[Pdns-users] Potentially Silly Question! - auth server, dns-(non) sec + sec.
Stefan Schmidt
zaphodb at zaphods.net
Thu Jul 21 19:27:28 UTC 2011
Hi Chris,
On Thu, Jul 21, 2011 at 8:57 PM, Chris Russell
<Chris.Russell at knowledgeit.co.uk> wrote:
> I think I've confused the issue with the two backends, I actually set this up as a test as running with one wasn't working.
>
> To back to the original issue, I have PDNSsec + DNS-SEC + ipv6 working flawlessly, without issues. However, for other reasons I need to serve zones where I don't wish to have any signing information in the database for this zone. This means I don't want to run secure-zone or rectify-zone instead keep that zone DNS-SEC free.
>
> Essentially configuring DNS-SEC on a zone by zone basis.
That is the default and afaik only way PowerDNS works.
> The problem is, I can push records into the DB as per a standard unsigned zone, but pdnssec will not serve these records only the SOA. So can pdnssec serve unsigned zones where no DNS-SEC related records exist when the g-mysql backend is set to gmysql-dnssec ?
Alright so i think we're getting closer to the culprit. You will need
to have the auth field set to '1' i.e. True for most if not all
records
Documentation [1] says:
"The 'auth' field should be set to '1' for data for which is itself
authoritative, which includes the SOA record and its own NS records."
"The 'auth' field should be 0 however for NS records which are used
for delegation, and also for any glue (A, AAAA) records present for
this purpose. Do note that the DS record for a secure delegation
should be authoritative!"
And that works for me.
Even so you are not serving DNSSEC signed zone data i think when
setting dnssec to on for a backend PowerDNS will just assume that if
the auth field is there and is '0' or False that it does not need to
serve this as authoritative data.
> Or am I stuck with PDNS serving DNS-SEC enabled zones, OR non DNS-SEC enabled zones but not both :-/
Nope, definitely not. This usually just works.
dig a foo.zaphods.org @mandelbrot.zaphods.net +norec +dnssec
; <<>> DiG 9.7.3 <<>> a foo.zaphods.org @mandelbrot.zaphods.net +norec +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7345
;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 2800
;; QUESTION SECTION:
;foo.zaphods.org. IN A
;; ANSWER SECTION:
foo.zaphods.org. 3600 IN A 127.0.0.1
;; Query time: 54 msec
;; SERVER: 217.197.86.168#53(217.197.86.168)
;; WHEN: Thu Jul 21 21:12:26 2011
;; MSG SIZE rcvd: 60
mysql> select * from dns_record where domain_id=778;
+---------+-----------+-----------------+------+------------------------------------------------------------------------------------------+------+------+-------------+---------+-----------+------+
| id | domain_id | name | type | content
|
ttl | prio | description | dynamic | ordername | auth |
+---------+-----------+-----------------+------+------------------------------------------------------------------------------------------+------+------+-------------+---------+-----------+------+
| 7448641 | 778 | zaphods.org | NS | chiyoda.zaphods.net
|
3600 | 0 | NULL | 0 | | 1 |
| 7448642 | 778 | zaphods.org | NS |
mandelbrot.zaphods.net
| 3600 | 0 | NULL | 0 | |
1 |
| 7448643 | 778 | zaphods.org | NS | shinagawa.zaphods.net
|
3600 | 0 | NULL | 0 | | 1 |
| 7448644 | 778 | zaphods.org | NS | taito.zaphods.net
|
3600 | 0 | NULL | 0 | | 1 |
| 7448645 | 778 | zaphods.org | SOA |
mandelbrot.zaphods.net hostmaster at zaphods.net 2011072101 28800 14400
3600000 86400 86400 | 3600 | 0 | NULL | 0 |
| 1 |
| 7448646 | 778 | foo.zaphods.org | A | 127.0.0.1
|
3600 | 0 | | 0 | | 1 |
+---------+-----------+-----------------+------+------------------------------------------------------------------------------------------+------+------+-------------+---------+-----------+------+
6 rows in set (0.00 sec)
(note that my have renamed my queries to use 'dns_record' as table
name for the 'records' table as python django kind of insisted on that
naming scheme - no biggie ;-)
versus
dig a foo.zaphods.net @mandelbrot.zaphods.net +norec +dnssec
; <<>> DiG 9.7.3 <<>> a foo.zaphods.net @mandelbrot.zaphods.net +norec +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 55871
;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 6, ADDITIONAL: 0
;; QUESTION SECTION:
;foo.zaphods.net. IN A
;; AUTHORITY SECTION:
zaphods.net. 86400 IN SOA mandelbrot.zaphods.net.
zaphodb.zaphods.net. 2011071307 28800 3600 3600000 86400
zaphods.net. 86400 IN RRSIG SOA 8 2 86400 20110804000000
20110721000000 52750 zaphods.net.
cRUfLkD/w+YxWz05u7xQP83OJD5XbXFXk+2Q005UzYTixaw/6RN2EJJ4
e+GipLJJR7Se0Jp3yCfJswJoxysjPpK5EPrNLA2fn/hYRgsvfh9CLcla
0a0LiItyq5Z4tuagbYHwJg+2kJMSHUsrymBKa3lFOnRGs0Fk/5fU3IvK BJM=
zaphods.net. 86400 IN RRSIG SOA 8 2 86400 20110804000000
20110721000000 62385 zaphods.net.
kp+d1q3Nm2Q8ZgjPHqW5T9fWBiXuVhuT9ESOWjFlv/T6K4LJ3aClChJC
ir24Y9AVOFtp5+pGXLcsAs0vjZycEV6ExFJHt76fNVlw6RREaKIFOIn2
agI+gzFCkqajRheeSnnMtrkWjQAbLYHFODe09mA4fIsTqDXjIlp9KulE
VmNgIeF85LizgGjxXdWMH0vHoZUZ3MCXU7cw2EdKox40JHA7bNBn2j16
o36STeqMlMEVo04bk7VhRc79O7mwaMywPm0wAAnPDz+uzdJXrxw6qZsR
eH1IMQDhCHM3/yQVzM2lZDAjyZXc1Xw8Lj3YNWqI7j2bXRuKcw9OyItM
hAeemtiRhNZ4/PVXwX7ErDb9N7yO5+Jk2ilI5066mJZ7tADdDsNiVPVf
3+Fo3WCoZ6QBotIfOpMBSUvI4JxqINDchnET0FWE0wwd8DOfIKrDycoH
4JzAntOMP7qs+I4b1Gw8W7offw4SUgsYup+q1BQSUEIL9R6hyPBRW8he
oHmSmevyHVOn2z+DeU0ptq+xOffj8tieiDFsZ1FuOSrMaX2rMMhapAxG
PiTHkIAQbTP+yU05qpued/P8Pu5BLTjj/GrPf9pMzY/jsRnpkVAS+X7W
mElQmKN1qw781u9n4kl/lIRoj/FR8ztERKr55kz1i7vx6yJq3S1f0RZo 7bkMLj9mRGo=
ucekgdpo0a5ck5qtjn7grbjdsi1r6jm5.zaphods.net. 3600 IN NSEC3 1 0 1 AB
UCEKGDPO0A5CK5QTJN7GRBJDSI1R6JM6 A NS SOA MX TXT AAAA RRSIG DNSKEY
NSEC3PARAM SPF
ucekgdpo0a5ck5qtjn7grbjdsi1r6jm5.zaphods.net. 3600 IN RRSIG NSEC3 8 3
3600 20110804000000 20110721000000 52750 zaphods.net.
hhJEHgGSrIjKc0drIXIzOgITEdGVYB0K1lT9Qq5mNSRuWqOeCfnhjLyn
WafV+N5AGBkHgT7nucoyRqkhZAV29mMnILpisnP9d2jX8jZ7g83nlO34
/SBviLMP9WM4QUA6B4I4jsTjnQpFccQyLKfM4DywTLMU4fxyK0s+fjHj d6Q=
ucekgdpo0a5ck5qtjn7grbjdsi1r6jm5.zaphods.net. 3600 IN RRSIG NSEC3 8 3
3600 20110804000000 20110721000000 62385 zaphods.net.
oFXpy8ulFsguhLqJVMXpW0LWcBdxFIhwVkGOwh+mVijQeGT3DOq9W0sO
w5k3l+EdrYSZR8ydz3D++mcu8zX/KhaoCvTjcxZwVEcTwe7dTfldAtqP
qf9KIFOUSNc99iiWDkwBzCNPvPs0ELExPG7y0lIu31lgCzuoBfEzFHVf
56yPiUgtL2Ze8uutwR6dkIckgCsJMJEgMvoCQltHp9O0pLsbm8SVEbiq
R4Q4wJbD5+v8g/KUcx+VXYTnad21B+dxfYtumsmysq/730tegXRwuxiu
ECaX0TNeFx/Eme8vzHnXQkhpZjYfIy8aqrUzTXSJ1WNmD1HNYFw+eli2
q12xeFA0EkrU2svZm4RNSFAcmDrH0UvoBpBJKsWygGcTyURJFdSCnLFX
CvQYnTxrDGSJ//hn92pvpRjBZe7N2AlqcFqbhm3OV4Iu+8TVF2uAR0NL
79Euccc6TGt0OjGHfa56naLLR18m9g09pGBMGxqjlye2prW9dKAztcDr
NUI/lIIRKrnRJD+2eVxLHyiviYuLxNzfv3lOnu8nyXhpPE5JZGCq2JPn
IusZ8ZRJo24liZGWD8u/bg95dvZYZrC+0rVH4m90AJMF6IJ4oUVYAHo8
8OaS46USgiDnoBFN2ct5Sr7ZBDItG8oqRI3x65VVwvmja72K1Rii8Gmo BriXEMUibqs=
;; Query time: 519 msec
;; SERVER: 217.197.86.168#53(217.197.86.168)
;; WHEN: Thu Jul 21 21:24:50 2011
;; MSG SIZE rcvd: 1627
Stefan
[1] http://doc.powerdns.com/dnssec-modes.html
More information about the Pdns-users
mailing list