Agenda: dns-bind-transfer-security.txt

BIND TRANSFER SECURITY
----------------------

We're going to limit zone transfer of your zones so that only
your secondary/slave nameservers are allowed to request copies
of the zones.

ACL based security
------------------

To start with, we'll enable IP based ACLs -- on the MASTER host:

1. Start by editing /etc/namedb/named.conf, and in the "options" section,
   let's define who is allowed to transfer your zone.

   allow-transfer { 127.0.0.1; ::1; myslaves; };

   Now we need to define the ACL "myslaves".  To do so, AFTER the options
   section (find the '};' symbol at the end of the section), add something
   similar to this:

   (If the slave for your "MYTLD" domain is master.grp25, for example)

acl myslaves { 10.10.25.1; 10.10.X.3; }; // ACL with IP of Group25 master

        This means "myslaves is an ACL consisting of the IP 10.10.25.1,
        and your NSD secondary 10.10.25.3.

2. Restart named

        # /etc/rc.d/named restart

3. Make sure that you didn't break the zone transfer by asking your
   slave partner to run a zone transfer against YOUR machine.

   From their server:

   # dig @master.grpX.ws.nsrc.org MYTLD axfr

4. Now try and ask someone else who is NOT in the ACL to try the same
   axfr command as above.

   Q: Do they succeed ?
   Q: What do you see in the logs in /etc/namedb/log/transfers ?


KEY based security
------------------

Instead of using IP addresses, we'll now be using cryptographic keys
to authenticate zone transfer -- this uses TSIG, a mechanism by which
the communication between the master and slave server will be authenticated
using this key.

1. Run:

# cd /tmp/
# dnssec-keygen -a HMAC-MD5 -b 128 -n HOST mydomain.key

        You will see something like:

Kmydomain.key.+157+32373   (the last number will change)

        Two files have been created:

        # ls -l K*

Kmydomain.key.+157+32373.key
Kmydomain.key.+157+32373.private

2. View the contents of the private key

        # cat Kmydomain.key.+157+32373.private

        You will see something similar:

Private-key-format: v1.2
Algorithm: 157 (HMAC_MD5)
Key: tHTRSKKrmyGmPnzNCf2IRA==
Bits: AAA=

        ... the "Key:" is the important here, so copy "tHTRSKKrmyGmPnzNCf2IRA=="
        (not THIS one, the one in YOUR file :)

3.  Modify your named.conf

        # cd /etc/namedb/

        Edit the file, and change the allow-transfer statement, so that it looks
        like this:

options {
        ...
        allow-transfer { 127.0.0.1; ::1; };  // myslaves is removed!
        ...
};

        Note: We have removed "myslaves"

        Now, after the options (or at the bottom of the file), add a new
        declaration for the key

key "mydomain-key" {
        algorithm hmac-md5;
        secret "tHTRSKKrmyGmPnzNCf2IRA==";
};

        Change the definition for your zone:

zone "MYTLD" {
        zone "mytld" { type master; ... };

        allow-transfer { key mydomain-key; };   // <-- Add this!
};

As you can see above, we've added an "allow-transfer" statement
allowing transfer of the zone for holders of the "mydomain-key".

Note that the allow-transfer is now placed INSIDE the zone definition,
and not globally inside the options section -- BIND can control zone
transfer either globally, or by zone.

4. Restart named

        # /etc/rc.d/named restart

5. Try and make a zone transfer from ANOTER machine -- ask your neighbors:

        # dig @10.10.XX.1 MYTLD axfr

        Look at /etc/namedb/logs/general and /etc/namedb/logs/transfers

        Q: What do you notice ?

6. Try again with the key:

        # dig @10.10.XX.1 axfr mydomain -y mydomain-key:tHTRSKKrmyGmPnzNCf2IRA==

        Q: what happens now ?

        Check the logs again, especially /etc/namedb/log/transfers


7. On your slave:

        Start by deleting the copy of the slave zone:

        - Remove the zone from /etc/namedb/slave/MYTLD -- remember, this
          is on the machine of your SLAVE partner

        # rm /etc/namedb/slave/MYTLD

        - Restart named 
        
        # /etc/rc.d/named restart

        Check that the zone is gone AND that the slave wasn't able to reload it.

        Q: What do you see in the MASTER logs (transfers and general) ?
        Q: What do you see in the SLAVE logs (transfers and general) ?

8. Still on the SLAVE:

Find the statement for the zone:

zone "MYTLD" {
        type slave;
        masters { 10.10.XX.1; };
        file "slave/mydomain.dns";
};

... and add the key, and a statement to tell which key to use
when talking to "10.10.XXX.1" (the master):

key mydomain-key {
        algorithm hmac-md5;
        secret "tHTRSKKrmyGmPnzNCf2IRA==";
};
server 10.10.XX.1 {
        keys { mydomain-key; };
};

9. Restart named

        # /etc/rc.d/named restart

        On the SLAVE server:

        Q: Is the zone "MYTLD" back in the slave/ directory ?
        Q: What do you see in the MASTER logs (transfers and general) ?
        Q: What do you see in the SLAVE logs (transfers and general) ?

        Can you see a general benefit from using keys instead of IP ACLs ?