2 Zář
2024
2 Zář
'24
12:52
Hi all,
we are using dynamic updates for solving ACME challenges. My goal is to
restrict the key used for this as much as possible. However, I find it a
bit difficult to do so while keeping the required flexibility. Maybe
someone has some good recommendations for this?
The key is already restricted to TXT records, so that's good.
In a nutshell, I'd like to allow only "_acme-challenge.example.com" and
"_acme-challenge.*.example.com". However, the latter cannot be expressed
in the current config format.
I would be fine allowing "*.example.com", if I could just deny a select
few names (SPF, DKIM). But AFAICT, the "deny" option only works on
action, key, and address, now owner matching. Is there any other way to
achieve something like this?
Thanks a lot,
Conrad
2 Zář
2 Zář
15:47
Hi,
The 'deny' option should apply to every match. Please show me the current ACL
rule.
Daniel
On 9/2/24 12:52, Conrad Hoffmann via knot-dns-users wrote:
Hi all,
we are using dynamic updates for solving ACME challenges. My goal is to restrict the key
used for this as much as possible. However, I find it a bit difficult to do so while
keeping the required
flexibility. Maybe someone has some good recommendations for this?
The key is already restricted to TXT records, so that's good.
In a nutshell, I'd like to allow only "_acme-challenge.example.com" and
"_acme-challenge.*.example.com". However, the latter cannot be expressed in the
current config format.
I would be fine allowing "*.example.com", if I could just deny a select few
names (SPF, DKIM). But AFAICT, the "deny" option only works on action, key, and
address, now owner matching. Is there any
other way to achieve something like this?
Thanks a lot,
Conrad
--
21:24
On 9/2/24 3:47 PM, Daniel Salzman wrote:
The 'deny' option should apply to every match.
Please show me the
current ACL rule.
Right, it does indeed :/ I feel a tad stupid now for not trying hard
enough, but what really threw me off was the wording in the docs [1]:
If enabled, instead of allowing, deny the specified
action, address, key, or combination if these items.
Much more importantly, though, I discovered that 3.3(?) introduced
`update-owner-match: pattern` [2], which provides _exactly_ what I was
asking for (matching "_acme-challenge.*.example.com"). So thanks for that :)
But for anyone playing along at home, this works even without `pattern`:
acl:
- id: txt_updates_protect
action: update
key: tsigkey.example.com
update-type: [TXT]
update-owner: name
update-owner-name: [ _spf, _dmarc ] # Protect these records
deny: on
- id: txt_updates_allow
action: update
key: tsigkey.example.com
update-type: [TXT]
update-owner: name
update-owner-name: [ example.com. ]
update-owner-match: sub
template:
- id: default
acl: [txt_updates_protect, txt_updates_allow]
...
So, sorry for the noise, but maybe someone else learned a thing or two,
I know I did. And I might also submit a patch for the documentation :)
Cheers,
Conrad
[1] https://www.knot-dns.cz/docs/3.4/singlehtml/index.html#deny
[2]
https://www.knot-dns.cz/docs/3.4/singlehtml/index.html#update-owner-match
3 Zář
3 Zář
12:02
Conrad,
We are happy that you found a solution. I agree that the documentation should be improved.
It's never perfect.
Daniel
On 9/2/24 21:24, Conrad Hoffmann wrote:
On 9/2/24 3:47 PM, Daniel Salzman wrote:
The 'deny' option should apply to every
match. Please show me the current ACL rule.
Right, it does indeed :/ I feel a tad stupid now for not trying hard enough, but what
really threw me off was the wording in the docs [1]:
If enabled, instead of allowing, deny the
specified action, address, key, or combination if these items.
Much more importantly, though, I discovered that 3.3(?) introduced `update-owner-match:
pattern` [2], which provides _exactly_ what I was asking for (matching
"_acme-challenge.*.example.com"). So
thanks for that :)
But for anyone playing along at home, this works even without `pattern`:
acl:
- id: txt_updates_protect
action: update
key: tsigkey.example.com
update-type: [TXT]
update-owner: name
update-owner-name: [ _spf, _dmarc ] # Protect these records
deny: on
- id: txt_updates_allow
action: update
key: tsigkey.example.com
update-type: [TXT]
update-owner: name
update-owner-name: [ example.com. ]
update-owner-match: sub
template:
- id: default
acl: [txt_updates_protect, txt_updates_allow]
...
So, sorry for the noise, but maybe someone else learned a thing or two, I know I did. And
I might also submit a patch for the documentation :)
Cheers,
Conrad
[1] https://www.knot-dns.cz/docs/3.4/singlehtml/index.html#deny
[2] https://www.knot-dns.cz/docs/3.4/singlehtml/index.html#update-owner-match
16
days inactive
17
days old
3 comments
2 participants
participants (2)
-
Conrad Hoffmann -
Daniel Salzman