On 09/07/2021 14:43, informant--- via Pdns-users wrote:
I intend to set up a PowerDNS authoritative server and recursor, where
a few subdomains will be forwarded to the auth server for internal use
only. (local IP addresses) We do not wish to allow lookups for these
domains by any external host. So far, so good.
Now, additionally, I would like to employ Let’s Encrypt certificates
for these private services by using DNS wildcard challenge. This, of
course, requires that the DNS server be public. My question, then, is
can I set up PowerDNS in such a way that the DNS server allows the
necessary lookups required to complete the DNS challenge, but prevents
lookups for any subdomains by any external host?
You have a domain like "int.example.com" where you don't want any names
to be visible to the outside world, but you want to be able to obtain
certificates for them. Correct?
The way I deal with this is to have a separate nameserver, say
ns-acme.example.com, and delegate int.example.com to that server (in the
public DNS):
int.example.com. NS ns-acme.example.com.
The zone file on ns-acme is empty, so if anyone tries to resolve
XXX.int.example.com they'll get NXDOMAIN. However, you also set up TSIG
zones on this server so that servers can response to DNS01 challenges.
You can either just have a single TSIG record which allows all updates
to the domain; or (more securely) you can create separate zones on the
nameserver, e.g.
_acme-challenge.foo.int.example.com
_acme-challenge.bar.int.example.com
so that the servers foo.int.example.com and bar.int.example.com have
separate TSIG keys, and can only issue certs for themselves.
Any lightweight authoritative DNS server that supports TSIG updates is
fine - e.g. powerdns with SQLite backend, BIND with filebackend.
Regards,
Brian.
_______________________________________________
Pdns-users mailing list
Pdns-users@mailman.powerdns.com
https://mailman.powerdns.com/mailman/listinfo/pdns-users
