1 | 1. Run: |
---|
2 | |
---|
3 | # dnssec-keygen -a HMAC-MD5 -b 128 -n HOST mydomain.key |
---|
4 | |
---|
5 | You will see something like: |
---|
6 | |
---|
7 | Kmydomain.key.+157+32373 |
---|
8 | |
---|
9 | 2. Then do: |
---|
10 | |
---|
11 | # cat Kmydomain.key.+157+32373.private |
---|
12 | |
---|
13 | You will see something similar: |
---|
14 | |
---|
15 | Private-key-format: v1.2 |
---|
16 | Algorithm: 157 (HMAC_MD5) |
---|
17 | Key: tHTRSKKrmyGmPnzNCf2IRA== |
---|
18 | Bits: AAA= |
---|
19 | |
---|
20 | ... the "Key:" is the important here, so copy "tHTRSKKrmyGmPnzNCf2IRA==" |
---|
21 | |
---|
22 | |
---|
23 | 3. Add the following to your named.conf: |
---|
24 | |
---|
25 | options { |
---|
26 | ... |
---|
27 | allow-transfer { none; }; |
---|
28 | ... |
---|
29 | }; |
---|
30 | |
---|
31 | logging { |
---|
32 | ... |
---|
33 | }; |
---|
34 | |
---|
35 | key mydomain-key { |
---|
36 | algorithm hmac-md5; |
---|
37 | secret "tHTRSKKrmyGmPnzNCf2IRA=="; |
---|
38 | }; |
---|
39 | |
---|
40 | zone "mydomain.menog" { |
---|
41 | // ... here is your zone definition from before |
---|
42 | allow-transfer { key mydomain-key; }; |
---|
43 | }; |
---|
44 | |
---|
45 | ... |
---|
46 | |
---|
47 | 4. Restart named |
---|
48 | |
---|
49 | 5. Try and make a zone transfer from ANOTER machine -- ask your neighbors: |
---|
50 | |
---|
51 | # dig @10.10.1.XXX axfr mydomain.menog |
---|
52 | |
---|
53 | Look at /etc/namedb/logs/general and /etc/namedb/logs/transfers |
---|
54 | |
---|
55 | What do you notice ? |
---|
56 | |
---|
57 | 6. Try again with the key: |
---|
58 | |
---|
59 | # dig@10.10.1.XXX axfr mydomain.menog -y mydomain-key:tHTRSKKrmyGmPnzNCf2IRA== |
---|
60 | |
---|
61 | ... what happens now ? |
---|
62 | |
---|
63 | Check the logs again. |
---|
64 | |
---|
65 | |
---|
66 | 7. ON THE SLAVE: |
---|
67 | |
---|
68 | - Remove the zone from /etc/namedb/slave/mydomain.menog |
---|
69 | - Restart named (/etc/rc.d/named restart) |
---|
70 | |
---|
71 | Check that the zone is gone AND that the slave wasn't able to reload it. |
---|
72 | |
---|
73 | - What do you see in the MASTER logs (transfers and general) ? |
---|
74 | - What do you see in the SLAVE logs (transfers and general) ? |
---|
75 | |
---|
76 | 8. Still on the SLAVE: |
---|
77 | |
---|
78 | Find the statement for the zone: |
---|
79 | |
---|
80 | zone "mydomain.menog" { |
---|
81 | type slave; |
---|
82 | masters { 10.10.1.XXX; }; |
---|
83 | file "slave/mydomain.menog"; |
---|
84 | }; |
---|
85 | |
---|
86 | ... and add the key, and a statement to tell which key to use |
---|
87 | when talking to "10.10.1.XXX" (the master): |
---|
88 | |
---|
89 | key mydomain-key { |
---|
90 | algorithm hmac-md5; |
---|
91 | secret "tHTRSKKrmyGmPnzNCf2IRA=="; |
---|
92 | }; |
---|
93 | server 10.10.1.203 { |
---|
94 | keys { mydomain-key; }; |
---|
95 | }; |
---|
96 | |
---|
97 | 9. Restart named |
---|
98 | |
---|
99 | - Is the zone "mydomain.menog" back in the slave/ directory ? |
---|
100 | - What do you see in the MASTER logs (transfers and general) ? |
---|
101 | - What do you see in the SLAVE logs (transfers and general) ? |
---|