Hi,
I'd put off DNSSEC because of the high maintenance requirement. But
with 9.9 and inline signing, it looks like I can now do DNSSEC the way
I need (static zone files that work with legacy tools, automatic key
rotation, etc.)
I see that 9.9-rc2 came out yesterday; I'm building it now, but I
don't see anything in the relnotes that tells me this has
changed. Unfortunately, I'm trying to figure out how to use DNSSEC
inline signing from the Internet's ten years of DNSSEC tutorials, none
of which exactly cover this setup. And the ARM isn't quite updated for
this yet.
If someone is kind enough to help me figure out DNSSEC, I'll happily
blog it for the next guy who comes along. I'm sure I won't be the
last...
My understanding of the process is:
1) create KSK and ZSK
nstest/etc/namedb/keys;dnssec-keygen -f KSK -a RSASHA1 -b 768 -n ZONE
transnetworks.net
Generating key
pair.........................................................++++++++ .++++++++
Ktransnetworks.net.+005+54607
nstest/etc/namedb/keys;dnssec-keygen -a RSASHA1 -b 768 -n ZONE transnetworks.net
Generating key pair......................................++++++++
..................++++++++
Ktransnetworks.net.+005+51087
2) tell named.conf about the zone's DNSSEC:
zone transnetworks.net {
type master;
file "master/transnetworks.net";
key-directory "keys/";
inline-signing yes;
auto-dnssec maintain;
};
I restart named, and see the following files:
transnetworks.net
transnetworks.net.jbk
transnetworks.net.signed
So, it appears that inline is doing something.
But dig shows:
nstest/etc/namedb/keys;dig transnetworks.net @localhost +dnssec
; <<>> DiG 9.8.1-P1 <<>> transnetworks.net @localhost +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42076
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;transnetworks.net. IN A
;; ANSWER SECTION:
transnetworks.net. 86400 IN A 198.22.63.130
;; AUTHORITY SECTION:
transnetworks.net. 86400 IN NS ns1.minetworkservices.net.
transnetworks.net. 86400 IN NS ns2.minetworkservices.net.
;; Query time: 2 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed Feb 1 17:12:21 2012
;; MSG SIZE rcvd: 116
My understanding is that once I get this to work, I use
$ dnssec-dsfromkey -2 Ktransnetworks.net.<ksk #>
and give that to my registrar.
Any suggestions, folks? What am I not understanding?
Thanks,
==ml
--
Michael W. Lucas
http://www.MichaelWLucas.com/, http://blather.MichaelWLucas.com/
Latest book: SSH Mastery http://www.michaelwlucas.com/nonfiction/ssh-mastery
mwlu...@blackhelicopters.org, Twitter @mwlauthor
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
