No edit summary |
No edit summary |
||
| Line 40: | Line 40: | ||
= Management = | = Management = | ||
== internal zones == | == internal zones == | ||
There are two ways of managing the DNS zones, via the UI or via the CLI. In both cases, the DNS serial number is automagically updated. IMPORTANT: FreeIPA uses DNS syntax for the FQDN, so these [b]must[/b] end with a period (.) | |||
=== UI === | |||
You can use the webui on https://ipa.nurd.space/. Navigate to Network Services -> DNS -> DNS Zones, and select the zone you want to add a record to. Select the "Create reverse" option to automatically create a PTR record. | |||
=== CLI === | |||
The second way to edit records is via the ipa cli. First, fetch a kerberos ticket using `kinit <yourusername>`. Next, perform one of the following options: | |||
ipa dnsrecord-add <zone.name> <name> | |||
== external zones == | == external zones == | ||
Revision as of 21:07, 3 September 2024
Summary
We offer both internal and external DNS zones. The internal zones are used by anyone that is connected to the NURDspace lan or via VPN. The external zones are for internet to use.
Available zones
The following zones are available for editing.
Internal
- nurdspace.nl
- nurd.space
- vm.nurd.space
- lan.nurd.space
- vpn.nurd.space
External
- nurdspace.nl
- nurd.space
Architecture
Internal DNS
- Zones are managed using FreeIPA (https://ipa.nurd.space).
- The two services machines (services-[12].lan.nurd.space) are configured to slave all zones that live on FreeIPA.
- Dynamic DNS is provided using a script that parses the DHCP leases file and updates the corresponding zonefiles.
- All records are exported in hosts file format on https://dns.lan.nurd.space/hosts.txt.
External DNS
- Zones are managed and hosted using NSD on extdns.vm.nurd.space
- Two externally hosted nameservers are configured as secondaries
secondary services.as65342.net
- ipv4: 213.154.229.26
- ipv6: 2001:7b8:3:47:213:154:229:26
- hoster: BIT
- operator: r3boot
secondary neutralino.soleus.nu
- ipv4: 94.142.246.90
- ipv6: 2a02:898:62:f6::5a
- hoster: Soleus
- operator: bofh team
Management
internal zones
There are two ways of managing the DNS zones, via the UI or via the CLI. In both cases, the DNS serial number is automagically updated. IMPORTANT: FreeIPA uses DNS syntax for the FQDN, so these [b]must[/b] end with a period (.)
UI
You can use the webui on https://ipa.nurd.space/. Navigate to Network Services -> DNS -> DNS Zones, and select the zone you want to add a record to. Select the "Create reverse" option to automatically create a PTR record.
CLI
The second way to edit records is via the ipa cli. First, fetch a kerberos ticket using `kinit <yourusername>`. Next, perform one of the following options:
ipa dnsrecord-add <zone.name> <name>
external zones
The zonefiles can be found under /etc/nsd/zones. Navigate to that directory, and make the changes you need to make. Dont forget to update the serial number ;)
cd /etc/nsd/zones vi db.nurd.space
Once the zone is updated, you need to sign it with the correct DNSSEC keys, and reload it. To make this easier, you can run the following command:
reload_zone.sh nurd.space
This script will perform the following steps (for nurd.space) if you are inclined to do this by hand:
cd /etc/nsd/zones nsd-checkzone nurd.space db.nurd.space ldns-signzone -n -s $(head -n 1000 /dev/random | sha256sum | cut -b 1-16) db.nurd.space $(cat nurd.space.zsk) $(cat nurd.space.ksk) nsd-control reload nurd.space
Note that you need to wait atleast the zone TTL before you use external validation tools for the DNSSEC status (like https://dnsviz.net/), since these validation tools will cache DNSSEC records as long as they are queried.
DNSSEC
Setup DNSSEC for a domain
Start off by generating a zone signing key (ZSK) and a key signing key (KSK).
cd /etc/nsd/zones ldns-keygen -a ECDSAP256SHA256 -b 1024 nurd.space > nurd.space.zsk ldns-keygen -k -a ECDSAP256SHA256 -b 2048 nurd.space > nurd.space.ksk
Next, delete the automatically generated DS records, and sign the zone using the newly generated ZSK and KSK.
rm *.ds ldns-signzone -n -s $(head -n 1000 /dev/random | sha256sum | cut -b 1-16) db.nurd.space `cat nurd.space.zsk` `cat nurd.space.ksk`
Finally, switch the zone config definition to the signed variant of the zonefile. Add .signed to the zone filename, as shown below:
zone: name: "nurd.space" zonefile: db.nurd.space.signed
Reload the zonefile using nsd-control:
nsd-control reconfig nsd-control reload nurd.space
Once this is done, dnssec is enabled for the domain. Validate that this is working by checking the DNSKEY record(s) for the domain. You should get two records. One for the KSK, and one for the ZSK.
root@extdns:~# dig DNSKEY @10.208.1.33 nurd.space +multiline +norec +short 256 3 13 DsflOcaa2FufX6cYmH4A+LupEZqQwPGqAE/XTjghg9Kj+SgitAtizv8L rbE2KCJ/VhRZ7SEtptTjdrN9MwCrbg== 257 3 13 j6WGne+l0zp9QiX1lbeGRvYyAm3riQm49hbXeos2uJPh5xS2maAtBryk jfhIHUEYu3fHC1nIi/D2gutun711DQ==
To attach these keys to the DNSSEC chain of trust, you need to generate DS records for the domain, and submit these records to the DNS registrar. This will lead to the DS records being signed with the TLD keys, completing the chain of trust:
cd /etc/nsd/zones ldns-key2ds -n -f -2 db.nurd.space.signed
This should return two DS records as can be seen below. Submit these records to the DNS registrar to get them included in the TLD zone.
nurd.space. 3600 IN DS 12278 13 2 a9f5b7e06f85aea2679bc242a69950ec5fc8fd21f18833126b088b82c9cef2f6 nurd.space. 3600 IN DS 35766 13 2 ce0766ad4857197d67e631c815ef13c654b6f601f15cbb54c6c43629127794a0
Once this process is completed, the zone is fully signed.
Zone cannot be resolved anymore
The signature of the nurd.space zone is configured with an expiry period. To fix this, the zone needs to be re-signed. Do this by updating the serial number in the zone, and run the following command:
/usr/local/sbin/reload_zone.sh nurd.space