Home

Bind nsupdate dnssec-keygen

Bind nsupdate dnssec-keygen

nsupdate: Painless Dynamic DNS. Introduced in BIND version 8 and refined in BIND version 9, the nsupdate utility provides the system administrator or casual user with a quick and painless method of updating a DNS zone, adding or deleting any type of DNS record the name server supports. This article describes how to setup dynamic DNS, and provides some examples of use. For Fedora Core (and Red Hat) users, you will need to install both the bind (for dnssec-keygen) and bind-utils (for nsupdate) packages. If you plan to configure a DNS server, also read the companion article on configuring your server. My home network is the same as millions of other Internet users: dynamic IP obtained from my ISP via DHCP. Wanting to make sure that I can connect to my home network remotely, even if the underlying dynamic IP changes, I looked around for a reliable (and hopefully free!) dynamic DNS service. I found which I use today, and recently someone also pointed me to. Even though my DNS is automatically updated when it changes, via the highly versatile ddclient package, the traditional dynamic DNS update protocols (including are typically site-specific and non-standard. While googling around for a better solution, a friend on IRC pointing me to a utility that has been around since BIND 8: nsupdate. nsupdate is a fantastic little utility that enable quick and secure DNS zone updates. Setup is quick and painless, and use is fairly intuitive for anyone remotely familiar with DNS, and skilled enough to admin their own Linux system. Creating the keypair. Access to update a DNS zone is granted by key. This key is created by running the dnssec-keygen utility. For single users generating a key, you provide your email address and hash algorithm details as input, and dnssec-keygen generates two keys, a public key and a private key. For this specific case, HMAC-MD5, the public and private keys are the same. In this example, email address is used. This created two files in the current directory, and . The filename with the suffix is the public key, and the file with suffix is, you guessed it, the private key. The contents of the public key (you give this to your DNS administrator) looks like. and the content of the private key looks like. (again, the public and private keys are the same for HMAC-MD5. Store the private key in a secure location. If you are also the DNS server adminstrator, configure your server with the public key. Otherwise, email the public key to your DNS adminstrator. Executing a Dynamic DNS update. The first step is to create a convenience script for performing regular DNS updates, using the private key you just generated. Here is my do-nsupdate script. The next step is to create a text file which contains the information necessary to perform a DNS update. The full format of this text file is described on the nsupdate man page. server is the nameserver to which updates will be sent. zone is the DNS domain to be updated. The update lines specify the changes to be made to one or more DNS records. The show line is optional, and causes nsupdate to display the records after updating. The send line directs nsupdate to send flush all updates listed in the file to the nameserver. The final step is to execute the script, passing the text file you just created in this example) to the update script. That's it! The updates are available on the DNS server immediately. Further thought. Anyone familiar with scripting should be able to hook this into their DHCP client, to provide automatic DNS updates directly to the DNS server. For more imaginative folks, nsupdate facilitates a great many automated DNS services one can devise. For example, if you wish to fight spam by running your own DNS "blackhole list" (blacklist), nsupdate makes it trivial to automate updates. Since the updates take affect immediately on the DNS server, anti-spam and anti-virus databases can effectively be made real-time. In fact, I would be surprised if spam fighters are not already using nsupdate to update their anti-spam and anti-virus DNS blackhole lists. Further reading. Copyright 2008 Jeff Garzik.