Restrict dynamic updates to one domain - disallow subdomains

[André Steden]

I solved the problem with a small daemon and grant external.

It was not easy for me since I am not a C programmer.

It would be nice if there would be some examples in C or Python in the 
future.

regex support for grant rules would also be nice.

André

Am 14.02.2023 um 14:18 schrieb Mark Andrews:
> Use external.  You can create any rule you can think of with that.
>
>> On 14 Feb 2023, at 20:29, André Steden <bind at steden.de> wrote:
>>
>> I want an external server to be able to update all the hosts (A) records inside the example.de domain.
>> But i don't want that the external server can create subdomain entries inside the example.de domain.
>>
>> Is this possible? What grant/deny rule must i use?
>>
>> -André
>>
>> Am 13.02.2023 um 23:33 schrieb Mark Andrews:
>>> Step back and tell us what you are attempting to achieve.
>>>
>>> e.g. I want my hosts to be able to update their address records.
>>>
>>> 	grant admin-key subzone ANY;
>>> 	grant * self . A AAAA;
>>>
>>> and use SIG(0) to sign the updates. The admin adds the public KEY record for the machine
>>> using ‘admin-key’.
>>>
>>> You generate a KEY record on the machine
>>>
>>> % dnssec-keygen -T KEY -a RSASHA256 -n host -L 3600 ns1.example.com
>>> Generating key pair....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*..........+.+...........+...+...+....+.....+.+..+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ...+...+.+.....+...+..........+........+.......+.....+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.+.........+......+.....................+.+..+......+.+...........+.............+..+...+....+........+.......+........+...+.+......+..+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.+.....+.........+.+.........+.....+...+..........+.........+..............+.+.........+..+..........+.........+...+..+................+..+...+....+.....+.............+............+.....+.+...+..............+.+.....+.+......+..+............+......+............+.+...........+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>>> Kns1.example.com.+008+18976
>>> %
>>>
>>> which produces the public key
>>>
>>> % cat Kns1.example.com.+008+18976.key
>>> ns1.example.com. 3600 IN KEY 512 3 8 AwEAAaxeX1NDwHGxgBKNb/D9+JrwbRnoM+OIe/Y/f5X7gmXdiZ9xOjWM alGauUtKzx1VvX2QyDUMs8zimoK4L+MM+ghEsvPjUBAnBN+p3Urq+Ae/ mxCmNMzwm3At18MS4TwmzJFFOOZCyQ2eIp0DiW8G+JZTr/3tYmZmPvTO l4OSAZ3DRPQlwro2QH2gp2r3nIEdPbY4x5//H++5NSns6N2mAGo3fkA2 b6EpINrQJ40NPIOq8fvWGs+oiGFl83xsCWpbbezjMebdvMFDTaEZBqPS vtqQCBfT7RRqIUebT6fKU3ZQh55Bah/5LJDIK3VDy05iAVVby/lCZ2YU IgGQm6NU1bM=
>>> %
>>>
>>> and you add to the zone like this
>>>
>>> % awk '{print “update add", $0 } END { print "send" }’ Kns1.example.com.+008+18976.key | nsupdate -k admin-key.key
>>> %
>>>
>>> Add ‘BEGIN { print “zone <parent zone name>” }’ to the awk command if you are updating glue address records this way.
>>>
>>> Then the host it updates its address records using the private part of the key pair
>>>
>>> % nsupdate -k Kns1.example.com.+008+18976.private
>>> update add ns1.example.com 3600 IN A 10.0.0.1
>>> update add ns1.example.com 3600 IN AAAA 2001::1
>>> send
>>> %
>>>
>>> You can do similar with TSIG by giving the key the same name as the machine but you also need to add key clauses for all the TSIG keys to named.conf.
>>>
>>>> On 14 Feb 2023, at 07:55, André Steden via bind-users <bind-users at lists.isc.org> wrote:
>>>>
>>>> But i don't want to specify all possible hostnames in the update-policy settings .
>>>>
>>>> there are more than 350 hosts in the example.de domain.
>>>>
>>>>
>>>> Am 13.02.2023 um 20:06 schrieb Jan-Piet Mens:
>>>>>> is it possible to restrict dynamic dns updates to one domain?
>>>>> I think 'name' is what you're after:
>>>>>
>>>>>      grant key-name name host1.example.de. A;
>>>>>
>>>>> You will be aware that the type list can take multiple space-separated values.
>>>>>
>>>>>      -JP
>>>> -- 
>>>> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list
>>>>
>>>> ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.
>>>>
>>>>
>>>> bind-users mailing list
>>>> bind-users at lists.isc.org
>>>> https://lists.isc.org/mailman/listinfo/bind-users