From: Mark Andrews Date: Fri, 11 Jun 2004 00:13:41 +0000 (+0000) Subject: 1657. [doc] ARM: document query log output. X-Git-Tag: v9.2.4rc6~9^2~44 X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=68fb0934fd5e2f8f95a2f43e26b1208f7cbc4307;p=thirdparty%2Fbind9.git 1657. [doc] ARM: document query log output. 1656. [doc] Update DNSSEC description in ARM to cover DS, NSEC DNSKEY and RRSIG. [RT #11542] --- diff --git a/CHANGES b/CHANGES index 73d1cee64d5..9c8446a74dd 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,8 @@ +1657. [doc] ARM: document query log output. + +1656. [doc] Update DNSSEC description in ARM to cover DS, NSEC + DNSKEY and RRSIG. [RT #11542] + 1655. [placeholder] rt11446 1654. [placeholder] rt11541 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index 6df8cd1565c..c85df6aa377 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -2,7 +2,7 @@ - + BIND 9 Administrator Reference Manual @@ -989,7 +989,7 @@ protocol is specified in RFC 1996. zone statement. Updating of secure zones (zones using DNSSEC) follows - RFC 3007: SIG and NXT records affected by updates are automatically + RFC 3007: RRSIG and NSEC records affected by updates are automatically regenerated by the server using an online zone key. Update authorization is based on transaction signatures and an explicit server policy. @@ -1433,8 +1433,8 @@ allow-update { key host1-host2. ;}; DNSSEC Cryptographic authentication of DNS information is possible - through the DNS Security (DNSSEC) extensions, - defined in RFC 2535. This section describes the creation and use + through the DNS Security (DNSSEC-bis) extensions, + defined in RFC <TBA>. This section describes the creation and use of DNSSEC signed zones. In order to set up a DNSSEC secure zone, there are a series @@ -1443,15 +1443,17 @@ allow-update { key host1-host2. ;}; that are used in this process, which are explained in more detail below. In all cases, the option prints a full list of parameters. Note that the DNSSEC tools require the - keyset and signedkey files to be in the working directory or the + keyset files to be in the working directory or the directory specified by the option, and - that the tools shipped with BIND 9.0.x are not fully compatible + that the tools shipped with BIND 9.2.x and earlier are not compatible with the current ones. There must also be communication with the administrators of - the parent and/or child zone to transmit keys and signatures. A - zone's security status must be indicated by the parent zone for a - DNSSEC capable resolver to trust its data. + the parent and/or child zone to transmit keys. A zone's security + status must be indicated by the parent zone for a DNSSEC capable + resolver to trust its data. This is done through the presense + or absence of a DS record at the delegation + point. For other servers to trust data in this zone, they must either be statically configured with this zone's zone key or the @@ -1470,16 +1472,16 @@ allow-update { key host1-host2. ;}; ZONE, and must be usable for authentication. It is recommended that zone keys use a cryptographic algorithm designated as "mandatory to implement" by the IETF; currently - these are RSASHA1 and DSA. + the only one is RSASHA1. - The following command will generate a 768 bit DSA key for + The following command will generate a 768 bit RSASHA1 key for the child.example zone: - dnssec-keygen -a DSA -b 768 -n ZONE child.example. + dnssec-keygen -a RSASHA1 -b 768 -n ZONE child.example. Two output files will be produced: - Kchild.example.+003+12345.key and - Kchild.example.+003+12345.private (where + Kchild.example.+005+12345.key and + Kchild.example.+005+12345.private (where 12345 is an example of a key tag). The key file names contain the key name (child.example.), algorithm (3 is DSA, 1 is RSAMD5, 5 is RSASHA1, etc.), and the key tag (12345 in this case). @@ -1496,65 +1498,6 @@ allow-update { key host1-host2. ;}; $INCLUDE statements. - - - Creating a Keyset - - The dnssec-makekeyset program is used - to create a key set from one or more keys. - - Once the zone keys have been generated, a key set must be - built for transmission to the administrator of the parent zone, - so that the parent zone can sign the keys with its own zone key - and correctly indicate the security status of this zone. When - building a key set, the list of keys to be included and the TTL - of the set must be specified, and the desired signature validity - period of the parent's signature may also be specified. - - The list of keys to be inserted into the key set may also - included non-zone keys present at the top of the zone. - dnssec-makekeyset may also be used at other - names in the zone. - - The following command generates a key set containing the - above key and another key similarly generated, with a TTL of - 3600 and a signature validity period of 10 days starting from - now. - -dnssec-makekeyset -t 3600 -e +864000 Kchild.example.+003+12345 Kchild.example.+003+23456 - - One output file is produced: - keyset-child.example.. This file should be - transmitted to the parent to be signed. It includes the keys, - as well as signatures over the key set generated by the zone - keys themselves, which are used to prove ownership of the - private keys and encode the desired validity period. - - - - Signing the Child's Keyset - - The dnssec-signkey program is used to - sign one child's keyset. - - If the child.example zone has any - delegations which are secure, for example, - grand.child.example, the - child.example administrator should receive - keyset files for each secure subzone. These keys must be signed - by this zone's zone keys. - - The following command signs the child's key set with the - zone keys: - -dnssec-signkey keyset-grand.child.example. Kchild.example.+003+12345 Kchild.example.+003+23456 - - One output file is produced: - signedkey-grand.child.example.. This file - should be both transmitted back to the child and retained. It - includes all keys (the child's keys) from the keyset file and - signatures generated by this zone's zone keys. - Signing the Zone @@ -1562,14 +1505,13 @@ allow-update { key host1-host2. ;}; The dnssec-signzone program is used to sign a zone. - Any signedkey files corresponding to - secure subzones should be present, as well as a - signedkey file for this zone generated by - the parent (if there is one). The zone signer will generate - NXT and SIG records for - the zone, as well as incorporate the zone key signature from the - parent and indicate the security status at all delegation - points. + Any keyset files corresponding + to secure subzones should be present. The zone signer will + generate NSEC and RRSIG + records for the zone, as well as DS for + the child zones if '-d' is specified. + If '-d' is not specified then DS RRsets for + the secure child zones need to be added manually. The following command signs the zone, assuming it is in a file called zone.child.example. By @@ -1583,6 +1525,12 @@ allow-update { key host1-host2. ;}; should be referenced by named.conf as the input file for the zone. + dnssec-signzone will also produce a + keyset and dsset files and optionally a dlvset file. These + are used to provide the parent zone administators with the + DNSKEYs (or their corresponding DS + records) that are the secure entry point to the zone. + Configuring Servers @@ -2632,7 +2580,16 @@ the null channel. At startup, specifing the category queries will also enable query logging unless querylog option has been specified. - + + +The query log entry reports the client's IP address and port number. The +query name, class and type. It also reports whether the Recursion Desired +flag was set (+ if set, - if not set), EDNS was in use (E) or if the +query was signed (S). +client 127.0.0.1#62536: query: www.example.com IN AAAA +SE +client ::1#62537: query: www.example.net IN AAAA -SE + + dispatch