15 Led
2024
15 Led
'24
12:03
Hi,
I’m updating our config files and I’m wondering if we need to set ‘key’ in remotes
section, and in acl section?
If I have this in my config:
remote:
- id: remote01
address: 127.0.0.1
key: my_key
acl:
- id: allow_transfer
address: 127.0.0.1
key: my_key
action: transfer
zone:
- domain: example.com
acl: [ allow_transfer ]
notify: [ remote01 ]
Couldn’t I just remove key attribute from the remote, since the acl declares the address
and key that are allowed to transfer the zone?
.einar
15 Led
15 Led
16:45
On Mon, 15 Jan 2024 11:03:49 +0000
Einar Bjarni Halldórsson <einar(a)isnic.is> wrote:
Hi,
I’m updating our config files and I’m wondering if we need to set
‘key’ in remotes section, and in acl section? If I have this in my
config:
remote:
- id: remote01
address: 127.0.0.1
key: my_key
^^This looks like incomplete config. It should have port in it. I'd
expect:
remote:
- id: remote01
address: 127.0.0.1@53
Remote configuration tells where to contact.
acl:
- id: allow_transfer
address: 127.0.0.1
key: my_key
action: transfer
And acl describes which ip can transfer.
zone:
- domain: example.com
acl: [ allow_transfer ]
notify: [ remote01 ]
Couldn’t I just remove key attribute from the remote, since the acl
declares the address and key that are allowed to transfer the zone?
Remote declaration needs port and acl doesn't have port (allows all
source ports). So I'd say you need both.
--
Tuomo Soini <tis(a)foobar.fi>
Foobar Linux services
+358 40 5240030
Foobar Oy <https://foobar.fi/>
16:53
Hi Tuomo,
On 15 Jan 2024, at 15:45, Tuomo Soini
<tis(a)foobar.fi> wrote:
But do I need the TSIG key configured both in remote section, and in acl section?
I guess my point is, what is the purpose of the key attribute in remote section?
.einar
Couldn’t I just remove key attribute from the remote, since the acl
declares the address and key that are allowed to transfer the zone?
Remote declaration needs port and acl doesn't have port (allows all
source ports). So I'd say you need both.
17:03
On 15/01/2024 16:53, Einar Bjarni Halldórsson wrote:
Hi Einar,
But do I need the TSIG key configured both in remote
section, and in acl section?
I guess my point is, what is the purpose of the key attribute in remote section?
If you configure a TSIG key in the remote section, then the NOTIFY will
be signed with the key. This does no harm, but signed NOTIFY messages
are unnecessary. But be careful. If the remote is Knot DNS or NSD, and
has been configured with a notify acl containing a key, then, if I
recall correctly, it will ignore an unsigned NOTIFY. If it's BIND, then
I think it doesn't care. So if you're going to remove the key from your
"remote" definition, ensure that the remote will accept your unsigned
NOTIFY.
Regards,
Anand
18:22
On 15 Jan 2024, at 16:03, Anand Buddhdev
<anandb(a)ripe.net> wrote:
On 15/01/2024 16:53, Einar Bjarni Halldórsson wrote:
Hi Einar,
Ah, of coure! I blanked on the notfy being signed.
It all makes sense now.
Thank you,
.einar
But do I need the TSIG key configured both in
remote section, and in acl section?
I guess my point is, what is the purpose of the key attribute in remote section?
If you configure a TSIG key in the remote section, then the NOTIFY will be signed with
the key. This does no harm, but signed NOTIFY messages are unnecessary. But be careful. If
the remote is Knot DNS or NSD, and has been configured with a notify acl containing a key,
then, if I recall correctly, it will ignore an unsigned NOTIFY. If it's BIND, then I
think it doesn't care. So if you're going to remove the key from your
"remote" definition, ensure that the remote will accept your unsigned NOTIFY.
18:15
On Mon, 15 Jan 2024 15:53:16 +0000
Einar Bjarni Halldórsson <einar(a)isnic.is> wrote:
But do I need the TSIG key configured both in remote
section, and in
acl section?
I guess my point is, what is the purpose of the key attribute in
remote section?
That is used for TSIG authenticated notifies.
--
Tuomo Soini <tis(a)foobar.fi>
Foobar Linux services
+358 40 5240030
Foobar Oy <https://foobar.fi/>
18:24
Hi Einar,
If TSIG is used in both directions (outbound NOTIFY, inbound XFR), I would recommend
reconfiguration to:
server:
automatic-acl: on
remote:
- id: remote01
address: 127.0.0.1
key: my_key
zone:
- domain: example.com
notify: [ remote01 ]
Daniel
On 1/15/24 12:03, Einar Bjarni Halldórsson wrote:
Hi,
I’m updating our config files and I’m wondering if we need to set ‘key’ in remotes
section, and in acl section?
If I have this in my config:
remote:
- id: remote01
address: 127.0.0.1
key: my_key
acl:
- id: allow_transfer
address: 127.0.0.1
key: my_key
action: transfer
zone:
- domain: example.com
acl: [ allow_transfer ]
notify: [ remote01 ]
Couldn’t I just remove key attribute from the remote, since the acl declares the address
and key that are allowed to transfer the zone?
.einar
--
115
days inactive
115
days old
6 comments
4 participants
participants (4)
-
Anand Buddhdev -
Daniel Salzman -
Einar Bjarni Halldórsson -
Tuomo Soini