<div dir="auto">To echo what Kevin has said. </div><div dir="auto"><br></div><div dir="auto">A TXT record is what is needed in the ZONE file. Furthermore with Letsencrypt or any other CA you need to add a CAA record otherwise you run the risk of returning a SERVFAIL with whatever client goes to validate that record. </div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><div><a href="https://letsencrypt.org/docs/caa/">https://letsencrypt.org/docs/caa/</a></div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><br></div>This record should go in the same zone file as your TXT record. </div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto">Hope that helps. </div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto">Cameron </div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><br><div class="gmail_quote" dir="auto"><div dir="ltr" class="gmail_attr">On Mon, Apr 26, 2021 at 7:47 AM <<a href="mailto:bind-users-request@lists.isc.org">bind-users-request@lists.isc.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;padding-left:1ex;border-left-color:rgb(204,204,204)">Send bind-users mailing list submissions to<br>
<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:bind-users-request@lists.isc.org" target="_blank">bind-users-request@lists.isc.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:bind-users-owner@lists.isc.org" target="_blank">bind-users-owner@lists.isc.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of bind-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: Configuring the location of named .jnl files (Kevin Darcy)<br>
2. Re: Using RNDC to control remote access to my BIND server<br>
(Greg Donohoe)<br>
3. Re: Using RNDC to control remote access to my BIND server<br>
(Anand Buddhdev)<br>
4. How to interpret BIND 9 JSON Counters (Dom Brown)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Mon, 26 Apr 2021 09:56:29 -0400<br>
From: Kevin Darcy <<a href="mailto:kevin.darcy@stellantis.com" target="_blank">kevin.darcy@stellantis.com</a>><br>
To: ML BIND Users <<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>><br>
Subject: Re: Configuring the location of named .jnl files<br>
Message-ID:<br>
<CAAeHe+x2qk1W9L3WYTzLRW=<a href="mailto:msKVKZYVCDc4G2Mv90WGSf2hq0g@mail.gmail.com" target="_blank">msKVKZYVCDc4G2Mv90WGSf2hq0g@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
[ Classification Level: GENERAL BUSINESS ]<br>
<br>
Ivan,<br>
I've never done the Let's Encrypt thing myself, but from my skim<br>
of the documentation, it appears they want you to place a TXT record in a<br>
specific part of your domain's namespace hierarchy.<br>
<br>
I sincerely hope you're not trying to write the TXT record directly to the<br>
journal file. That could lead to corruption, or, at the very least, your<br>
changes could be overwritten, since journal files are written dynamically.<br>
<br>
The safe way to update DNS programmatically is through the Dynamic Update<br>
extension to DNS, typically via the "nsupdate" command-line utility, or via<br>
various libraries/modules of scripting languages like Perl or Python.<br>
<br>
One of the bash-based ACME client implementations linked from Let's<br>
Encrypt's webpage, for instance, is <a href="http://github.com/bruncsak/ght-acme.sh" rel="noreferrer" target="_blank">github.com/bruncsak/ght-acme.sh</a>, and<br>
for the DNS-01 challenge method, it feeds some commands to nsupdate. The<br>
code is rather crude, assuming no crypto-based authentication on the server<br>
side, among other things, but it's at least a start on a recommended way to<br>
update DNS data. Better than mucking around with journal files.<br>
<br>
There is a learning curve associated with Dynamic Update. On the server<br>
side, for instance, you'll need to establish permissions via allow-update.<br>
Limiting updates to localhost at least would protect your DNS data from<br>
unauthorized changes from remote hosts, but ideally, you'd generate a key<br>
and use that.<br>
<br>
<br>
- Kevin<br>
<br>
On Sun, Apr 25, 2021 at 7:39 PM Ivan Avery Frey <<a href="mailto:ivan.avery.frey@gmail.com" target="_blank">ivan.avery.frey@gmail.com</a>><br>
wrote:<br>
<br>
> I'm trying to obtain certificates from Let's Encrypt using the DNS-01<br>
> challenge method.<br>
><br>
> I just want to confirm that there is no option to configure the<br>
> directory for the .jnl files independently of the zone files.<br>
> _______________________________________________<br>
> Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to<br>
> unsubscribe from this list<br>
><br>
> ISC funds the development of this software with paid support<br>
> subscriptions. Contact us at <a href="https://www.isc.org/contact/" rel="noreferrer" target="_blank">https://www.isc.org/contact/</a> for more<br>
> information.<br>
><br>
><br>
> bind-users mailing list<br>
> <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
> <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
><br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="https://lists.isc.org/pipermail/bind-users/attachments/20210426/a196f485/attachment-0001.htm" rel="noreferrer" target="_blank">https://lists.isc.org/pipermail/bind-users/attachments/20210426/a196f485/attachment-0001.htm</a>><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Mon, 26 Apr 2021 15:04:27 +0100<br>
From: Greg Donohoe <<a href="mailto:dubgregd@gmail.com" target="_blank">dubgregd@gmail.com</a>><br>
To: Anand Buddhdev <<a href="mailto:anandb@ripe.net" target="_blank">anandb@ripe.net</a>><br>
Cc: <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
Subject: Re: Using RNDC to control remote access to my BIND server<br>
Message-ID:<br>
<<a href="mailto:CAMBNh5rYLCkgUHs%2BzToDXyBKAXeXeEXQ0CZPP699uQ9p8UEPHQ@mail.gmail.com" target="_blank">CAMBNh5rYLCkgUHs+zToDXyBKAXeXeEXQ0CZPP699uQ9p8UEPHQ@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Thanks Anand.<br>
When using this TSIG solution is the key visible (clear) within the DNS<br>
packet being sent to the remote server or is it encrypted?<br>
Is this communication secure? eg if someone is sitting on the wire sniffing<br>
the packets, would they be able to extract the key ?<br>
Or is the security of the communication done through the ACL and the key is<br>
TSIG only used to allow me to make changes to the zone file?<br>
The main reason why I was leaning towards SSH was to try to ensure that all<br>
communication between local & remote was encrypted.<br>
<br>
Rgds,<br>
Greg.<br>
<br>
On Fri, Apr 23, 2021 at 2:21 PM Anand Buddhdev <<a href="mailto:anandb@ripe.net" target="_blank">anandb@ripe.net</a>> wrote:<br>
<br>
> On 23/04/2021 14:24, Greg Donohoe wrote:<br>
><br>
> Hi Greg,<br>
><br>
> > In regards to the nsupdate, what is the best way to secure the<br>
> connection,<br>
> > so to ensure that only my local server can make the amendments to the<br>
> > remote server named & zone files?<br>
> > I dont want anyone/anything else other than my local machine to make any<br>
> > changes on my remote BIND server.<br>
><br>
> You should create a TSIG key, and configure the zones on the remote<br>
> server to only accept dynamic DNS updates signed by this key. And then<br>
> use this key with nsupdate when sending your updates. Check the man page<br>
> of nsupdate and look at the '-k' and '-y' options for using tsig keys.<br>
><br>
> You can additionally also configure your remote BIND to accept updates<br>
> only from certain IP addresses. For details on how to configure this,<br>
> please read the excellent documentation (especially section 4.2.29 and<br>
> the "allow-update" option):<br>
><br>
> <a href="https://bind9.readthedocs.io/en/v9_16/" rel="noreferrer" target="_blank">https://bind9.readthedocs.io/en/v9_16/</a><br>
><br>
> Regards,<br>
> Anand Buddhdev<br>
><br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="https://lists.isc.org/pipermail/bind-users/attachments/20210426/4cee450e/attachment-0001.htm" rel="noreferrer" target="_blank">https://lists.isc.org/pipermail/bind-users/attachments/20210426/4cee450e/attachment-0001.htm</a>><br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Mon, 26 Apr 2021 16:32:48 +0200<br>
From: Anand Buddhdev <<a href="mailto:anandb@ripe.net" target="_blank">anandb@ripe.net</a>><br>
To: Greg Donohoe <<a href="mailto:dubgregd@gmail.com" target="_blank">dubgregd@gmail.com</a>><br>
Cc: <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
Subject: Re: Using RNDC to control remote access to my BIND server<br>
Message-ID: <<a href="mailto:115665a1-43f4-2c15-6482-a452acbe269e@ripe.net" target="_blank">115665a1-43f4-2c15-6482-a452acbe269e@ripe.net</a>><br>
Content-Type: text/plain; charset=utf-8<br>
<br>
Hi Greg,<br>
<br>
a TSIG key is *never* transmitted. A sender uses a TSIG key to generate<br>
a secure hash over the DNS content being sent, and sends the hash along<br>
with the DNS content. A receiver configured with the same key can then<br>
verify that hash. If it can, then it can apply the DNS content.<br>
<br>
If someone is sniffing the wire between the client and server, they can<br>
see the DNS content. This usually doesn't matter, because the DNS is<br>
usually public anyway. However, if a man-in-the-middle tries to modify<br>
the packet in any way, then the receiver will detect the change, because<br>
the hash will not verify, and the receiver can reject that packet as<br>
invalid.<br>
<br>
DNS was NOT designed to be encrypted, because as I wrote above, it's<br>
usually public data anyway.<br>
<br>
If you want to encrypt your dynamic DNS update anyway (even though<br>
there's good reason to do this), then you need to send your update over<br>
an encrypted session of some kind. The DNS protocol itself has recently<br>
been updated to allow for encryption, using DTLS (DNS-over-TLS). But<br>
while DNS resolvers can use this to send queries to suitably configured<br>
servers, I don't think "nsupdate" can use DTLS just yet (someone please<br>
correct me if I'm wrong). So your only alternative is to use another<br>
secure protocol, such as SSH, with port forwarding, to send your dynamic<br>
updates to the server.<br>
<br>
BUT AGAIN, there is usually no need for this. Do NOT overcomplicate your<br>
design for no reason.<br>
<br>
Regards,<br>
Anand<br>
<br>
On 26/04/2021 16:04, Greg Donohoe wrote:<br>
> Thanks Anand.<br>
> When using this TSIG solution is the key visible (clear) within the DNS<br>
> packet being sent to the remote server or is it encrypted?<br>
> Is this communication secure? eg if someone is sitting on the wire sniffing<br>
> the packets, would they be able to extract the key ?<br>
> Or is the security of the communication done through the ACL and the key is<br>
> TSIG only used to allow me to make changes to the zone file?<br>
> The main reason why I was leaning towards SSH was to try to ensure that all<br>
> communication between local & remote was encrypted.<br>
> <br>
> Rgds,<br>
> Greg.<br>
> <br>
> On Fri, Apr 23, 2021 at 2:21 PM Anand Buddhdev <<a href="mailto:anandb@ripe.net" target="_blank">anandb@ripe.net</a>> wrote:<br>
> <br>
>> On 23/04/2021 14:24, Greg Donohoe wrote:<br>
>><br>
>> Hi Greg,<br>
>><br>
>>> In regards to the nsupdate, what is the best way to secure the<br>
>> connection,<br>
>>> so to ensure that only my local server can make the amendments to the<br>
>>> remote server named & zone files?<br>
>>> I dont want anyone/anything else other than my local machine to make any<br>
>>> changes on my remote BIND server.<br>
>><br>
>> You should create a TSIG key, and configure the zones on the remote<br>
>> server to only accept dynamic DNS updates signed by this key. And then<br>
>> use this key with nsupdate when sending your updates. Check the man page<br>
>> of nsupdate and look at the '-k' and '-y' options for using tsig keys.<br>
>><br>
>> You can additionally also configure your remote BIND to accept updates<br>
>> only from certain IP addresses. For details on how to configure this,<br>
>> please read the excellent documentation (especially section 4.2.29 and<br>
>> the "allow-update" option):<br>
>><br>
>> <a href="https://bind9.readthedocs.io/en/v9_16/" rel="noreferrer" target="_blank">https://bind9.readthedocs.io/en/v9_16/</a><br>
>><br>
>> Regards,<br>
>> Anand Buddhdev<br>
>><br>
> <br>
<br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Mon, 26 Apr 2021 14:46:07 +0000<br>
From: Dom Brown <<a href="mailto:Dom.Brown@mycom-osi.com" target="_blank">Dom.Brown@mycom-osi.com</a>><br>
To: "<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>" <<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>><br>
Cc: Greg Choules <<a href="mailto:Greg.Choules@three.co.uk" target="_blank">Greg.Choules@three.co.uk</a>><br>
Subject: How to interpret BIND 9 JSON Counters<br>
Message-ID:<br>
<<a href="mailto:CWXP123MB3045D7583644D5FF1F7AEC30B6429@CWXP123MB3045.GBRP123.PROD.OUTLOOK.COM" target="_blank">CWXP123MB3045D7583644D5FF1F7AEC30B6429@CWXP123MB3045.GBRP123.PROD.OUTLOOK.COM</a>><br>
<br>
Content-Type: text/plain; charset="us-ascii"<br>
<br>
Hi All,<br>
Wonder if you can help, I'm looking to input the BIND 9 JSON stats file to our OSS PM tool and I need some basic information on the counter types.<br>
Looking at the various counters I need to understand whether they are of type gauge (a snapshot in time) or counter (we need to calculate the delta between the last and the last but one values received).<br>
<br>
I think they are gauge but would be great if you can confirm.<br>
<br>
Additionally is there guidance on how the Network Elements and the time would be aggregated. Would they be aggregated by sum?<br>
<br>
Please feedback if my ask isn't clear. I hope you can help.<br>
<br>
BR,<br>
Dom Brown<br>
07577 272977<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="https://lists.isc.org/pipermail/bind-users/attachments/20210426/94a03d39/attachment.htm" rel="noreferrer" target="_blank">https://lists.isc.org/pipermail/bind-users/attachments/20210426/94a03d39/attachment.htm</a>><br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
_______________________________________________<br>
ISC funds the development of this software with paid support subscriptions. Contact us at <a href="https://www.isc.org/contact/" rel="noreferrer" target="_blank">https://www.isc.org/contact/</a> for more information.<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
<br>
<br>
------------------------------<br>
<br>
End of bind-users Digest, Vol 3696, Issue 2<br>
*******************************************<br>
</blockquote></div></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div dir="ltr"><div dir="ltr"><font face="monospace">Cameron Banowsky</font><div><font face="monospace">c. 323-217-8592</font></div><div><font face="monospace">o. 323-664-8285</font></div><div><a href="https://shebash.io" style="font-family:monospace" target="_blank">https://shebash.io</a><br></div><div><a href="https://calendly.com/banowsky" target="_blank">https://calendly.com/banowsky<br></a></div><div><br></div><div><br></div><div><img src="https://docs.google.com/uc?export=download&id=1OIiKilZnesivyfkb1OcVxIq3MrrlSRWR&revid=0B7okutIfOZNjQXhNdVNuWmJWOWFBb1UvU0dLZlhncVdTNm1NPQ" width="200" height="24"><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><font face="monospace">The content of this email is confidential and intended for the recipient specified in message only. It is strictly forbidden to share any part of this message with any third party, without a written consent of the sender. If you received this message by mistake, please reply to this message and follow with its deletion, so that we can ensure such a mistake does not occur in the future.</font><br></div></div></div></div></div>