# dnsseczonetool : Simple DNSSEC key management and zone signing tool # # https://github.com/kfujiwara/dnsseczonetool # # Installation and Configuration: # # 1. Copy dnsseczonetool into some directory. # Example: copy it to /etc/namedb/master. # # 2. Create dnsseczonetool.conf into the same directory of dnsseczonetool. # if you want to change the default values. # Example: touch /etc/namedb/master/dnsseczonetool.conf # # 3. Prepare traditional zone files. File name should be equal to zone name. # Example: /etc/namedb/master/example.com # # 4. Generate first key. # Example: /etc/namedb/master/dnsseczonetool keygen example.com # # 5. Sign zone # Example: /etc/namedb/master/dnsseczonetool sign example.com # # 6. Edit named.conf/nsd.conf to load signed zone file # Example: zone "example.com" { # type master; # file "/etc/namedb/master/exapmle.com.signed"; # } # # 7. Periodic zone signing: Add one entry to your crontab # Example: "0 7 * * * /etc/namedb/dnsseczonetool sign exapmle.com" # # dnsseczonetool.conf: # FATAL_MAIL: Send an email to $FATAL_MAIL when fatal error occurs. # MASTERDIR: Zone file directory # Default: MASTERDIR="/etc/namedb/master" # KSK_PARAM: Default dnssec-keygen's options for KSK # Default: KSK_PARAM_DEFAULT="-n zone -a RSASHA1 -b 2048 -f ksk" # KSK_PARAM_$zone: dnssec-keygen's options for zone's KSK # Default: KSK_PARAM # ZSK_PARAM: Default dnssec-keygen's options for ZSK # Default: ZSK_PARAM_DEFAULT="-n zone -a RSASHA1 -b 1024" # ZSK_PARAM_$zone: dnssec-keygen's options for zone's ZSK # Default: ZSK_PARAM # SIGN_PARAM: Default dnssec-signzone options # Default: SIGN_PARAM_DEFAULT="-N unixtime" # SIGN_PARAM_$zone: dnssec-signzone options for zone # Default: SIGN_PARAM # DS_PARAM: Default dsfromkey options for zone # Default: SIGN_PARAM_DEFAULT="-2" # DS_PARAM_$zone: dsfromkey options for zone # Default: SIGN_PARAM # keygen: dnssec-keygen path # Default: keygen="/usr/local/sbin/dnssec-keygen" # signzone: dnssec-signzone path # Default: signzone="/usr/local/sbin/dnssec-signzone" # dsfromkey: dnssec-dsfromkey path # Default: dsfromkey="/usr/local/sbin/dnssec-dsfromkey" # rndc: rndc path # Default: rndc="/usr/local/sbin/rndc" # CONFIGDIR: directory where dnsseczonetool uses. # Default: CONFIGDIR="$MASTERDIR/config" # KEYDIR: directory where dnsseczonetool puts zone keys. # Default: KEYDIR="$MASTERDIR/config/keydir" # KEYBACKUPDIR: directory where dnsseczonetool puts old keys. # Default: KEYBACKUPDIR="$MASTERDIR/config/backup" # RNDC_OPTION: rndc options or OFF # Default: RNDC_OPTION="-k $MASTERDIR/rndc.key" # ZONE_PREPROCESS: zone preprocess command # Default: cat # RELOADALL_COMMAND: reload all command # Default: none # PRESERVE_REMOVED_KEY: NO|YES # Default: YES # TWOFACE_$zone: The zone has two face zone file for split DNS # The value is another zone file name # When signing, both zone files are signed # Default: none # # caution: $zone is zone name # whose '.' and '-' characters are replaced by '_'. # All zone name must be lowercase. # # Usage: # # 1. Generate KSK and ZSK # dnsseczonetool keygen zone(s) # # 2. Sign zone using keys generated in step 1 # dnsseczonetool sign zone(s) # # 3. Add next ZSK for ZSK rollover (generate new ZSK and sign with old key) # dnsseczonetool add-next-zsk zone(s) # # 4. ZSK Rollover (Change current ZSK as unused previous ZSK, # and sign new ZSK generated by step.3) # dnsseczonetool zsk-rollover zone(s) # # 4'. ZSK Rollover 2 (Change current ZSK as unused previous ZSK, # stand-by ZSK as current ZSK, # Generate new ZSK as a stand-by ZSK, # and sign the zone by new ZSK.) # dnsseczonetool zskroll zone(s) # # 5. Add next KSK for KSK rollover (generate new KSK and sign with both keys) # dnsseczonetool add-next-ksk zone(s) # # 6. KSK Rollover (Remove old KSK and sign new KSK generated by step.5) # dnsseczonetool ksk-rollover zone(s) # # 7. Zone key status # dnsseczonetool status zone(s) # # 8. Zone key status-dnskey (Show KSK DNSKEY for DLV registration) # dnsseczonetool status-dnskey zone(s) # # # Using LDNS and NSD instead of BIND 9 dnssec-* tools # # http://www.nlnetlabs.nl/projects/ldns/ # http://www.nlnetlabs.nl/projects/nsd/ # # ldns-signzone does not support unixtime serial number generaton and some # pseudo definitions ($TTL? $ORIGIN?). # Change serial number field as _SERIAL_ at SOA RR in your zone file. # $ZONE_PREPROCESS command (=sed) will change _SERIAL_ as unixtime. # # Suppose LDNS and NSD are installed in /usr/local. # To use LDNS and NSD with unixtime serial generation, # add following entries in your dnsseczonetool.conf file. # # keygen="/usr/local/bin/ldns-keygen" # signzone="/usr/local/bin/ldns-signzone" # dsfromkey="/usr/local/bin/ldns-key2ds -n" # RNDC_OPTION="OFF" # UNIXTIME=`date +%s` # ZONE_PREPROCESS="sed s/_SERIAL_/$UNIXTIME/" # RELOADALL_COMMAND="/usr/local/sbin/nsdc rebuild && /usr/local/sbin/nsdc reload" #