• bind9

bind9

See Also

• DNS

• PowerDNS

About

• https://www.isc.org/bind/

• https://gitlab.isc.org/isc-projects/bind9

• youtube Internet Systems Consortium

BIND 9 has evolved to be a very flexible, full-featured DNS system. Whatever your application is, BIND 9 probably has the required features. As the first, oldest, and most commonly deployed solution, there are more network engineers who are already familiar with BIND 9 than with any other system.

BIND 9 is transparent open source, licensed under the MPL 2.0 license. Users are free to add functionality to BIND 9 and contribute back to the community through our open Gitlab.

Bundy

Bind10 was ceased and is now named Bundy. The BUNDY project is currently in hibernation status. It is not dead, but it is also not alive either.

• https://bundy-dns.de/

• https://github.com/bundy-dns/bundy

Directories

Docs

• Bind9 doc ftp current

• Bind9 doc latest

Uploaded Bv9ARM

Current ARM

Determine the current version of bind in Debian

   1 # dpkg -l bind9| grep bind
   2 ii  bind9          1:9.11.5.P4+dfsg-5 amd64        Internet Domain Name Server

• Bindv9.11 Annotated reference manual

• Bindv9.17 Annotated reference manual

Install

Without DHCP-Server

   1 aptitude install bind9 dnsutils

With DHCP-Server

   1 aptitude install autodns-dhcp

This is a lightweight package that pulls the following dependencies:

• bind9
• dnsutils
• isc-dhcp-server
• perl

The cronjob that comes with the package may be easily deactivated.
/etc/cron.d/autodns-dhcp

   1 #
   2 # Regular cron jobs for the autodns-dhcp package
   3 #
   4 #*/1 * * * *    root    /usr/bin/test -x /usr/sbin/autodns-dhcp_cron && /usr/sbin/autodns-dhcp_cron
   5 

Important commands

Get current daemon status

   1 rndc status

Print running config (but oscure secrets)

   1 named-checkconf -px

Flush complete cache

   1 rndc flush

You actually may want to be more specific

   1 rndc flushtree example.com

Configure

Create directories for journals and zones

   1 install -o root -g bind -m 2775 -d /var/lib/bind/zones
   2 install -o bind -g bind -m 2755 -d /var/lib/bind/journal
   3 # Just for administrative convenience
   4 ln -s /var/lib/bind/zones /etc/bind/zones

Main configuration file

I decided to move acls, auth and logging configuration to their own files and include them in the main configuration file. They may be reused on other servers as well.

/etc/bind/named.conf

   1 //
   2 // Please read /usr/share/doc/bind9/README.Debian.gz for information on the
   3 // structure of BIND configuration files in Debian, *BEFORE* you customize
   4 // this configuration file.
   5 //
   6 // If you are just adding zones, please do that in /etc/bind/named.conf.local
   7 
   8 include "/etc/bind/named.conf.logging";
   9 include "/etc/bind/named.conf.options";
  10 include "/etc/bind/named.conf.acls";
  11 include "/etc/bind/named.conf.auth";
  12 include "/etc/bind/named.conf.local";
  13 //DEFAULT ZONES CANNOT BE INCLUDED HERE SINCE WE ARE USING VIEWS
  14 // SEE: named.conf.local
  15 //include "/etc/bind/named.conf.default-zones";
  16 

Logging

Basic logging

Default logging got extended by some info for debugging dynamic updates.

To use the path /var/log/bind you must extend the apparmor profile, otherwise leave it to /var/log/named. It's much easier to just create a symlink.

Create the directory

   1 install -o bind -g adm -m 2750 -d /var/log/named
   2 ### FOR MY OWN LAZYNESS I SET A LINK
   3 ln -s /var/log/named /var/log/bind

/etc/bind/named.conf.logging

   1 logging {
   2         channel null {
   3                 null;
   4         };
   5         channel update_debug {
   6                 file            "/var/log/named/update-debug.log" versions 10 size 10m;
   7                 severity        debug   3;
   8                 print-category  yes;
   9                 print-severity  yes;
  10                 print-time      yes;
  11         };
  12         channel security_info {
  13                 file            "/var/log/named/security.info" versions 10 size 10m;
  14                 severity        info;
  15                 print-category  yes;
  16                 print-severity  yes;
  17                 print-time      yes;
  18                 //stderr;
  19         };
  20         channel general_info {
  21                 file            "/var/log/named/general.info" versions 10 size 10m;
  22                 severity        info;
  23                 print-category  yes;
  24                 print-severity  yes;
  25                 print-time      yes;
  26                 //stderr;
  27         };
  28         channel general_warn {
  29                 severity        warning;
  30                 syslog          local7;
  31                 print-category  yes;
  32                 print-severity  yes;
  33                 print-time      yes;
  34                 //stderr;
  35         };
  36 
  37         // BIND9 LOGGING CATEGORIES
  38         //client cname config database default delegation-only dispatch dnssec dnstap
  39         //edns-disabled general lame-servers network notify queries query-errors
  40         //rate-limit resolver rpz security spill trust-anchor-telemetry unmatched update
  41         //update-security xfer-in xfer-out
  42 
  43         category general                { general_warn; };
  44         category general                { general_info; };
  45         category rate-limit             { security_info; };
  46         category security               { security_info; };
  47         category update                 { update_debug; };
  48         category update-security        { security_info;
  49                                           update_debug; };
  50         category notify                 { update_debug; };
  51 };
  52 
  53 // vim: set syntax=named:
  54 

Adjust apparmor profile

In retrospective it may be easier to simply set a symlink than extending the apparmor config.

   1 ln -s /var/log/named /var/log/bind

Extend apparmor profile /etc/apparmor.d/local/usr.sbin.named

   1   # some people like to put logs in /var/log/named/ instead of having
   2   # syslog do the heavy lifting.
   3   /var/log/bind/** rw,
   4   /var/log/bind/ rw,

This path must match the named apparmor-profile /etc/apparmor.d/{,local/}usr.sbin.named or bind will not start with the following error:

Jun 18 15:04:18 kvm2 named[6707]: isc_stdio_open '/var/log/bind/update-debug.log' failed: permission denied
Jun 18 15:04:18 kvm2 named[6707]: configuring logging: permission denied
Jun 18 15:04:18 kvm2 named[6707]: loading configuration: permission denied
Jun 18 15:04:18 kvm2 named[6707]: exiting (due to fatal error)

   1 install -o bind -g adm -m 750 -d /var/log/bind

Query Log

During a migration it may be necessary to determine, which clients are using the server. This can be accomplished using the query log. You should not forget the versions and size limit, it grows rapidly.

/etc/bind/named.conf.logging

   1         channel querylog_info {
   2                 file            "/var/log/bind/query.log" versions 1 size 10m;
   3                 severity        info;
   4                 print-category  yes;
   5                 print-severity  yes;
   6                 print-time      yes;
   7                 //stderr;
   8         };
   9 
  10         category queries { querylog_info; };

Regular-expression magic from
https://www.regular-expressions.info/ip.html

Determine RFC1918 client

   1 grep -Eo 'client \<[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\>' \
   2         /var/log/bind/query.log \
   3         |sed 's/client //' \
   4         |grep -E '^(10|172\.(1[6-9]|2[0-9]|3[01])|192\.168)\.' \
   5         |sort \
   6         |uniq

Logrotate

Just remove versions 10 size 10m from the file config in /etc/bind/named.conf.logging

Please also take a look on ISC logrotate settings in bind-9

/etc/logrotate.d/named_custom

   1 /var/log/named/*.log
   2 /var/log/named/*.info {
   3   compress
   4   create 0644 bind adm
   5   daily
   6   dateext
   7   missingok
   8   notifempty
   9   size 10M
  10   rotate 14
  11   sharedscripts
  12   postrotate
  13     /usr/sbin/rndc reconfig > /dev/null 2>/dev/null || true
  14   endscript
  15 }
  16 

Options

Some common options to all instances of bind9 around in the infrastructure.

• rate limit
• max-cache-size
• disable IPv6

/etc/bind/named.conf.options

   1 options {
   2 //      attach-cache            cache_name;
   3 //      version                 version_string;
   4 //      hostname                hostname_string;
   5 //      server-id               server_id_string;
   6         directory               "/var/cache/bind";              # path_name;
   7 //      key-directory           "/var/lib/bind/keys";           # path_name;
   8 //      managed-keys-directory  "/var/lib/bind/managed_keys";   # path_name;
   9 //      named-xfer              "/var/cache/bind";              # path_name;  // obsolete
  10 
  11         // If there is a firewall between you and nameservers you want
  12         // to talk to, you may need to fix the firewall to allow multiple
  13         // ports to talk.  See http://www.kb.cert.org/vuls/id/800113
  14 
  15         // If your ISP provided one or more IP addresses for stable
  16         // nameservers, you probably want to use them as forwarders.
  17         // Uncomment the following block, and insert the addresses replacing
  18         // the all-0's placeholder.
  19 
  20         // forwarders {
  21         //      0.0.0.0;
  22         // };
  23 
  24         //========================================================================
  25         // If BIND logs error messages about the root key being expired,
  26         // you will need to update your keys.  See https://www.isc.org/bind-keys
  27         //========================================================================
  28         dnssec-validation       auto;
  29 
  30         auth-nxdomain           no;                     # conform to RFC1035
  31         dump-file               "/var/cache/bind/named_dump.db";
  32         listen-on               { any; };               # Default "any;"
  33         listen-on-v6            { none; };              # Default
  34         allow-transfer          { rockstable_dns; };    # { address_match_list };
  35         empty-zones-enable      yes ;                   # Default no
  36 //      empty-zones-enable      no ;                    # Default no
  37 //      disable-empty-zone      zone_name ;
  38         allow-recursion { any; };       # Default with 9.4.1 { localhost; localnets; };
  39 //      allow-query { any; };
  40 //      allow-query-cache { any; };
  41         rate-limit {
  42                 all-per-second 80;      # integer;
  43                 //errors-per-second     # integer default responses-per-second;
  44                 exempt-clients {
  45                         localhost;      # address_match_element;
  46                         kvm2_nets_int;
  47                         kvm2_nets_ext;
  48                 };
  49                 //ipv4-prefix-length    # integer default 24;
  50                 //ipv6-prefix-length    # integer default 56;
  51                 //log-only boolean;             
  52                 max-table-size 20480;   # integer default 20000;
  53                 min-table-size 512;     # integer default 500;
  54                 //nodata-per-second     # integer default responses-per-second;
  55                 //nxdomains-per-second  # integer default responses-per-second;
  56                 qps-scale 200;          # integer;
  57                 //referrals-per-second  # integer default responses-per-second; 
  58                 responses-per-second 15;        # integer default 0 (no-limit);
  59                 slip 3;                 # integer default 2;            
  60                 window 15;              # integer default 15;
  61         };
  62 //      listen-on-v6 { any; };
  63         //PER VIEW - DEFAULT: 90%
  64         max-cache-size 256m;
  65 };
  66 
  67 // vim: set syntax=named:
  68 

Rate-limit

• Rate Limiting in DNS mit BIND9

• ISC KB Using the Response Rate Limiting Feature

• https://bind9.readthedocs.io/en/latest/reference.html?#response-rate-limiting

The rate-limit above is applied at the options (and not the view) level to be committed to the recursion. A whitelist has been applied to leave internal clients without restrictions. Therefore more aggressive limits can be set. Additionally i'm using a #fail2ban jail on udp/domain to block very aggressive sources aggressivly. TCP should not be blocked to allow slipped truncated queries TC=1 to be answered via tcp.

This will throttle single clients and networks to mask of 24 or 56 effectivly But this won't stop DDoS with a high amount of sources that stay under the radar.

Statistics

Statistics options

   1 options {
   2         //memstatistics boolean;
   3         //memstatistics-file # quoted_string; default is named.memstatsin cwd.
   4         //statistics-file # quoted_string; default is named.stats in cwd.
   5 };

Get current working directory

   1 ls -l /proc/$(pidof named)/cwd
   2 lrwxrwxrwx 1 bind bind 0 Aug 19 09:33 /proc/8213/cwd -> /var/cache/bind

View the statistics

   1 rndc stats
   2 view /var/cache/bind/named.stats

ACLs

Using ACLs is a good idea

Define ACLs for your networks and ip-interfaces. This will simplify your configuration and make it more readable.

address_match_list

A list of one or more ip_addr, ip_prefix, key_id, or acl_name elements, see ARM Section 6.1.

Only IPs - no DNS-Names or DNS resolution in ACLs.

/etc/bind/named.conf.acls

   1 // ACCESS CONTROL LISTS
   2 
   3 // ROCKSTABLE DNS-SERVERS
   4 
   5 acl ns2.rockstable.org { kvm1_eth0; };
   6 acl ns3.rockstable.org { kvm2_enp0s31f6; };
   7 acl ns4.rockstable.org { ns4_eth0; };
   8 // GROUP THEM TOGETHER
   9 acl rockstable_dns {
  10         ns2.rockstable.org;
  11         ns3.rockstable.org;
  12         ns4.rockstable.org;
  13 };
  14 
  15 // NETWORKS
  16 
  17 acl     rockstable_org  { 176.9.178.16/29; };
  18 acl     rockstable_it   { 178.63.149.224/28; };
  19 
  20 acl     kvm2_nets_int { …; …; };
  21 acl     kvm2_nets_ext { rockstable_it; rockstable_org; };
  22 
  23 // Exotic networks, client networks, …
  24 // …
  25 
  26 // INTERFACES
  27 acl     kvm1_eth0       { 176.9.99.233; };
  28 acl     kvm2_enp0s31f6  { 195.201.246.253; };
  29 acl     ns4_eth0        { 78.47.38.48; };
  30 
  31 // Exotic clients, name-server interfaces in client networks, …
  32 // …
  33 
  34 // vim: set syntax=named:
  35 

Auth

For creation of a TSIG key please see
#dnssec-keygen - TSIG

Secrets (e.g. for TSIG (Transaction SIGnature)) are separated in a file from the rest of the configuration, since they deserve protection.
Make sure this file has correct unix-permissions!
This file is later included from the main configuration file.

   1 FILE_AUTH="/etc/bind/named.conf.auth"
   2 [ -f "$FILE_AUTH" ]
   3 chown root:bind "$FILE_AUTH"
   4 chmod 0640 "$FILE_AUTH"

/etc/bind/named.conf.auth

   1 // KEYS
   2 key DNS_REPLICATOR_INTERNAL {
   3         algorithm       HMAC-SHA512;
   4         secret          "ENDLESS_LONG_SECRET_KEY_FOR_INTERNAL_VIEW";
   5 };
   6 
   7 key DNS_REPLICATOR_EXTERNAL {
   8         algorithm       HMAC-SHA512;
   9         secret          "ENDLESS_LONG_SECRET_KEY_FOR_EXTERNAL_VIEW";
  10 };
  11 
  12 // MASTERS
  13 // INTERNAL
  14 masters masters_rockstable_org_internal port 53 {
  15         176.9.99.233 port 53 key DNS_REPLICATOR_INTERNAL;
  16 };
  17 
  18 masters masters_rockstable_it_internal port 53 {
  19         195.201.246.253 port 53 key DNS_REPLICATOR_INTERNAL;
  20 };
  21 
  22 // EXTERNAL
  23 masters masters_rockstable_org_external port 53 {
  24         176.9.99.233 port 53 key DNS_REPLICATOR_EXTERNAL;
  25 };
  26 
  27 masters masters_rockstable_it_external port 53 {
  28         195.201.246.253 port 53 key DNS_REPLICATOR_EXTERNAL;
  29 };
  30 
  31 // vim: set syntax=named:
  32 

Local

A slave-only setup authenticated using TSIG with only a view "external".

/etc/bind/named.conf.local

   1 //
   2 //      Do any local configuration here
   3 //
   4 
   5 //      Consider adding the 1918 zones here, if they are not used in your
   6 //      organization
   7 //include "/etc/bind/zones.rfc1918";
   8 
   9 //      be authoritative for the rockstable.org forward and reverse zones, and for
  10 //      broadcast zones
  11 
  12 view external {
  13         // TAKEN FROM named.conf.default-zones
  14         include "/etc/bind/named.conf.default-zones";
  15 
  16         match-clients {
  17                  key DNS_REPLICATOR_EXTERNAL;
  18                 !key DNS_REPLICATOR_INTERNAL;
  19                 any;
  20         };
  21 
  22         //REVERSE ZONE DEFINITIONS (INTERNAL)
  23         //-> NONE
  24 
  25         //FORWARD ZONE DEFINITIONS
  26         zone "rockstable.org" {
  27                 type                    slave;
  28                 masters                 { masters_rockstable_org_external; };
  29                 masterfile-format       text;     # (text|raw)
  30                 file                    "/var/lib/bind/zones/db.org.rockstable";
  31                 journal                 "/var/lib/bind/journal/db.org.rockstable.jnl";  # string ;
  32 
  33                 check-names             warn;     # (warn|fail|ignore) ;
  34                 notify                  yes;      # yes_or_no | explicit | master-only ;
  35                 zone-statistics         yes;      # yes_or_no ;
  36         };
  37 
  38         zone "rockstable.it" {
  39                 type                    slave;
  40                 masters                 { masters_rockstable_it_external; };
  41                 masterfile-format       text;     # (text|raw)
  42                 file                    "/var/lib/bind/zones/db.it.rockstable";
  43                 journal                 "/var/lib/bind/journal/db.it.rockstable.jnl";   # string ;
  44                 check-names             warn;     # (warn|fail|ignore) ;
  45                 notify                  yes;      # yes_or_no | explicit | master-only ;
  46                 zone-statistics         yes;      # yes_or_no ;
  47         };
  48 };
  49 
  50 // vim: syntax=named:
  51 

Forwarding

nhs.uk Forward first vs only

From bind ARM 9.17

Forwarding

The forwarding facility can be used to create a large site-wide cache on a few servers, reducing traffic over links to external name servers. It can also be used to allow queries by servers that do not have direct access to the Internet, but wish to look up exterior names anyway. Forwarding occurs only on those queries for which the server is not authoritative and does not have the answer in its cache.

forward

This option is only meaningful if the forwarders list is not empty. A value of first is the default and causes the server to query the forwarders first; if that does not answer the question, the server then looks for the answer itself. If only is specified, the server only queries the forwarders.

forwarders

This specifies a list of IP addresses to which queries are forwarded. The default is the empty list (no forwarding). Each address in the list can be associated with an optional port number and/or DSCP value, and a default port number and DSCP value can be set for the entire list. Forwarding can also be configured on a per-domain basis, allowing for the global forwarding options to be overridden in a variety of ways. Particular domains can be set to use different forwarders, or have a different forward only/first behavior, or not forward at all; see zone Statement Grammar.

In the example reverse zones are resolved using forwarders only.

/etc/bind/named.conf.local

   1 // FORWARDS
   2 zone "0.10.in-addr.arpa" {
   3         type forward;
   4         forward only;
   5         forwarders {
   6                 10.0.0.5;
   7                 10.0.0.6;
   8                 10.0.0.7;
   9         };
  10 };
  11 
  12 zone "2.10.in-addr.arpa" {
  13         type forward;
  14         forward only;
  15         forwarders {
  16                 10.2.0.5;
  17                 10.2.0.6;
  18                 10.2.0.7;
  19         };
  20 };

Changing a dynamic zone with views

When you are using a dynamic zones with views there are some steps you need to walk through to update a zone.

   1 ZONE="rockstable.org"
   2 ### "IN" IS SIMPLY THE CLASS OF ZONE (CASE INSENSITIVE)
   3 VIEW="external"
   4 
   5 ### FREEZE A DYNAMIC ZONE
   6 rndc freeze "$ZONE" IN "$VIEW"
   7 ### EDIT THE ZONE AND INCREMENT THE SERIAL
   8 vim /etc/bind/zones/db.org.rockstable
   9 ### Don't forget to increment the serial in SOA Record!
  10 ### CHECK NAMED CONFIG
  11 #named-checkconf /etc/bind/named.conf
  12 ### CHECK ZONE SYNTAX
  13 named-checkzone "$ZONE" /etc/bind/zones/db.org.rockstable
  14 ### RELOAD THE ZONE LOCALLY
  15 rndc reload "$ZONE" IN "$VIEW"
  16 ### UNFREEZE THE ZONE AND NOTIFY 
  17 rndc thaw "$ZONE" IN "$VIEW"
  18 ### NOTIFY SLAVES EXPLICITLY (IF NECESSARY)
  19 #rndc notify "$ZONE" IN "$VIEW"
  20 ### CHECK ZONE STATUS
  21 rndc zonestatus rockstable.org
  22 ### FLUSH CACHES TO OVERCOME TTLs (IF NECESSARY)
  23 #rndc flush
  24 

Debugging

Check config

   1 named-checkconf

Check zone

   1 # named-checkzone rockstable.org /etc/bind/zones/db.org.rockstable
   2 zone rockstable.org/IN: _matrix._tcp.rockstable.org/SRV 'matrix.rockstable.org' is a CNAME (illegal)
   3 zone rockstable.org/IN: _stun._tcp.rockstable.org/SRV 'jabber.rockstable.org' is a CNAME (illegal)
   4 zone rockstable.org/IN: _stuns._tcp.rockstable.org/SRV 'jabber.rockstable.org' is a CNAME (illegal)
   5 zone rockstable.org/IN: _turn._tcp.rockstable.org/SRV 'jabber.rockstable.org' is a CNAME (illegal)
   6 zone rockstable.org/IN: _turns._tcp.rockstable.org/SRV 'jabber.rockstable.org' is a CNAME (illegal)
   7 zone rockstable.org/IN: _stun._udp.rockstable.org/SRV 'jabber.rockstable.org' is a CNAME (illegal)
   8 zone rockstable.org/IN: _turn._udp.rockstable.org/SRV 'jabber.rockstable.org' is a CNAME (illegal)
   9 zone rockstable.org/IN: _stun._tcp.jabber.rockstable.org/SRV 'jabber.rockstable.org' is a CNAME (illegal)
  10 zone rockstable.org/IN: _stuns._tcp.jabber.rockstable.org/SRV 'jabber.rockstable.org' is a CNAME (illegal)
  11 zone rockstable.org/IN: _turn._tcp.jabber.rockstable.org/SRV 'jabber.rockstable.org' is a CNAME (illegal)
  12 zone rockstable.org/IN: _turns._tcp.jabber.rockstable.org/SRV 'jabber.rockstable.org' is a CNAME (illegal)
  13 zone rockstable.org/IN: _xmpp-client._tcp.jabber.rockstable.org/SRV 'jabber.rockstable.org' is a CNAME (illegal)
  14 zone rockstable.org/IN: _xmpp-server._tcp.jabber.rockstable.org/SRV 'jabber.rockstable.org' is a CNAME (illegal)
  15 zone rockstable.org/IN: _xmpps-client._tcp.jabber.rockstable.org/SRV 'jabber.rockstable.org' is a CNAME (illegal)
  16 zone rockstable.org/IN: _xmpps-client._tcp.jabber.rockstable.org/SRV 'jabber.rockstable.org' is a CNAME (illegal)
  17 zone rockstable.org/IN: _stun._udp.jabber.rockstable.org/SRV 'jabber.rockstable.org' is a CNAME (illegal)
  18 zone rockstable.org/IN: _turn._udp.jabber.rockstable.org/SRV 'jabber.rockstable.org' is a CNAME (illegal)
  19 zone rockstable.org/IN: _xmpp-server._tcp.conference.jabber.rockstable.org/SRV 'jabber.rockstable.org' is a CNAME (illegal)
  20 zone rockstable.org/IN: loaded serial 2020030301
  21 OK

I should think about the advisory of named-checkzone one day. Seems like i'm doing illegal things with DNS.

DNSsec

• https://www.isc.org/dnssec/

• ISC DNSsec Guide

• ISC DNSsec Guide pdf]

• ISC DNSsec Guide html

• BIND DNSSEC Guide PDF

• ISC DNSSEC Quick Reference Guide

• DNSinstitite DNSsec guide

• ISC Eleven, twelve; dig and delv: BIND 9.10

• Internetsociety DNSSEC

• DNSSEC Goes Mainstream: Deployment Incentives, Experience, and QuestionsSuzanne Woolf, ISC

ISC's BIND 9 DNSSEC Webinar Series

This series of 10 lectures will take you through a full-day class on DNSSEC theory, history, implementation and troubleshooting, using BIND.

By Alan Clegg Initial presentation on 2020-02-05

Be sure

Once you upload your DS record to the parent zone you need to serve DNSsec or it will cause failure.

The process

Process of enabling DNSsec

Links

Thanks to the Leibniz-Rechenzentrum (LRZ) for it's nice tutorial (in german).

• LRZ doc DNSSEC mit BIND 9.9

• LRZ doc DNSKEYs und Key rollover - "best practices"

• Holger Zuleger DNSSEC made easy - Inline Signing mit BIND

Bind9 tools

man -k dnssec

   1 dnssec-checkds (8)         - DNSSEC delegation consistency checking tool
   2 dnssec-coverage (8)        - checks future DNSKEY coverage for a zone
   3 dnssec-dsfromkey (8)       - DNSSEC DS RR generation tool
   4 dnssec-importkey (8)       - import DNSKEY records from external systems so they can be managed
   5 dnssec-keyfromlabel (8)    - DNSSEC key generation tool
   6 dnssec-keygen (8)          - DNSSEC key generation tool
   7 dnssec-keymgr (8)          - Ensures correct DNSKEY coverage for a zone based on a defined policy
   8 dnssec-revoke (8)          - set the REVOKED bit on a DNSSEC key
   9 dnssec-settime (8)         - set the key timing metadata for a DNSSEC key
  10 dnssec-signzone (8)        - DNSSEC zone signing tool
  11 dnssec-trust-anchors.d (5) - DNSSEC trust anchor configuration files
  12 dnssec-verify (8)          - DNSSEC zone verification tool
  13 systemd.negative (5)       - DNSSEC trust anchor configuration files
  14 systemd.positive (5)       - DNSSEC trust anchor configuration files

Create key-directory

Create key directory

   1 DIR_KEY="/var/lib/bind/keys"
   2 install -o root -g bind -m 2750 -d "$DIR_KEY"
   3 ### CREATE A SYMBOLIC LINK FOR CONVENIENCE
   4 ln -s "$DIR_KEY" /etc/bind/keys

Ensure user bind can read the files!

dnssec-keygen

Manual page

   1 man dnssec-keygen

dnssec-keygen - DNSsec

key-directory needs to be already created.

Create DNSsec keys

   1 DIR_KEY="/var/lib/bind/keys"
   2 declare -a ZONES
   3 ZONES=(
   4   "rockstable.org" "rockstable.it"
   5   "dyna.rockstable.org" "dyna.rockstable.it"
   6 )
   7 for ZONE in ${ZONES[@]}; do
   8   ### CREATE KEY SIGNING KEY (KSK)
   9   dnssec-keygen -a RSASHA256 -b 4096 -3 -f KSK "$ZONE"
  10   ### CREATE ZONE SIGNING KEY (ZSK)
  11   dnssec-keygen -a RSASHA256 -b 2048 -3 "$ZONE"
  12 done
  13 ### ADJUST PERMISSIONS
  14 chown bind:bind "$DIR_KEY"/K*{.key,.private}
  15 chmod 644 "$DIR_KEY"/K*.key
  16 chmod 600 "$DIR_KEY"/K*.private

dnssec-keygen - TSIG

Since Version 4.2.8 isc-dhcp-server supports new TSIG algorithms - let's try them out. DHCP 4.2.8b1 Release Notes

- TSIG-authenticated dynamic DNS updates now support the use of these
  additional algorithms: hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384,
  and hmac-sha512
  [ISC-Bugs #36947]

Generate a TSIG key

• For HMAC length (-b) must be between 1 and 512 depending on the algorithm.

• Random numbers are perceived per default for /dev/random, but you can also use /dev/urandom or keyboard

• HMAC-Algorithms are symmetric,

  so the .private and .key file contain both the same string.

Create a TSIG key

   1 ### CREATE THE DIRECTORY
   2 DIR_KEY_TSIG="/etc/bind/keys/tsig"
   3 install -o root -g bind -m 0640 -d "$DIR_KEY_TSIG"
   4 cd "$DIR_KEY_TSIG"
   5 
   6 ### TSIG-KEY FOR DYNAMIC DNS UPDATE BY ISC-DHCP-SERVER
   7 dnssec-keygen -a HMAC-SHA512 -b 512 -n USER DHCP_UPDATER
   8 ### TSIG-KEY FOR ZONE-TRANSFER F.E. BY ANOTHER ANOTHER ISC-BIND9
   9 dnssec-keygen -a HMAC-SHA512 -b 512 -n HOST kvm2_rockstable_org
  10 
  11 ### ADJUST PERMISSIONS
  12 chown root:bind "$DIR_KEY_TSIG"/K*{.key,.private}
  13 chmod 640 "$DIR_KEY_TSIG"/K*.key
  14 chmod 640 "$DIR_KEY_TSIG"/K*.private

TSIG key example

Just to give an example, this files look like this: /etc/bind/keys/tsig/Kkvm2_rockstable_org.+165+41832.key

   1 kvm2_rockstable_org. IN KEY 512 3 165 FO07a2PRNLWVH0H8Thb4JyO/4WqJQio44jyclTrWLoc4gdKrosnBWIJl x/1Ss+EjhcFSJ5og4krZHmQ+eGT/FQ==

/etc/bind/keys/tsig/Kkvm2_rockstable_org.+165+41832.private

   1 Private-key-format: v1.3
   2 Algorithm: 165 (HMAC_SHA512)
   3 Key: FO07a2PRNLWVH0H8Thb4JyO/4WqJQio44jyclTrWLoc4gdKrosnBWIJlx/1Ss+EjhcFSJ5og4krZHmQ+eGT/FQ==
   4 Bits: AAA=
   5 Created: 20210208150641
   6 Publish: 20210208150641
   7 Activate: 20210208150641

ls -l /etc/bind/keys/tsig

   1 insgesamt 8
   2 -rw------- 1 root bind 128 Feb  8 16:06 Kkvm2_rockstable_org.+165+41832.key
   3 -rw------- 1 root bind 232 Feb  8 16:06 Kkvm2_rockstable_org.+165+41832.private

dnssec-keymgr

Ensures correct DNSKEY coverage for a zone based on a defined policy.

• LRZ doc dnssec-keymgr (aus BIND 9.11)

The man-page also contains info for /etc/dnssec-policy.conf
man dnssec-keymgr

key-directory needs to be created.

/etc/dnssec-policy.conf

   1 ### ROCKSTABLE DNSSEC POLICY
   2 policy default {
   3         directory "/var/lib/bind/keys"; # DIRECTORY TO STORE THE KEYS IN
   4         algorithm RSASHA256;            # SIGNATURE ALGORITHM
   5 
   6         ### KEY PARAMETERS
   7         keyttl 86400;           # TTL OF THE KEYS
   8         key-size ksk 4096;      # 4096BIT KEY-SIGNING KEY (KSK)
   9         key-size zsk 2048;      # 2048BIT ZONE-SIGNING KEY (ZSK)
  10 
  11         ### ROLL-OVER PARAMETERS
  12         #roll-period ksk 2y;    # MANUAL INTERACTION WITH PARENT ZONE;
  13                                 # KSK AUTO-ROLOVER IS NOT RECOMMENDED 
  14                                 # AND DISABLED BY DEFAULT
  15         roll-period  zsk 6mo;   # DEFAULT: 1 YEAR
  16 
  17         pre-publish  zsk 1 month;       # PRE-PUBLISH  ZSK (DEFAULT: 1 MONTH)
  18         post-publish zsk 1 month;       # POST-PUBLISH ZSK (DEFAULT: 1 MONTH)
  19         pre-publish  ksk 1 month;
  20         post-publish ksk 1 month;
  21 
  22         ### STANDBY KEYS - NOT YET IMPLEMENTED
  23         #standby ksk 1;         # PROVISION 1 KSK AS STANDBY PER ZONE
  24         #standby zsk 1;         # PROVISION 1 ZSK AS STANDBY PER ZONE
  25 
  26         ### LENGTH OF TIME TO ENSURE THAT KEYS WILL BE CORRECT
  27         coverage 1y;
  28 };
  29 
  30 ### ZONE SPECIFIC PARAMETERS
  31 #zone rockstable.it {
  32 #       coverage 1y;            # coverage-Periode für die Schlüssel erzeugt werden
  33 #       policy default;         # "default"-Policy für diese Zone anwenden
  34 #};
  35 

Activation via systemd

/etc/dnssec-policy.conf

   1 ### ROCKSTABLE DNSSEC POLICY
   2 policy default {
   3         directory "/var/lib/bind/keys"; # DIRECTORY TO STORE THE KEYS IN
   4         algorithm RSASHA256;            # SIGNATURE ALGORITHM
   5 
   6         ### KEY PARAMETERS
   7         keyttl 86400;           # TTL OF THE KEYS
   8         key-size ksk 4096;      # 4096BIT KEY-SIGNING KEY (KSK)
   9         key-size zsk 2048;      # 2048BIT ZONE-SIGNING KEY (ZSK)
  10 
  11         ### ROLL-OVER PARAMETERS
  12         #roll-period ksk 2y;    # MANUAL INTERACTION WITH PARENT ZONE;
  13                                 # KSK AUTO-ROLOVER IS NOT RECOMMENDED
  14                                 # AND DISABLED BY DEFAULT
  15         roll-period  ksk 6mo;   # 6 MONTH
  16 
  17         ### STANDBY KEYS - NOT YET IMPLEMENTED
  18         #standby ksk 1;         # PROVISION 1 KSK AS STANDBY PER ZONE
  19         #standby zsk 1;         # PROVISION 1 ZSK AS STANDBY PER ZONE
  20 
  21         pre-publish  zsk 1 month;       # PRE-PUBLISH  ZSK (DEFAULT 1 MONTH)
  22         post-publish zsk 1 month;       # POST-PUBLISH ZSK (DEFAULT 1 MONTH)
  23         pre-publish  ksk 1 month;
  24         post-publish ksk 1 month;
  25 
  26         ### length of time to ensure that keys will be correct
  27         coverage 1y;
  28 };
  29 
  30 ### ZONE SPECIFIC PARAMETERS
  31 #zone rockstable.it {
  32 #       coverage 1y;            # coverage-Periode für die Schlüssel erzeugt werden
  33 #       policy default;         # "default"-Policy für diese Zone anwenden
  34 #};
  35 

/lib/systemd/system/dnssec-keymgr.service

   1 [Unit]
   2 Description=Bind9 dnssec-keymgr
   3 Documentation=https://bind9.readthedocs.io/en/v9_16_5/manpages.html#dnssec-keymgr-ensures-correct-dnskey-coverage-based-on-a-defined-policy
   4 [Service]
   5 Type=oneshot
   6 ExecStart=/usr/sbin/dnssec-keymgr
   7 PrivateTmp=true

/lib/systemd/system/dnssec-keymgr.timer

   1 [Unit]
   2 Description=Run dnssec-keymgr twice daily
   3 
   4 [Timer]
   5 OnCalendar=*-*-* 00,12:00:00
   6 RandomizedDelaySec=43200
   7 Persistent=true
   8 
   9 [Install]
  10 WantedBy=timers.target

Reload systemd and enable the timer

   1 systemctl daemon-reload
   2 systemctl enable dnssec-keymgr.timer
   3 Created symlink /etc/systemd/system/timers.target.wants/dnssec-keymgr.timer → /lib/systemd/system/dnssec-keymgr.timer.

Activation via cron

/etc/cron.d/dnssec-keymgr

   1 ### dnssec-keymgr
   2 * */8 * * * /usr/sbin/dnssec-keymgr

dnssec-signzone - manually

DNSSEC zone signing tool

dnssec-signzone signs a zone. It generates NSEC and RRSIG records and produces a signed version of the zone. The security status of delegations from the signed zone (that is, whether the child zones are secure or not) is determined by the presence or absence of a keyset file for each child zone.

man dnssec-signzone

   1 cp db.it.rockstable.signed db.it.rockstable
   2 dnssec-signzone -v1 -g -S \
   3         -K /var/lib/bind/keys \
   4         -o rockstable.it \
   5         db.it.rockstable

Used options

   1        -g
   2            Generate DS records for child zones from dsset- or keyset-
   3            file. Existing DS records will be removed.
   4        -K directory
   5            Key repository: Specify a directory to search for DNSSEC
   6            keys. If not specified, defaults to the current directory.
   7        -o origin
   8            The zone origin. If not specified, the name of the zone file
   9            is assumed to be the origin.
  10        -S
  11            Smart signing: Instructs dnssec-signzone to search the key
  12            repository for keys that match the zone being signed, and to
  13            include them in the zone if appropriate.
  14        -T ttl
  15            Specifies a TTL to be used for new DNSKEY records imported
  16            into the zone from the key repository. If not specified, the
  17            default is the TTL value from the zone's SOA record. This
  18        -v level
  19            Sets the debugging level.

#failed to find keys at the zone apex

dnssec-settime - manually

set the key timing metadata for a DNSSEC key

dnssec-settime reads a DNSSEC private key file and sets the key timing metadata as specified by the -P, -A, -R, -I, and -D options. The metadata can then be used by dnssec-signzone or other signing software to determine when a key is to be published, whether it should be used for signing a zone, etc.

If none of these options is set on the command line, then dnssec-settime simply prints the key timing metadata already stored in the key.

When key metadata fields are changed, both files of a key pair (Knnnn.+aaa+iiiii.key and Knnnn.+aaa+iiiii.private) are regenerated. Metadata fields are stored in the private file. A human-readable description of the metadata is also placed in comments in the key file. The private file's permissions are always set to be inaccessible to anyone other than the owner (mode 0600).

   1        dnssec-settime [-f] [-K directory] [-L ttl] [-P date/offset]
   2                       [-P sync date/offset] [-A date/offset]
   3                       [-R date/offset] [-I date/offset]
   4                       [-D date/offset] [-D sync date/offset] [-S key]
   5                       [-i interval] [-h] [-V] [-v level] [-E engine]
   6                       {keyfile}

   1 

Options

   1        -f
   2            Force an update of an old-format key with no metadata
   3            fields. Without this option, dnssec-settime will fail when
   4            attempting to update a legacy key. With this option, the key
   5            will be recreated in the new format, but with the original
   6            key data retained. The key's creation date will be set to
   7            the present time. If no other values are specified, then the
   8            key's publication and activation dates will also be set to
   9            the present time.
  10 
  11        -K directory
  12            Sets the directory in which the key files are to reside.
  13 
  14        -L ttl
  15            Sets the default TTL to use for this key when it is
  16            converted into a DNSKEY RR. If the key is imported into a
  17            zone, this is the TTL that will be used for it, unless there
  18            was already a DNSKEY RRset in place, in which case the
  19            existing TTL would take precedence. If this value is not set
  20            and there is no existing DNSKEY RRset, the TTL will default
  21            to the SOA TTL. Setting the default TTL to 0 or none removes
  22            it from the key.
  23 
  24        -h
  25            Emit usage message and exit.
  26 
  27        -V
  28            Prints version information.
  29 
  30        -v level
  31            Sets the debugging level.
  32 
  33        -E engine
  34            Specifies the cryptographic hardware to use, when
  35            applicable.
  36 
  37            When BIND is built with OpenSSL PKCS#11 support, this
  38            defaults to the string "pkcs11", which identifies an OpenSSL
  39            engine that can drive a cryptographic accelerator or
  40            hardware service module. When BIND is built with native
  41            PKCS#11 cryptography (--enable-native-pkcs11), it defaults
  42            to the path of the PKCS#11 provider library specified via
  43            "--with-pkcs11".

Timing options

   1        Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
   2        If the argument begins with a '+' or '-', it is interpreted as
   3        an offset from the present time. For convenience, if such an
   4        offset is followed by one of the suffixes 'y', 'mo', 'w', 'd',
   5        'h', or 'mi', then the offset is computed in years (defined as
   6        365 24-hour days, ignoring leap years), months (defined as 30
   7        24-hour days), weeks, days, hours, or minutes, respectively.
   8        Without a suffix, the offset is computed in seconds. To unset a
   9        date, use 'none' or 'never'.
  10 
  11        -P date/offset
  12            Sets the date on which a key is to be published to the zone.
  13            After that date, the key will be included in the zone but
  14            will not be used to sign it.
  15 
  16        -P sync date/offset
  17            Sets the date on which CDS and CDNSKEY records that match
  18            this key are to be published to the zone.
  19 
  20        -A date/offset
  21            Sets the date on which the key is to be activated. After
  22            that date, the key will be included in the zone and used to
  23            sign it.
  24 
  25        -R date/offset
  26            Sets the date on which the key is to be revoked. After that
  27            date, the key will be flagged as revoked. It will be
  28            included in the zone and will be used to sign it.
  29 
  30        -I date/offset
  31            Sets the date on which the key is to be retired. After that
  32            date, the key will still be included in the zone, but it
  33            will not be used to sign it.
  34 
  35        -D date/offset
  36            Sets the date on which the key is to be deleted. After that
  37            date, the key will no longer be included in the zone. (It
  38            may remain in the key repository, however.)
  39 
  40        -D sync date/offset
  41            Sets the date on which the CDS and CDNSKEY records that
  42            match this key are to be deleted.
  43 
  44        -S predecessor key
  45            Select a key for which the key being modified will be an
  46            explicit successor. The name, algorithm, size, and type of
  47            the predecessor key must exactly match those of the key
  48            being modified. The activation date of the successor key
  49            will be set to the inactivation date of the predecessor. The
  50            publication date will be set to the activation date minus
  51            the prepublication interval, which defaults to 30 days.
  52 
  53        -i interval
  54            Sets the prepublication interval for a key. If set, then the
  55            publication and activation dates must be separated by at
  56            least this much time. If the activation date is specified
  57            but the publication date isn't, then the publication date
  58            will default to this much time before the activation date;
  59            conversely, if the publication date is specified but
  60            activation date isn't, then activation will be set to this
  61            much time after publication.
  62 
  63            If the key is being set to be an explicit successor to
  64            another key, then the default prepublication interval is 30
  65            days; otherwise it is zero.
  66 
  67            As with date offsets, if the argument is followed by one of
  68            the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the
  69            interval is measured in years, months, weeks, days, hours,
  70            or minutes, respectively. Without a suffix, the interval is
  71            measured in seconds.

Printing options

   1        dnssec-settime can also be used to print the timing metadata
   2        associated with a key.
   3 
   4        -u
   5            Print times in UNIX epoch format.
   6 
   7        -p C/P/Psync/A/R/I/D/Dsync/all
   8            Print a specific metadata value or set of metadata values.
   9            The -p option may be followed by one or more of the
  10            following letters or strings to indicate which value or
  11            values to print: C for the creation date, P for the
  12            publication date, Psync for the CDS and CDNSKEY publication
  13            date, A for the activation date, R for the revocation date,
  14            I for the inactivation date, D for the deletion date, and
  15            Dsync for the CDS and CDNSKEY deletion date To print all of
  16            the metadata, use -p all.

DNSsec options

   1         //auto-dnssec ( allow | maintain | off );
   2 
   3         //dnssec-accept-expired boolean;
   4         //dnssec-dnskey-kskonly boolean;
   5         //dnssec-enable boolean;
   6         //dnssec-loadkeys-interval integer;
   7         //dnssec-lookaside ( string trust-anchor string | auto | no );
   8         //dnssec-must-be-secure string boolean;
   9         //dnssec-secure-to-insecure boolean;
  10         //dnssec-update-mode ( maintain | no-resign );
  11         //dnssec-validation ( yes | no | auto );
  12 
  13         //inline-signing boolean;
  14         //key-directory path_name;
  15         //managed-keys-directory path_name;
  16         //update-check-ksk boolean;
  17 

auto-dnssec

• Zones configured for dynamic DNS may use this option to allow varying levels of automatic DNSSEC key management. There are three possible settings:

  auto-dnssec allow; permits keys to be updated and the zone fully re-signed whenever the user issues the command rndc sign zonename.

  auto-dnssec maintain; includes the above, but also automatically adjusts the zone’s DNSSEC keys on a schedule, according to the keys’ timing metadata (see dnssec-keygen: DNSSEC key generation tool and dnssec-settime: set the key timing metadata for a DNSSEC key). The command rndc sign zonename causes named to load keys from the key repository and sign the zone with all keys that are active. rndc loadkeys zonename causes named to load keys from the key repository and schedule key maintenance events to occur in the future, but it does not sign the full zone immediately. Note: once keys have been loaded for a zone the first time, the repository is searched for changes periodically, regardless of whether rndc loadkeys is used. The recheck interval is defined by dnssec-loadkeys-interval.

  The default setting is auto-dnssec off.

dnssec-accept-expired

• Accept expired signatures when verifying DNSSEC signatures. The default is no. Setting this option to yes leaves named vulnerable to replay attacks.

dnssec-dnskey-kskonly

• When this option and update-check-ksk are both set to yes, only key-signing keys (that is, keys with the KSK bit set) will be used to sign the DNSKEY, CDNSKEY, and CDS RRsets at the zone apex. Zone-signing keys (keys without the KSK bit set) will be used to sign the remainder of the zone, but not the DNSKEY RRset.

  This is similar to the dnssec-signzone -x command line option.
  
  The default is no. If update-check-ksk is set to no, this option is ignored.

dnssec-enable

• This indicates whether DNSSEC-related resource records are to be returned by named. If set to no, named will not return DNSSEC-related resource records unless specifically queried for. The default is yes. This option is obsolete and has no effect. (9.16+)

dnssec-loadkeys-interval

• When a zone is configured with auto-dnssec maintain; its key repository must be checked periodically to see if any new keys have been added or any existing keys’ timing metadata has been updated (see dnssec-keygen: DNSSEC key generation tool and dnssec-settime: set the key timing metadata for a DNSSEC key). The dnssec-loadkeys-interval option sets the frequency of automatic repository checks, in minutes. The default is 60 (1 hour),
  the minimum is 1 (1 minute),
  and the maximum is 1440 (24 hours);
  any higher value is silently reduced.

dnssec-lookaside

• When set, dnssec-lookaside provides the validator with an alternate method to validate DNSKEY records at the top of a zone. When a DNSKEY is at or below a domain specified by the deepest dnssec-lookaside, and the normal DNSSEC validation has left the key untrusted, the trust-anchor will be appended to the key name and a DLV record will be looked up to see if it can validate the key. If the DLV record validates a DNSKEY (similarly to the way a DS record does)

  the DNSKEY RRset is deemed to be trusted.
  
  If dnssec-lookaside is set to no, then dnssec-lookaside is not used.
  
  Note

  • The ISC-provided DLV service at dlv.isc.org, has been shut down. The dnssec-lookaside auto; configuration option, which set named up to use ISC DLV with minimal configuration, has accordingly been removed.

dnssec-must-be-secure

• Specify hierarchies which must be or may not be secure (signed and validated). If yes, then named will only accept answers if they are secure. If no, then normal DNSSEC validation applies allowing for insecure answers to be accepted. The specified domain must be defined as a trust anchor, for instance in a dnssec-keys statement, or dnssec-validation auto must be active.

dnssec-update-mode

• If this option is set to its default value of maintain in a zone of type master which is DNSSEC-signed and configured to allow dynamic updates (see Dynamic Update Policies), and if named has access to the private signing key(s) for the zone, then named will automatically sign all new or changed records and maintain signatures for the zone by regenerating RRSIG records

  whenever they approach their expiration date.
  
  If the option is changed to no-resign, then named will sign all new or changed records,

  but scheduled maintenance of signatures is disabled.
  
  With either of these settings, named will reject updates to a DNSSEC-signed zone when the signing keys are inactive or unavailable to named. (A planned third option, external, will disable all automatic signing and allow DNSSEC data to be submitted into a zone via dynamic update; this is not yet implemented.)

dnssec-validation

• This option enables DNSSEC validation in named.

  If set to auto, DNSSEC validation is enabled and a default trust anchor for the DNS root zone is used.

  If set to yes, DNSSEC validation is enabled, but a trust anchor must be manually configured using a trust-anchors statement (or the managed-keys or trusted-keys statements, both deprecated). If there is no configured trust anchor, validation does not take place.

  If set to no, DNSSEC validation is disabled.

  The default is auto, unless BIND is built with configure --disable-auto-validation, in which case the default is yes.

  The default root trust anchor is stored in the file bind.keys. named loads that key at startup if dnssec-validation is set to auto. A copy of the file is installed along with BIND 9, and is current as of the release date. If the root key expires, a new copy of bind.keys can be downloaded from https://www.isc.org/bind-keys.

  (To prevent problems if bind.keys is not found, the current trust anchor is also compiled in named. Relying on this is not recommended, however, as it requires named to be recompiled with a new key when the root key expires.)

  Note

  • named loads only the root key from bind.keys. The file cannot be used to store keys for other zones. The root key in bind.keys is ignored if dnssec-validation auto is not in use. Whenever the resolver sends out queries to an EDNS-compliant server, it always sets the DO bit indicating it can support DNSSEC responses,

    even if dnssec-validation is off.

inline-signing

• If yes, this enables “bump in the wire” signing of a zone, where a unsigned zone is transferred in or loaded from disk and a signed version of the zone is served, with possibly, a different serial number. This behavior is disabled by default.

key-directory

• When performing dynamic update of secure zones, the directory where the public and private DNSSEC key files should be found, if different than the current working directory. (Note that this option has no effect on the paths for files containing non-DNSSEC keys

  such as bind.keys, rndc.key or session.key.)

Just for completeness and reasons of comparision managed-keys-directory

• This specifies the directory in which to store the files that track managed DNSSEC keys

  (i.e., those configured using the initial-key or initial-ds keywords in a trust-anchors statement). By default, this is the working directory. The directory must be writable by the effective user ID of the named process.

  If named is not configured to use views, managed keys for the server are tracked in a single file called managed-keys.bind. Otherwise, managed keys are tracked in separate files, one file per view; each file name is the view name (or, if it contains characters that are incompatible with use as a file name, the SHA256 hash of the view name), followed by the extension .mkeys. (Note: in earlier releases, file names for views always used the SHA256 hash of the view name. To ensure compatibility after upgrading, if a file using the old name format is found to exist, it is used instead of the new format.)

update-check-ksk

• When set to the default value of yes, check the KSK bit in each key to determine how the key should be used when generating

  RRSIGs for a secure zone.
  
  Ordinarily, zone-signing keys (that is, keys without the KSK bit set) are used to sign the entire zone, while key-signing keys (keys with the KSK bit set) are only used to sign the DNSKEY RRset at the zone apex. However, if this option is set to no, then the KSK bit is ignored; KSKs are treated as if they were ZSKs and are used to sign the entire zone.

  This is similar to the dnssec-signzone -z command line option.
  
  When this option is set to yes, there must be at least two active keys for every algorithm represented in the DNSKEY RRset: at least one KSK and one ZSK per algorithm. If there is any algorithm for which this requirement is not met, this option will be ignored for that algorithm.

Validation

• ISC KB DNSSEC validation - how can I tell if my server is doing it?

/etc/bind/named.conf.options

   1 //      dnssec-enable yes; # Default yes; obsolete
   2         dnssec-lookaside auto;
   3         dnssec-validation auto;

You should use dnssec-validation auto;. Or you will need to configure trust-anchors via managed-keys or trusted-keys.

Inline signing

Probaly the way to go.

• Parallel setup for testing
• Editing possible on master or in ounsigned master file
• The signed file is always of type raw to speed up loading

Internet Systems Consortium - BIND and Inline Signing

Global options
/etc/bind/named.conf.options

   1 options {
   2         key-directory "/var/lib/bind/keys";
   3 }

Inline signing with local file

Zone specific options
/etc/bind/named.conf.local

   1 zone "rockstable.it" {
   2         type master;
   3         file "/etc/bind/zones/db.it.rockstable"
   4         auto-dnssec maintain;
   5         inline-signing yes;
   6 }

This will generate a corresponding signed file "/etc/bind/zones/db.it.rockstable.signed" and journal file "/etc/bind/zones/db.it.rockstable.jnl".

The master-file is untouched.

Inline signing with a master

Zone specific options
/etc/bind/named.conf.local

   1 zone "rockstable.it" {
   2         type slave;
   3         masters { master_name; };
   4         file "/etc/bind/zones/db.it.rockstable.signed"
   5         auto-dnssec maintain;
   6         inline-signing yes;
   7 }

Changed are received by AXFR updates and signed in-line. The master-file will be updated dynamically. This way also the DNSSEC records are inserted and updated.

To see the signed file's content convert the zone to a text file

Signing with local updates

No editing in zone files anymore, only dynamic updates to the zone.

Zone specific options
/etc/bind/named.conf.local

   1 zone "rockstable.it" {
   2         type master;
   3         file "/etc/bind/zones/db.it.rockstable"
   4         key-directory "/var/lib/bind/keys";
   5         auto-dnssec maintain;
   6         // update-policy local;
   7         update-policy {
   8                 grant local-ddns                zonesub ANY;
   9                 grant DNS_REPLICATOR_EXTERNAL   zonesub ANY;
  10         };
  11 }

To see the signed file's content convert the zone to a text file

NextSECure

Info about records

• DNS#NextSECure (NSEC)

• DNS#NextSECure3 (NSEC3)

Migrations NSEC to NSEC3

• DNSsec guide NSEC to NSEC3

rndc signing -nsec3param sets the NSEC3 parameters for a zone. This is the only supported mechanism for using NSEC3 with inline-signing zones. Parameters are specified in the same format as an NSEC3PARAM resource record: hash algorithm, flags, iterations, and salt, in that order.

Currently, the only defined value for hash algorithm is 1, representing SHA-1. The flags may be set to 0 or 1, depending on whether you wish to set the opt-out bit in the NSEC3 chain. iterations defines the number of additional times to apply the algorithm when generating an NSEC3 hash. The salt is a string of data expressed in hexadecimal, a hyphen (`-') if no salt is to be used, or the keyword auto, which causes named to generate a random 64-bit salt.

So, for example, to create an NSEC3 chain using the SHA-1 hash algorithm, no opt-out flag, 10 iterations, and a salt value of "FFFF", use:
rndc signing -nsec3param 1 0 10 FFFF zone. To set the opt-out flag, 15 iterations, and no salt, use:
rndc signing -nsec3param 1 1 15 - zone.

   1 rndc signing -nsec3param 1 0 10 auto rockstable.it

Create NSEC3PARAMs for specified views and specified zones with automatically generated seed