Hi Björn.
Not sure if my (late) reply is any use to you, but yes my understanding
is that you could use localhost as the parental agent in the cases where
(a) the local machine also hosts the parent zone, or (b) it is a
recursive resolver. In the latter case the DNSSEC responses would be
validated (assuming of course that the local resolver does DNSSEC
validation).
As I understand there are two schools of thought for configuring
parental-agents:
1. You could explicitly specify all of the parent zone name servers. In
that case all the servers are queried and the KSK rollover proceeds
once all servers are publishing the new DS record.
2. You could specify a validating recursive resolver. In that case only
one authoritative name server will be queried (you won't know which)
and the recursive resolver validates the response, and the KSK
rollover proceeds if that server is publishing the new DS record.
I suppose the theoretical risk with #1 is that because the responses
from the authoritative servers aren't validated, it would be possible
for a MITM to trick BIND into thinking that the new DS records had been
published before they actually had, which could lead to a situation
where you complete the KSK roll-over early and invalidate your zone?
Also please note that BIND 9.19 introduces a new option:
/*checkds*/
*Grammar: *|checkds ( explicit | <boolean> );|
*Blocks: *zone (primary, secondary)
*Tags: *dnssec
Controls whether |DS| queries are sent to parental agents.
If set to |yes|, DS queries are sent when a KSK rollover is in
progress. The queries are sent to the servers listed in the parent
zone’s NS records. This is the default if there are no
|parental-agents|
<https://bind9.readthedocs.io/en/latest/reference.html#namedconf-statement-parental-agents>
configured for the zone.
If set to |explicit|, DS queries are sent only to servers explicitly
listed using |parental-agents|
<https://bind9.readthedocs.io/en/latest/reference.html#namedconf-statement-parental-agents>.
This is the default if there are parental agents configured.
If set to |no|, no DS queries are sent. Users should manually run
|rndc dnssec -checkds|
<https://bind9.readthedocs.io/en/latest/manpages.html#cmdoption-rndc-arg-dnssec>
with the appropriate parameters to signal that specific DS records
are published and/or withdrawn.
Nick.
On 11/09/23 23:52, Björn Persson wrote:
Hello, I'm trying to configure automatic KSK (or CSK) rollover. I'm
confused about how to poll securely for DS records.
Section 5.1.2.1 of the BIND 9 Administrator Reference Manual says:
| [parental-agents] needs to be a trusted server, because BIND does not
| validate the response.
and section 8.2.26.1 says:
| The DS response is not validated so it is recommended to set up a
| trust relationship with the parental agent. For example, use TSIG to
| authenticate the parental agent, or point to a validating resolver.
I don't think the registry wants to exchange TSIG keys with every
domain holder. A validating resolver seems much more achievable. My
master server is also the validating resolver of its host. Can I set
parental-agents to localhost to make BIND ask itself to validate the DS
response? Or would it still do the lookup in the same non-validating
way? Or would it enter infinite recursion? Must the validating resolver
be a different name server from the master server that performs the key
rollover?
Björn Persson
--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from
this list
ISC funds the development of this software with paid support subscriptions.
Contact us at https://www.isc.org/contact/ for more information.
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
