Add bind configurations and helper scripts #1
2
.gitignore
vendored
Normal file
2
.gitignore
vendored
Normal file
@ -0,0 +1,2 @@
|
||||
# SECURITY(Krey): NEVER INCLUDE secret.rndc-key as leak would allow anyone to take control over the domain(s)
|
||||
secret.rndc-key
|
||||
94
bin/binder
Normal file
94
bin/binder
Normal file
@ -0,0 +1,94 @@
|
||||
#!/bin/sh
|
||||
# shellcheck shell=sh # Written to comply with POSIX IEEE Std 1003.1-2017
|
||||
|
||||
# NOTE(Krey): Define die()
|
||||
command -v die 1>/dev/null || die() { ${PRINTF:-printf} "${DIE_FORMAT_STRING:-"%s\\n"}" "$2"; ${EXIT:-exit} "$1";}
|
||||
|
||||
# NOTE(Krey): Functions are a rewrite of https://git.dotya.ml/RXT0112/Exheredrey/src/branch/master/packages/net-dns/bind/bind.exher#L247 designed for Mokleus GNU/Linux
|
||||
|
||||
###! Binder function that signs the zonefiles for provided domain assuming FSH3_0 standard followed
|
||||
###! SYNOPSIS: binder_signzone [DOMAIN(dotya.ml)]
|
||||
###! Copyright: Created by Jacob Hrbek identified using a GPG key assigned to the electronic mail <kreyren@rixotstudio.cz> based on the keyserver <https://keys.openpgp.org> as GPLv3 license <https://www.gnu.org/licenses/gpl-3.0.en.html> in 30/10/2020-EU
|
||||
binder_signzone() {
|
||||
# Define input
|
||||
domainInput="$1" # Expects domains alike 'dotya.ml'
|
||||
|
||||
for domain in $domainInput; do
|
||||
# NOTE(Krey): Make sure that all zonefiles are valid
|
||||
for zonefile in /etc/bind/zonefiles/"${domain##*.}"/"${domain%%.*}"/*.zonefile; do
|
||||
${NAMED_CHECKZONE:-named-checkzone} domain "$zonefile" || die 1 "Check for zonefile '$zonefile' of domain '$domain' failed"
|
||||
|
||||
# NOTE(Krey): Sign the zone
|
||||
${DNSSEC_SIGNZONE:-dnssec-signzone} \
|
||||
-g \
|
||||
-K "/var/cache/named/bind/keys/${domain##*.}/${domain%%.*}" \
|
||||
-T 300 \
|
||||
-n "$(nproc 2>/dev/null || printf 1)" \
|
||||
"/etc/bind/zonefiles/${domain##*.}/${domain%%.*}/$zonefile" || {
|
||||
case "$LANG" in
|
||||
en-*|*) die 1 "Signing zone dotya.ml failed"
|
||||
esac
|
||||
|
wanderer marked this conversation as resolved
|
||||
}
|
||||
done
|
||||
done
|
||||
}
|
||||
|
||||
###! Generate the rndc.conf and secret.rndc-key
|
||||
###! Copyright: Created by Jacob Hrbek identified using a GPG key assigned to the electronic mail <kreyren@rixotstudio.cz> based on the keyserver <https://keys.openpgp.org> as GPLv3 license <https://www.gnu.org/licenses/gpl-3.0.en.html> in 30/10/2020-EU
|
||||
binder_generate_rndc_key() {
|
||||
# NOTE(Krey): rndc.key is harder to manage for public review
|
||||
[ ! -f /etc/bind/rndc.key ] || ${MV:mv} /etc/bind/rndc.key /etc/bind/rndc.key.bk
|
||||
|
||||
# Generate the rndc.conf
|
||||
[ -s /etc/bind/rndc.conf ] || { ${RNDC_CONFGEN:-rndc-confgen} \
|
||||
-A hmac-sha512 \
|
||||
-b 512 \
|
||||
-u bind \
|
||||
-p 953 \
|
||||
> /etc/bind/rndc.conf ;} || {
|
||||
case "$LANG" in
|
||||
en-*|*) die 1 "Command '${RNDC_CONFGEN:-rndc-confgen}' was unable to generate the '/etc/bind/rndc.conf' file"
|
||||
esac
|
||||
}
|
||||
[ -s "/etc/bind/secret.rndc-key" ] || {
|
||||
{ ${GREP:-grep} "^#" "/etc/bind/rndc.conf" | ${GREP:-grep} "^# key" -A 3 | ${SED:-sed} "s/# //" > "/etc/bind/secret.rndc-key"
|
||||
} || die 1 "Unable to generate 'secret.rndc-key'" ;}
|
||||
|
||||
# FIXME-QA(Krey): Sanitize
|
||||
# SECURITY(Krey): Set the apropriate perms on secret.rndc-key
|
||||
${CHMOD:-chmod} 0640 "/etc/bind/secret.rndc-key" || die 1 "Unable to set the expected permission on file '/etc/bind/secret.rndc-key'"
|
||||
|
||||
# FIXME-QA(Krey): Sanitize
|
||||
# SECURITY(Krey): Set the apropriate perms on secret.rndc-key
|
||||
${CHOWN:-chown} bind:bind "/etc/bind/secret.rndc-key" || die 1 "Unable to set the expected ownership on file '/etc/bind/secret.rndc-key'"
|
||||
|
||||
# SECURITY(Krey): By default rndc.conf has CONFIDENTIAL INFORMATIONS, this will strip them
|
||||
${GREP:-grep} "^# " "/etc/bind/rndc.conf" >/dev/null || { { ${PRINTF:-printf} 'g/# .*/d\nw\nq\n' | ${ED:-ed} -s "/etc/bind/rndc.conf" ;} || die 28 "SECURITY WARNING UNABLE TO REMOVE CONFIDENTIAL INFORMATIONS FROM FILE '/etc/bind/rndc.conf'" ;}
|
||||
}
|
||||
|
||||
###! Function used to generate the KSK and ZSK
|
||||
###! SYNOPSIS: binder_generate_keys [DOMAIN(dotya.ml)]
|
||||
###! Copyright: Created by Jacob Hrbek identified using a GPG key assigned to the electronic mail <kreyren@rixotstudio.cz> based on the keyserver <https://keys.openpgp.org> as GPLv3 license <https://www.gnu.org/licenses/gpl-3.0.en.html> in 30/10/2020-EU
|
||||
binder_generate_keys() {
|
||||
# Define input
|
||||
domainInput="$1" # Expects domains alike 'dotya.ml'
|
||||
|
||||
for domain in $domainInput; do
|
||||
# FIXME-QA(Krey): Sanitize
|
||||
# Generate Key-Signing Key (KSK)
|
||||
${DNSSEC_KEYGEN:-dnssec-keygen} \
|
||||
-a "ECDSAP384SHA384" \
|
||||
-f KSK \
|
||||
-c IN \
|
||||
-L 300 \
|
||||
-K "/var/cache/named/bind/keys/${domain##*.}/${domain%%.*}" "$domain" || die 1 "Unable to generate Key-Signing Key (KSK) for domain '$domain'"
|
||||
|
||||
# Generate Zone-Signing Key (ZSK)
|
||||
${DNSSEC_KEYGEN:-dnssec-keygen} \
|
||||
-a ECDSAP384SHA384\
|
||||
-n ZONE \
|
||||
-c IN \
|
||||
-L 300 \
|
||||
-K "/var/cache/named/bind/keys/${domain##*.}/${domain%%.*}" "$domain" || die 1 "Unable to generate Zone-Signing Key (ZSK) for domain '$domain'"
|
||||
done
|
||||
}
|
||||
133
named.conf
133
named.conf
@ -0,0 +1,133 @@
|
||||
# Comment
|
||||
// Comment
|
||||
/* Comment */
|
||||
|
||||
# Relevant Administrator Reference Manual (ARM): https://downloads.isc.org/isc/bind9/9.16.8/doc/arm/Bv9ARM.pdf
|
||||
# FIXME-DOCS(Krey): Provide best practices reference
|
||||
|
||||
# NOTE(Krey): The key has to be included in named.conf
|
||||
include "/etc/bind/secret.rndc-key"
|
||||
|
||||
options {
|
||||
// Set directory CWD (Current Working Directory)
|
||||
directory "/var/named/bind";
|
||||
|
||||
// Path configuration
|
||||
dump-file "/bind_dump.db"; // _PATH_DUMPFILE
|
||||
pid-file "/run/named/bind.pid"; // _PATH_PIDFILE
|
||||
statistics-file "bind.stats"; // _PATH_STATS
|
||||
memstatistics-file "bind.memstats"; // _PATH_MEMSTATS
|
||||
|
||||
// Sets Random Device
|
||||
random-device "/dev/random";
|
||||
|
||||
// uncomment the following lines to turn on DNS forwarding,
|
||||
// and change the forwarding ip address(es) :
|
||||
//forward first;
|
||||
//forwarders {
|
||||
// 123.123.123.123;
|
||||
// 123.123.123.123;
|
||||
//};
|
||||
|
||||
# NOTE(Krey): Open port 53 reserved for name deamon
|
||||
listen-on port 53 { any; };
|
||||
|
||||
# NOTE(Krey): Close IPv6 ports as current dotya.ml doesn't have IPv6
|
||||
|
wanderer marked this conversation as resolved
wanderer
commented
this is not correct, we've got a /64 subnet available this is not correct, we've got a /64 subnet available
```bash
âžś dig AAAA dotya.ml
; <<>> DiG 9.11.23-RedHat-9.11.23-1.fc33 <<>> AAAA dotya.ml
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8087
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;dotya.ml. IN AAAA
;; ANSWER SECTION:
dotya.ml. 14364 IN AAAA 2a02:c207:2030:396::1
;; Query time: 0 msec
;; SERVER: ::1#53(::1)
;; WHEN: Sat Oct 31 20:54:23 CET 2020
;; MSG SIZE rcvd: 65
```
kreyren
commented
Lets first make it work on IPv4 then we can followup with IPv6 Lets first make it work on IPv4 then we can followup with IPv6
|
||||
listen-on-v6 { none; };
|
||||
|
||||
# NOTE(Krey): Set this to allow only specific hosts to use the recursive server
|
||||
//allow-query {
|
||||
// 127.0.0.1;
|
||||
//};
|
||||
|
||||
// Cache configuration
|
||||
min-cache-ttl "60";
|
||||
max-cache-ttl "600";
|
||||
|
||||
# NOTE(Krey): Disable recursion server as it's not needed
|
||||
recursion no;
|
||||
|
||||
// if you have problems and are behind a firewall:
|
||||
//query-source address * port 53;
|
||||
|
||||
// NOTE(Krey): Set the PID file location
|
||||
pid-file "/run/named/bind.pid";
|
||||
|
||||
// DNSSEC validation
|
||||
dnssec-validation "auto";
|
||||
|
||||
// Automatically sign zones
|
||||
auto-dnssec "maintain";
|
||||
};
|
||||
|
||||
controls {
|
||||
inet 127.0.0.1 port 953
|
||||
allow { 127.0.0.1; } keys { "rndc-key"; };
|
||||
};
|
||||
|
||||
logging {
|
||||
channel named_log{
|
||||
file "/var/log/named/bind.log" versions 3 size 2m;
|
||||
severity info;
|
||||
print-severity yes;
|
||||
print-time yes;
|
||||
print-category yes;
|
||||
};
|
||||
category default {
|
||||
named_log;
|
||||
};
|
||||
category lame-servers {
|
||||
null;
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
// Briefly, a zone which has been declared delegation-only will be effectively
|
||||
// limited to containing NS RRs for subdomains, but no actual data beyond its
|
||||
// own apex (for example, its SOA RR and apex NS RRset). This can be used to
|
||||
// filter out "wildcard" or "synthesized" data from NAT boxes or from
|
||||
// authoritative name servers whose undelegated (in-zone) data is of no
|
||||
// interest.
|
||||
// See http://www.isc.org/products/BIND/delegation-only.html for more info
|
||||
|
||||
zone "dotya.ml" {
|
||||
type master;
|
||||
file "/etc/bind/zonefiles/ml/dotya/master.zonefile.signed";
|
||||
key-directory "/var/cache/named/bind/keys/ml/dotya/";
|
||||
update-policy {
|
||||
grant ddns-key zonesub ANY;
|
||||
};
|
||||
allow-transfer {
|
||||
// Current Server IP
|
||||
144.91.70.62;
|
||||
|
wanderer marked this conversation as resolved
wanderer
commented
following up on my previous comment, ipv6 should also be specified here. following up on my previous comment, ipv6 should also be specified here.
kreyren
commented
See #1 (comment) See https://git.dotya.ml/dotya.ml/bind-configs/pulls/1#issuecomment-646
|
||||
};
|
||||
allow-update { 144.91.70.62; };
|
||||
inline-signing yes;
|
||||
dnssec-dnskey-kskonly yes;
|
||||
# expiration time 21d, refresh period 16d
|
||||
sig-validity-interval 21 16;
|
||||
auto-dnssec maintain;
|
||||
serial-update-method unixtime;
|
||||
};
|
||||
|
||||
zone "COM" { type delegation-only; };
|
||||
zone "NET" { type delegation-only; };
|
||||
|
||||
zone "." IN {
|
||||
type hint;
|
||||
file "named.cache";
|
||||
};
|
||||
|
||||
zone "localhost" IN {
|
||||
type master;
|
||||
file "pri/localhost.zone";
|
||||
allow-update { none; };
|
||||
notify no;
|
||||
};
|
||||
|
||||
zone "127.in-addr.arpa" IN {
|
||||
type master;
|
||||
file "pri/127.zone";
|
||||
allow-update { none; };
|
||||
notify no;
|
||||
};
|
||||
28
zonefiles/ml/dotya/master.zonefile
Normal file
28
zonefiles/ml/dotya/master.zonefile
Normal file
@ -0,0 +1,28 @@
|
||||
;; Tested using: named-checkzone dotya.ml /etc/bind/zonefiles/ml/dotya/*.zonefile
|
||||
;; Signed using: dnssec-signzone -g -K "/var/cache/named/bind/keys/ml/dotya" -T 300 -n "$(nproc || printf 1)" /etc/zonefiles/ml/dotya/main.zonefile
|
||||
$TTL 300
|
||||
$ORIGIN dotya.ml.
|
||||
;; NameServer (NS)
|
||||
@ IN NS ns.nebula.dotya.ml.
|
||||
;; Start Of Authority (SOA)
|
||||
@ IN SOA (
|
||||
ns.nebula.dotya.ml. ; MNAME
|
||||
hostmaster.nebula.dotya.ml. ; RNAME
|
||||
2020103022 ; SERIAL (YYYYMMDDHH)
|
||||
8H ; REFRESH
|
||||
2H ; RETRY
|
||||
1W ; EXPIRY
|
||||
2H ; MINIMUM Negative Cache TTL
|
||||
)
|
||||
;; DEFAULT
|
||||
nebula.dotya.ml. IN A 144.91.70.62
|
||||
ns.nebula.dotya.ml. IN A 144.91.70.62
|
||||
|
||||
;; Include other files here
|
||||
;; $INCLUDE "PATH" DOMAIN
|
||||
|
||||
;; Zone-Signing key (ZSK)
|
||||
$INCLUDE "/var/cache/named/bind/keys/<YOUR_KEY_HERE>" dotya.ml
|
||||
|
||||
;; Key-Signing key (KSK)
|
||||
$INCLUDE "/var/cache/named/bind/keys/<YOUR_KEY_HERE>" dotya.ml
|
||||
Loading…
Reference in New Issue
Block a user
this is most definitely incorrect :D
Can you fix it then? i ain't too good in slovak~
for now I think we should remove translations
I would remove just the sk line so that it's contributable for 3rd party more easily
please do that, alright.