Project

General

Profile

Actions

DNS » History » Revision 11

« Previous | Revision 11/20 (diff) | Next »
Marc Dequènes, 2019-01-01 10:50


DNS

Zone Management

Adding a Zone

On each DNS server, master zone can be created/updated on /etc/bind/masters/. The ownership needs to be:
  • banya: if a user zone which should be updatable via the Banya service
  • root:bind in all other cases

The zone is declared in host_vars/_dnsserver/dns.yml_ and the playbook playbooks/tenants/duckcorp/dns.yml is in charge of updating all configurations. Only the zone content is not Ansible managed.

Updating a Zone

Better to check the file validity before updating the zone:

named-checkzone <zone-name> <zone-file>

Then to update the zone, if DNSSEC-signed (except on Elwing, use the usual reload command below, more info in the DNSSEC chapter):

ods-signer sign <zone-name>

else:
rndc reload <zone-name>

In case the zone is DNSSEC-signed, the publishing of keys in the parent zone is to be done manually (not automated yet); more details below.

Reseting the Zone Serial

See: http://www.microhowto.info/howto/reset_the_serial_number_of_a_dns_zone.html

Secure Zone Transfers

To secure zone transfers, a TSIG key needs to be created and added on both sides. Beware the key name must be identical on both side.

DNS server groups (servers allowed to request transfer) and keys can be defined in host_vars/<dnsserver>/dns.yml and host_vars/<dnsserver>/dns.vault.yml respectively. If they are to be used on all servers, then you can declare them in group_vars/dns_servers/dns.yml and group_vars/dns_servers/dns.vault.yml respectively.

You can a new key using:

dnssec-keygen -a HMAC-SHA512 -b 512 -n HOST taiste

Take the 'Key' part in 'Ktaiste.*.private' file, to put into the configuration.

The same playbook (playbooks/tenants/duckcorp/dns.yml) is used to update the configuration.

DNSSEC (with OpenDNSSEC, all server except Elwing)

Introduction

Better read some documentation before fiddling with the controls:

List of keys with states and IDs:

ods-enforcer key list -v

List of planned rollover dates:

ods-enforcer rollover list

Key Rollover

The ZSK key rollover is handled automatically by OpenDNSSEC, so admins have nothing to do.

The KSK rollover implies contact with the parent zone and a manual step to get the DS entry in their zone is needed.

KSK Rollover Workflow

Here are the states and what needs to be done:
  • publish state:
    • when a new key is created, either for a new zone of to replace an old key, this key is added to the zone but not used to sign yet
    • action: wait
  • ready state:
    • the new zone, containing the key, is considered propagated, but not used to sign yet
    • action: export the key, either using the DNSKEY or DS format depending on the provider (ods-enforcer key export -z <zone-name> --keytype KSK --keystate ready for the DNSKEY, or add --ds for the DS)
    • action: add the key to the parent zone
    • action: wait for the key to appear in the parent zone (host -t DS -r <zone-name> $(host -t NS <tld> | grep "name server" | head -n 1 | cut -d" " -f4))
    • action: notify OpenDNSSEC (ods-enforcer key ds-seen -z <zone-name> --cka_id <key-id>)
  • active state:
    • the key is used for signing
    • action: wait for the next rollover
  • retire state:
    • the key is no more used to sign but still advertized
    • action: remove the key from the parent zone
    • action: wait for the key to disappear from the parent zone (host -t DS -r <zone-name> $(host -t NS <zone-tld> | grep "name server" | head -n 1 | cut -d" " -f4))
    • action: notify OpenDNSSEC (ods-enforcer key ds-gone -z <zone-name> --cka_id <key-id>)
    • action: when you're sure everything went fine, purge old keys (ods-enforcer key purge --policy default)

Checking a Zone

Test a Zone using a DNSSEC-enabled resolver:

dig <zone-name> +dnssec

You need to get the ad flag. If you get the aa flag, then you're interrogating one of the official NS for the zone, then try on another server to be sure your configuration is OK (remotely with @<server> as first command option).

Test a Zone using an external web tool:

Forcing a policy change to be applied at once

ods-enforcer enforce

Unsecuring a Zone

If you plan to continue using the zone, better not remove DNSSEC support at once or until all DNSSEC information leaves the caches on the Internet problems are to be expected.

A special unsigned policy has been added to the opendnssec Ansible role. It was created using the specifications in the OpenDNSSEC documentation but has never been tested.

In Ansible you need to affect this policy to your zone and deploy. Then follow the KSK rollover procedure until all keys have been retired. Then you can unconfigure DNSSEC for the zone.

To buy some time you might try to force an early rollover (see below).

Forcing an Early Rollover

ods-enforcer key rollover --zone <zone-name> --keytype ksk

DNSSEC (with Bind, only Elwing)

Here are notes about using Bind inline-signing and key management in place of OpenDNSSEC. Until this is deemed stable enough and well tested, this will only affect DNSSEC-enabled zones on Elwing. Important fixes for inline-signing are expected in version 9.13 (so 9.14 stable), and hopefully more DNSSEC tooling improvements.

All general info above about DNSSEC does not change, expecially the rollover steps are similar even if the tooling change, and testing the zone is identical.

The Ansible bind role has been updated in a branch to be able to use Bind directly for DNSSEC. Our Ansible repository now tracks this branch (which still supports OpenDNSSEC) and add the necessary parameters to use it. Please look at the role's documentation to understand the inner technical details, this page is about administration of the solution.

Introduction

Better read some documentation before fiddling with the controls:

Key materials are initially created by the role when a zone is declared in Ansible, so no need to do anything outside Ansible. Cleanup when a zone is removed is not yet done though. As Bind is not using the usual date-based zone serial, it can be less misleading to reset the serial (see dedicated chapter above).

Zone Status

General zone info, including the real published serial (after signing, resigning if it happens, rollovers…) and planned signing events:

rndc zonestatus <zone-name>

Zone Keys

To know which keys are currently signing a zone:

rndc signing -list <zone-name>

There is no way yet to know which is the KSK or ZSK without looking at the key materials. Keys are stored in /etc/bind/keys and you can use the key ID to locate the corresponding file this way:

ls /etc/bind/keys/K<zone-name>.+*+*<key-id>.key

Inside you can read the key type (KSK/ZSK) and the lifetime schedule (so important rollover dates).

DO NOT CHANGE KEY INFORMATION !!! Do not even use the dnssec-settime tool directly. dnssec-keymgr is in charge of the key maintenance according to the policy. Read more about rollover below.

Parent Zone Publishing

To see if the zone keys are properly published in the parent zone:

dnssec-checkds <zone-name>

(SHA-1 is obsolete, so not published)

Key Rollover

The ZSK key rollover is handled automatically by Bind (dnssec-keymgr in crontab), so admins have nothing to do.

The KSK rollover implies contact with the parent zone and a manual step to get the DS entry in their zone is needed. Creating the new keys and planning the change is also done automatically using the same tool.

To get a view of the schedule (past events for currently involved keys are displayed too) (beware it is using UTC):

dnssec-coverage -K /etc/bind/keys -m 1w -d 1d -k

KSK Rollover Workflow

The workflow is the same except there is no way to notify bind a change occurred, thus we must do the rollover in time or update the policy to allow more time (via Ansible parameters).

Currently we need to check manually when to do the KSK rollover. The coverage command above and next key event in the zone info should help build a little script to warn us in time.

To get the DS RR to set in the parent zone, first get the absolute filename for the current KSK key (see previous chapter, any of the key or private file would do), and use this command:

dnssec-dsfromkey -2 <ksk-filename>

The plan in the long run is to use CDS/CDNSKEY (RFC 7344). Some interesting reading about an implementation:
https://jpmens.net/2017/09/21/parents-children-cds-cdnskey-records-and-dnssec-cds/

Forcing a policy change to be applied at once

Via Ansible it is possible to change the policy directly, then either wait a few hours or run dnssec-keymgr manually (as bind user).

Unsecuring a Zone

First the DS needs to be removed from the parent zone, then we need to wait for the DS TTL to expire before unsigning.

The Ansible config can then be updated. Key materials need to be removed manually.

Forcing an Early Rollover

Currently I'm not sure how it would interact with the dnssec-keymgr operations so I need to test.

It is possible to do so: https://blog.webernetz.net/dnssec-ksk-emergency-rollover/

In our case we already do have pre-generated waiting keys scheduled to be injected, so changing the timing of the current key to reduce its lifetime and rerunning dnssec-keymgr manually (as bind user) should do the trick, but I need to test.

Checking Servers

Updated by Marc Dequènes 10 months ago · 11 revisions