DNS master-slave Securing zone transfer with TSIG

Written by red_coder Wednesday, 06 January 2010 00:00

User Rating: / 0
PoorBest 

Install bind-chroot on both servers

# yum install bind-chroot

From Primary DNS

# dnssec-keygen -a HMAC-MD5 -b 128 -n HOST master-slave
Kmaster-slave.+157+50029

The output tells us the name of the file containing our new key: in this case
Kmaster-slave.+157+50029.private. The numbers are the DNSSEC algorithm
(157=HMACMD5), and the key's fingerprint (50029) which will probably be different on your machine

From Kmaster-slave+157.50029.private we will extract the shared key:
# cat Kmaster-slave+157.50029.private
Private-key-format: v1.2
Algorithm: 157 (HMAC_MD5)
Key: axdafafFTdafaCSDF090DSDs==

The key here is axdafafFTdafaCSDF090DSDs==; this will be different in your file. Keep track of this file;
we will need it for testing our configuration later.

On both the master and slave name server, create a new file called /var/named/chroot/etc/transfer.key with
the following contents:

key "master-slave." {
algorithm hmac-md5;
secret "axdafafFTdafaCSDF090DSDs==";
};

Protect the contents of the transfer.key so only the nameserver can read it and only root can write to it:
# chown root:named /var/named/chroot/etc/transfer.key
# chmod 640 /var/named/chroot/etc/transfer.key
# ln -s /var/named/chroot/etc/transfer.key /etc/transfer.key

In /var/named/chroot/etc/named.conf on both the master and slave server, add the following lines at the very top of the file

include "/etc/transfer.key";

On the slave server, prohibit all zone transfer from anywhere. Add the line in to your options block.

options {
allow-transfer { none; };



Slave DNS

# vi /etc/named.conf

Add the following lines

include "/etc/transfer.key";
server 208.67.222.22 {
keys { master-slave.; };
};


On the master server, change the allow-transfer line to your options block so it appears as follows:
# vi /etc/named.conf

include "/etc/transfer.key";
options {
listen-on port 53 { 127.0.0.1; 192.168.1.1; 208.67.222.22; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
query-source port 53;
query-source-v6 port 53;
allow-query { localhost; any; };
allow-transfer { key master-slave.; };
allow-notify { 208.67.222.23; };
version "Bind";
};

Now restart both servers