CourseOutline: bind-transfer.txt

File bind-transfer.txt, 2.0 KB (added by regnauld, 9 years ago)

DNS securing zone transfers

Line 
11. Run:
2
3# dnssec-keygen -a HMAC-MD5 -b 128 -n HOST mydomain.key
4
5You will see something like:
6
7        Kmydomain.key.+157+32373
8
92. Then do:
10
11# cat Kmydomain.key.+157+32373.private
12
13You will see something similar:
14
15        Private-key-format: v1.2
16        Algorithm: 157 (HMAC_MD5)
17        Key: tHTRSKKrmyGmPnzNCf2IRA==
18        Bits: AAA=
19
20... the "Key:" is the important here, so copy "tHTRSKKrmyGmPnzNCf2IRA=="
21
22
233.  Add the following to your named.conf:
24
25options {
26        ...
27        allow-transfer { none; };
28        ...
29};
30
31logging {
32        ...
33};
34
35key mydomain-key {
36        algorithm hmac-md5;
37        secret "tHTRSKKrmyGmPnzNCf2IRA==";
38};
39
40zone "mydomain.menog" {
41        // ... here is your zone definition from before
42        allow-transfer { key mydomain-key; };
43};
44
45...
46
474. Restart named
48
495. Try and make a zone transfer from ANOTER machine -- ask your neighbors:
50
51# dig @10.10.1.XXX axfr mydomain.menog
52
53Look at /etc/namedb/logs/general and /etc/namedb/logs/transfers
54
55What do you notice ?
56
576. Try again with the key:
58
59# dig@10.10.1.XXX axfr mydomain.menog -y mydomain-key:tHTRSKKrmyGmPnzNCf2IRA==
60
61... what happens now ?
62
63Check the logs again.
64
65
667. ON THE SLAVE:
67
68- Remove the zone from /etc/namedb/slave/mydomain.menog
69- Restart named (/etc/rc.d/named restart)
70
71Check that the zone is gone AND that the slave wasn't able to reload it.
72
73- What do you see in the MASTER logs (transfers and general) ?
74- What do you see in the SLAVE logs (transfers and general) ?
75
768. Still on the SLAVE:
77
78Find the statement for the zone:
79
80zone "mydomain.menog" {
81        type slave;
82        masters { 10.10.1.XXX; };
83        file "slave/mydomain.menog";
84};
85
86... and add the key, and a statement to tell which key to use
87when talking to "10.10.1.XXX" (the master):
88
89key mydomain-key {
90        algorithm hmac-md5;
91        secret "tHTRSKKrmyGmPnzNCf2IRA==";
92};
93server 10.10.1.203 {
94        keys { mydomain-key; };
95};
96
979. Restart named
98
99- Is the zone "mydomain.menog" back in the slave/ directory ?
100- What do you see in the MASTER logs (transfers and general) ?
101- What do you see in the SLAVE logs (transfers and general) ?