Bv9ARM.ch04.html revision 605b07cadd58ff1d8f89ddf277451ee87a542f9b
5569e7de51513952d89f29de08049ed6bb054d6eAutomatic Updater - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews - Copyright (C) 2000-2003 Internet Software Consortium.
ec5347e2c775f027573ce5648b910361aa926c01Automatic Updater - Permission to use, copy, modify, and distribute this software for any
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence - purpose with or without fee is hereby granted, provided that the above
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence - copyright notice and this permission notice appear in all copies.
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - PERFORMANCE OF THIS SOFTWARE.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<!-- $Id: Bv9ARM.ch04.html,v 1.64 2006/01/29 22:57:16 marka Exp $ -->
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<title>Chapter�4.�Advanced DNS Features</title>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
29747dfe5e073a299b3681e01f5c55540f8bfed7Mark Andrews<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<link rel="prev" href="Bv9ARM.ch03.html" title="Chapter�3.�Name Server Configuration">
899f7f9af527d3dfe8345dcc8210d7c23fc950afDavid Lawrence<link rel="next" href="Bv9ARM.ch05.html" title="Chapter�5.�The BIND 9 Lightweight Resolver">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<table width="100%" summary="Navigation header">
c4958494a98a59ce25e9fecad76a9ab0e36cc59fDanny Mayer<tr><th colspan="3" align="center">Chapter�4.�Advanced DNS Features</th></tr>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<a accesskey="p" href="Bv9ARM.ch03.html">Prev</a>�</td>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch05.html">Next</a>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<div class="titlepage"><div><div><h2 class="title">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<a name="Bv9ARM.ch04"></a>Chapter�4.�Advanced DNS Features</h2></div></div></div>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect1"><a href="Bv9ARM.ch04.html#notify">Notify</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect1"><a href="Bv9ARM.ch04.html#dynamic_update">Dynamic Update</a></span></dt>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#journal">The journal file</a></span></dt></dl></dd>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect1"><a href="Bv9ARM.ch04.html#incremental_zone_transfers">Incremental Zone Transfers (IXFR)</a></span></dt>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2552168">Split DNS</a></span></dt>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<dt><span class="sect1"><a href="Bv9ARM.ch04.html#tsig">TSIG</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2552619">Generate Shared Keys for Each Pair of Hosts</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2552693">Copying the Shared Secret to Both Machines</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2552704">Informing the Servers of the Key's Existence</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2552743">Instructing the Server to Use the Key</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2552801">TSIG Key Based Access Control</a></span></dt>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2552845">Errors</a></span></dt>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2552859">TKEY</a></span></dt>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2552977">SIG(0)</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect1"><a href="Bv9ARM.ch04.html#DNSSEC">DNSSEC</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2553181">Generating Keys</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2553251">Signing the Zone</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2553330">Configuring Servers</a></span></dt>
2918b5bda6a55c301eb87992b5f2acd7176d0737David Lawrence<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2553404">IPv6 Support in <span class="acronym">BIND</span> 9</a></span></dt>
2918b5bda6a55c301eb87992b5f2acd7176d0737David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2553534">Address Lookups Using AAAA Records</a></span></dt>
959cf5e112c41ba8da2a202f51bc0c7a3cf47f68Tatuya JINMEI 神明達哉<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2553556">Address to Name Lookups Using Nibble Format</a></span></dt>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<div class="titlepage"><div><div><h2 class="title" style="clear: both">
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<a name="notify"></a>Notify</h2></div></div></div>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <span class="acronym">DNS</span> NOTIFY is a mechanism that allows master
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence servers to notify their slave servers of changes to a zone's data. In
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence response to a <span><strong class="command">NOTIFY</strong></span> from a master server, the
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence slave will check to see that its version of the zone is the
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence current version and, if not, initiate a zone transfer.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein For more information about <span class="acronym">DNS</span>
0cfbb9285a96f1355e5a3bd458624eaed2f16846Automatic Updater <span><strong class="command">NOTIFY</strong></span>, see the description of the
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein <span><strong class="command">notify</strong></span> option in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a> and
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein the description of the zone option <span><strong class="command">also-notify</strong></span> in
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>. The <span><strong class="command">NOTIFY</strong></span>
d409ceeda41a256e8114423674d844d5f5035ee8Bob Halley protocol is specified in RFC 1996.
8f804834e2b537da5c8bc81f986143a46147b490Andreas Gustafsson<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence As slave zone can also be a master to other slaves, named,
8f804834e2b537da5c8bc81f986143a46147b490Andreas Gustafsson by default, sends <span><strong class="command">NOTIFY</strong></span> messages for every zone
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence it loads. Specifying <span><strong class="command">notify master-only;</strong></span> will
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein cause named to only send <span><strong class="command">NOTIFY</strong></span> for master
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein zones that it loads.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<div class="titlepage"><div><div><h2 class="title" style="clear: both">
8f804834e2b537da5c8bc81f986143a46147b490Andreas Gustafsson<a name="dynamic_update"></a>Dynamic Update</h2></div></div></div>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein Dynamic Update is a method for adding, replacing or deleting
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence records in a master server by sending it a special form of DNS
0cfbb9285a96f1355e5a3bd458624eaed2f16846Automatic Updater messages. The format and meaning of these messages is specified
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein in RFC 2136.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein Dynamic update is enabled by
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence including an <span><strong class="command">allow-update</strong></span> or
0cfbb9285a96f1355e5a3bd458624eaed2f16846Automatic Updater <span><strong class="command">update-policy</strong></span> clause in the
8862388bcb44f634cbfc3e69f11ff4cb76590a4bMark Andrews <span><strong class="command">zone</strong></span> statement.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein Updating of secure zones (zones using DNSSEC) follows
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein RFC 3007: RRSIG and NSEC records affected by updates are automatically
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein regenerated by the server using an online zone key.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein Update authorization is based
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence on transaction signatures and an explicit server policy.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<div class="titlepage"><div><div><h3 class="title">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<a name="journal"></a>The journal file</h3></div></div></div>
61e9c1cdbe29683bb2db388e4fc6a6fd59315cefDavid Lawrence All changes made to a zone using dynamic update are stored
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein in the zone's journal file. This file is automatically created
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence by the server when the first dynamic update takes place.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence The name of the journal file is formed by appending the extension
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein <code class="filename">.jnl</code> to the name of the
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence corresponding zone
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence file unless specifically overridden. The journal file is in a
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence binary format and should not be edited manually.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence The server will also occasionally write ("dump")
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence the complete contents of the updated zone to its zone file.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence This is not done immediately after
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein each dynamic update, because that would be too slow when a large
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein zone is updated frequently. Instead, the dump is delayed by
1a487fb7d230403bf1b5d6628542134f52c80653Michael Graff up to 15 minutes, allowing additional updates to take place.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence When a server is restarted after a shutdown or crash, it will replay
1a487fb7d230403bf1b5d6628542134f52c80653Michael Graff the journal file to incorporate into the zone any updates that
c4958494a98a59ce25e9fecad76a9ab0e36cc59fDanny Mayer place after the last zone dump.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein Changes that result from incoming incremental zone transfers are
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein journalled in a similar way.
1a487fb7d230403bf1b5d6628542134f52c80653Michael Graff The zone files of dynamic zones cannot normally be edited by
1a487fb7d230403bf1b5d6628542134f52c80653Michael Graff hand because they are not guaranteed to contain the most recent
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence dynamic changes - those are only in the journal file.
5fe5a0c02634eaadfcbc3528bf2c184557110a3bAndreas Gustafsson The only way to ensure that the zone file of a dynamic zone
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein is up to date is to run <span><strong class="command">rndc stop</strong></span>.
df0f58959ed82a2a43ca8d816ce9592541df9f2fMark Andrews If you have to make changes to a dynamic zone
ecf7a1812527d5557564b71363dabec491980246Mark Andrews manually, the following procedure will work: Disable dynamic updates
88f7da46901f5d1218e354768674e72e9190d05aMichael Graff to the zone using
1a487fb7d230403bf1b5d6628542134f52c80653Michael Graff <span><strong class="command">rndc freeze <em class="replaceable"><code>zone</code></em></strong></span>.
b161f87be81548d1b6d0210a7e138a08fbb2d3e5David Lawrence This will also remove the zone's <code class="filename">.jnl</code> file
b161f87be81548d1b6d0210a7e138a08fbb2d3e5David Lawrence and update the master file. Edit the zone file. Run
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <span><strong class="command">rndc thaw <em class="replaceable"><code>zone</code></em></strong></span>
edcd1247ad7e81bb8b430e610d9718f64c70f05dDavid Lawrence to reload the changed zone and re-enable dynamic updates.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<div class="titlepage"><div><div><h2 class="title" style="clear: both">
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence<a name="incremental_zone_transfers"></a>Incremental Zone Transfers (IXFR)</h2></div></div></div>
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence The incremental zone transfer (IXFR) protocol is a way for
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein slave servers to transfer only changed data, instead of having to
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein transfer the entire zone. The IXFR protocol is specified in RFC
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein 1995. See <a href="Bv9ARM.ch09.html#proposed_standards">Proposed Standards</a>.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein When acting as a master, <span class="acronym">BIND</span> 9
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence supports IXFR for those zones
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein where the necessary change history information is available. These
1b106e224d3931e85d68c091fe1ec7758d9f07cbAndreas Gustafsson include master zones maintained by dynamic update and slave zones
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein whose data was obtained by IXFR. For manually maintained master
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence zones, and for slave zones obtained by performing a full zone
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence transfer (AXFR), IXFR is supported only if the option
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein <span><strong class="command">ixfr-from-differences</strong></span> is set
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein to <strong class="userinput"><code>yes</code></strong>.
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence When acting as a slave, <span class="acronym">BIND</span> 9 will
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence attempt to use IXFR unless
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein it is explicitly disabled. For more information about disabling
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence IXFR, see the description of the <span><strong class="command">request-ixfr</strong></span> clause
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence of the <span><strong class="command">server</strong></span> statement.
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence<div class="titlepage"><div><div><h2 class="title" style="clear: both">
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence<a name="id2552168"></a>Split DNS</h2></div></div></div>
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence Setting up different views, or visibility, of the DNS space to
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence internal and external resolvers is usually referred to as a
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence <span class="emphasis"><em>Split DNS</em></span> setup. There are several
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence reasons an organization would want to set up its DNS this way.
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence One common reason for setting up a DNS system this way is
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence to hide "internal" DNS information from "external" clients on the
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence Internet. There is some debate as to whether or not this is actually
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein Internal DNS information leaks out in many ways (via email headers,
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence for example) and most savvy "attackers" can find the information
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein they need using other means.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence However, since listing addresses of internal servers that
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein external clients cannot possibly reach can result in
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence connection delays and other annoyances, an organization may
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein choose to use a Split DNS to present a consistant view of itself
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence to the outside world.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Another common reason for setting up a Split DNS system is
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence to allow internal networks that are behind filters or in RFC 1918
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein space (reserved IP space, as documented in RFC 1918) to resolve DNS
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein on the Internet. Split DNS can also be used to allow mail from outside
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence back in to the internal network.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Here is an example of a split DNS setup:
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Let's say a company named <span class="emphasis"><em>Example, Inc.</em></span>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein has several corporate sites that have an internal network with
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Internet Protocol (IP) space and an external demilitarized zone (DMZ),
edcd1247ad7e81bb8b430e610d9718f64c70f05dDavid Lawrence or "outside" section of a network, that is available to the public.
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence <span class="emphasis"><em>Example, Inc.</em></span> wants its internal clients
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence to be able to resolve external hostnames and to exchange mail with
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence people on the outside. The company also wants its internal resolvers
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein to have access to certain internal-only zones that are not available
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence at all outside of the internal network.
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence In order to accomplish this, the company will set up two sets
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence of name servers. One set will be on the inside network (in the
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence IP space) and the other set will be on bastion hosts, which are
edcd1247ad7e81bb8b430e610d9718f64c70f05dDavid Lawrence hosts that can talk to both sides of its network, in the DMZ.
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence The internal servers will be configured to forward all queries,
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence except queries for <code class="filename">site1.internal</code>, <code class="filename">site2.internal</code>, <code class="filename">site1.example.com</code>,
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence and <code class="filename">site2.example.com</code>, to the servers
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence DMZ. These internal servers will have complete sets of information
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence for <code class="filename">site1.example.com</code>, <code class="filename">site2.example.com</code>,<span class="emphasis"><em></em></span> <code class="filename">site1.internal</code>,
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence and <code class="filename">site2.internal</code>.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein To protect the <code class="filename">site1.internal</code> and <code class="filename">site2.internal</code> domains,
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein the internal name servers must be configured to disallow all queries
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein to these domains from any external hosts, including the bastion
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein The external servers, which are on the bastion hosts, will
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence be configured to serve the "public" version of the <code class="filename">site1</code> and <code class="filename">site2.example.com</code> zones.
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence This could include things such as the host records for public servers
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein (<code class="filename">www.example.com</code> and <code class="filename">ftp.example.com</code>),
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein and mail exchange (MX) records (<code class="filename">a.mx.example.com</code> and <code class="filename">b.mx.example.com</code>).
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence In addition, the public <code class="filename">site1</code> and <code class="filename">site2.example.com</code> zones
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence should have special MX records that contain wildcard (`*') records
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein pointing to the bastion hosts. This is needed because external mail
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence servers do not have any other way of looking up how to deliver mail
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence to those internal hosts. With the wildcard records, the mail will
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence be delivered to the bastion host, which can then forward it on to
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein internal hosts.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein Here's an example of a wildcard MX record:
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<pre class="programlisting">* IN MX 10 external1.example.com.</pre>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Now that they accept mail on behalf of anything in the internal
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein network, the bastion hosts will need to know how to deliver mail
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence to internal hosts. In order for this to work properly, the resolvers
edcd1247ad7e81bb8b430e610d9718f64c70f05dDavid Lawrence the bastion hosts will need to be configured to point to the internal
edcd1247ad7e81bb8b430e610d9718f64c70f05dDavid Lawrence name servers for DNS resolution.
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence Queries for internal hostnames will be answered by the internal
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence servers, and queries for external hostnames will be forwarded back
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein out to the DNS servers on the bastion hosts.
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence In order for all this to work properly, internal clients will
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence need to be configured to query <span class="emphasis"><em>only</em></span> the internal
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein name servers for DNS queries. This could also be enforced via
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence filtering on the network.
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence If everything has been set properly, <span class="emphasis"><em>Example, Inc.</em></span>'s
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein internal clients will now be able to:
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Look up any hostnames in the <code class="literal">site1</code>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <code class="literal">site2.example.com</code> zones.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein Look up any hostnames in the <code class="literal">site1.internal</code> and
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence <code class="literal">site2.internal</code> domains.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<li>Exchange mail with internal AND external people.</li>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Hosts on the Internet will be able to:
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence Look up any hostnames in the <code class="literal">site1</code>
6a8832f784bd53aa6afbda22f6187cea6490e1e1Andreas Gustafsson <code class="literal">site2.example.com</code> zones.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein Exchange mail with anyone in the <code class="literal">site1</code> and
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence <code class="literal">site2.example.com</code> zones.
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence Here is an example configuration for the setup we just
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence described above. Note that this is only configuration information;
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein for information on how to configure your zone files, see <a href="Bv9ARM.ch03.html#sample_configuration" title="Sample Configurations">the section called “Sample Configurations”</a>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Internal DNS server config:
fc80027fb54b501cdd88461bf879d078259e0226David Lawrenceacl internals { 172.16.72.0/24; 192.168.1.0/24; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrenceacl externals { <code class="varname">bastion-ips-go-here</code>; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence forward only;
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein forwarders { // forward to external servers
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence <code class="varname">bastion-ips-go-here</code>;
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein allow-transfer { none; }; // sample allow-transfer (no one)
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-query { internals; externals; }; // restrict query access
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein allow-recursion { internals; }; // restrict recursion
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrencezone "site1.example.com" { // sample master zone
6a8832f784bd53aa6afbda22f6187cea6490e1e1Andreas Gustafsson forwarders { }; // do normal iterative
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence // resolution (do not forward)
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-query { internals; externals; };
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein allow-transfer { internals; };
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrencezone "site2.example.com" { // sample slave zone
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence masters { 172.16.72.3; };
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein forwarders { };
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein allow-query { internals; externals; };
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein allow-transfer { internals; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence forwarders { };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-query { internals; };
edcd1247ad7e81bb8b430e610d9718f64c70f05dDavid Lawrence allow-transfer { internals; }
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence masters { 172.16.72.3; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence forwarders { };
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein allow-query { internals };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-transfer { internals; }
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence External (bastion host) DNS server config:
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austeinacl internals { 172.16.72.0/24; 192.168.1.0/24; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrenceacl externals { bastion-ips-go-here; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-transfer { none; }; // sample allow-transfer (no one)
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-query { any; }; // default query access
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-query-cache { internals; externals; }; // restrict cache access
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-recursion { internals; externals; }; // restrict recursion
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencezone "site1.example.com" { // sample slave zone
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein type master;
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence allow-transfer { internals; externals; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence masters { another_bastion_host_maybe; };
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein allow-transfer { internals; externals; }
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence In the <code class="filename">resolv.conf</code> (or equivalent) on
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein the bastion host(s):
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencenameserver 172.16.72.2
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencenameserver 172.16.72.3
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austeinnameserver 172.16.72.4
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<div class="titlepage"><div><div><h2 class="title" style="clear: both">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<a name="tsig"></a>TSIG</h2></div></div></div>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence This is a short guide to setting up Transaction SIGnatures
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence (TSIG) based transaction security in <span class="acronym">BIND</span>. It describes changes
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence to the configuration file as well as what changes are required for
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein different features, including the process of creating transaction
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein keys and using transaction signatures with <span class="acronym">BIND</span>.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <span class="acronym">BIND</span> primarily supports TSIG for server
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence to server communication.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence This includes zone transfer, notify, and recursive query messages.
edcd1247ad7e81bb8b430e610d9718f64c70f05dDavid Lawrence Resolvers based on newer versions of <span class="acronym">BIND</span> 8 have limited support
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence TSIG can also be useful for dynamic update. A primary
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence server for a dynamic zone should control access to the dynamic
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence update service, but IP-based access control is insufficient.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence The cryptographic access control provided by TSIG
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein is far superior. The <span><strong class="command">nsupdate</strong></span>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence program supports TSIG via the <code class="option">-k</code> and
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <code class="option">-y</code> command line options or inline by use
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence of the <span><strong class="command">key</strong></span>.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<div class="titlepage"><div><div><h3 class="title">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<a name="id2552619"></a>Generate Shared Keys for Each Pair of Hosts</h3></div></div></div>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence A shared secret is generated to be shared between <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host2</em></span>.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence An arbitrary key name is chosen: "host1-host2.". The key name must
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein be the same on both hosts.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<div class="titlepage"><div><div><h4 class="title">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<a name="id2552636"></a>Automatic Generation</h4></div></div></div>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein The following command will generate a 128 bit (16 byte) HMAC-MD5
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence key as described above. Longer keys are better, but shorter keys
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence are easier to read. Note that the maximum key length is 512 bits;
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein keys longer than that will be digested with MD5 to produce a 128
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <strong class="userinput"><code>dnssec-keygen -a hmac-md5 -b 128 -n HOST host1-host2.</code></strong>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein The key is in the file <code class="filename">Khost1-host2.+157+00000.private</code>.
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence Nothing directly uses this file, but the base-64 encoded string
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence can be extracted from the file and used as a shared secret:
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<pre class="programlisting">Key: La/E5CjG9O+os1jq0a2jdA==</pre>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein The string "<code class="literal">La/E5CjG9O+os1jq0a2jdA==</code>" can
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence be used as the shared secret.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<div class="titlepage"><div><div><h4 class="title">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<a name="id2552675"></a>Manual Generation</h4></div></div></div>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence The shared secret is simply a random sequence of bits, encoded
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence in base-64. Most ASCII strings are valid base-64 strings (assuming
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence the length is a multiple of 4 and only valid characters are used),
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence so the shared secret can be manually generated.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Also, a known string can be run through <span><strong class="command">mmencode</strong></span> or
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence a similar program to generate base-64 encoded data.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<div class="titlepage"><div><div><h3 class="title">
0cfbb9285a96f1355e5a3bd458624eaed2f16846Automatic Updater<a name="id2552693"></a>Copying the Shared Secret to Both Machines</h3></div></div></div>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence This is beyond the scope of DNS. A secure transport mechanism
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence should be used. This could be secure FTP, ssh, telephone, etc.
fc6f5743aa860861fe39ca2680d9aa08e39d3039Andreas Gustafsson<div class="titlepage"><div><div><h3 class="title">
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<a name="id2552704"></a>Informing the Servers of the Key's Existence</h3></div></div></div>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Imagine <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host 2</em></span>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein both servers. The following is added to each server's <code class="filename">named.conf</code> file:
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencekey host1-host2. {
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein algorithm hmac-md5;
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence The algorithm, hmac-md5, is the only one supported by <span class="acronym">BIND</span>.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein The secret is the one generated above. Since this is a secret, it
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence is recommended that either <code class="filename">named.conf</code> be non-world
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence readable, or the key directive be added to a non-world readable
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence file that is included by
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein At this point, the key is recognized. This means that if the
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence server receives a message signed by this key, it can verify the
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence signature. If the signature is successfully verified, the
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence response is signed by the same key.
b161f87be81548d1b6d0210a7e138a08fbb2d3e5David Lawrence<div class="titlepage"><div><div><h3 class="title">
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<a name="id2552743"></a>Instructing the Server to Use the Key</h3></div></div></div>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein Since keys are shared between two hosts only, the server must
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein be told when keys are to be used. The following is added to the <code class="filename">named.conf</code> file
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein for <span class="emphasis"><em>host1</em></span>, if the IP address of <span class="emphasis"><em>host2</em></span> is
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrenceserver 10.1.2.3 {
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence keys { host1-host2. ;};
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence Multiple keys may be present, but only the first is used.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein This directive does not contain any secrets, so it may be in a
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence world-readable
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence If <span class="emphasis"><em>host1</em></span> sends a message that is a request
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein to that address, the message will be signed with the specified key. <span class="emphasis"><em>host1</em></span> will
0ef59d22882fc5d28f4683fdbe88aefd8eaad6f3Francis Dupont expect any responses to signed messages to be signed with the same
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence A similar statement must be present in <span class="emphasis"><em>host2</em></span>'s
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence configuration file (with <span class="emphasis"><em>host1</em></span>'s address) for <span class="emphasis"><em>host2</em></span> to
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence sign request messages to <span class="emphasis"><em>host1</em></span>.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<div class="titlepage"><div><div><h3 class="title">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<a name="id2552801"></a>TSIG Key Based Access Control</h3></div></div></div>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <span class="acronym">BIND</span> allows IP addresses and ranges
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein to be specified in ACL
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence definitions and
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <span><strong class="command">allow-{ query | transfer | update }</strong></span>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein This has been extended to allow TSIG keys also. The above key would
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein be denoted <span><strong class="command">key host1-host2.</strong></span>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein An example of an allow-update directive would be:
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austeinallow-update { key host1-host2. ;};
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein This allows dynamic updates to succeed only if the request
b161f87be81548d1b6d0210a7e138a08fbb2d3e5David Lawrence was signed by a key named
fc6f5743aa860861fe39ca2680d9aa08e39d3039Andreas Gustafsson "<span><strong class="command">host1-host2.</strong></span>".
0c7b7a19e5a3c23fbb789238dcc4d43cd55387a0Brian Wellington You may want to read about the more
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein powerful <span><strong class="command">update-policy</strong></span> statement in <a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a>.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<div class="titlepage"><div><div><h3 class="title">
1b038dbf0659fce246485562601ee851a9841ba1David Lawrence<a name="id2552845"></a>Errors</h3></div></div></div>
fc6f5743aa860861fe39ca2680d9aa08e39d3039Andreas Gustafsson The processing of TSIG signed messages can result in
b161f87be81548d1b6d0210a7e138a08fbb2d3e5David Lawrence several errors. If a signed message is sent to a non-TSIG aware
b161f87be81548d1b6d0210a7e138a08fbb2d3e5David Lawrence server, a FORMERR will be returned, since the server will not
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein understand the record. This is a result of misconfiguration,
0c7b7a19e5a3c23fbb789238dcc4d43cd55387a0Brian Wellington since the server must be explicitly configured to send a TSIG
1b038dbf0659fce246485562601ee851a9841ba1David Lawrence signed message to a specific server.
0cfbb9285a96f1355e5a3bd458624eaed2f16846Automatic Updater If a TSIG aware server receives a message signed by an
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein unknown key, the response will be unsigned with the TSIG
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein extended error code set to BADKEY. If a TSIG aware server
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein receives a message with a signature that does not validate, the
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein response will be unsigned with the TSIG extended error code set
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein to BADSIG. If a TSIG aware server receives a message with a time
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein outside of the allowed range, the response will be signed with
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein the TSIG extended error code set to BADTIME, and the time values
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein will be adjusted so that the response can be successfully
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein verified. In any of these cases, the message's rcode is set to
b74896ead5671943135727b50d86d1040d7ffbf3David Lawrence<div class="titlepage"><div><div><h2 class="title" style="clear: both">
b74896ead5671943135727b50d86d1040d7ffbf3David Lawrence<a name="id2552859"></a>TKEY</h2></div></div></div>
b74896ead5671943135727b50d86d1040d7ffbf3David Lawrence<p><span><strong class="command">TKEY</strong></span>
b74896ead5671943135727b50d86d1040d7ffbf3David Lawrence is a mechanism for automatically generating a shared secret
b74896ead5671943135727b50d86d1040d7ffbf3David Lawrence between two hosts. There are several "modes" of
b74896ead5671943135727b50d86d1040d7ffbf3David Lawrence <span><strong class="command">TKEY</strong></span> that specify how the key is generated
b74896ead5671943135727b50d86d1040d7ffbf3David Lawrence or assigned. <span class="acronym">BIND</span> 9 implements only one of
b74896ead5671943135727b50d86d1040d7ffbf3David Lawrence these modes, the Diffie-Hellman key exchange. Both hosts are
b74896ead5671943135727b50d86d1040d7ffbf3David Lawrence required to have a Diffie-Hellman KEY record (although this
b74896ead5671943135727b50d86d1040d7ffbf3David Lawrence record is not required to be present in a zone). The
b74896ead5671943135727b50d86d1040d7ffbf3David Lawrence <span><strong class="command">TKEY</strong></span> process must use signed messages,
b74896ead5671943135727b50d86d1040d7ffbf3David Lawrence signed either by TSIG or SIG(0). The result of
b74896ead5671943135727b50d86d1040d7ffbf3David Lawrence <span><strong class="command">TKEY</strong></span> is a shared secret that can be used to
b74896ead5671943135727b50d86d1040d7ffbf3David Lawrence sign messages with TSIG. <span><strong class="command">TKEY</strong></span> can also be
b74896ead5671943135727b50d86d1040d7ffbf3David Lawrence used to delete shared secrets that it had previously
b74896ead5671943135727b50d86d1040d7ffbf3David Lawrence The <span><strong class="command">TKEY</strong></span> process is initiated by a
b74896ead5671943135727b50d86d1040d7ffbf3David Lawrence or server by sending a signed <span><strong class="command">TKEY</strong></span>
b74896ead5671943135727b50d86d1040d7ffbf3David Lawrence (including any appropriate KEYs) to a TKEY-aware server. The
b74896ead5671943135727b50d86d1040d7ffbf3David Lawrence server response, if it indicates success, will contain a
b74896ead5671943135727b50d86d1040d7ffbf3David Lawrence <span><strong class="command">TKEY</strong></span> record and any appropriate keys.
b74896ead5671943135727b50d86d1040d7ffbf3David Lawrence this exchange, both participants have enough information to
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence determine the shared secret; the exact process depends on the
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <span><strong class="command">TKEY</strong></span> mode. When using the
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein Diffie-Hellman
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <span><strong class="command">TKEY</strong></span> mode, Diffie-Hellman keys are
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence and the shared secret is derived by both participants.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<div class="titlepage"><div><div><h2 class="title" style="clear: both">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<a name="id2552977"></a>SIG(0)</h2></div></div></div>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein <span class="acronym">BIND</span> 9 partially supports DNSSEC SIG(0)
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence transaction signatures as specified in RFC 2535 and RFC2931.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence uses public/private keys to authenticate messages. Access control
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence is performed in the same manner as TSIG keys; privileges can be
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein granted or denied based on the key name.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence When a SIG(0) signed message is received, it will only be
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein verified if the key is known and trusted by the server; the server
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence will not attempt to locate and/or validate the key.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein SIG(0) signing of multiple-message TCP streams is not
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence The only tool shipped with <span class="acronym">BIND</span> 9 that
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence generates SIG(0) signed messages is <span><strong class="command">nsupdate</strong></span>.
30576c592b538cab293cf6e1f6265d376cd5a12cAndreas Gustafsson<div class="titlepage"><div><div><h2 class="title" style="clear: both">
30576c592b538cab293cf6e1f6265d376cd5a12cAndreas Gustafsson<a name="DNSSEC"></a>DNSSEC</h2></div></div></div>
30576c592b538cab293cf6e1f6265d376cd5a12cAndreas Gustafsson Cryptographic authentication of DNS information is possible
30576c592b538cab293cf6e1f6265d376cd5a12cAndreas Gustafsson through the DNS Security (<span class="emphasis"><em>DNSSEC-bis</em></span>) extensions,
30576c592b538cab293cf6e1f6265d376cd5a12cAndreas Gustafsson defined in RFC 4033, RFC 4034 and RFC 4035.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein This section describes the creation and use of DNSSEC signed zones.
30576c592b538cab293cf6e1f6265d376cd5a12cAndreas Gustafsson In order to set up a DNSSEC secure zone, there are a series
30576c592b538cab293cf6e1f6265d376cd5a12cAndreas Gustafsson of steps which must be followed. <span class="acronym">BIND</span>
edcd1247ad7e81bb8b430e610d9718f64c70f05dDavid Lawrence with several tools
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein that are used in this process, which are explained in more detail
1b038dbf0659fce246485562601ee851a9841ba1David Lawrence below. In all cases, the <code class="option">-h</code> option prints a
1b038dbf0659fce246485562601ee851a9841ba1David Lawrence full list of parameters. Note that the DNSSEC tools require the
1b038dbf0659fce246485562601ee851a9841ba1David Lawrence keyset files to be in the working directory or the
1b038dbf0659fce246485562601ee851a9841ba1David Lawrence directory specified by the <code class="option">-d</code> option, and
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein that the tools shipped with BIND 9.2.x and earlier are not compatible
1b038dbf0659fce246485562601ee851a9841ba1David Lawrence with the current ones.
1b038dbf0659fce246485562601ee851a9841ba1David Lawrence There must also be communication with the administrators of
1b038dbf0659fce246485562601ee851a9841ba1David Lawrence the parent and/or child zone to transmit keys. A zone's security
1b038dbf0659fce246485562601ee851a9841ba1David Lawrence status must be indicated by the parent zone for a DNSSEC capable
1b038dbf0659fce246485562601ee851a9841ba1David Lawrence resolver to trust its data. This is done through the presense
1b038dbf0659fce246485562601ee851a9841ba1David Lawrence or absence of a <code class="literal">DS</code> record at the
1b038dbf0659fce246485562601ee851a9841ba1David Lawrence For other servers to trust data in this zone, they must
edcd1247ad7e81bb8b430e610d9718f64c70f05dDavid Lawrence either be statically configured with this zone's zone key or the
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein zone key of another zone above this one in the DNS tree.
1b038dbf0659fce246485562601ee851a9841ba1David Lawrence<div class="titlepage"><div><div><h3 class="title">
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<a name="id2553181"></a>Generating Keys</h3></div></div></div>
2918b5bda6a55c301eb87992b5f2acd7176d0737David Lawrence The <span><strong class="command">dnssec-keygen</strong></span> program is used to
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein generate keys.
87cafc5e70f79f2586d067fbdd64f61bbab069d2David Lawrence A secure zone must contain one or more zone keys. The
87cafc5e70f79f2586d067fbdd64f61bbab069d2David Lawrence zone keys will sign all other records in the zone, as well as
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein the zone keys of any secure delegated zones. Zone keys must
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein have the same name as the zone, a name type of
2918b5bda6a55c301eb87992b5f2acd7176d0737David Lawrence <span><strong class="command">ZONE</strong></span>, and must be usable for
2918b5bda6a55c301eb87992b5f2acd7176d0737David Lawrence authentication.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein It is recommended that zone keys use a cryptographic algorithm
2918b5bda6a55c301eb87992b5f2acd7176d0737David Lawrence designated as "mandatory to implement" by the IETF; currently
2918b5bda6a55c301eb87992b5f2acd7176d0737David Lawrence the only one is RSASHA1.
2918b5bda6a55c301eb87992b5f2acd7176d0737David Lawrence The following command will generate a 768 bit RSASHA1 key for
2918b5bda6a55c301eb87992b5f2acd7176d0737David Lawrence the <code class="filename">child.example</code> zone:
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein <strong class="userinput"><code>dnssec-keygen -a RSASHA1 -b 768 -n ZONE child.example.</code></strong>
2918b5bda6a55c301eb87992b5f2acd7176d0737David Lawrence Two output files will be produced:
87cafc5e70f79f2586d067fbdd64f61bbab069d2David Lawrence <code class="filename">Kchild.example.+005+12345.key</code> and
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein <code class="filename">Kchild.example.+005+12345.private</code>
87cafc5e70f79f2586d067fbdd64f61bbab069d2David Lawrence 12345 is an example of a key tag). The key file names contain
2918b5bda6a55c301eb87992b5f2acd7176d0737David Lawrence the key name (<code class="filename">child.example.</code>),
2918b5bda6a55c301eb87992b5f2acd7176d0737David Lawrence is DSA, 1 is RSAMD5, 5 is RSASHA1, etc.), and the key tag (12345 in
2918b5bda6a55c301eb87992b5f2acd7176d0737David Lawrence The private key (in the <code class="filename">.private</code>
2918b5bda6a55c301eb87992b5f2acd7176d0737David Lawrence used to generate signatures, and the public key (in the
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein <code class="filename">.key</code> file) is used for signature
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein verification.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein To generate another key with the same properties (but with
2918b5bda6a55c301eb87992b5f2acd7176d0737David Lawrence a different key tag), repeat the above command.
2918b5bda6a55c301eb87992b5f2acd7176d0737David Lawrence The public keys should be inserted into the zone file by
2918b5bda6a55c301eb87992b5f2acd7176d0737David Lawrence including the <code class="filename">.key</code> files using
2918b5bda6a55c301eb87992b5f2acd7176d0737David Lawrence <span><strong class="command">$INCLUDE</strong></span> statements.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<div class="titlepage"><div><div><h3 class="title">
1b038dbf0659fce246485562601ee851a9841ba1David Lawrence<a name="id2553251"></a>Signing the Zone</h3></div></div></div>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence The <span><strong class="command">dnssec-signzone</strong></span> program is used
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein sign a zone.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Any <code class="filename">keyset</code> files corresponding
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein to secure subzones should be present. The zone signer will
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence generate <code class="literal">NSEC</code> and <code class="literal">RRSIG</code>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence records for the zone, as well as <code class="literal">DS</code>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein the child zones if <code class="literal">'-d'</code> is specified.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein If <code class="literal">'-d'</code> is not specified then
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence DS RRsets for
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence the secure child zones need to be added manually.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence The following command signs the zone, assuming it is in a
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence file called <code class="filename">zone.child.example</code>. By
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence default, all zone keys which have an available private key are
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence used to generate signatures.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein <strong class="userinput"><code>dnssec-signzone -o child.example zone.child.example</code></strong>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence One output file is produced:
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <code class="filename">zone.child.example.signed</code>. This
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein should be referenced by <code class="filename">named.conf</code>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence input file for the zone.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<p><span><strong class="command">dnssec-signzone</strong></span>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence will also produce a keyset and dsset files and optionally a
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence dlvset file. These are used to provide the parent zone
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein administators with the <code class="literal">DNSKEYs</code> (or their
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence corresponding <code class="literal">DS</code> records) that are the
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence secure entry point to the zone.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<div class="titlepage"><div><div><h3 class="title">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<a name="id2553330"></a>Configuring Servers</h3></div></div></div>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein To enable <span><strong class="command">named</strong></span> to respond appropriately
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence to DNS requests from DNSSEC aware clients
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <span><strong class="command">dnssec-enable</strong></span> must be set to yes.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence To enable <span><strong class="command">named</strong></span> to validate answers from
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein other servers both <span><strong class="command">dnssec-enable</strong></span> and
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <span><strong class="command">dnssec-validate</strong></span> must be set and some
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence some <span><strong class="command">trusted-keys</strong></span> must be configured
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein <span><strong class="command">trusted-keys</strong></span> are copies of DNSKEY RRs
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence for zones that are used to form the first link the the
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence cryptographic chain of trust. All keys listed in
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein <span><strong class="command">trusted-keys</strong></span> (and corresponding zones)
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence are deemed to exist and only the listed keys will be used
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence to validated the DNSKEY RRset that they are from.
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence <span><strong class="command">trusted-keys</strong></span> are described in more detail
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein later in this document.
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence Unlike <span class="acronym">BIND</span> 8, <span class="acronym">BIND</span>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein 9 does not verify signatures on load, so zone keys for
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence authoritative zones do not need to be specified in the
1be10d46cbdf77d1a59a2e7512b72daceea47058David Lawrence configuration file.
1be10d46cbdf77d1a59a2e7512b72daceea47058David Lawrence After DNSSEC gets established, a typical DNSSEC configuration
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence will look something like the following. It has a one or
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein more public keys for the root. This allows answers from
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence outside the organization to be validated. It will also
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein have several keys for parts of the namespace the organization
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence controls. These are here to ensure that named is immune
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence to compromises in the DNSSEC components of the security
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence of parent zones.
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrencetrusted-keys {
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence /* Root Key */
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein"." 257 3 3 "BNY4wrWM1nCfJ+CXd0rVXyYmobt7sEEfK3clRbGaTwSJxrGkxJWoZu6I7PzJu/
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence E9gx4UC1zGAHlXKdE4zYIpRhaBKnvcC2U9mZhkdUpd1Vso/HAdjNe8LmMlnzY3
1be10d46cbdf77d1a59a2e7512b72daceea47058David Lawrence zy2Xy4klWOADTPzSv9eamj8V18PHGjBLaVtYvk/ln5ZApjYghf+6fElrmLkdaz
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein MQ2OCnACR817DF4BBa7UR/beDHyp5iWTXWSi6XmoJLbG9Scqc7l70KDqlvXR3M
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein /lUUVRbkeg1IPJSidmK3ZyCllh4XSKbje/45SKucHgnwU5jefMtq66gKodQj+M
1be10d46cbdf77d1a59a2e7512b72daceea47058David Lawrence iA21AfUVe7u99WzTLzY3qlxDhxYQQ20FQ97S+LKUTpQcq27R7AT3/V5hRQxScI
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence Nqwcz4jYqZD2fQdgxbcDTClU0CRBdiieyLMNzXG3";
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence/* Key for out organizations forward zone */
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austeinexample.com. 257 3 5 "AwEAAaxPMcR2x0HbQV4WeZB6oEDX+r0QM65KbhTjrW1ZaARmPhEZZe
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence 3Y9ifgEuq7vZ/zGZUdEGNWy+JZzus0lUptwgjGwhUS1558Hb4JKUbb
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence OTcM8pwXlj0EiX3oDFVmjHO444gLkBO UKUf/mC7HvfwYH/Be22GnC
1a487fb7d230403bf1b5d6628542134f52c80653Michael Graff lrinKJp1Og4ywzO9WglMk7jbfW33gUKvirTHr25GL7STQUzBb5Usxt
1a487fb7d230403bf1b5d6628542134f52c80653Michael Graff 8lgnyTUHs1t3JwCY5hKZ6CqFxmAVZP20igTixin/1LcrgX/KMEGd/b
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein iuvF4qJCyduieHukuY3H4XMAcR+xia2 nIUPvm/oyWR8BW/hWdzOvn
1a487fb7d230403bf1b5d6628542134f52c80653Michael Graff/* Key for our reverse zone. */
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein2.0.192.IN-ADDRPA.NET. 257 3 5 "AQOnS4xn/IgOUpBPJ3bogzwcxOdNax071L18QqZnQQQA
1a487fb7d230403bf1b5d6628542134f52c80653Michael Graff VVr+iLhGTnNGp3HoWQLUIzKrJVZ3zggy3WwNT6kZo6c0
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence yOI6BgPsw+YZdzlYMaIJGf4M4dyoKIhzdZyQ2bYQrjyQ
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence 4LB0lC7aOnsMyYKHHYeRv PxjIQXmdqgOJGq+vsevG06
see <a href="Bv9ARM.ch09.html#ipv6addresses" title="IPv6 addresses (AAAA)">the section called “IPv6 addresses (AAAA)”</a>.
$ORIGIN example.com.
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 14400 IN PTR host.example.com.