On 5/12/22 15:34, vom513 wrote:
Hello all,
So I set up parental-agents lists for my zones, and actually got to see it work
(awesome !). bind detected the parent DS records and acted accordingly.
However, I currently have these lists configured using the IP (v4 only at the
moment) addresses of the parent NS’es. I tried inputting hostnames, and I got
errors (i.e. syntax) every time.
I would prefer to put these in as hostnames. While at a certain level in the
tree these don’t change very often, they can and do. I’d rather not have to
keep track of these in this manner.
So my question - am I just mangling the syntax - or does this clause really
only support IPs ? I was thinking if so - perhaps the reason is some chicken
vs. egg / security reason ? I.e. not trusting the name (which would have to be
itself resolved) ?
Thanks in advance for clue++
Although I haven't personally set up parental-agents (yet), I noticed an
interesting remark in section 8.2.26.1 of the documentation
(https://bind9.readthedocs.io/en/v9_18_8/reference.html#automated-ksk-rollovers)
- NB: italics added for emphasis:
Note
The DS response is not validated so it is recommended to set up a
trust relationship with the parental agent. For example, use TSIG
to authenticate the parental agent, /or point to a validating
resolver/.
So you might consider pointing your parental-agents at (an IP address
of) your local resolver(s), instead of the parent NSs?
However the obvious drawback of this approach would seem to be that the
resolver will only check one of the parent NSs for the DS record,
whereas if you explicitly specify all the NSs in parental-agents, then
they all get checked?
Nick.
--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from
this list
ISC funds the development of this software with paid support subscriptions.
Contact us at https://www.isc.org/contact/ for more information.
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
