signed messages is <span><strong class="command">nsupdate</strong></span>.
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User<div class="titlepage"><div><div><h2 class="title" style="clear: both">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="DNSSEC"></a>DNSSEC</h2></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Cryptographic authentication of DNS information is possible
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt through the DNS Security (<span class="emphasis"><em>DNSSEC-bis</em></span>) extensions,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein defined in RFC 4033, RFC 4034, and RFC 4035.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User This section describes the creation and use of DNSSEC signed zones.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein In order to set up a DNSSEC secure zone, there are a series
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User of steps which must be followed. <acronym class="acronym">BIND</acronym>
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User with several tools
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User that are used in this process, which are explained in more detail
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User below. In all cases, the <code class="option">-h</code> option prints a
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User full list of parameters. Note that the DNSSEC tools require the
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User keyset files to be in the working directory or the
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User directory specified by the <code class="option">-d</code> option, and
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User that the tools shipped with BIND 9.2.x and earlier are not compatible
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User with the current ones.
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User There must also be communication with the administrators of
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User the parent and/or child zone to transmit keys. A zone's security
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User status must be indicated by the parent zone for a DNSSEC capable
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User resolver to trust its data. This is done through the presence
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User or absence of a <code class="literal">DS</code> record at the
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User For other servers to trust data in this zone, they must
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User either be statically configured with this zone's zone key or the
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User zone key of another zone above this one in the DNS tree.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<a name="id2571722"></a>Generating Keys</h3></div></div></div>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User The <span><strong class="command">dnssec-keygen</strong></span> program is used to
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User generate keys.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User A secure zone must contain one or more zone keys. The
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User zone keys will sign all other records in the zone, as well as
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User the zone keys of any secure delegated zones. Zone keys must
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User have the same name as the zone, a name type of
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User <span><strong class="command">ZONE</strong></span>, and must be usable for
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User authentication.
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User It is recommended that zone keys use a cryptographic algorithm
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User designated as "mandatory to implement" by the IETF; currently
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User the only one is RSASHA1.
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User The following command will generate a 768-bit RSASHA1 key for
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User the <code class="filename">child.example</code> zone:
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User <strong class="userinput"><code>dnssec-keygen -a RSASHA1 -b 768 -n ZONE child.example.</code></strong>
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User Two output files will be produced:
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User <code class="filename">Kchild.example.+005+12345.key</code> and
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User <code class="filename">Kchild.example.+005+12345.private</code>
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User 12345 is an example of a key tag). The key filenames contain
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User the key name (<code class="filename">child.example.</code>),
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User is DSA, 1 is RSAMD5, 5 is RSASHA1, etc.), and the key tag (12345 in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The private key (in the <code class="filename">.private</code>
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User used to generate signatures, and the public key (in the
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User <code class="filename">.key</code> file) is used for signature
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User verification.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User To generate another key with the same properties (but with
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User a different key tag), repeat the above command.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User The <span><strong class="command">dnssec-keyfromlabel</strong></span> program is used
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User to get a key pair from a crypto hardware and build the key
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User files. Its usage is similar to <span><strong class="command">dnssec-keygen</strong></span>.
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User The public keys should be inserted into the zone file by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein including the <code class="filename">.key</code> files using
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User <span><strong class="command">$INCLUDE</strong></span> statements.
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User<div class="titlepage"><div><div><h3 class="title">
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User<a name="id2571801"></a>Signing the Zone</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The <span><strong class="command">dnssec-signzone</strong></span> program is used
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User to sign a zone.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Any <code class="filename">keyset</code> files corresponding to
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews secure subzones should be present. The zone signer will
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt generate <code class="literal">NSEC</code>, <code class="literal">NSEC3</code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and <code class="literal">RRSIG</code> records for the zone, as
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User well as <code class="literal">DS</code> for the child zones if
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <code class="literal">'-g'</code> is specified. If <code class="literal">'-g'</code>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User is not specified, then DS RRsets for the secure child
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zones need to be added manually.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The following command signs the zone, assuming it is in a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein file called <code class="filename">zone.child.example</code>. By
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews default, all zone keys which have an available private key are
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews used to generate signatures.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <strong class="userinput"><code>dnssec-signzone -o child.example zone.child.example</code></strong>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein One output file is produced:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">zone.child.example.signed</code>. This
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein should be referenced by <code class="filename">named.conf</code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein input file for the zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<p><span><strong class="command">dnssec-signzone</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein will also produce a keyset and dsset files and optionally a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dlvset file. These are used to provide the parent zone
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User administrators with the <code class="literal">DNSKEYs</code> (or their
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User corresponding <code class="literal">DS</code> records) that are the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein secure entry point to the zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="id2571882"></a>Configuring Servers</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein To enable <span><strong class="command">named</strong></span> to respond appropriately
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User to DNS requests from DNSSEC aware clients,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">dnssec-enable</strong></span> must be set to yes.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (This is the default setting.)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein To enable <span><strong class="command">named</strong></span> to validate answers from
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User other servers, the <span><strong class="command">dnssec-enable</strong></span> and
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">dnssec-validation</strong></span> options must both be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein set to yes (the default setting in <acronym class="acronym">BIND</acronym> 9.5
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User and later), and at least one trust anchor must be configured
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User with a <span><strong class="command">trusted-keys</strong></span> or
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">managed-keys</strong></span> statement in
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">trusted-keys</strong></span> are copies of DNSKEY RRs
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User for zones that are used to form the first link in the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein cryptographic chain of trust. All keys listed in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">trusted-keys</strong></span> (and corresponding zones)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein are deemed to exist and only the listed keys will be used
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to validated the DNSKEY RRset that they are from.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">managed-keys</strong></span> are trusted keys which are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein automatically kept up to date via RFC 5011 trust anchor
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein maintenance.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">trusted-keys</strong></span> and
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews <span><strong class="command">managed-keys</strong></span> are described in more detail
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein later in this document.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Unlike <acronym class="acronym">BIND</acronym> 8, <acronym class="acronym">BIND</acronym>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 9 does not verify signatures on load, so zone keys for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein authoritative zones do not need to be specified in the
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User configuration file.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein After DNSSEC gets established, a typical DNSSEC configuration
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein will look something like the following. It has one or
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein more public keys for the root. This allows answers from
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews outside the organization to be validated. It will also
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein have several keys for parts of the namespace the organization
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein controls. These are here to ensure that <span><strong class="command">named</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is immune to compromises in the DNSSEC components of the security
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of parent zones.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinmanaged-keys {
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein /* Root Key */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "." initial-key 257 3 3 "BNY4wrWM1nCfJ+CXd0rVXyYmobt7sEEfK3clRbGaTwS
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User 66gKodQj+MiA21AfUVe7u99WzTLzY3qlxDhxYQQ20FQ
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt dgxbcDTClU0CRBdiieyLMNzXG3";
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User /* Key for our organization's forward zone */
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User example.com. 257 3 5 "AwEAAaxPMcR2x0HbQV4WeZB6oEDX+r0QM6
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 5KbhTjrW1ZaARmPhEZZe3Y9ifgEuq7vZ/z
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein GZUdEGNWy+JZzus0lUptwgjGwhUS1558Hb
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt 4JKUbbOTcM8pwXlj0EiX3oDFVmjHO444gL
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User g4ywzO9WglMk7jbfW33gUKvirTHr25GL7S
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User TQUzBb5Usxt8lgnyTUHs1t3JwCY5hKZ6Cq
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein F4qJCyduieHukuY3H4XMAcR+xia2nIUPvm
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt /* Key for our reverse zone. */
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater 2.0.192.IN-ADDRPA.NET. 257 3 5 "AQOnS4xn/IgOUpBPJ3bogzwc
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein xOdNax071L18QqZnQQQAVVr+i
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User LhGTnNGp3HoWQLUIzKrJVZ3zg
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User gy3WwNT6kZo6c0tszYqbtvchm
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater siaOdS0yOI6BgPsw+YZdzlYMa
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater IJGf4M4dyoKIhzdZyQ2bYQrjy
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater Q4LB0lC7aOnsMyYKHHYeRvPxj
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater IQXmdqgOJGq+vsevG06zW+1xg
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater 59VvjSPsZJHeDCUyWYrvPZesZ
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DIRvhDD52SKvbheeTJUm6Ehkz
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dnssec-enable yes;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dnssec-validation yes;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User None of the keys listed in this example are valid. In particular,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User the root key is not valid.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein When DNSSEC validation is enabled and properly configured,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the resolver will reject any answers from signed, secure zones
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein which fail to validate, and will return SERVFAIL to the client.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Responses may fail to validate for any of several reasons,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User including missing, expired, or invalid signatures, a key which
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews does not match the DS RRset in the parent zone, or an insecure
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein response from a zone which, according to its parent, should have
a1b05dea35aa30b152a47115e18bbe679d3fcf19Mark Andrews been secure.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User When the validator receives a response from an unsigned zone
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User that has a signed parent, it must confirm with the parent
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User that the zone was intentionally left unsigned. It does
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein this by verifying, via signed and validated NSEC/NSEC3 records,
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User that the parent zone contains no DS records for the child.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt If the validator <span class="emphasis"><em>can</em></span> prove that the zone
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews is insecure, then the response is accepted. However, if it
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt cannot, then it must assume an insecure response to be a
cbf7f1435f332b31f51a98611ccbfcd07c42c032Automatic Updater forgery; it rejects the response and logs an error.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User The logged error reads "insecurity proof failed" and
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt "got insecure response; parent indicates it should be secure".
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt (Prior to BIND 9.7, the logged error was "not insecure".
ebabe300b615154d08f5577822cfd8726d2643c8Automatic Updater This referred to the zone, not the response.)
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h2 class="title" style="clear: both">
ebabe300b615154d08f5577822cfd8726d2643c8Automatic Updater<a name="dnssec.dynamic.zones"></a>DNSSEC, Dynamic Zones, and Automatic Signing</h2></div></div></div>
ebabe300b615154d08f5577822cfd8726d2643c8Automatic Updater<p>As of BIND 9.7.0 it is possible to change a dynamic zone
ebabe300b615154d08f5577822cfd8726d2643c8Automatic Updater from insecure to signed and back again. A secure zone can use
ebabe300b615154d08f5577822cfd8726d2643c8Automatic Updater either NSEC or NSEC3 chains.</p>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="id2605770"></a>Converting from insecure to secure</h3></div></div></div></div>
ebabe300b615154d08f5577822cfd8726d2643c8Automatic Updater<p>Changing a zone from insecure to secure can be done in two
ebabe300b615154d08f5577822cfd8726d2643c8Automatic Updater ways: using a dynamic DNS update, or the
ebabe300b615154d08f5577822cfd8726d2643c8Automatic Updater <span><strong class="command">auto-dnssec</strong></span> zone option.</p>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<p>For either method, you need to configure
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">named</strong></span> so that it can see the
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <code class="filename">K*</code> files which contain the public and private
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt parts of the keys that will be used to sign the zone. These files
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews will have been generated by
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews <span><strong class="command">dnssec-keygen</strong></span>. You can do this by placing them
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt in the key-directory, as specified in
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User update-policy local;
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p>If one KSK and one ZSK DNSKEY key have been generated, this
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User configuration will cause all records in the zone to be signed
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt with the ZSK, and the DNSKEY RRset to be signed with the KSK as
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt well. An NSEC chain will be generated as part of the initial
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews signing process.</p>
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews<div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<a name="id2563550"></a>Dynamic DNS update method</h3></div></div></div></div>
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews > ttl 3600
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews > update add example.net DNSKEY 256 3 7 AwEAAZn17pUF0KpbPA2c7Gz76Vb18v0teKT3EyAGfBfL8eQ8al35zz3Y I1m/SAQBxIqMfLtIwqWPdgthsu36azGQAX8=
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews > update add example.net DNSKEY 257 3 7 AwEAAd/7odU/64o2LGsifbLtQmtO8dFDtTAZXSX2+X3e/UNlq9IHq3Y0 XtC0Iuawl/qkaKVxXe2lo8Ct+dM6UehyCqk=
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews<p>While the update request will complete almost immediately,
d3907d27cc138f45772d3d63082ae02c7659148aAutomatic Updater the zone will not be completely signed until
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews <span><strong class="command">named</strong></span> has had time to walk the zone and
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews generate the NSEC and RRSIG records. The NSEC record at the apex
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews will be added last, to signal that there is a complete NSEC
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater<p>If you wish to sign using NSEC3 instead of NSEC, you should
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews add an NSEC3PARAM record to the initial update request. If you
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews wish the NSEC3 chain to have the OPTOUT bit set, set it in the
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User flags field of the NSEC3PARAM record.</p>
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews > ttl 3600
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater > update add example.net DNSKEY 256 3 7 AwEAAZn17pUF0KpbPA2c7Gz76Vb18v0teKT3EyAGfBfL8eQ8al35zz3Y I1m/SAQBxIqMfLtIwqWPdgthsu36azGQAX8=
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater > update add example.net DNSKEY 257 3 7 AwEAAd/7odU/64o2LGsifbLtQmtO8dFDtTAZXSX2+X3e/UNlq9IHq3Y0 XtC0Iuawl/qkaKVxXe2lo8Ct+dM6UehyCqk=
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater > update add example.net NSEC3PARAM 1 1 100 1234567890
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater<p>Again, this update request will complete almost
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater immediately; however, the record won't show up until
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater <span><strong class="command">named</strong></span> has had a chance to build/remove the
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater relevant chain. A private type record will be created to record
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater the state of the operation (see below for more details), and will
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater be removed once the operation completes.</p>
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews<p>While the initial signing and NSEC/NSEC3 chain generation
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater is happening, other updates are possible as well.</p>
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater<div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title">
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater<a name="id2563587"></a>Fully automatic zone signing</h3></div></div></div></div>
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater<p>To enable automatic signing, add the
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater <span><strong class="command">auto-dnssec</strong></span> option to the zone statement in
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater <span><strong class="command">auto-dnssec</strong></span> has two possible arguments:
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater <code class="constant">maintain</code>.</p>
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater <span><strong class="command">auto-dnssec allow</strong></span>,
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater <span><strong class="command">named</strong></span> can search the key directory for keys
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater matching the zone, insert them into the zone, and use them to
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews sign the zone. It will do so only when it receives an
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater <span><strong class="command">rndc sign <zonename></strong></span> command.</p>
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater <span><strong class="command">auto-dnssec maintain</strong></span> includes the above
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater functionality, but will also automatically adjust the zone's
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater DNSKEY records on schedule according to the keys' timing metadata.
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater (See <a href="man.dnssec-keygen.html" title="dnssec-keygen"><span class="refentrytitle"><span class="application">dnssec-keygen</span></span>(8)</a> and
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater <a href="man.dnssec-settime.html" title="dnssec-settime"><span class="refentrytitle"><span class="application">dnssec-settime</span></span>(8)</a> for more information.)
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater If keys are present in the key directory the first time the zone
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater is loaded, it will be signed immediately, without waiting for an
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater <span><strong class="command">rndc sign</strong></span> command. (This command can still be
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater used for unscheduled key changes, however.)</p>
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater <span><strong class="command">auto-dnssec</strong></span> option requires the zone to be
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater configured to allow dynamic updates, by adding an
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews <span><strong class="command">allow-update</strong></span> or
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews <span><strong class="command">update-policy</strong></span> statement to the zone
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews configuration. If this has not been done, the configuration will
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews<div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title">
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews<a name="id2563662"></a>Private-type records</h3></div></div></div></div>
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews<p>The state of the signing process is signaled by
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews private-type records (with a default type value of 65534). When
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User signing is complete, these records will have a nonzero value for
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User the final octet (for those records which have a nonzero initial
dec590a3deb8e87380a8bd3a77d535dba3729bf6Tinderbox User<p>The private type record format: If the first octet is
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews non-zero then the record indicates that the zone needs to be
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews signed with the key matching the record, or that all signatures
dec590a3deb8e87380a8bd3a77d535dba3729bf6Tinderbox User that match the record should be removed.</p>
cbf7f1435f332b31f51a98611ccbfcd07c42c032Automatic Updater��algorithm�(octet�1)<br>
cbf7f1435f332b31f51a98611ccbfcd07c42c032Automatic Updater��key�id�in�network�order�(octet�2�and�3)<br>
cbf7f1435f332b31f51a98611ccbfcd07c42c032Automatic Updater��removal�flag�(octet�4)<br>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User��complete�flag�(octet�5)<br>
cbf7f1435f332b31f51a98611ccbfcd07c42c032Automatic Updater<p>Only records flagged as "complete" can be removed via
cbf7f1435f332b31f51a98611ccbfcd07c42c032Automatic Updater dynamic update. Attempts to remove other private type records
5d564da348e890e42f63eebf2dced9a05b41f4fbTinderbox User will be silently ignored.</p>
cbf7f1435f332b31f51a98611ccbfcd07c42c032Automatic Updater<p>If the first octet is zero (this is a reserved algorithm
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User number that should never appear in a DNSKEY record) then the
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User record indicates changes to the NSEC3 chains are in progress. The
cbf7f1435f332b31f51a98611ccbfcd07c42c032Automatic Updater rest of the record contains an NSEC3PARAM record. The flag field
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User tells what operation to perform based on the flag bits.</p>
cbf7f1435f332b31f51a98611ccbfcd07c42c032Automatic Updater��0x01�OPTOUT<br>
cbf7f1435f332b31f51a98611ccbfcd07c42c032Automatic Updater��0x80�CREATE<br>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User��0x40�REMOVE<br>
cbf7f1435f332b31f51a98611ccbfcd07c42c032Automatic Updater��0x20�NONSEC<br>
cbf7f1435f332b31f51a98611ccbfcd07c42c032Automatic Updater<div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<a name="id2563768"></a>DNSKEY rollovers via UPDATE</h3></div></div></div></div>
cbf7f1435f332b31f51a98611ccbfcd07c42c032Automatic Updater<p>It is possible to perform key rollovers via dynamic update.
cbf7f1435f332b31f51a98611ccbfcd07c42c032Automatic Updater You need to add the
cbf7f1435f332b31f51a98611ccbfcd07c42c032Automatic Updater <code class="filename">K*</code> files for the new keys so that
cbf7f1435f332b31f51a98611ccbfcd07c42c032Automatic Updater <span><strong class="command">named</strong></span> can find them. You can then add the new
cbf7f1435f332b31f51a98611ccbfcd07c42c032Automatic Updater DNSKEY RRs via dynamic update.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">named</strong></span> will then cause the zone to be signed
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User with the new keys. When the signing is complete the private type
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User records will be updated so that the last octet is non
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p>If this is for a KSK you need to inform the parent and any
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater trust anchor repositories of the new KSK.</p>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<p>You should then wait for the maximum TTL in the zone before
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User removing the old DNSKEY. If it is a KSK that is being updated,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User you also need to wait for the DS RRset in the parent to be
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater updated and its TTL to expire. This ensures that all clients will
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater be able to verify at least one signature when you remove the old
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p>The old DNSKEY can be removed via UPDATE. Take care to
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User specify the correct key.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">named</strong></span> will clean out any signatures generated
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User by the old key after the update completes.</p>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title">
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User<a name="id2563801"></a>NSEC3PARAM rollovers via UPDATE</h3></div></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<p>Add the new NSEC3PARAM record via dynamic update. When the
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User new NSEC3 chain has been generated, the NSEC3PARAM flag field
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User will be zero. At this point you can remove the old NSEC3PARAM
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater record. The old chain will be removed after the update request
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater completes.</p>
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User<div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="id2563811"></a>Converting from NSEC to NSEC3</h3></div></div></div></div>
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User<p>To do this, you just need to add an NSEC3PARAM record. When
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater the conversion is complete, the NSEC chain will have been removed
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User and the NSEC3PARAM record will have a zero flag field. The NSEC3
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt chain will be generated before the NSEC chain is
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt destroyed.</p>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="id2563820"></a>Converting from NSEC3 to NSEC</h3></div></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<p>To do this, use <span><strong class="command">nsupdate</strong></span> to
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt remove all NSEC3PARAM records with a zero flag
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater field. The NSEC chain will be generated before the NSEC3 chain is
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title">
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<a name="id2563901"></a>Converting from secure to insecure</h3></div></div></div></div>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<p>To convert a signed zone to unsigned using dynamic DNS,
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater delete all the DNSKEY records from the zone apex using
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">nsupdate</strong></span>. All signatures, NSEC or NSEC3 chains,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User and associated NSEC3PARAM records will be removed automatically.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User This will take place after the update request completes.</p>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p> This requires the
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">dnssec-secure-to-insecure</strong></span> option to be set to
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <strong class="userinput"><code>yes</code></strong> in
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <code class="filename">named.conf</code>.</p>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<p>In addition, if the <span><strong class="command">auto-dnssec maintain</strong></span>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt zone statement is used, it should be removed or changed to
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">allow</strong></span> instead (or it will re-sign).
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title">
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<a name="id2563939"></a>Periodic re-signing</h3></div></div></div></div>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p>In any secure zone which supports dynamic updates, named
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User will periodically re-sign RRsets which have not been re-signed as
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt a result of some update action. The signature lifetimes will be
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater adjusted so as to spread the re-sign load over time rather than
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater all at once.</p>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<a name="id2563948"></a>NSEC3 and OPTOUT</h3></div></div></div></div>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater <span><strong class="command">named</strong></span> only supports creating new NSEC3 chains
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater where all the NSEC3 records in the zone have the same OPTOUT
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">named</strong></span> supports UPDATES to zones where the NSEC3
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt records in the chain have mixed OPTOUT state.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">named</strong></span> does not support changing the OPTOUT
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt state of an individual NSEC3 record, the entire chain needs to be
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt changed if the OPTOUT state of an individual NSEC3 needs to be
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt changed.</p>
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User<div class="titlepage"><div><div><h2 class="title" style="clear: both">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="rfc5011.support"></a>Dynamic Trust Anchor Management</h2></div></div></div>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<p>BIND 9.7.0 introduces support for RFC 5011, dynamic trust
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater anchor management. Using this feature allows
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater <span><strong class="command">named</strong></span> to keep track of changes to critical
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User DNSSEC keys without any need for the operator to make changes to
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater configuration files.</p>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<div class="titlepage"><div><div><h3 class="title">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<a name="id2605417"></a>Validating Resolver</h3></div></div></div>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p>To configure a validating resolver to use RFC 5011 to
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User maintain a trust anchor, configure the trust anchor using a
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">managed-keys</strong></span> statement. Information about
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User this can be found in
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User <a href="Bv9ARM.ch06.html#managed-keys" title="managed-keys Statement Definition
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User and Usage">the section called “<span><strong class="command">managed-keys</strong></span> Statement Definition
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User<div class="titlepage"><div><div><h3 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="id2605440"></a>Authoritative Server</h3></div></div></div>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<p>To set up an authoritative zone for RFC 5011 trust anchor
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User maintenance, generate two (or more) key signing keys (KSKs) for
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt the zone. Sign the zone with one of them; this is the "active"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User KSK. All KSK's which do not sign the zone are "stand-by"
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<p>Any validating resolver which is configured to use the
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater active KSK as an RFC 5011-managed trust anchor will take note
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater of the stand-by KSKs in the zone's DNSKEY RRset, and store them
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt for future reference. The resolver will recheck the zone
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User periodically, and after 30 days, if the new key is still there,
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater then the key will be accepted by the resolver as a valid trust
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User anchor for the zone. Any time after this 30-day acceptance
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt timer has completed, the active KSK can be revoked, and the
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater zone can be "rolled over" to the newly accepted key.</p>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<p>The easiest way to place a stand-by key in a zone is to
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater use the "smart signing" features of
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater <span><strong class="command">dnssec-keygen</strong></span> and
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater <span><strong class="command">dnssec-signzone</strong></span>. If a key with a publication
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt date in the past, but an activation date which is unset or in
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt the future, "
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater <span><strong class="command">dnssec-signzone -S</strong></span>" will include the DNSKEY
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User record in the zone, but will not sign with it:</p>
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User$ <strong class="userinput"><code>dnssec-keygen -K keys -f KSK -P now -A now+2y example.net</code></strong>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt$ <strong class="userinput"><code>dnssec-signzone -S -K keys example.net</code></strong>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<p>To revoke a key, the new command
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater <span><strong class="command">dnssec-revoke</strong></span> has been added. This adds the
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User REVOKED bit to the key flags and re-generates the
ef8014e56f35bb36daa5fd2c313f5e7963e97aa1Tinderbox User <code class="filename">K*.private</code> files.</p>
ef8014e56f35bb36daa5fd2c313f5e7963e97aa1Tinderbox User<p>After revoking the active key, the zone must be signed
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt with both the revoked KSK and the new active KSK. (Smart
ef8014e56f35bb36daa5fd2c313f5e7963e97aa1Tinderbox User signing takes care of this automatically.)</p>
ef8014e56f35bb36daa5fd2c313f5e7963e97aa1Tinderbox User<p>Once a key has been revoked and used to sign the DNSKEY
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User RRset in which it appears, that key will never again be
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater accepted as a valid trust anchor by the resolver. However,
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater validation can proceed using the new active key (which had been
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater accepted by the resolver when it was a stand-by key).</p>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<p>See RFC 5011 for more details on key rollover
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater scenarios.</p>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<p>When a key has been revoked, its key ID changes,
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater increasing by 128, and wrapping around at 65535. So, for
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater example, the key "<code class="filename">Kexample.com.+005+10000</code>" becomes
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater "<code class="filename">Kexample.com.+005+10128</code>".</p>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p>If two keys have ID's exactly 128 apart, and one is
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt revoked, then the two key ID's will collide, causing several
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User problems. To prevent this,
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User <span><strong class="command">dnssec-keygen</strong></span> will not generate a new key if
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt another key is present which may collide. This checking will
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater only occur if the new keys are written to the same directory
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater which holds all other keys in use for that zone.</p>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p>Older versions of BIND 9 did not have this precaution.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Exercise caution if using key revocation on keys that were
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User generated by previous releases, or if using keys stored in
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User multiple directories or on multiple machines.</p>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p>It is expected that a future release of BIND 9 will
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User address this problem in a different way, by storing revoked
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater keys with their original unrevoked key ID's.</p>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<div class="titlepage"><div><div><h2 class="title" style="clear: both">
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<a name="pkcs11"></a>PKCS #11 (Cryptoki) support</h2></div></div></div>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<p>PKCS #11 (Public Key Cryptography Standard #11) defines a
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater platform- independent API for the control of hardware security
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User modules (HSMs) and other cryptographic support devices.</p>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<p>BIND 9 is known to work with two HSMs: The Sun SCA 6000
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater cryptographic acceleration board, tested under Solaris x86, and
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater the AEP Keyper network-attached key storage device, tested with
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater Debian Linux, Solaris x86 and Windows Server 2003.</p>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<div class="titlepage"><div><div><h3 class="title">
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<a name="id2607939"></a>Prerequisites</h3></div></div></div>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<p>See the HSM vendor documentation for information about
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater installing, initializing, testing and troubleshooting the
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p>BIND 9 uses OpenSSL for cryptography, but stock OpenSSL
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater does not yet fully support PKCS #11. However, a PKCS #11 engine
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater for OpenSSL is available from the OpenSolaris project. It has
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User been modified by ISC to work with with BIND 9, and to provide
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater new features such as PIN management and key by
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater reference.</p>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<p>The patched OpenSSL depends on a "PKCS #11 provider".
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater This is a shared library object, providing a low-level PKCS #11
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User interface to the HSM hardware. It is dynamically loaded by
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater OpenSSL at runtime. The PKCS #11 provider comes from the HSM
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater vendor, and and is specific to the HSM to be controlled.</p>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<p>There are two "flavors" of PKCS #11 support provided by
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater the patched OpenSSL, one of which must be chosen at
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater configuration time. The correct choice depends on the HSM
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<li><p>Use 'crypto-accelerator' with HSMs that have hardware
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater cryptographic acceleration features, such as the SCA 6000
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater board. This causes OpenSSL to run all supported
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User cryptographic operations in the HSM.</p></li>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<li><p>Use 'sign-only' with HSMs that are designed to
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User function primarily as secure key storage devices, but lack
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User hardware acceleration. These devices are highly secure, but
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User are not necessarily any faster at cryptography than the
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User system CPU — often, they are slower. It is therefore
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User most efficient to use them only for those cryptographic
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt functions that require access to the secured private key,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User such as zone signing, and to use the system CPU for all
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User other computationally-intensive operations. The AEP Keyper
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p>The modified OpenSSL code is included in the BIND 9.7.0
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User release, in the form of a context diff against the latest OpenSSL.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The latest OpenSSL version at the time of the BIND release
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater ISC will provide an updated patch as new versions of OpenSSL
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater are released. The version number in the following examples
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User is expected to change.</div>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Before building BIND 9 with PKCS #11 support, it will be
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater necessary to build OpenSSL with this patch in place and inform
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater it of the path to the HSM-specific PKCS #11 provider
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User$ <strong class="userinput"><code>wget <a href="" target="_top">http://www.openssl.org/source/openssl-0.9.8l.tar.gz</a></code></strong>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User$ <strong class="userinput"><code>tar zxf openssl-0.9.8l.tar.gz</code></strong>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p>Apply the patch from the BIND 9 release:</p>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User$ <strong class="userinput"><code>patch -p1 -d openssl-0.9.8l \
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User < bind-9.7.0/bin/pkcs11/openssl-0.9.8l-patch</code></strong>
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<h3 class="title">Note</h3>(Note that the patch file may not be compatible with the
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater "patch" utility on all operating systems. You may need to
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater install GNU patch.)</div>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<p>When building OpenSSL, place it in a non-standard
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater location so that it does not interfere with OpenSSL libraries
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater elsewhere on the system. In the following examples, we choose
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater to install into "/opt/pkcs11/usr". We will use this location
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater when we configure BIND 9.</p>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<div class="titlepage"><div><div><h4 class="title">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<a name="id2580318"></a>Building OpenSSL for the AEP Keyper on Linux</h4></div></div></div>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p>The AEP Keyper is a highly secure key storage device,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User but does not provide hardware cryptographic acceleration. It
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User can carry out cryptographic operations, but it is probably
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User slower than your system's CPU. Therefore, we choose the
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User 'sign-only' flavor when building OpenSSL.</p>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<p>The Keyper-specific PKCS #11 provider library is
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater delivered with the Keyper software. In this example, we place
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User$ <strong class="userinput"><code>cp pkcs11.GCC4.0.2.so.4.05 /opt/pkcs11/usr/lib/libpkcs11.so</code></strong>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p>This library is only available for Linux as a 32-bit
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User binary. If we are compiling on a 64-bit Linux system, it is
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User necessary to force a 32-bit build, by specifying -m32 in the
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User build options.</p>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<p>Finally, the Keyper library requires threads, so we
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater must specify -pthread.</p>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater$ <strong class="userinput"><code>cd openssl-0.9.8l</code></strong>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User$ <strong class="userinput"><code>/Configure linux-generic32 -m32 -pthread \
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User --pk11-libname=/opt/pkcs11/usr/lib/libpkcs11.so \
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User --pk11-flavor=sign-only \
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p>After configuring, run "<span><strong class="command">make</strong></span>"
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater and "<span><strong class="command">make test</strong></span>". If "<span><strong class="command">make
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater test</strong></span>" fails with "pthread_atfork() not found", you forgot to
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater add the -pthread above.</p>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<div class="titlepage"><div><div><h4 class="title">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<a name="id2606056"></a>Building OpenSSL for the SCA 6000 on Solaris</h4></div></div></div>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p>The SCA-6000 PKCS #11 provider is installed as a system
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User library, libpkcs11. It is a true crypto accelerator, up to 4
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater times faster than any CPU, so the flavor shall be
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt 'crypto-accelerator'.</p>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<p>In this example, we are building on Solaris x86 on an
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater AMD64 system.</p>
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User$ <strong class="userinput"><code>cd openssl-0.9.8l</code></strong>
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User$ <strong class="userinput"><code>/Configure solaris64-x86_64-cc \
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User --pk11-flavor=crypto-accelerator \
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<p>(For a 32-bit build, use "solaris-x86-cc" and
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p>After configuring, run
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">make</strong></span> and
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">make test</strong></span>.</p>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p>Once you have built OpenSSL, run
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User "<span><strong class="command">apps/openssl engine pkcs11</strong></span>" to confirm
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater that PKCS #11 support was compiled in correctly. The output
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater should be one of the following lines, depending on the flavor
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User (pkcs11) PKCS #11 engine support (sign only)
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User (pkcs11) PKCS #11 engine support (crypto accelerator)
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater "<span><strong class="command">apps/openssl engine pkcs11 -t</strong></span>". This will
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User attempt to initialize the PKCS #11 engine. If it is able to
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt do so successfully, it will report
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User “<span class="quote"><code class="literal">[ available ]</code></span>”.</p>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<p>If the output is correct, run
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater "<span><strong class="command">make install</strong></span>" which will install the
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater modified OpenSSL suite to
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater <code class="filename">/opt/pkcs11/usr</code>.</p>
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<div class="titlepage"><div><div><h3 class="title">
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<a name="id2606230"></a>Building BIND 9 with PKCS#11</h3></div></div></div>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p>When building BIND 9, the location of the custom-built
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User OpenSSL library must be specified via configure.</p>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h4 class="title">
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<a name="id2606238"></a>Configuring BIND 9 for Linux</h4></div></div></div>
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<p>To link with the PKCS #11 provider, threads must be
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User enabled in the BIND 9 build.</p>
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<p>The PKCS #11 library for the AEP Keyper is currently
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User only available as a 32-bit binary. If we are building on a
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User 64-bit host, we must force a 32-bit build by adding "-m32" to
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User the CC options on the "configure" command line.</p>
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User$ <strong class="userinput"><code>cd /bind-9.7.0</code></strong>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt$ <strong class="userinput"><code>/configure CC="gcc -m32" --enable-threads \
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt --with-pkcs11=/opt/pkcs11/usr/lib/libpkcs11.so</code></strong>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<div class="titlepage"><div><div><h4 class="title">
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<a name="id2606269"></a>Configuring BIND 9 for Solaris</h4></div></div></div>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<p>To link with the PKCS #11 provider, threads must be
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User enabled in the BIND 9 build.</p>
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater$ <strong class="userinput"><code>cd /bind-9.7.0</code></strong>
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater$ <strong class="userinput"><code>/configure CC="cc -xarch=amd64" --enable-threads \
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater --with-pkcs11=/usr/lib/64/libpkcs11.so</code></strong>
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<p>(For a 32-bit build, omit CC="cc -xarch=amd64".)</p>
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<p>If configure complains about OpenSSL not working, you
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater may have a 32/64-bit architecture mismatch. Or, you may have
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater incorrectly specified the path to OpenSSL (it should be the
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater same as the --prefix argument to the OpenSSL
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater Configure).</p>
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<p>After configuring, run
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User "<span><strong class="command">make</strong></span>",
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User "<span><strong class="command">make test</strong></span>" and
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User "<span><strong class="command">make install</strong></span>".</p>
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User<div class="titlepage"><div><div><h3 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="id2606325"></a>PKCS #11 Tools</h3></div></div></div>
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<p>BIND 9 includes a minimal set of tools to operate the
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User HSM, including
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater <span><strong class="command">pkcs11-keygen</strong></span> to generate a new key pair
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater within the HSM,
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater <span><strong class="command">pkcs11-list</strong></span> to list objects currently
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User available, and
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">pkcs11-destroy</strong></span> to remove objects.</p>
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User<p>In UNIX/Linux builds, these tools are built only if BIND
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User 9 is configured with the --with-pkcs11 option. (NOTE: If
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater --with-pkcs11 is set to "yes", rather than to the path of the
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User PKCS #11 provider, then the tools will be built but the
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater provider will be left undefined. Use the -m option or the
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater PKCS11_PROVIDER environment variable to specify the path to the
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User provider.)</p>
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<div class="titlepage"><div><div><h3 class="title">
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<a name="id2606356"></a>Using the HSM</h3></div></div></div>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p>First, we must set up the runtime environment so the
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater OpenSSL and PKCS #11 libraries can be loaded:</p>
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater$ <strong class="userinput"><code>export LD_LIBRARY_PATH=/opt/pkcs11/usr/lib:${LD_LIBRARY_PATH}</code></strong>
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<p>When operating an AEP Keyper, it is also necessary to
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User specify the location of the "machine" file, which stores
6478b87fd23bcd3ab74c25b261021fe19a239c4fTinderbox User information about the Keyper for use by PKCS #11 provider
9d557856c2a19ec95ee73245f60a92f8675cf5baTinderbox User library. If the machine file is in
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <code class="filename">/opt/Keyper/PKCS11Provider/machine</code>,
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater$ <strong class="userinput"><code>export KEYPER_LIBRARY_PATH=/opt/Keyper/PKCS11Provider</code></strong>
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<p>These environment variables must be set whenever running
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater any tool that uses the HSM, including
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater <span><strong class="command">pkcs11-keygen</strong></span>,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">pkcs11-list</strong></span>,
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater <span><strong class="command">pkcs11-destroy</strong></span>,
6478b87fd23bcd3ab74c25b261021fe19a239c4fTinderbox User <span><strong class="command">dnssec-keyfromlabel</strong></span>,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">dnssec-signzone</strong></span>,
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater <span><strong class="command">dnssec-keygen</strong></span>(which will use the HSM for
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User random number generation), and
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">named</strong></span>.</p>
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User<p>We can now create and use keys in the HSM. In this case,
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User we will create a 2048 bit key and give it the label
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User "sample-ksk":</p>
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User$ <strong class="userinput"><code>pkcs11-keygen -b 2048 -l sample-ksk</code></strong>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User$ <strong class="userinput"><code>pkcs11-list</code></strong>
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox Userobject[0]: handle 2147483658 class 3 label[8] 'sample-ksk' id[0]
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox Userobject[1]: handle 2147483657 class 2 label[8] 'sample-ksk' id[0]
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User<p>Before using this key to sign a zone, we must create a
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User pair of BIND 9 key files. The "dnssec-keyfromlabel" utility
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User does this. In this case, we will be using the HSM key
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User "sample-ksk" as the key-signing key for "example.net":</p>
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User$ <strong class="userinput"><code>dnssec-keyfromlabel -l sample-ksk -f KSK example.net</code></strong>
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User<p>The resulting K*.key and K*.private files can now be used
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User to sign the zone. Unlike normal K* files, which contain both
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User public and private key data, these files will contain only the
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User public key data, plus an identifier for the private key which
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User remains stored within the HSM. The HSM handles signing with the
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User private key.</p>
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User<p>If you wish to generate a second key in the HSM for use
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User as a zone-signing key, follow the same procedure above, using a
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User different keylabel, a smaller key size, and omitting "-f KSK"
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User from the dnssec-keyfromlabel arguments:</p>
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User$ <strong class="userinput"><code>pkcs11-keygen -b 1024 -l sample-zsk</code></strong>
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User$ <strong class="userinput"><code>dnssec-keyfromlabel -l sample-zsk example.net</code></strong>
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User<p>Alternatively, you may prefer to generate a conventional
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User on-disk key, using dnssec-keygen:</p>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User$ <strong class="userinput"><code>dnssec-keygen example.net</code></strong>
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User<p>This provides less security than an HSM key, but since
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User HSMs can be slow or cumbersome to use for security reasons, it
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User may be more efficient to reserve HSM keys for use in the less
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User frequent key-signing operation. The zone-signing key can be
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User rolled more frequently, if you wish, to compensate for a
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User reduction in key security.</p>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<p>Now you can sign the zone. (Note: If not using the -S
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">dnssec-signzone</strong></span>, it will be necessary to add
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User the contents of both
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User <code class="filename">K*.key</code> files to the zone master file before
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User signing it.)</p>
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User$ <strong class="userinput"><code>dnssec-signzone -S example.net</code></strong>
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox UserVerifying the zone using the following algorithms:
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox UserZone signing complete:
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox UserAlgorithm: NSEC3RSASHA1: ZSKs: 1, KSKs: 1 active, 0 revoked, 0 stand-by
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<div class="titlepage"><div><div><h3 class="title">
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User<a name="id2608124"></a>Specifying the engine on the command line</h3></div></div></div>
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User<p>The OpenSSL engine can be specified in
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User <span><strong class="command">named</strong></span> and all of the BIND
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User <span><strong class="command">dnssec-*</strong></span> tools by using the "-E
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <engine>" command line option. If BIND 9 is built with
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt the --with-pkcs11 option, this option defaults to "pkcs11".
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Specifying the engine will generally not be necessary unless
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User for some reason you wish to use a different OpenSSL
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User<p>If you wish to disable use of the "pkcs11" engine —
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt for troubleshooting purposes, or because the HSM is unavailable
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt — set the engine to the empty string. For example:</p>
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User$ <strong class="userinput"><code>dnssec-signzone -E '' -S example.net</code></strong>
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User<p>This causes
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <span><strong class="command">dnssec-signzone</strong></span> to run as if it were compiled
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User without the --with-pkcs11 option.</p>
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User<div class="titlepage"><div><div><h3 class="title">
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<a name="id2608443"></a>Running named with automatic zone re-signing</h3></div></div></div>
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User<p>If you want
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User <span><strong class="command">named</strong></span> to dynamically re-sign zones using HSM
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User keys, and/or to to sign new records inserted via nsupdate, then
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User named must have access to the HSM PIN. This can be accomplished
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User by placing the PIN into the openssl.cnf file (in the above
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User <code class="filename">/opt/pkcs11/usr/ssl/openssl.cnf</code>).</p>
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User<p>The location of the openssl.cnf file can be overridden by
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User setting the OPENSSL_CONF environment variable before running
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User openssl_conf = openssl_def
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User [ openssl_def ]
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User engines = engine_section
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User [ engine_section ]
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User pkcs11 = pkcs11_section
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User [ pkcs11_section ]
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User PIN = <em class="replaceable"><code><PLACE PIN HERE></code></em>
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User<p>This will also allow the dnssec-* tools to access the HSM
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User without PIN entry. (The pkcs11-* tools access the HSM directly,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User not via OpenSSL, so a PIN will still be required to use
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User<p>Placing the HSM's PIN in a text file in
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User this manner may reduce the security advantage of using an
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User HSM. Be sure this is what you want to do before configuring
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User OpenSSL in this way.</p>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<div class="titlepage"><div><div><h2 class="title" style="clear: both">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<a name="id2572077"></a>IPv6 Support in <acronym class="acronym">BIND</acronym> 9</h2></div></div></div>
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User <acronym class="acronym">BIND</acronym> 9 fully supports all currently
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User defined forms of IPv6 name to address and address to name
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User lookups. It will also use IPv6 addresses to make queries when
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User running on an IPv6 capable system.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User For forward lookups, <acronym class="acronym">BIND</acronym> 9 supports
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User only AAAA records. RFC 3363 deprecated the use of A6 records,
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User and client-side support for A6 records was accordingly removed
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User from <acronym class="acronym">BIND</acronym> 9.
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User However, authoritative <acronym class="acronym">BIND</acronym> 9 name servers still
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User load zone files containing A6 records correctly, answer queries
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User for A6 records, and accept zone transfer for a zone containing A6
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User For IPv6 reverse lookups, <acronym class="acronym">BIND</acronym> 9 supports
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User the traditional "nibble" format used in the
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User <span class="emphasis"><em>ip6.arpa</em></span> domain, as well as the older, deprecated
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span class="emphasis"><em>ip6.int</em></span> domain.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Older versions of <acronym class="acronym">BIND</acronym> 9
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User supported the "binary label" (also known as "bitstring") format,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User but support of binary labels has been completely removed per
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User Many applications in <acronym class="acronym">BIND</acronym> 9 do not understand
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User the binary label format at all any more, and will return an
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User error if given.
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User In particular, an authoritative <acronym class="acronym">BIND</acronym> 9
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User name server will not load a zone file containing binary labels.
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User For an overview of the format and structure of IPv6 addresses,
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User see <a href="Bv9ARM.ch09.html#ipv6addresses" title="IPv6 addresses (AAAA)">the section called “IPv6 addresses (AAAA)”</a>.
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User<div class="titlepage"><div><div><h3 class="title">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<a name="id2572344"></a>Address Lookups Using AAAA Records</h3></div></div></div>
a24330c4805a224191ab687d0291963062fe3355Tinderbox User The IPv6 AAAA record is a parallel to the IPv4 A record,
6825f304c5f0cc2d4ba22fa2b6f7a431f9c1de59Tinderbox User and, unlike the deprecated A6 record, specifies the entire
6825f304c5f0cc2d4ba22fa2b6f7a431f9c1de59Tinderbox User IPv6 address in a single record. For example,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Userhost 3600 IN AAAA 2001:db8::1
6825f304c5f0cc2d4ba22fa2b6f7a431f9c1de59Tinderbox User Use of IPv4-in-IPv6 mapped addresses is not recommended.
6825f304c5f0cc2d4ba22fa2b6f7a431f9c1de59Tinderbox User If a host has an IPv4 address, use an A record, not
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User a AAAA, with <code class="literal">::ffff:192.168.42.1</code> as
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<div class="titlepage"><div><div><h3 class="title">
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User<a name="id2572434"></a>Address to Name Lookups Using Nibble Format</h3></div></div></div>
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User When looking up an address in nibble format, the address
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User components are simply reversed, just as in IPv4, and
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <code class="literal">ip6.arpa.</code> is appended to the
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User resulting name.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User For example, the following would provide reverse name lookup for
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User a host with address
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User$ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 14400 IN PTR (
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<table width="100%" summary="Navigation footer">
dec590a3deb8e87380a8bd3a77d535dba3729bf6Tinderbox User<a accesskey="p" href="Bv9ARM.ch03.html">Prev</a>�</td>
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User<td width="40%" align="right">�<a accesskey="n" href="Bv9ARM.ch05.html">Next</a>
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User<td width="40%" align="left" valign="top">Chapter�3.�Name Server Configuration�</td>
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
2f161339d28f61a05dd92bbe01ce754e32e35addTinderbox User<td width="40%" align="right" valign="top">�Chapter�5.�The <acronym class="acronym">BIND</acronym> 9 Lightweight Resolver</td>