Question about managed-keys-zone

Fri Apr 8 12:47:12 UTC 2016

Hi

I am trying to do a simple proof of concept test for DNSSEC signing for our organization.

We are an agency under DOL and the plan is to use a DNSSECsigner appliance hosted at DOL to sign the zones so that we do not have to do DNSSEC key management.

So basically the configuration is from our DNS server we send unsigned zones to the DNSSECSIGNER appliance physically hosted at a different location it does the DNSSEC signing and sends the signed zones back to our master and we than present the DNSSEC signed zones for our zone to the world. All DNSSEC key management will be done by the DNSSECSIGNER appliance. Meaning  DNSSEC key management is not done by our agency.

Running 9.10.3P4 on Red Hat Linux 6.x

Was compiled using the following options.

Apr  7 15:15:32 cfdnsquar01 named[37952]: built with '--prefix=/usr/local/named-jail9.10.3P4' '--sysconfdir=/usr/local/named-jail9.10.3P4/etc' '--mandir=/usr/local/named-jail9.10.3P4/usr/man' '--bindir=/usr/local/named-jail9.10.3P4/usr/bin' '--sbindir=/usr/local/named-jail9.10.3P4/usr/sbin' '--libexecdir=/usr/local/named-jail9.10.3P4/usr/libexec' '--sharedstatedir=/usr/local/named-jail9.10.3P4/usr/shared' '--localstatedir=/usr/local/named-jail9.10.3P4/var' '--libdir=/usr/local/named-jail9.10.3P4/usr/lib' '--includedir=/usr/local/named-jail9.10.3P4/usr/include' '--with-randomdev=/dev/urandom' '--disable-static' '--with-openssl' '--disable-openssl-version-check' '--enable-ipv6' '--enable-fixed-rrset' '--enable-rrl' '--enable-largefile' '--enable-newstats' '--with-libxml2' '--enable-fullreport' 'CFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic'

Relevant parts of Named.conf is as follows.

options {
        version "None";
        recursive-clients 2000;
        listen-on-v6 { any; };
        auth-nxdomain no;
        directory "/usr/named";
        check-names master ignore;
        check-names slave ignore;
        check-names response ignore;
        allow-transfer { 10.183.168.21; 10.183.168.22; 198.6.1.115; 198.6.1.154;};
        allow-query { bls;};
        allow-recursion { bls;};
        allow-query-cache { bls;};
        empty-zones-enable no;
        masterfile-format text;
        interface-interval 0;
};

controls {
        inet 127.0.0.1 allow { localhost; };
};

view "unsigned" {
        zone "149.10.in-addr.arpa" {
                type master;
                file "/usr/named/test.rev";
          };

        match-clients { 10.1.1.1; };                               ------------------> DNSSEC appliance hosted at other place.
        zone "joe.com" {
                type master;
                file "/usr/named/testunsigned.hosts";
                also-notify { 10.1.1.1; };  ---------------------------------> DNSSEC appliance hosted at other place.
        };
};
view "signed" {
        match-clients { any; };
        zone "149.10.in-addr.arpa" {
              type master;
              file "/usr/named/test.rev";
              allow-query { any;};
       };
        zone "joe.com" {
                type slave;
                file "/usr/named/test.hosts";
                masters { 10.1.1.2; };                                ---------------------> DNSSEC appliance at hosted at other place.
                allow-query { any; };
        };
};

Problem,

1. Cannot seem to start named and it seems that it is looking for some keys to validation locally.

I believe managed-key-zone validation is by default enabled in Bind......is there an option that I can use in named.conf file to disable that so that it does not look for the key......I guess this is just a self-validation on the master itself and has nothing to do with DNSSEC signing as it seems I am not even able to get the named up...

I guess question is do I have an option that I can specify such that it will not look for self-validation keys at all so that I do not have to deal with rndc.key and rndc.conf or is this something I cannot get by with when I use "views" ? Or am I not understanding this properly?

If there is no option to disable the key check  can I just put the secret key generated ( looks like the log below has some keys )  in rdnc.key file  for self-validation will that work?

Any advice suggestions??  

Apr  7 15:15:32 cfdnsquar01 named[37952]: BIND 9 is maintained by Internet Systems Consortium,
Apr  7 15:15:32 cfdnsquar01 named[37952]: Inc. (ISC), a non-profit 501(c)(3) public-benefit 
Apr  7 15:15:32 cfdnsquar01 named[37952]: corporation.  Support and training for BIND 9 are 
Apr  7 15:15:32 cfdnsquar01 named[37952]: available at https://www.isc.org/support
Apr  7 15:15:32 cfdnsquar01 named[37952]: ----------------------------------------------------
Apr  7 15:15:32 cfdnsquar01 named[37952]: adjusted limit on open files from 4096 to 1048576
Apr  7 15:15:32 cfdnsquar01 named[37952]: found 32 CPUs, using 32 worker threads
Apr  7 15:15:32 cfdnsquar01 named[37952]: using 16 UDP listeners per interface
Apr  7 15:15:32 cfdnsquar01 named[37952]: using up to 4096 sockets
Apr  7 15:15:32 cfdnsquar01 named[37952]: loading configuration from '/usr/local/named-jail9.10.3P4/etc/named.conf'
Apr  7 15:15:32 cfdnsquar01 named[37952]: reading built-in trusted keys from file '/usr/local/named-jail9.10.3P4/etc/bind.keys'
Apr  7 15:15:32 cfdnsquar01 named[37952]: using default UDP/IPv4 port range: [9000, 65500]
Apr  7 15:15:32 cfdnsquar01 named[37952]: using default UDP/IPv6 port range: [9000, 65500]
Apr  7 15:15:32 cfdnsquar01 named[37952]: no IPv6 interfaces found
Apr  7 15:15:32 cfdnsquar01 named[37952]: listening on IPv4 interface lo, 127.0.0.1#53
Apr  7 15:15:32 cfdnsquar01 named[37952]: listening on IPv4 interface eth0, 10.10.10.10.#53    ------> My Master.
Apr  7 15:15:32 cfdnsquar01 named[37952]: generating session key for dynamic DNS
Apr  7 15:15:32 cfdnsquar01 named[37952]: sizing zone task pool based on 4 zones
Apr  7 15:15:32 cfdnsquar01 named[37952]: set up managed keys zone for view unsigned, file 'ceffe878ab2fa2c7c3322ee4a1aa0c2d2a4664836c5867df93dd15055bb986be.mkeys'
Apr  7 15:15:32 cfdnsquar01 named[37952]: set up managed keys zone for view signed, file '4a3cdfae6f764c8f544daea5b73505cf9e74c1ed427d391ad0d7ca00c73c899d.mkeys'
Apr  7 15:15:32 cfdnsquar01 named[37952]: configuring command channel from '/usr/local/named-jail9.10.3P4/etc/rndc.key'
Apr  7 15:15:32 cfdnsquar01 named[37952]: couldn't add command channel 127.0.0.1#953: file not found
Apr  7 15:15:32 cfdnsquar01 named[37952]: isc_stdio_open '/usr/local/named-jail9.10.3P4/var/adm/named.log' failed: file not found
Apr  7 15:15:32 cfdnsquar01 named[37952]: configuring logging: file not found
Apr  7 15:15:32 cfdnsquar01 named[37952]: loading configuration: file not found
Apr  7 15:15:32 cfdnsquar01 named[37952]: exiting (due to fatal error)