Discussion:
Ask for automated KSK roll with DS checking
Bob Harold
2021-04-14 20:00:38 UTC
Permalink
Does anyone have an automated KSK roll process, that checks for the DS
record at the parent, that they can share?


As far as I can tell, the automated signing in BIND will roll the KSK if I
set the timing in the policy file, but it won't check the DS record, so it
will happily break DNSSEC if some other process does not update the DS
record at the right time. That's too big a risk for me, the process needs
to check the DS record before completing the KSK roll. Surely someone has
done this. I would rather not reinvent the wheel. But I have searched and
not found anything yet.
--
Bob Harold
DNS and DHCP Hostmaster - UMNet
Information and Technology Services (ITS)
***@umich.edu
Greg Rivers via bind-users
2021-04-14 20:30:45 UTC
Permalink
Post by Bob Harold
Does anyone have an automated KSK roll process, that checks for the DS
record at the parent, that they can share?
As far as I can tell, the automated signing in BIND will roll the KSK if I
set the timing in the policy file, but it won't check the DS record, so it
will happily break DNSSEC if some other process does not update the DS
record at the right time. That's too big a risk for me, the process needs
to check the DS record before completing the KSK roll. Surely someone has
done this. I would rather not reinvent the wheel. But I have searched and
not found anything yet.
As I understand it, the way it works now is that the actual KSK rollover won't occur until you execute `rndc dnssec -checkds ...` [1].

I'm hopeful that named will fully automate this check at some point soon.


[1] <https://dnssec-guide.readthedocs.io/en/latest/signing.html#working-with-the-parent-zone-2>
--
Greg


_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
bind-***@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
Matthijs Mekking
2021-04-15 06:56:44 UTC
Permalink
Post by Greg Rivers via bind-users
Post by Bob Harold
Does anyone have an automated KSK roll process, that checks for the DS
record at the parent, that they can share?
As far as I can tell, the automated signing in BIND will roll the KSK if I
set the timing in the policy file, but it won't check the DS record, so it
will happily break DNSSEC if some other process does not update the DS
record at the right time. That's too big a risk for me, the process needs
to check the DS record before completing the KSK roll. Surely someone has
done this. I would rather not reinvent the wheel. But I have searched and
not found anything yet.
As I understand it, the way it works now is that the actual KSK rollover won't occur until you execute `rndc dnssec -checkds ...` [1].
That is correct.
Post by Greg Rivers via bind-users
I'm hopeful that named will fully automate this check at some point soon.
It is on the roadmap:

https://gitlab.isc.org/isc-projects/bind9/-/issues/1126

- Matthijs
Post by Greg Rivers via bind-users
[1] <https://dnssec-guide.readthedocs.io/en/latest/signing.html#working-with-the-parent-zone-2>
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
bind-***@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
Bob Harold
2021-04-15 12:50:09 UTC
Permalink
Post by Greg Rivers via bind-users
Post by Greg Rivers via bind-users
Post by Bob Harold
Does anyone have an automated KSK roll process, that checks for the DS
record at the parent, that they can share?
As far as I can tell, the automated signing in BIND will roll the KSK
if I
Post by Greg Rivers via bind-users
Post by Bob Harold
set the timing in the policy file, but it won't check the DS record, so
it
Post by Greg Rivers via bind-users
Post by Bob Harold
will happily break DNSSEC if some other process does not update the DS
record at the right time. That's too big a risk for me, the process
needs
Post by Greg Rivers via bind-users
Post by Bob Harold
to check the DS record before completing the KSK roll. Surely someone
has
Post by Greg Rivers via bind-users
Post by Bob Harold
done this. I would rather not reinvent the wheel. But I have searched
and
Post by Greg Rivers via bind-users
Post by Bob Harold
not found anything yet.
As I understand it, the way it works now is that the actual KSK rollover
won't occur until you execute `rndc dnssec -checkds ...` [1].
That is correct.
Post by Greg Rivers via bind-users
I'm hopeful that named will fully automate this check at some point soon.
https://gitlab.isc.org/isc-projects/bind9/-/issues/1126
- Matthijs
Post by Greg Rivers via bind-users
[1] <
https://dnssec-guide.readthedocs.io/en/latest/signing.html#working-with-the-parent-zone-2
Thank you both very much. I missed that, and I am testing with the RedHat
RHEL7 version of BIND 9.11, which does not seem to wait. Looks like I will
need to run a newer version of BIND, at least on my in-line signing server.
--
Bob Harold
University of Michigan
Bob Harold
2021-04-15 14:35:20 UTC
Permalink
Post by Bob Harold
Post by Greg Rivers via bind-users
Post by Bob Harold
Does anyone have an automated KSK roll process, that checks for the DS
record at the parent, that they can share?
As far as I can tell, the automated signing in BIND will roll the KSK
if I
Post by Greg Rivers via bind-users
Post by Bob Harold
set the timing in the policy file, but it won't check the DS record,
so it
Post by Greg Rivers via bind-users
Post by Bob Harold
will happily break DNSSEC if some other process does not update the DS
record at the right time. That's too big a risk for me, the process
needs
Post by Greg Rivers via bind-users
Post by Bob Harold
to check the DS record before completing the KSK roll. Surely someone
has
Post by Greg Rivers via bind-users
Post by Bob Harold
done this. I would rather not reinvent the wheel. But I have
searched and
Post by Greg Rivers via bind-users
Post by Bob Harold
not found anything yet.
As I understand it, the way it works now is that the actual KSK
rollover won't occur until you execute `rndc dnssec -checkds ...` [1].
That is correct.
Post by Greg Rivers via bind-users
I'm hopeful that named will fully automate this check at some point
soon.
https://gitlab.isc.org/isc-projects/bind9/-/issues/1126
- Matthijs
Post by Greg Rivers via bind-users
[1] <
https://dnssec-guide.readthedocs.io/en/latest/signing.html#working-with-the-parent-zone-2
Thank you both very much. I missed that, and I am testing with the
RedHat RHEL7 version of BIND 9.11, which does not seem to wait. Looks like
I will need to run a newer version of BIND, at least on my in-line signing
server.
--
Bob Harold
University of Michigan
If BIND holds both the child and parent zone, will it add the DS record at
the correct time? Or do I still need to write scripts to update the DS
records in all my sub-zones? And is there some signal from BIND at the
time the DS record should be written, or do i need to calculate the right
time?
--
Bob Harold
Matthijs Mekking
2021-04-15 14:59:37 UTC
Permalink
Post by Bob Harold
Post by Greg Rivers via bind-users
Post by Bob Harold
Does anyone have an automated KSK roll process, that checks
for the DS
Post by Greg Rivers via bind-users
Post by Bob Harold
record at the parent, that they can share?
As far as I can tell, the automated signing in BIND will
roll the KSK if I
Post by Greg Rivers via bind-users
Post by Bob Harold
set the timing in the policy file, but it won't check the DS
record, so it
Post by Greg Rivers via bind-users
Post by Bob Harold
will happily break DNSSEC if some other process does not
update the DS
Post by Greg Rivers via bind-users
Post by Bob Harold
record at the right time.  That's too big a risk for me, the
process needs
Post by Greg Rivers via bind-users
Post by Bob Harold
to check the DS record before completing the KSK roll.
Surely someone has
Post by Greg Rivers via bind-users
Post by Bob Harold
done this.  I would rather not reinvent the wheel.  But I
have searched and
Post by Greg Rivers via bind-users
Post by Bob Harold
not found anything yet.
As I understand it, the way it works now is that the actual
KSK rollover won't occur until you execute `rndc dnssec -checkds
...` [1].
That is correct.
Post by Greg Rivers via bind-users
I'm hopeful that named will fully automate this check at some
point soon.
https://gitlab.isc.org/isc-projects/bind9/-/issues/1126
<https://gitlab.isc.org/isc-projects/bind9/-/issues/1126>
- Matthijs
Post by Greg Rivers via bind-users
[1]
<https://dnssec-guide.readthedocs.io/en/latest/signing.html#working-with-the-parent-zone-2
<https://dnssec-guide.readthedocs.io/en/latest/signing.html#working-with-the-parent-zone-2>>
Thank you both very much.  I missed that, and I am testing with the
RedHat RHEL7 version of BIND 9.11, which does not seem to wait.
Looks like I will need to run a newer version of BIND, at least on
my in-line signing server.
--
Bob Harold
University of Michigan
If BIND holds both the child and parent zone, will it add the DS record
at the correct time?  Or do I still need to write scripts to update the
DS records in all my sub-zones?  And is there some signal from BIND at
the time the DS record should be written, or do i need to calculate the
right time?
Currently you still have to write scripts to update DS records in all
your parent zones.

The CDS/CDNSKEY records are published in the child zones that indicate
the DS should be published, so I would script against that.

Then when the DS is seen in the parent, call the rndc dnssec -checkds
published/withdrawn command.

Best regards,

Matthijs
Post by Bob Harold
--
Bob Harold
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
bind-***@lists.isc.org
https:/
Tony Finch
2021-04-15 16:44:14 UTC
Permalink
Post by Matthijs Mekking
Post by Bob Harold
If BIND holds both the child and parent zone, will it add the DS record
at the correct time?  Or do I still need to write scripts to update the
DS records in all my sub-zones?  And is there some signal from BIND at
the time the DS record should be written, or do i need to calculate the
right time?
Currently you still have to write scripts to update DS records in all
your parent zones.
The CDS/CDNSKEY records are published in the child zones that indicate
the DS should be published, so I would script against that.
Then when the DS is seen in the parent, call the rndc dnssec -checkds
published/withdrawn command.
dnssec-cds can tell you what the parental DS record(s) should be. It
can maintain a dsset file for each child zone that you can $INCLUDE in the
parent. It's fairly bare so it needs to be wrapped with a script that does
the necessary queries and updates.

I don't know if the dnssec-policy stuff includes timing parameters or
checks to protect against parental publication delays; if not then the
wrapper script will have to keep track of time or poll the parent servers
or something.

Tony.
--
f.anthony.n.finch <***@dotat.at> https://dotat.at/
Fair Isle: South 3 to 5, occasionally 6 later. Slight or moderate,
becoming rough later in west. Fair. Good.
Bob Harold
2021-04-15 17:54:55 UTC
Permalink
Post by Tony Finch
Post by Matthijs Mekking
Post by Bob Harold
If BIND holds both the child and parent zone, will it add the DS record
at the correct time? Or do I still need to write scripts to update the
DS records in all my sub-zones? And is there some signal from BIND at
the time the DS record should be written, or do i need to calculate the
right time?
Currently you still have to write scripts to update DS records in all
your parent zones.
The CDS/CDNSKEY records are published in the child zones that indicate
the DS should be published, so I would script against that.
Then when the DS is seen in the parent, call the rndc dnssec -checkds
published/withdrawn command.
dnssec-cds can tell you what the parental DS record(s) should be. It
can maintain a dsset file for each child zone that you can $INCLUDE in the
parent. It's fairly bare so it needs to be wrapped with a script that does
the necessary queries and updates.
I don't know if the dnssec-policy stuff includes timing parameters or
checks to protect against parental publication delays; if not then the
wrapper script will have to keep track of time or poll the parent servers
or something.
Tony.
--
Fair Isle: South 3 to 5, occasionally 6 later. Slight or moderate,
becoming rough later in west. Fair. Good.
Seeing that I still need some scripting, does anyone already have scripts
that work?
--
Bob Harold
Mark Andrews
2021-04-16 01:56:25 UTC
Permalink
The following should work. I’ve not tested it.

zone=“$1"
shift
dig axfr -q "${zone}" |
tr '[A-Z]' '[a-z]' |
awk ‘
BEGIN { zone=“” }
$4 == “soa” { zone=$1 }
$1 != zone && $4 == "ns" { print "cds", $1 }' |
sort -u |
dig -f - |
awk '
BEGIN { last = ""; secure=0 }
$1 = ";;" && $2 == "flags:" {
if (/ad;/) {
secure=1
} else {
secure=0
}
}
secure == 1 && $4 == "CDS" {
if (last != $1) {
if (last != "") {
print "send"
}
print "update delete", $1, "DS"
last = $1;
}
if ($5 != "0" && $6 != "0" && $7 != "00") {
$4 = "DS"
print "update add", $0
}
}
END { if (last != "") { print "send" } }
' |
Post by Tony Finch
Post by Matthijs Mekking
Post by Bob Harold
If BIND holds both the child and parent zone, will it add the DS record
at the correct time? Or do I still need to write scripts to update the
DS records in all my sub-zones? And is there some signal from BIND at
the time the DS record should be written, or do i need to calculate the
right time?
Currently you still have to write scripts to update DS records in all
your parent zones.
The CDS/CDNSKEY records are published in the child zones that indicate
the DS should be published, so I would script against that.
Then when the DS is seen in the parent, call the rndc dnssec -checkds
published/withdrawn command.
dnssec-cds can tell you what the parental DS record(s) should be. It
can maintain a dsset file for each child zone that you can $INCLUDE in the
parent. It's fairly bare so it needs to be wrapped with a script that does
the necessary queries and updates.
I don't know if the dnssec-policy stuff includes timing parameters or
checks to protect against parental publication delays; if not then the
wrapper script will have to keep track of time or poll the parent servers
or something.
Tony.
--
Fair Isle: South 3 to 5, occasionally 6 later. Slight or moderate,
becoming rough later in west. Fair. Good.
Seeing that I still need some scripting, does anyone already have scripts that work?
--
Bob Harold
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list
ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.
bind-users mailing list
https://lists.isc.org/mailman/listinfo/bind-users
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: ***@isc.org

_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
bind-***@lists.isc.o
Mark Andrews
2021-04-16 02:49:06 UTC
Permalink
and the following for the child side should work. If you are only interested
in DS algorithm 2 check that $6 == 2 (&& $6 == 2) when selecting DS and CDS records from the
stream. Again untested.

while read zone garbage
do
( echo "ds -q $zone"; echo "cds -q $zone"; ) |
dig +noall +answer +nottl -f - |
tr '[A-Z]' '[a-z]' |
sort |
awk 'BEGIN { last = "" ; cds=""; ds="" }
$3 == "cds" {
if ($1 != last) {
if (last != "" && cds == ds) {
print "rndc dnssec -checkds published", last
}
if (last != "" && ds == "" && match(cds, "0 0 00")) {
print "rndc dnssec -checkds withdrawn", last
}
last=$1; cds=""; ds=""
}
csd=cds " " $0
}
$3 == "ds" {
ds=ds " " $0
}
END {
if (last != "" && cds == ds) {
print "rndc --checkds published", last
}
if (last != "" && ds == "" && match(cds, "0 0 00")) {
print "rndc dnssec -checkds withdrawn", last
}
}'
done
Post by Tony Finch
Post by Matthijs Mekking
Post by Bob Harold
If BIND holds both the child and parent zone, will it add the DS record
at the correct time? Or do I still need to write scripts to update the
DS records in all my sub-zones? And is there some signal from BIND at
the time the DS record should be written, or do i need to calculate the
right time?
Currently you still have to write scripts to update DS records in all
your parent zones.
The CDS/CDNSKEY records are published in the child zones that indicate
the DS should be published, so I would script against that.
Then when the DS is seen in the parent, call the rndc dnssec -checkds
published/withdrawn command.
dnssec-cds can tell you what the parental DS record(s) should be. It
can maintain a dsset file for each child zone that you can $INCLUDE in the
parent. It's fairly bare so it needs to be wrapped with a script that does
the necessary queries and updates.
I don't know if the dnssec-policy stuff includes timing parameters or
checks to protect against parental publication delays; if not then the
wrapper script will have to keep track of time or poll the parent servers
or something.
Tony.
--
Fair Isle: South 3 to 5, occasionally 6 later. Slight or moderate,
becoming rough later in west. Fair. Good.
Seeing that I still need some scripting, does anyone already have scripts that work?
--
Bob Harold
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list
ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.
bind-users mailing list
https://lists.isc.org/mailman/listinfo/bind-users
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: ***@isc.org

_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
bind-***@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
Matthijs Mekking
2021-04-16 06:13:50 UTC
Permalink
Post by Tony Finch
Post by Matthijs Mekking
Post by Bob Harold
If BIND holds both the child and parent zone, will it add the DS record
at the correct time?  Or do I still need to write scripts to update the
DS records in all my sub-zones?  And is there some signal from BIND at
the time the DS record should be written, or do i need to calculate the
right time?
Currently you still have to write scripts to update DS records in all
your parent zones.
The CDS/CDNSKEY records are published in the child zones that indicate
the DS should be published, so I would script against that.
Then when the DS is seen in the parent, call the rndc dnssec -checkds
published/withdrawn command.
dnssec-cds can tell you what the parental DS record(s) should be. It
can maintain a dsset file for each child zone that you can $INCLUDE in the
parent. It's fairly bare so it needs to be wrapped with a script that does
the necessary queries and updates.
I don't know if the dnssec-policy stuff includes timing parameters or
checks to protect against parental publication delays; if not then the
wrapper script will have to keep track of time or poll the parent servers
or something.
It does.

After you have issued the 'rndc dnssec -checkds published' command
(which should be done only if you have seen the DS in the parent), BIND
will wait for 'parent-ds-ttl' plus 'parent-propagation-delay' plus
'retire-safety' before actually considering the DS omnipresent. The DS
needs to be omnipresent before the predecessor DNSKEY may be removed.

The defaults for these values are 1 day, 1 hour, and 1 hour. So after
running the 'rndc dnssec -checkds published' command, by default the
rollover will continue 26 hours later.

You should set these parameters to whatever your parent zone is using.
You should set the 'retire-safety' delay to whatever you feel
comfortable with.

Best regards,

Matthijs
Post by Tony Finch
Tony.
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list
ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.
bind-users mailing list
https://lists.isc.org/mailman/listinfo/bind-users
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
bind-***@lists.isc.org
https://l

Loading...